Agentic AI

Enterprises need a strong data foundation to scale AI agents, a report from Google Cloud and MIT Technology Review Insights found. The report is based on a global survey of 300 CIOs, CTOs and other IT and data executives. 

Nearly all surveyed enterprises plan to use AI agents, with more than two-thirds planning to deploy agents within the next two years, according to the report. However, only 10% of companies today deploy agentic AI widely across the business.

“Without a deep understanding of the full data estate, including unstructured dark data, you do not have the quality and trust to activate agents at scale,” the report’s foreword said. 

Limited access to enterprise data — along with necessary overhauls to business processes, the workforce and governance policies — pose challenges to scaling agentic AI. 

Only 15% of companies have successfully scaled multiagent systems, according to a Deloitte report. IT leaders surveyed for the report said their organizations were, at a minimum, three to four years away from redesigning processes and workflows around agentic AI. 

For long-term success with agentic AI, data access is key, according to the Google and MIT report. Today, AI has access to just 45% of enterprise data on average, according to surveyed organizations. Additionally, only half of organizations trust that AI agent decisions are relevant and accurate, which the report said is a direct reflection of an enterprise’s data readiness.

Global IT spend is projected to reach $6.31 trillion this year as enterprises pour significant resources into the latest AI developments in pursuit of operational efficiency and productivity gains. To reach those gains, the Google and MIT report said IT leaders will need to focus on the data foundation and updating legacy systems, which can further hamper AI’s access to data. 

It’s a tack The Magnum Ice Cream Company is taking as it builds its tech stack from scratch, Michael Friedlander, CIO of the Americas, told CIO Dive in a previous interview. A clean data foundation to support future AI capabilities is the cornerstone of Friedlander’s approach. 

“The shift from answering questions to taking actions means AI agents need data from across the enterprise, in all its structured and unstructured forms, and with the right business context,” the report said. “To make decisions and act in real time, agents also need frictionless access to the organization’s operational systems — for example, those storing its supply chain, point-of-sale, or human resources data.”

Agent-led software development is fundamentally changing engineering, but some tech teams are missing out on most of the productivity AI can provide, a Bain & Company report found. The report was based on surveys of global executives and market research conducted in 2025 and 2026 by the management consulting firm.

By the fall, respondents said they expect more than half of their engineering efforts to be agent-assisted, and by spring 2027, that number rose to about 90%. While respondents reported AI is producing 63% higher outputs per engineer, most companies said they’re not yet seeing large enough increases in their overall efficiency as they figure out new roles in managing AI output.

For value to be derived, tech teams need to make adjustments to all levels of their engineering operations when introducing AI agents, not by plugging in agents into singular activities, such as code generation or testing, said Purna Doddapaneni, a partner at Bain & Company and coauthor of the report. “In an agentic world, agents are doing the work,” he said. “And as humans or organizations, we are responsible for the decisions that the agents are making.”

Agents are no longer just making developers incrementally faster, they’re rebuilding the entire delivery system around engineering, Doddapaneni said. 

Adopting AI into engineering workflows has become the default, The State of Engineering Excellence 2026 report, published by software platform Harness, found last month. The technology has changed the way engineering teams complete work and measure productivity, with more time spent on reviewing code, fixing bugs and context switching between tools. 

But teams that fail to adjust their operations around advancing tools won’t gain the benefits of them, Doddapaneni said. The report recommended humans should act as strategic advisers and incident responders through the AI-assisted workflows. Product and engineering teams will likely adopt hybrid agentic models, where developers can move from being code writers to agent orchestrators. 

More powerful AI models don't derive value without the processes put in place to direct them toward a company’s goals and objectives, Doddapaneni said.

“A model is like an engine, just having a beefier passenger engine doesn't really help me drive the car — I need to think about the steering wheel, the brakes and everything around it,” he said. “It’s like I'm building a harness around the engine, or the model, giving it context to get me from one place to the other.” 

Most engineering processes include both a product development life cycle — which defines what to build based on customer needs, market opportunity and strategic roadmap — and a software development life cycle, which is the process of building the product through coding, testing and deploying.

