You Can Only See a Third of Your AI

Imagine you run a big office building. You have a lobby, a security desk, and a wall of camera feeds. It feels like you can see everything. Then someone hands you the blueprints and you realize there are two more floors, a loading dock, and a dozen side doors you never had cameras on. That is roughly the position most companies are in with AI right now, and this week we finally got a number for it.

Snyk released Volume II of its State of Agentic AI Adoption report, drawn from more than 3,000 enterprise accounts. The headline finding: security teams typically see only about one-third of their organization's real AI footprint. The other two-thirds is running somewhere, doing something, and the people responsible for keeping it safe cannot see it.

Adoption is outrunning the map

The reason the blind spot is growing is simple. The AI is multiplying faster than anyone can inventory it. In the same report, the share of organizations running agentic architecture (software that does not just answer questions but takes actions on its own) rose from 28% to 33% in six months. And among the companies that have adopted it, the full-stack setups (an agent framework plus MCP servers, which is the plumbing that lets agents reach out and touch other tools) jumped from 36% to 50%.

Read those two facts together and you get the whole story. Half of the companies using agents are now running the most connected, most capable, most reach-everywhere version of the technology, and most of them can only account for a third of what they own. Adoption is sprinting. The map is walking.

Security teams see only about a third of their organization's real AI footprint. The other two-thirds is running, connected, and unwatched.

The fix has a shape: put the controls outside the agent

Here is the encouraging part. The products that shipped this same week are not random. They all share one design idea, and once you see it you can't unsee it.

Redpanda introduced governance in its Agentic Data Plane built around an out-of-band policy engine that sits at the MCP boundary rather than inside each agent. Translation: instead of politely asking every agent to follow the rules, you build one guarded doorway that every agent has to walk through. From that doorway you can see every agent, control which systems each one is allowed to reach, control what data is allowed to leave, and hit a kill switch that stops any agent instantly. Crucially, none of that depends on the agent cooperating.

Why does "doesn't depend on cooperation" matter so much? Because an agent is not a filing cabinet, it is closer to a very fast, very literal new employee who sometimes misreads the instructions. If your only safety rule is a note taped to that employee's desk, you are trusting them to read and obey it. If instead the exit door itself won't open for anything sensitive, it no longer matters whether they read the note.

The defenders are agents now too

The other move this week: the same technology that created the blind spot is being pointed at the blind spot. Microsoft moved Project Perception, its cybersecurity-focused agent platform, into public preview on August 3, aiming to help organizations detect and respond to threats with AI defenders. And Crogl made its Enterprise AI SOC Agent a free download. It runs inside the customer's own environment (including fully air-gapped, offline setups), connects to existing security tools, and autonomously investigates alerts and hunts threats while documenting every investigative step and leaving the final decisions to human analysts.

Notice the pattern in Crogl's design, because it is the honest version of how this should work. The data never leaves your building. Every action is written down. And the human keeps the authority to decide. That is not "the AI takes over security." That is "the AI does the tireless first pass, and shows its work."

The through-line

Strip away the product names and the whole week says one thing three times. Know what is actually running. Put the controls where the software cannot reach them. And keep the human at the point where their judgment actually matters. The blind spot is real and now measured. The good news is that the answer is not more clever instructions inside the machine, it is a stronger doorway around it.

If you run any part of a business that has quietly started using AI tools, the takeaway is not to panic, it is to go find the blueprints. The floors you didn't know about are the ones worth walking first.

FAQ

• What does "one-third visibility" actually mean? Per Snyk's report of 3,000+ enterprise accounts, security teams can typically see only about a third of the AI systems and agents genuinely operating in their organization. The rest exists but is not inventoried or monitored.
• What is an MCP boundary? MCP is the connective layer that lets AI agents reach other tools and data. The "boundary" is the doorway an agent must pass through to do that, which makes it a natural place to enforce rules for every agent at once.
• Why put controls outside the agent instead of inside it? Controls that live inside an agent (prompts, settings) rely on the agent behaving. Controls at a shared gateway (access limits, data-egress filters, kill switches) work even if the agent misbehaves.