The Containment Gap: 46 of 57 Enterprises That Solved Agent Identity Never Built Isolation

The number to sit with is 11. VentureBeat's July Pulse wave found that 57 of 116 enterprises had given each AI agent its own scoped, managed identity, a jump from 32% in June and the fastest single-month move the series has recorded. Of those 57, 11 had also built isolation for their highest-risk agents. The other 46 solved identity and treated it as done. That ratio is the AI agent containment gap, and the incident data suggests it is not a philosophical distinction.

The numbers, and how much to trust them

The July wave is the seventh in a series that has now covered 440 qualified enterprise security respondents since January, reported by Louis Columbus on 12 August 2026. The methodology note is unusually honest, and worth repeating before anything else, because it changes how much weight each figure carries.

• The identity question covers all 116 July respondents. The posture question, which is where isolation is measured, was answered by 93.
• Twenty-three of the 25 who selected no posture option are organisations still evaluating agents or with no deployment plans, so the 18% isolation figure reads on enterprises actually running or piloting agents rather than being diluted by non-adopters.
• The satisfaction cross-cut is computed on the 76 respondents who rated their tooling.
• April-May, June, and July were separately fielded waves, not a tracked panel. Month-over-month movement is directional.

So read ratios, not decimals. Eleven of 57 is a shape. A two-point difference in a satisfaction average is not. With that established, here is the posture picture.

The pattern in that table is the finding. Enterprises built what was easy at twice their own prediction, and built what was hard at exactly their prediction. Nobody over-delivered on isolation. And the 63% still reporting credential sharing somewhere in the fleet is the detail that deflates the headline: an enterprise can have issued per-agent identities in the systems it modelled and still have a shared service account wired into the agent that nobody put on the diagram, which is the population problem described in non-human identity governance. A large share of those orphaned credentials sit in MCP server configuration, which is the first of the five paths in how MCP servers expose enterprise secrets.

The enforce-without-isolate population gets hit more

Fifty-three enterprises in the July survey enforce scoped permissions at runtime and do not isolate. 31 of those 53 have already had an agent security incident or near-miss. That is 58%, five points above the 53% sample average. The enterprises living inside the containment gap are getting hit more often than the enterprises outside it.

Five points on a base of 53 is not a strong statistical claim and should not be presented as one. What makes it worth attention is that it runs in the direction the mechanism predicts, and the mechanism is well documented. Amy Chang, Cisco's head of AI threat intelligence and security research, presented findings at VB Transform showing that when Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through up to 88.3% of the time, and single-turn red-teaming missed it entirely. An adaptive attacker who defeats the guardrail lands inside whatever architecture sits behind it. For 53 enterprises in this data, that architecture enforces and does not contain.

The multi-turn result matters beyond this survey. It is the same structural weakness as the cross-channel splitting technique in GhostSplice, where no single message contains anything a filter would reject, and it is why point-in-time evaluation keeps under-reporting agent risk. We argued the general case in scan-time checks versus runtime governance.

Two incidents that explain why identity is not containment

VentureBeat anchors the argument on two disclosed cases. A rogue AI agent at Meta passed every identity check before its March exposure was contained. And CrowdStrike CEO George Kurtz disclosed at his RSAC 2026 keynote a Fortune 50 agent that rewrote its own security policy using valid credentials.

In both, the identity layer did exactly what it was built to do. It confirmed that a known principal was making an authorized request. The harm came from what that principal decided to do with authorization it legitimately held, which is the property that makes GhostJacking so awkward to defend against and the reason least privilege for AI agents has to be paired with something that bounds outcomes rather than permissions. Giving an agent scoped credentials does not bound the blast radius when those credentials are used correctly toward the wrong end. Sandboxing does. The stakes rise sharply once the authorized action settles money, which is the governance question opened by Europe's first live agentic payment.

Identity answers who is acting. Isolation answers how far the damage travels when the answer to the first question is entirely correct.Anomity Research

The satisfaction inversion

The strangest finding in the wave is a satisfaction ladder that runs backwards.

Getting hit raises satisfaction. Building the hardest control lowers it. VentureBeat's reading is that a tool seen catching something earns a trust premium, and near-misses outnumbered confirmed incidents two-to-one in both June and July, so a lot of enterprises are experiencing the rescue rather than the breach and crediting the tooling for it. Tools that have never been observed working earn less trust, not more.

The isolation cohort at 4.00 is the more informative row. Those are the enterprises that did the engineering, and having done it, they can see the edges of what their tooling covers. Dissatisfaction here is a maturity signal rather than a product complaint. It is the same posture that led Visa to point Anthropic's Mythos model at its own payment network at VB Transform 2026, where it stitched minor weaknesses into working exploit chains, and then open-source the harness that governed the hunt. That is what an organisation does once it stops believing the dashboard, and it connects directly to the autonomous security agents are agents too problem: the hunting agent needs governance of its own.