The sequential nature of development is disappearing in the AI era, Doddapaneni said, as humans spend less time developing products and writing code, and instead spend their time managing AI outputs. He called it “technical scaffolding,” or putting the guardrails and guidelines in place for AI to create the desired outcomes. 

“CIOs who are still running pilots without that system redesign are going to hit the ceiling,” he said. 

Sponsored content

By OutSystems

An upcoming survey report shows enterprise AI is moving beyond individual use cases into interconnected systems of agents, creating new demands for control, flexibility and measurable value.

AI is no longer confined to experiments and isolated productivity tasks. Adoption is rapidly broadening into consequential enterprise functions, with organizations expecting agents to increasingly coordinate work across applications, systems and business processes.

Getting AI into production is, for the most part, yesterday’s challenge. Now, the architecture of these workflows is changing too. Instead of having one AI tool complete one task, organizations are moving into an era where agents collaborate, call tools and applications, exchange context, and hand work to one another.

So, what does it take to manage AI when individual agents become part of an interconnected agentic ecosystem? An upcoming survey report from OutSystems and KPMG explores that transition: 71% of respondents expect enterprise applications to evolve toward agents coordinating work across systems, teams and business processes or helping business users complete more complex, multi-step workflows.

Adoption gives way to orchestration

Isolated agents are typically evaluated on their own outputs. However, while that might validate their technical capability, deploying them in a production environment is another matter entirely, not least because most real-world workflows involve multiple applications, datasets and other agents. That introduces dependencies where agents may exchange context, invoke APIs or interact with enterprise applications and depend on outputs generated earlier in the chain.

Gonçalo Borrêga, SVP of Product, AI, and AppDev at OutSystems, describes this as an orchestration challenge. “The higher the goal is, the more coordination effort is involved. That’s where we get into orchestration,” he says. “One error here can lead to 10 errors down the line.”

That transition is already visible. For instance, one global logistics organization is moving from an agent that analyzes application logs toward a multi-agent model where specialized agents collaborate and share context in real-time.

Complexity raises the stakes for control

As these systems become more interconnected, the challenge shifts from governing individual AI projects to maintaining control across the full workflow. More than two thirds of survey respondents cite security, permissions and policy enforcement across agents as a leading orchestration hurdle.

The implication is that, while most organizations do have governance, that doesn’t necessarily mean their processes work operationally across the entire workflow, especially those involving coordination between multiple agents and other tools. “You still need to guarantee security, observability, accuracy and quality across all of those agents, and you need to coordinate and orchestrate that work across multiple platforms,” says Borrêga.

Some organizations are already taking a more structured approach. For instance, a major digital bank defined authorized AI tools and preconfigured workflows before letting teams deploy autonomous agents, thus reducing the security risks that come with fragmented adoption while keeping room for innovation.

Greater control shouldn’t mean less choice

The agentic enterprise will inevitably be heterogenous, with different agents, applications, models and data services all living on different platforms. Borrêga argues that simply adopting agentic AI is not a straight path to building an agentic enterprise when agents are being added to application and data landscapes that are already fragmented.

Organizations need that flexibility, not least because what might be the best tool for a given use case today might not be the same tomorrow. Therefore, they shouldn’t attempt to standardize everything on one vendor, but rather establish consistent engineering, orchestration and governance across the environment.

The goal is portfolio-wide visibility and a consistent control layer that applies policies across the environment while preserving freedom to choose the agents, tools, platforms and models best suited to each use case.

Business outcomes have become the real test

As enterprise AI matures, organizations are increasingly measuring success by impact on business outcomes, rather than narrow activity-based metrics. In the survey, 64% use error reduction to evaluate AI’s impact, while 60% measure compliance or risk reduction.

Borrêga challenges the narrow focus on productivity gains and instead shifts the focus to business outcomes: “The fact that you can just generate more text or more code doesn’t yield a good outcome by default.” Instead, the more relevant question is whether the newly redesigned agentic process meaningfully improves a business outcome, such as reducing costs, improving customer experience, reducing risk, or helping the organization respond to market pressures faster.

