AI Agents Are Entering Critical Workflows.
Who’s Governing Them?

The AI Maturity Mirage

IT leaders are moving out of the hype-and-experimentation phase of AI and into the harder work of scaling it, and the first sign of recalibration is how IT leaders describe their own progress.

Organizations remain optimistic about their AI progress. 57% describe themselves as Scaling or Mature, yet only 23% demonstrate the combination of AI maturity, business-critical AI agent deployment, and IT unification associated with successful AI execution at scale.

That gap is becoming harder to ignore. Six months ago, 40% of IT leaders described their organizations as mature in AI deployment. Today, that share has dropped to 23%. Over the same period, the share saying they are just getting started rose from 5% to 13%.

IT leaders are not backing away from AI. In fact, 84% plan to expand AI use in IT operations over the next 6-24 months. What is changing is how they define readiness. As AI agents move into production, maturity depends less on adoption alone and more on whether organizations can govern access, manage risk, measure outcomes, and apply controls consistently.

Fragmented IT Doesn’t Just Slow Down AI. It Makes It Dangerous.

Many organizations are attempting to scale AI on top of fragmented IT environments that were never designed to support growing numbers of autonomous systems. On average, organizations use 6.9 separate tools to manage core IT functions. Complexity is even higher among tech companies, which use an average of 1.8 more tools than non-tech organizations.

Hybrid Google Workspace/Microsoft 365 environments use more tools on average than Google Workspace-only environments. Every additional tool can create another place where identity, access, administration, and governance need to be managed.

Nearly all respondents (96%) say the level of IT unification in their environment affects their ability to implement and scale AI securely. When identity, access, and administration are spread across disconnected systems, scaling AI securely becomes harder. Organizations operating in fully unified environments are far more likely to deploy AI agents into business-critical workflows than organizations running fragmented environments (55% versus 11%). As AI adoption expands, unified IT gives teams a stronger foundation for managing users, devices, applications, and AI agents consistently.

The AI Governance Gap Is Growing in Real Time

More access and less oversight are creating a harder control challenge for IT teams. Organizations aren’t ignoring AI security. The problem is that AI deployment is moving faster than the controls designed to govern it. As agents take on more workflows, IT teams face a harder control problem – giving them enough access to be useful without losing accountability.

Agent Autonomy Is Increasing Faster Than Human Oversight

Organizations are becoming more comfortable allowing agents to act with limited human involvement. Six months ago, 40% required human review before high-risk AI actions. Today, that figure has dropped to 25%.

Over the same period, full autonomy without human review more than doubled, rising from 11% to 26%. Automated review after the fact is now the most common oversight model, used by 44%.

The pattern is strongest among Scaling organizations. More than one-third, 35%, allow high-risk actions without human review, compared with 22% of Operationalizing organizations and 21% of Emerging organizations. Advanced teams appear more willing to grant autonomy when stronger identity, governance, and oversight foundations are in place.

Connecting Agents Is Easier Than Governing Them

Organizations are increasingly connecting AI agents to the same identity and access management systems used by employees. More than 90% have integrated AI agents into their identity infrastructure in some form. Full integration rose from 37% to 45% over the past six months.

Identity integration provides the foundation for visibility, access management, and accountability. Scaling organizations are almost twice as likely as Emerging organizations to report full identity integration.

Access Is Expanding Faster Than Accountability

Non-human identities now outnumber human users in 83% of organizations, and one-third report six or more for every human user.

Among organizations using AI agents, the share reporting ratios of 6-to-1 or higher rose from 23% to 31% over the past 6 months. Scaling organizations are about three times more likely to report ratios of 20-to-1 or higher.

Yet only 21% have adopted governance controls for non-human identities. That leaves many IT teams managing a fast-growing population of autonomous systems without consistent ownership, access review, or lifecycle controls.

• “Managing non-human identities and API keys for multiple AI agents is challenging.”

  — Chief Information Security Officer, U.S., IT/Software/Hardware

Confidence Is Not a Control

Many organizations believe they are governing AI effectively. Roughly half report confidence in their ability to manage AI securely.

However, organizations have implemented an average of just 3.1 out of 10 recommended AI governance and security practices. Role-based access control is the most commonly adopted control, in place at 37%. Governance for non-human identities is the least common, implemented by just 21%.

The gap between confidence and implementation suggests many organizations may be overestimating their readiness for autonomous AI. While most have established basic controls such as role-based access management, adoption drops significantly for practices that provide accountability, oversight, and governance at scale.

As AI agents gain access to business systems and critical workflows, organizations will need a broader set of governance controls to ensure those systems remain secure, auditable, and aligned with business policies.

The challenge is not simply implementing more controls. Many organizations are still determining how governance should evolve as AI agents become more autonomous and interconnected with existing systems.

As a result, governance efforts often lag behind deployment. Organizations may recognize the risks, but practical challenges around visibility, identity management, security, and policy enforcement continue to slow progress.

U.S. Organizations Are Further Along In AI Deployment, But Governance Challenges Are Shared

U.S. respondents show somewhat higher AI execution and IT consolidation, while governance pressure remains similar across both markets.

FOMO to ROI: AI Spending Is Getting A Reality Check

AI realism is also reshaping spending decisions. Six months ago, 91% of IT leaders expected budget increases, but only 42% say those increases materialized.

That gap is forcing harder tradeoffs, with 44% of organizations shifting toward cost reduction as a priority and 35% delaying or canceling IT projects.

AI budgets are also being scrutinized more closely. The share of organizations allocating more than 25% of IT budget to AI fell from 20% to 12%, even as average AI spending held steady at 15% of total IT budget.

The next phase of AI investment is becoming more selective. Teams need clearer proof of value, stronger measurement, and a more reliable operational foundation before expanding further.

AI Is Changing The Jobs IT Has To Do

The workforce picture is more complicated than the common AI job-loss narrative suggests. For most IT leaders, AI does not simply mean fewer roles. It means new work, new skills, new support models, and new operating demands.

58% of IT leaders expect AI to increase total IT headcount over the next one to two years. Half expect to rely more on outside vendors, nearly half expect to shift current staff toward higher-value work, and 48% expect to need new roles and skills.

One-third of IT leaders expect AI to eliminate roles. That rises sharply among technology companies, where 48% expect role elimination compared with 29% of non-tech organizations.

Organizations earlier in their AI journey are more likely to anticipate job displacement, while those with deeper operational experience are more likely to view AI as a driver of augmentation, role evolution, and higher-value work.

The more immediate challenge for many organizations is managing a more complex IT function. As AI becomes embedded in IT operations, teams need to govern new systems, measure new outcomes, manage new risks, and develop new skills to make AI useful at scale.