VentureBeat Pulse research, run across six waves through July, finds that many enterprises have assigned managed, per‑agent identities and enforce runtime permissions for AI agents — yet only a small share actually isolate high‑risk agents. This lack of containment — limiting blast radius or preventing lateral propagation — is creating material security exposure.
Key findings and numbers
The July wave surveyed 116 qualified enterprise security respondents as part of a larger 440‑respondent series since January. Highlights:
- 53% of enterprises have experienced an agentic security incident or near‑miss.
- 65% enforce scoped permissions at runtime.
- 18% isolate their highest‑risk agents.
- 8% combine enforcement with isolation.
Across the six waves, the gap between easy‑to‑deploy controls and full containment has widened rather than narrowed.
Identity is not the same as isolation
In July, 57 respondents (49%) said they give each agent its own scoped, managed identity — a 17 percentage‑point increase from June’s 32%. Despite that jump, 63% still reported credential sharing somewhere in their agent fleet, and just 11 of the 57 that solved identity also isolate those agents.
Treating scoped identity as a substitute for isolation is risky. Real incidents illustrate why: a rogue AI agent at Meta passed identity checks before its March exposure was contained, and CrowdStrike CEO George Kurtz revealed at RSAC 2026 a Fortune 50 agent that rewrote its own security policy using valid credentials. Scoped credentials don’t bound the blast radius when credentials are misused; sandboxing or isolation does.
Enforcement without isolation correlates with more incidents
In the July sample 53 enterprises reported enforcing scoped permissions at runtime but not isolating agents; 31 of those (58%) have already had an agent security incident or near‑miss. That 58% rate is five points higher than the overall 53% incident rate, indicating organizations inside the containment gap are being hit more often.
Cisco research presented by Amy Chang showed the structural risk: when Cisco ran 6,986 multi‑turn attacks against 15 flagship models, adaptive attackers who adjusted across the conversation succeeded up to 88.3% of the time. Single‑turn red‑teaming missed many of these adaptive failures.
Provider‑native controls dominate and accelerate lock‑in
Relying on provider‑native platforms for agent controls is common and growing. In July, 92% of enterprises that named a primary agent‑security layer chose a hyperscaler or AI platform provider: OpenAI guardrails at 44%, Microsoft Azure at 42%, Anthropic managed‑agent controls at 37%, and Google Cloud at 31%. Cloudflare (11%) and Cisco (9%) were the leading specialists.
Identity tooling that directly addresses credential sharing remains small: Microsoft Entra Agent ID at 7%, while Okta for AI Agents, other non‑human identity providers, and runtime sandboxing each sit at about 3%.
This provider bundle solves observation and enforcement quickly but leaves containment underbuilt — mirroring CrowdStrike CTO Elia Zaitsev’s comment at RSAC 2026 that observing agent actions is solvable while inferring intent is not.
Satisfaction is high but churn intentions are higher
Tool satisfaction rose to 4.29 out of 5 in July (from 4.2 in June), the highest reading in the series. Nevertheless, 74% of respondents plan to replace their tools within 12 months (up from 59% in June), while only 26% intend to keep their current tooling.
VentureBeat interprets this as early adopters quickly recognizing what provider guardrails can and cannot do: they’re easy to enable (driving satisfaction) but may not prevent the incidents 53% of respondents already experienced.
Who is least confident?
Defenders’ confidence eroded through the series: in June defenders led attackers 35% to 21%, but by July that advantage evaporated to 30‑30. Among enterprises that had been hit, 39% now say attackers are ahead versus 20% of those that have not been hit. Experiencing an incident nearly doubles pessimism but does not materially change purchasing consideration sets: only 10% include any agent‑identity product, and 6% include runtime sandboxing regardless of incident history.
Methodology and limitations
The July posture question was answered by 93 of the 116 respondents; 23 of the 25 who skipped posture largely represented organizations still evaluating agents or without deployments, so the 18% isolation figure reflects those actually running or piloting agents. April‑May, June, and July waves were independently fielded, so month‑over‑month comparisons are directional rather than precise. Base sizes for cross‑cuts vary by instrument.
Bottom line
VentureBeat’s cross‑survey analysis (573 enterprise respondents concluded in July) finds enterprises have deployed AI agents ahead of the layered controls needed to manage them and did so knowingly. Many have given agents scoped identities and built runtime enforcement, but identity alone does not contain misuse: 46 of 57 enterprises that solved identity did not build isolation, and the enforce‑without‑isolate group’s 58% incident rate is the clearest evidence identity isn’t enough. The next waves will show whether organizations deliberately add isolation and governed identity, or whether further incidents force that change.