In light of the survey’s findings, it’s clear that the next stage of enterprise AI will be defined less by how many agents an organization has in operation and more by how effectively it connects them to trusted business systems. As applications themselves become increasingly agentic, organizations will need to combine orchestration with governance, enterprise context, technology choice, and outcome-based measurement.

Dive deeper into the data with the complete 2026 OutSystems and CIO Dive survey report, coming soon. ↗

Applying a uniform governance strategy to all AI agents leads to higher project failure rates for enterprises, a Gartner report found. The firm predicts that by 2027, 40% of companies will decommission agents because tech teams haven't distinguished between an agent’s ability to act and the scope of access it is granted. 

Many teams find that when they scale a tool or push it to production, it has the capacity to do things it shouldn't do, Shiva Varma, senior director analyst at Gartner told CIO Dive. “A lot of organizations either have no AI governance at all, no agent governance, or they have a very blanket policy approach to that governance.”

A proportional governance approach that gives different agents strategic levels of clearances and autonomy can keep organizations from experiencing these failures, Gartner found.

Almost as quickly as enterprises worked to adopt AI tools, companies have had to form human oversight and governance policies for autonomous agents with access to sensitive information. AI providers have also invested in offering governance features to quickly adapting agentic workflows. 

Many enterprises treat AI agent governance with a binary approach, either fully controlled or fully trusted, Shiva Varma, senior director analyst at Gartner said. When all agents get the same controls, organizations can over-restrict simple agents which slows delivery and drives shadow development, or they under-restrict autonomous agents which increases security and risk concerns, he said. 

Gartner suggests taking a proportional approach to governance, with four different levels of autonomy and boundaries — observe, advise, act with approval and act autonomously — depending on the agent’s role. Agents primarily deployed to read or summarize a document may only need baseline controls, such as scoped data access or user authentication, Varma said. 

But agents used to advise or generate recommendations with human review will need higher levels of oversight like output quality review, hallucination testing and user training on appropriate reliance. Agents that can act with approval, like sending communication or modifying configurations need “meaningful control,” Varma said. 

Agents that act autonomously to execute actions independently need the most guardrails, Gartner said. 

“That's when you need to be very, very specific and careful about how you calibrate your guardrails and ensure that you have some human sampling as well,” Varma said. 

Though 80% of tech leaders recently surveyed by Solvd said they feel pressure to make AI projects work, enterprises with successful guardrails usually work with cross-functional teams, including tech C-suite, engineers, the business and legal teams, Varma said. 

“[Governance] shouldn't be sitting with one individual person, that's already a failure mode,” he said. “The whole point is that it's a shared, repeatable classification. It's not a top-down decree from a single executive.”

AI agents are rapidly changing the way enterprises operate, reshaping the cybersecurity landscape for those that use them — and expanding risk across different parts of the business. 

The appeal to deploy the technology is massive. Enterprises are set to more than double their spending on generative AI models and AI agents, with an additional $6 billion in spending on them in 2026, a recent Gartner report found. While some organizations report agentic systems and agents are used for very discrete tasks, others say they’ve embedded AI into human decision-making with plans to use it mostly without human intervention. 

But newer, more powerful models such as Anthropic’s Mythos and OpenAI’s launch of the Daybreak initiative have highlighted just how much access agentic AI can get. Executives must steer their organizations toward a new model for risk management that responds to the shifting profile of cybersecurity in the agentic era.

More than half of executives said their organization had an AI-related security incident or a close call last year, according to a recent Okta report. AI providers themselves have gotten in on enterprise AI security management as cyber risk becomes a greater concern. 

Although many enterprises quickly jumped on the hype of agentic AI, tech leaders are realizing they introduce a complicated mix of benefits and risks to organizations, Shiva Varma, senior director analyst at Gartner, told CIO Dive. Agentic AI is changing the type and frequency of risk that enterprises face and is making security a cross-organization responsibility.

“They don't solve every problem, they come with a lot of risk, and they are very expensive to run,” Varma said. 

