New Zentera Systems Research Reveals Security Leaders' Struggles to Govern AI Agents

Zentera's survey of 251 security leaders found that 58% of organizations already operate more than 50 AI agents, while 79% expect to significantly restrict or claw back agent use within 18 months because of governance concerns. Key risks include agents crossing project boundaries (84%), retaining unapproved access (80%), and performing valid tasks in unauthorized contexts (75%); fewer than 43% of respondents were very confident they could demonstrate explicit agent authorization. The findings underscore growing demand for Zero Trust controls, project isolation and auditable authorization as enterprise AI-agent deployments scale.

Analysis

This is directionally supportive for the cybersecurity control plane, but not yet a revenue event for Gartner (IT). The more investable implication is that agent adoption shifts budget from endpoint/network prevention toward identity, privileged-access management, segmentation, and auditability. Likely beneficiaries are PANW, CRWD, ZS, OKTA, CYBR and RBRK; the winners will be vendors that can enforce policy across machine identities, SaaS applications and cloud workloads rather than merely detect anomalous prompts.

The second-order risk is that enterprise agent projects encounter governance gates before reaching production scale. That would temper near-term inference consumption and application-layer AI spending, creating a modest headwind for usage-sensitive AI software vendors and cloud workloads, while improving the relative budget resilience of security platforms. Security buyers may also consolidate point tools: large platforms with existing identity, SASE and SIEM distribution should capture spend at the expense of private standalone "AI security" vendors lacking proven integrations.

Over the next 1-3 months, monitor earnings commentary on AI-related ARR, machine-identity growth, net retention and security budget reallocation. The 6-18 month catalyst is a visible production incident or audit finding that makes authorization evidence a board-level requirement; that would accelerate platform purchases but could simultaneously delay agent rollouts. The survey is vendor-sponsored and heavily skewed toward technology-intensive respondents, so it does not establish broad enterprise spend conversion; absent disclosed pipeline/ARR data, there is no direct trade in Zentera's claims or in IT.

Contrarian view: governance concerns may be a feature, not a brake, for incumbents. Enterprises historically deploy new workloads only after attaching existing identity and logging stacks, making incremental AI governance more likely to expand seat, telemetry and module consumption at PANW/CRWD/CYBR than create a new category winner. This thesis is falsified if security vendors report prolonged AI pilots without higher platform attach rates, or if hyperscalers bundle adequate native controls at little incremental cost.

Key Decisions for Investors

• Watch-list, not immediate trade: track PANW, CRWD, CYBR and OKTA through the next two earnings cycles for disclosed AI-security bookings, machine-identity ARR and platform attach-rate acceleration. Initiate only after a measurable guidance raise or backlog conversion; survey evidence alone is insufficient.
• On a broad AI-security catalyst or enterprise incident, prefer a 3-6 month long PANW / short ZS pair. PANW has greater cross-sell leverage across network segmentation, cloud security and SOC workflows; ZS is more exposed if budgets favor consolidated identity-plus-policy platforms. Exit if ZS billings reaccelerate materially versus PANW or PANW's NGS growth decelerates below guidance.
• Maintain a tactical hedge on agentic-AI software beta via selective underweight of high-multiple, usage-dependent application names until production-governance metrics improve. The risk/reward favors security infrastructure over application-layer AI during a governance pause, but reverse the positioning if hyperscaler-native controls reduce buyer friction and agent deployments translate into sustained consumption growth.
• Do not position in IT from this item. Gartner could benefit indirectly from governance-advisory demand, but the financial sensitivity is too small and the company has no identified product exposure to monetize the theme.