Agent Governance Statistics: A Denominator and Evidence Audit (2025–2026)

This is not a hypothetical problem. Current coverage has converted IBM’s nested 97% into a general organizational rate in ITPro, described Microsoft’s 28-day activity measure as use in “daily operations” in another ITPro article, changed Gartner’s “in use” forecast to “in production” in TechRadar, and converted Omdia’s sample average into “every organization” in Dark Reading. These examples establish the need for a citation-safe source card; they are not used as evidence for the underlying statistics.

A denominator is the population to which a percentage applies. In governance research, there are often two or three nested populations. IBM’s 2025 research population was 600 organizations that had experienced a data breach; within it, 13% reported an AI model or application breach; within that subgroup, 97% reported no AI access controls.

Dropping the first level turns a breach-sample statistic into a claim about all enterprises. Dropping the second turns a conditional 97% into a general control-coverage rate. Neither transformation is supported.

The same discipline applies to units. A project is not an agent, one run in a month is not daily use, a forecast is not telemetry, and “in use” is broader than “in production.”

Primary source: IBM’s July 30, 2025 release for the Cost of a Data Breach Report.

Population and period: Ponemon Institute conducted the research, while IBM sponsored and analyzed it. The sample comprised 600 organizations globally that experienced data breaches from March 2024 through February 2025.

What the source supports: Within that breach sample, 13% reported a breach of an AI model or application; 8% said they did not know whether such a compromise had occurred. Among the AI-compromised subgroup, 97% reported that they had no AI access controls in place.

What it does not support: It is not a prevalence estimate for AI breaches across all organizations. It does not show that 97% of enterprises lack controls. It also does not prove that absent access controls caused the breach. The release reports that 60% of AI-related incidents involved compromised data and 31% operational disruption, but the observational design cannot establish the counterfactual—what would have happened to otherwise identical organizations with controls.

Citation-safe sentence: “Among 600 organizations in IBM’s 2025 global data-breach sample, 13% reported a breach of an AI model or application; among that subset, 97% reported no AI access controls.”

For buyer decisions, measure your own nested funnel: known AI systems → non-human identities → privileged access → effective controls → incidents and impacts.

Primary source: Microsoft Cyber Pulse: An AI Security Report, published February 10, 2026.

Measurement window and scope: Microsoft used first-party telemetry for agents built with Copilot Studio or Microsoft Agent Builder that were in use during the final 28 days of November 2025. The source defines an active agent as deployed to production with at least one user engagement for an assistive agent or one autonomous run for an autonomous agent during the window.

What the source supports: Microsoft reports that more than 80% of Fortune 500 organizations were deploying active low-code/no-code agents in that measured ecosystem.

Common overstatement: “Eighty percent use AI agents in daily operations.” One event in 28 days satisfies the threshold; the source does not quantify daily frequency, materiality, outcomes, or use outside the measured products.

Citation-safe sentence: “Microsoft reported that more than 80% of the Fortune 500 deployed an active low-code/no-code agent built with Copilot Studio or Agent Builder during a 28-day November 2025 telemetry window.”

This shows broad platform reach, not scaled autonomous work every day.

The same Microsoft report combines its telemetry with a separate 25-minute online survey conducted July 16–August 11, 2025, among 1,725 data-security leaders, plus ten one-hour interviews in the United States and United Kingdom.

Microsoft reports that 47% were implementing specific generative-AI security controls. That is not complete or formal agent governance: implementation can be unfinished, “specific” is not comprehensive, and GenAI includes more than agents.

Microsoft also gives a 29% employee unsanctioned-use estimate. Because the disclosed sample is data-security leaders—not employees—the attribution and respondent population must stay attached.

Citation-safe sentence: “In Microsoft’s July–August 2025 survey of 1,725 data-security leaders, 47% reported implementing specific GenAI security controls; the report also attributed unsanctioned agent use by employees to that research.”

Do not combine the 80%, 47% and 29% figures into a single implied funnel. One is platform telemetry; the others arise from survey research, and they measure different concepts.

Primary source: Gartner’s April 28, 2026 agent-sprawl release.

Gartner predicts that by 2028 an average global Fortune 500 enterprise will have more than 150,000 agents in use, up from fewer than 15 in 2025. The public release also says only 13% of organizations think they have the right agent governance in place.

The forecast is sourceable, but the public release does not disclose model inputs, agent taxonomy, sampling, or calculation. Its 13% governance statement also lacks public sample and fieldwork details. Both can be attributed; neither is independently reproducible from the release.

Common overstatement: changing “in use” to “in production.” Do not treat the forecast as a current count or calculate a precise multiple from open-ended values.

Citation-safe sentence: “Gartner predicted in April 2026 that an average global Fortune 500 enterprise would have more than 150,000 agents in use by 2028, compared with fewer than 15 in 2025.”

Primary sources: the BeyondTrust research page and its Omdia report PDF.

BeyondTrust commissioned the study. Omdia surveyed 400 IT and cybersecurity professionals from private- and public-sector organizations in North America from January 7–15, 2026. Respondents had to be involved with or responsible for identity-security products and services; respondents received incentives.

The study found that surveyed organizations were in the middle of 22 distinct AI-agent projects on average. The source explicitly notes that many projects involve multiple agents.

Common overstatements: “Every organization has 22 projects” and “the average enterprise has 22 agents.” The sample is role-qualified and North American, the unit is a project, and an average does not reveal the distribution.

Citation-safe sentence: “A January 2026 Omdia survey commissioned by BeyondTrust found an average of 22 AI-agent projects among 400 North American IT and cybersecurity professionals’ organizations.”

Primary source: the Cloud Security Alliance release and methodology.

Token Security commissioned and financed the study and co-developed the questionnaire with CSA analysts. CSA surveyed 418 IT and security professionals online in January 2026 across organizations of varied sizes and locations.

The precise wording is that 82% reported discovering a previously unknown agent during the prior year; 41% said this happened multiple times. Separately, 65% reported at least one agent-related incident. These are self-reports, not telemetry proving an agent remained unknown at survey time.

Citation-safe sentence: “In a January 2026 CSA survey commissioned by Token Security, 82% of 418 IT and security respondents reported discovering a previously unknown agent, and 65% reported an agent-related incident, in the prior year.”

External statistics should prioritize questions; answers have to be measured inside your own environment. NIST’s software-agent identity and authority work emphasizes identification, authorization, auditing and non-repudiation, and OWASP’s Top 10 for Agentic Applications provides a practical risk taxonomy.