Data security and governance company AvePoint has released its third annual State of AI Report, detailing the most recent trends in AI tools and agents. According to the research, nearly half of employees now rely on AI agents on a daily or weekly basis, and agentic workflows are expected to double in the next 12 months. Organizations are anticipating that agents will replace a quarter of human work within the same time span.
The Blind Spot Nobody Budgeted For
The AI tool visibility gap has nearly tripled year-over-year, with 17.6% of organizations stating that they are unsure whether their employees are using unsanctioned AI tools. The rate of uncertainty surrounding unsanctioned use of agentic AI is even higher, exceeding one-fifth (21.1%). This demonstrates a significant risk profile created in many organizations from unseen, unmonitored, and unmanaged shadow AI tools and agents.
The massive blind spots where AI runs without supervision introduce major threats to enterprise systems, especially as AI agents are able to act at machine speed, enabling a much higher volume of potentially harmful behavior than a human user can carry out. The top fear when it comes to agentic AI use within organizations is not job loss, but agents acting unsupervised on bad judgment. AI tools and agents are not infallible, and placing too much trust in them to carry out operations without oversight or accountability can lead to significant damage.
Unearned Confidence Among Organizations
The outsized danger introduced by AI tools and agents is made all the more alarming by understanding how organizations view the risks of using AI. More than 80% (82.7%) of organizations cited in the report claim that they are confident in their ability to prevent unauthorized access to AI-related data. In spite of this, 72% of these confident organizations still experienced breach incidents within the last year.
These statistics highlight a significant gap between how prepared organizations believe they are to protect against AI-specific risks and how prepared they are in reality. Organizational readiness and security posture are still being measured by the existence of policy to prevent AI-related incidents, rather than measurable evidence that the controls in place are actually effective. This approach creates false confidence rather than secure systems.
Breach Numbers Catching Up to the Hype
The data in the report clearly shows that the AI landscape is already proving to be a playground for cybercriminal activity. Security incidents related to AI agents have jumped to nearly 9 out of 10 organizations. Similarly, the rate of breaches connected to generative AI has also climbed sharply, from 75.1% in 2025 to 89.5% in 2026.
The risk of AI tools and agents is borne out not only in the data concerning AI-related breaches, but also in the actions of organizations attempting to roll out AI-enhanced operations. The vast majority of organizations state that they have delayed deploying AI tools (86.9%) and agents (86%), citing data security and management concerns. These organizations are shifting the deployment timelines by an average of almost six months, emphasizing the significant real-world impact of these security worries.
A Self-Feeding Data Problem
In addition to introducing significant security risks through shadow AI and a lack of supervision, AI is also prone to producing erroneous outputs that can have a wide range of impacts. The rapid, ongoing adoption of AI tools and agents leads to massive issues with data integrity and dependability. Content generated by AI already accounts for more than a third of enterprise data, a statistic that only continues to grow, on pace to approach half within one year. The massive volumes of aging, redundant data compound governance failures when acted on by AI agents.
The Pivot to Trust as Infrastructure
The research laid out in the report underlines the importance of a changed approach to AI security. “The new mandate is to pivot from a mindset of static protection to one of real-time governance, either through least privilege or zero standing privilege,” says Chandra Gnanasambandam, Chief Technology Officer at SailPoint. “We must also recognize that governing non-human identities (NHIs) is fundamentally different from governing humans and requires a new, specialized framework built for machine-speed operations.”
The top investment priority is becoming the ability to secure AI training data, as this will inform the efficacy and reliability of AI tools and agents in use. Third-party governance tools and AI Agent Management Platforms are gaining traction, demonstrating industry-wide desire to ensure the secure handling of AI data. Organizations are increasingly moving from passive policy to active, enforceable control.
The New Competitive Line
The state of AI technology and security over the past several years has led to a significantly shifted landscape. The bottleneck for effective AI deployment is no longer the power of the model, but operational trust. Companies that attempt to incorporate AI tools and agents into their operations without ensuring enforceable data foundations are going to continue to face growing exposure. The next phase of AI adoption will be won on the battlegrounds of visibility and control rather than speed.