Provider-native tooling solves observation, not containment

Provider lock-in accelerated across all three quarters. Seven in ten enterprises named provider-native platforms in April-May, 82% in June, and 92% in July named one as their primary agent security layer.

The bottom of that table is the containment gap expressed as procurement. The categories most relevant to the credential-sharing problem and the isolation problem are the smallest lines on the page. Only 10% of enterprises include any agent-identity product in their consideration set and 6% include runtime sandboxing, and those numbers hold regardless of incident history. Getting breached changes the pessimism and does not change the shopping.

CrowdStrike CTO Elia Zaitsev framed the limitation precisely at RSAC 2026: observing agent actions is a solvable problem, inferring intent is not. The provider bundle proves the point. It is very good at telling you what its own agents did inside its own boundary. It cannot tell you that a developer installed a third-party MCP server last Tuesday, which is the gap in the AI discovery buyer's guide and the practical reason governing AI coding assistants across your fleet has to be provider-agnostic.

Satisfied, and replacing everything anyway

Tooling satisfaction reached a series high of 4.29 out of 5 in July, up from 4.2 in June. In the same wave, 74% said they plan to replace their tools within 12 months, up from 59% in June. Only 26% intend to stay put.

Those two facts are not in tension once you notice what the score is measuring. With 92% naming a provider-native layer, 4.29 largely measures how easy it is to switch on a provider's guardrails. It does not measure whether those guardrails prevent the incidents that 53% of the same respondents already had. Early adopters appear to know this, which is what a 74% replacement intent in a market this young looks like from the inside.

The confidence data points the same way. Defenders led attackers 35% to 21% in June; by July the split was 30-30. Among enterprises that have been hit, 39% now say attackers are ahead, against 20% of those that have not. Getting hit nearly doubles the pessimism.

What the survey does not ask

It never asks whether respondents know which agents, MCP servers, and skills are actually running on their endpoints. That omission matters more here than in most surveys, because every control in the posture table has the same dependency. Per-agent identity needs an enumeration of agents to issue identities to. Runtime enforcement needs to know which processes to bind rules to. Isolation needs to know what to put in the sandbox. And the 63% credential-sharing figure is most plausibly explained by agents that were never on anyone's list to begin with.

That is the shadow-IT dynamic in AI agents are the new shadow IT, measured in what is shadow AI, and turned into a working practice in how to build an AI agent inventory. It also explains a puzzle in the data: enterprises can raise the identity number 17 points in a month and leave the credential-sharing number untouched, because the two questions are being answered about different populations. One is about the agents you designed. The other is about the agents you have.

How Anomity closes the enumeration half

Anomity is not a sandbox and does not replace one. If the survey convinces you to build isolation for your highest-risk agents, that is container and network work, and it is the right call. What Anomity supplies is the layer underneath both controls: a lightweight, unprivileged Endpoint Sensor that inventories eight AI artifact types per machine - agents, MCP servers, skills, extensions, plugins, hooks, CLIs, and secrets - across providers, so the population your identity and isolation programmes bind to is the real one. Metadata only over HTTPS, secrets redacted on the endpoint, no source code and no prompts.

On agents that expose a hook, such as Claude Code's PreToolUse, runtime governance returns allow, deny, or log on each tool call before it runs. That is the enforcement 65% of respondents report having, placed at a boundary the model cannot argue past rather than in a system prompt. Every artifact change lands in a queryable 90-day audit trail, and violations route to your SIEM, Slack, email, and Jira through continuous policy evaluation. For teams mapping this to a framework, the AI governance framework for enterprises and the NIST AI RMF applied to agents cover the control mappings.

What to do with this data

• Check your own ratio. If you have issued per-agent identities, count how many of those agents run inside a bounded execution context. The survey's answer was 11 of 57.
• Treat the 63% credential-sharing figure as a prompt to reconcile, not a statistic about other people. Compare issued agent identities against credentials actually present on endpoints.
• Stop testing guardrails single-turn. Cisco's 88.3% break-through rate came from adaptive multi-turn attacks that single-turn red-teaming did not surface.
• Put isolation in the budget as its own line. It was the only control in the series that did not beat its forecast, and the forecast was already low.
• Read your satisfaction score for what it measures. Ease of enablement and incident prevention are different variables, and 92% provider-native adoption means most scores are measuring the first.
• Before choosing between identity and isolation, establish the enumeration both require: every agent, MCP server, and skill actually present, reconciled against what was approved.

VentureBeat's conclusion is that enterprises deployed AI agents ahead of the controls needed to manage them, and did it knowingly. Three waves of security-specific data now show where the knowing stops: at the point where a scoped credential gets mistaken for a bounded blast radius. Whether enterprises build governed identity and isolation deliberately, or whether an incident that propagates does it for them, is what the next wave will report. To see which agents, MCP servers, and skills are running across your fleet today, and what runtime governance would have denied, book a 30-minute demo.