The State of Agent DLC 2026 asked 700 organizations already running AI agents how confident they were across five domains: testing, security, inventory, cost, and rollback. Confidence came back between 74% and 77% in every domain we tested. In most of them, the controls that would justify it are not there.
%20(1).jpg)
TL;DR
- The widest distance is in security. 75% say their agents are secure end to end. 23% have a dedicated AI-agent security layer running in production.
- 77% of organizations are confident they hold a complete inventory of every agent, MCP server and LLM running in production. Only 44% run discovery tooling that could verify it.
- 74% are confident their testing would catch a production-impacting failure. 19% have a gate that automatically blocks every bad release.
- Even where a control exists, it may not be sufficient for the failure it is supposed to catch.
- The best-positioned organizations are not the ones with the fewest incidents. They are the ones who verify domain by domain instead of treating confidence as evidence.
“No, I don't have a nanny cam, but I'm sure my kids are OK. They're good kids.”
Most of us would recognise that as a reasonable thing for a parent to say and a poor basis for a claim about what happened this afternoon. It is also, near enough, what 700 organizations told us about the AI agents running in their production environments.
There is one place the parenting analogy breaks down, and it breaks down against the organizations rather than for them. You can trust your kids without a camera because you know them, and character is reasonably stable. An AI agent is not deterministic. The same agent, given the same input, can behave differently from one run to the next. There is no stable “who” to know.
I spent 10 years reading self-reported survey data from an analyst's chair. The first question I learned to ask was never "what do these people believe?" It was "what would have to be true for them to be right?"
We asked 700 organizations already running AI agents how confident they were across five domains. Testing, security, inventory, cost, and rollback. Every answer landed between 74% and 77%. Then we asked what controls they actually had.
The widest gap is where you'd least want one
Let’s start with security. 75% say their agents are secure end to end. Only 23% have a dedicated AI-agent security layer live in production. Another 29% are piloting one. Just over half have moved to purpose-built agent tooling in some form. The rest are relying on general-purpose security tooling, running nothing dedicated at all, or unsure what is in use.
It is not that those teams have nothing; it’s that what most of them have was designed for a different threat model. General-purpose security tooling was not built to watch MCP-specific attack surfaces, and confidence does not appear to distinguish between a control aimed at the right target and one aimed at the wrong one.
The same shape, over and over
Testing looks like this too. 74% are confident their evaluation would catch a production-impacting failure. 19% have a gate that automatically blocks every bad release with no exceptions. Among the organizations confident in their evals, roughly four in five do not have that gate. A change that could damage the production experience can still ship with nothing automated standing in its way.
Rollback repeats it. So does the promotion decision itself: among organizations that push agent changes to production, more than four in 10 have no fixed standard at all, deciding case by case whether each change is safe.
Inventory shows the same thing more starkly, because there the check either exists or it does not. 77% are confident they have a complete inventory of every agent, MCP server and LLM in production, and that no shadow AI is running anywhere in their environment. Compare that to the 44% who run active discovery or inventory tooling. Put those together and 41% of the entire sample are confidently declaring an absence with nothing in place that could detect its presence. That is not a tooling gap. It is a belief with no mechanism behind it. If a shadow agent appeared in that 41% of organizations tomorrow, nothing would change: not the inventory, not the confidence.
Even when they’re present, do controls warrant confidence?
In every domain, most organizations do have some controls in place. What far fewer have is the control that would catch the failure in question. In other words, the controls aren’t sufficient, and that’s where the gaps lie.
That’s because those controls were built for a different kind of change. 42% manage agent changes with the same tooling they use for conventional code, with workarounds. Only 34% have a configuration system built for agent behavior, and 9% still need a full code redeploy to edit a prompt. So a prompt change gets a pull request, a review and a merge, and nothing anywhere in that pipeline understands what the prompt does.
The techniques built to contain a risky release have not made the crossing either. Canary deployments are used by 26% of organizations and blue/green by 25%, in a domain where behavior varies from run to run and blast radius is the entire problem.
58% report more production incidents per 100 changes since they started deploying agents; only 25% report fewer.
To return to the analogy: while some organizations have no camera, more of them have one pointed at the front door while the thing they are worried about happens in the kitchen.
Four questions worth asking this week
None of these require a budget. They require an artifact.
- Security. Is anything watching your agents specifically, or is your agent traffic covered by the same tooling that covers your services? Name the tool, then name what it was built to detect.
- Inventory. What, specifically, would surface an agent nobody registered? If the answer is a process rather than a running system, you are describing an intention.
- Testing. When did your gate last block a release? A gate that has never blocked anything is either perfect or not a gate.
- Promotion. Is the standard for promoting an agent change to production written down, and is it the same one every reviewer applies?
76% of organizations expect to invest in agent lifecycle tooling within six months. The money is coming. It will buy more if it is spent against a verified picture of what is missing rather than a felt one.
Confidence and the presence of a control are two different things, and most organizations are reporting on the first without having checked the second. Check explicitly, domain by domain.
