Gravitee's State of AI Agent Security research, a survey of 900 senior technology leaders in the US and UK, finds fewer than 1 in 10 organizations have a named person formally accountable for agent behavior, and only 6% can revoke a rogue agent's access within an hour
DENVER, Nov. 09, 2026 (GLOBE NEWSWIRE) -- Gravitee, the AI agent management platform, today released the third wave of its State of AI Agent Security research. The survey of 900 senior technology leaders across the US and UK shows AI agents are scaling faster than the controls and accountability needed to govern them.
Organizations running more than 150 agents more than doubled since the last Gravitee State of AI Agent Security research released in April 2026, jumping from 7% to 16%. Yet only 17% give each agent its own identity, and fewer than 1 in 10 have a named person formally accountable for what their agents do. As agent adoption accelerates, these accountability gaps create growing security risks. Over half (52%) of respondents indicate they've had an agent-related security or privacy incident in the past year.
"Agents are making decisions and acting on their own inside enterprises, including banks, hospitals and government departments," said Rory Blundell, CEO of Gravitee. "When one goes wrong, most organizations cannot say which agent it was, what it was allowed to do, or who is responsible. That is not a technology gap. It is an accountability gap, and it is widening as agent estates grow. Establishing accountability is essential to scaling AI agents safely."
Confidence is falling, and controls have not moved
As AI agent deployment rapidly expands, confidence in organizations' ability to manage incidents has declined from six months ago, while the controls under their agents look the same.
- Those "very prepared" to respond to an agent incident fell from 47% to 29%.
- Belief that current regulation covers agent risks fell from 40% to 26%.
- The share of agents monitored and secured barely moved, from 56% to 57%.
Accountability is missing at every layer
The research reveals significant gaps in organizations' ability to control, monitor and intervene agent activity:
- On average, only 51% of agents have policy enforced on what they can do.
- Only 1 in 8 can fully reconstruct what an agent did 30 days ago.
- Only 6% can revoke a rogue agent's access within an hour.
Incidents are real, and consequences are rare
Nearly all (97%) of respondents say they run agents that call other agents, and 40% connect to other organizations' agents. Only 27% define who is accountable across that chain.
More than half of respondents (58%) have already had to revoke an agent's access during a live incident. Afterward, only 25% held a named person responsible, and 17% changed nothing. These findings highlight a critical gap in how organizations establish accountability across increasingly interconnected agent systems and respond when things go wrong.
"Every organization we speak to wants to scale agents, and none of them want to slow down," said Linus Håkansson, CPTO of Gravitee. "The answer is to manage agents the way you would manage any employee with access to sensitive systems. Give each one an identity, enforce what it can do, keep a record, and maintain the ability to revoke access within minutes when something goes wrong."
Additional key findings by sector
- Government and public sector: have the largest fleets, with 25% running more than 150 agents, but the weakest traceability. Only 8.8% can fully reconstruct an agent action.
- Financial services: have the strongest controls, yet the most incidents (66%) and the least clarity on ownership (44% say accountability is unclear).
- Healthcare: 63% had an incident, including exposed patient data.
- Telecommunications: only 21% have a documented process to pause or revoke an agent.
Gravitee's Agent Accountability Framework defines six principles every agent in production should meet: Identity, Sponsor, Role, Authority, Oversight and Recourse. Together they let an organization answer, for any agent and any action, what acted, on whose authority, within what bounds, and how it can be stopped. The research shows most organizations fall short on at least one.
Availability
The full State of AI Agent Security report, including sector breakdowns, is available to download at https://www.gravitee.io/state-of-ai-agent-security.
Rory Blundell will discuss the findings with national security and AI leaders at a Gravitee evening at the National Gallery, London, on November 18.
Methodology
Gravitee surveyed 900 senior technology leaders at organizations in the United States (600) and United Kingdom (300) in October 2026. Respondents represent six sectors: financial services, healthcare, government and public sector, telecommunications, manufacturing, and travel and transport. Fieldwork was conducted by Opinion Matters. Comparisons are to the previous wave, fielded in April 2026.
About Gravitee
Gravitee is an AI Agent Management company that helps enterprises manage, secure, and govern AI agents, APIs, and event streams. Its Gamma platform spans Agent Management, API Management, Event Management, Authorization Management, and Identity & Access Management, giving organizations the visibility, control, and governance infrastructure they need to operate confidently in an agentic world. For more information, visit www.gravitee.io.
Media contact
Sydney Shufelt, sydney.shufelt@graviteesource.com
