VentureBeat: enterprises funded stage one, stage three arrived

There is a specific kind of security failure where the confidence numbers and the incident numbers are both very high at the same time, and this survey caught it in the wild. A VentureBeat three-wave pulse survey of 108 qualified enterprises reports that 82% of executives believe their policies protect them against unauthorized agent actions, while 88% say they had an AI agent security incident in the past year. Only 21% say they have runtime visibility into what their agents are actually doing.

VentureBeat maps enterprise defenses onto three stages. Stage one is observe, stage two is enforce with IAM integration and cross-provider controls, and stage three is isolate with sandboxed execution that bounds blast radius when guardrails fail. The finding is that budgets went to stage one, but the threats already need stage three, and the gap between monitoring and enforcement is described as the most common security architecture in production today, not an edge case. Two named incidents anchor the point: a rogue AI agent at Meta that reportedly passed every identity check and exposed data to unauthorized employees in March 2026, and a supply-chain breach at $10 billion AI startup Mercor traced to compromised LiteLLM.

The voices around the survey put it in plain language. Merritt Baer, CSO at Enkrypt AI and formerly deputy CISO at AWS, is quoted saying enterprises think they have 'approved AI vendors' but 'what they've actually approved is an interface.' CrowdStrike CTO Elia Zaitsev observes that 'it looks indistinguishable if an agent runs your web browser versus if you run your browser.' Cisco President Jeetu Patel describes agents as behaving 'more like teenagers, supremely intelligent, but with no fear of consequence.' The structural point underneath the quotes is that identity-based controls that predate agents cannot easily tell an authorized human from a delegated bot acting on their behalf.

The honest caveat is the sample and the shape of the reporting. 108 organizations across three waves, with the March directional reading on n=20, is a modest base for the crisper numbers, and VentureBeat does not put a dollar figure on any of the incidents, so the 88% headline is unsized. The write-up also does not break failures out by vertical, or say how many of the 108 have any stage-three controls at all, only that none of the major cloud providers ship complete stage-three primitives in general availability today.

Where this points is a market for runtime agent isolation and identity-for-agents that does not really exist as a shipped product yet. VentureBeat notes Allianz, Asana, Rakuten and Sentry running stage-three deployments on Anthropic's Claude Managed Agents beta, which is the first named production sighting of the pattern. For CISOs, the practical read is that the 6% of security budget currently allocated to agent risk is probably the wrong number, and moving spend from dashboards to sandboxes is the shift the next twelve months are likely to force.