Half of companies running AI agents have already had a security incident
New DigiCert research, an independent survey of 1,001 IT and security leaders across the US, UK and Australia and found half of enterprises had a security incident tied to an unauthorised or misconfigured AI agent in the past six months, and 78% reported some AI-related incident or vulnerability. Half have no centralised view of their AI systems, and nearly half say they can't trace how those systems reached a decision.
What it actually means
The story isn't 'agents are dangerous.' It's that most teams deliver them faster than they built the ability to watch them. The number that should stop you isn't the breach rate, but that half can't reconstruct what their AI did after the fact. An agent that acts wrong is a Tuesday; an agent that acts wrong and leaves no trace is the one that costs you a customer and a week of guessing. Before you add the next agent, add the layer under the ones you've got: a unique identity per agent, a log of what it touched, and a way to answer 'which model produced this, and why.' That's the only version of fast that survives an audit.
An agent that acts wrong is a Tuesday. An agent that acts wrong and leaves no trace is the one that costs you.
Source: DigiCert · Monday, 20 July 2026