Governance Is Not Keeping Pace With the Growth of Agentic AI

The Gap in One Chart 

Enterprise agent fleets have roughly doubled in a single quarter, while the share of agents under formal review has barely moved. The distance between the two lines is where most of the risk described in this report accumulates. 

Where the Risk Concentrates 

Not every agent carries the same exposure. The two variables that matter most are how much access an agent was granted and whether anyone reviewed it before it went live. Plotting those two variables produces a simple map of where an organization's real risk sits. 

Most organizational attention still goes toward the bottom row, agents that went through some form of review. The quadrant that deserves more of it is the top right: agents built quickly on a no-code platform or generated through AI-assisted development, connected to real systems, and never formally reviewed. This is not a small or unusual category. It is, by several industry estimates, where the majority of newly created agents actually sit. 

Two paths into the same quadrant 

Employees building agents on no-code and low-code platforms and developers shipping AI-generated code, informally called vibe coding, arrive at the same critical-exposure quadrant from different directions. The employee path is driven by convenience: an agent can be assembled and connected to email, calendars and shared drives in minutes, well before any security review would normally occur. The developer path is driven by speed: permissions and API access are often copied from existing services or granted broadly so that AI-assisted development is not interrupted by a scoping exercise. Neither path involves malicious intent. Both produce an identity with real access and no one specifically watching it. 

Why the Usual Controls Fall Short 

Identity and access management, code review and acceptable use policies remain necessary and should not be scaled back. Each was built around assumptions that agentic AI adoption is actively breaking. 

-Traditional IAM assumes a relatively stable, slowly growing set of identities. Agent fleets can double in a single quarter, faster than access reviews are typically scheduled. 

-Code review assumes a human wrote and understands the logic being deployed. Vibe coding compresses that step, often shipping a functional agent before a reviewer has fully traced what access it carries. 

-Acceptable use policies assume employees recognize when they are creating a governed system. Many do not realize that a no-code workflow they built is, functionally, a new identity with standing access to company data. 

An agent built in an afternoon and forgotten by the following quarter does not stop having access. It simply stops having anyone watching it. 

The Visibility Funnel 

The gap between deployment and protection shows up clearly when the same fleet of agents is tracked through three stages: how many exist, how many are actively monitored, and how many carry full security approval. Each stage loses more ground than the last. 

Source: Gravitee, State of AI Agent Security Report 2026. 

The practical consequence is that any control which depends on an agent having been inventoried and approved will, by construction, miss more than half of what is actually running. A response built for this environment has to work even when that inventory is incomplete. 

Implications for OT/ICS and Critical Infrastructure 

In organizations that operate industrial or financial systems, the critical-exposure quadrant is not a compliance abstraction. An agent built to automate a routine IT or business task can end up, through poor scoping rather than design, with credentials or network paths that reach into OT/ICS-adjacent systems. As agents connect to more tools through integrations and protocols such as MCP, the practical separation between a convenience automation and a privileged actor on the network narrows. Once such an agent is manipulated through prompt injection, a poisoned data source or a compromised integration, its legitimate credentials make its actions difficult to distinguish from ordinary automated activity, which is precisely what makes this category attractive to an attacker. 

A Layer That Does Not Depend on the Inventory Being Complete 

Closing the funnel above through governance alone would require every agent to be discovered, scoped and reviewed correctly the first time, at a pace that has not been achieved anywhere in the industry data reviewed for this report. A more realistic response adds a layer that recognizes anomalous behavior directly, independent of whether the acting identity was ever formally catalogued. 

Visibility independent of how the agent was built 

Whether an agent originated on a no-code platform, was generated through vibe coding, or was formally approved by IT, its actions on the network eventually look the same: connections, data access requests and calls to internal systems. Outis, the behavioral detection platform developed by IRONVALD, applies behavioral analysis supported by its own AI model to recognize and stop unauthorized or anomalous access in real time, regardless of whether the acting identity is human or non-human, catalogued or not. 

A passive and non-intrusive design 

Outis does not require access to an organization's data in order to provide protection. Its sensors accept no inbound traffic, and outbound traffic is limited to an mTLS channel, meaning that even a compromised or manipulated agent cannot use the platform itself as an additional attack vector. The platform is air-gap compatible, so sensors are recommended to reduce system load but are not required for the platform to function. 

Supporting regulatory compliance 

Frameworks such as GDPR Article 32, the NIS2 Directive and the EU AI Act increasingly require organizations to demonstrate real-time detection capability and a documented inventory of automated systems with access to sensitive data. Continuous behavioral monitoring directly supports these requirements in environments where agent proliferation has already outpaced formal AI governance. 

Recommendations 

-Run a discovery pass to inventory existing agents, including those built on no-code platforms and through vibe coding, before layering on new governance requirements. 

-Apply zero standing privilege to non-human identities: grant agents only the access their specific task requires, and review that access on a fixed schedule rather than at creation only. 

-Require a lightweight security checkpoint for any agent connected to production data or external systems, regardless of who built it or which platform was used. 

-Establish continuous, behavioral visibility across OT/ICS and corporate networks that functions independently of whether an individual agent was ever formally reviewed. 

A short demonstration remains the most direct way to assess how Outis performs at the operator level within a specific network environment.