A new risk landscape

Agentic AI has developed beyond the ability to generate text, images or code, and has taken on decision-making and task execution, performing duties traditionally done by human employees, said Aunshul Rege, a cybersecurity professor at Temple University. 

An average agent could be accessing the internet, querying a database or combing through sensitive information across an enterprise’s entire knowledge base. Because AI agents are given this autonomy, their permissions must be carefully considered, Janet Worthington, a senior analyst at Forrester, said. 

Worthington said she’s seen a trend of clients giving too much agency to agents in the name of productivity. Although companies form AI guidelines or policies for their employees, agents are built to complete tasks, Worthington said, often at any cost. As companies embed them into systems, they can learn to overcome obstacles even when they run into security-focused roadblocks or guardrails. 

“Every time they create an action, they learn from that, and so when they encounter issues in the real world, when they're being asked to do something, they will go back, learn and try a different way,” Worthington said. 

Humans operate this way too, she said. But agents don’t “clock out,” she added. 

“If we don't start treating these agents as their own particular identities and constrain them, then we're going to see a lot more issues,” Worthington said. 

Cliff Steinhauer, director of information security and engagement at the National Cybersecurity Alliance, likened the rise of agentic AI to the cloud revolution a decade ago. Companies are moving from operating their own equipment and processes to automating them.

“It changes the amount of risk when we take on new tools,” Steinhauer said. “It’s a new skill set, and much more to manage than we’ve seen before.”

Aside from overreaching agents, the technology also makes companies more vulnerable to malicious outside attacks, Rege said, as human behavior and trust still play a large role. Employees could begin trusting automated systems the same way they trust their human colleagues. 

“Many attacks succeed because they exploit people, workflows and organizational protocols,” Rege said.

Who is responsible for secure AI?

Historically, cybersecurity has been the responsibility of the CISO or IT teams. But AI systems used across an organization are disrupting this structure, Rege said. Tech executives’ biggest challenge is no longer control, but rather coordination of an organization’s tech strategy, Deloitte recently found. 

HR might use AI for hiring, finance may use agents for procurement or analysis, and legal teams may use AI for contracts. Security teams can’t govern all of these decisions in isolation.

“I think what we are seeing is a shift toward shared responsibility,” Rege said. 

A technology leader such as a CIO might own the decision-making around which AI models to use, while the cybersecurity team puts controls in place, Steinhauer said. Human resources and other people-focused teams might take on the enforcement of policy violations. 

“It’s important to get these groups aligned,” Steinhauer said. 

The role of the CISO is also changing, Worthington said. The role is morphing into the trust and assurance authority within an organization who has to think about AI outcomes, if they can be audited and how to explain outcomes to the board.

Steinhauer said he’s seen AI management roles get added to the C-suite in titles such as chief AI officer. 

“The thing with AI is it can do a lot, but it doesn't have a lot of context, so you need somebody who's been in the business and can understand [the] context of your business,” Steinhauer said. “They can answer, ‘Is this a desired output from what we're doing with AI?’”

Security vs. governance

The rollout of AI has come hand-in-hand with the desire for governance, though many organizations struggle to determine which guiding principles to apply to their systems. But just because an organization has a governance policy does not mean it’s absolved of security risks, Rege said. 

Executives should think of governance as a set of rules for how human employees are expected to use AI, Steinhauer said. This is where organizations should aim to be collaborative so expectations are understood across each department. 

“Governance asks questions such as: Should we be using this system? What decisions is it allowed to make? Who is accountable if something goes wrong?” Rege said. “What level of human oversight is necessary?”

Meanwhile, a security strategy is focused on protecting the systems, data and infrastructure from compromises. It more closely aligns with the traditional goals of cybersecurity teams.

Security, governance and risk management should be reviewed cyclically, and policies will likely ebb and flow as the technology develops and organizations figure out which tools are essential.

“Organizations should resist the temptation to treat AI as either magic or catastrophe,” Rege said. “The better approach is to be structured and risk-based.”

Companies are struggling to transition from smaller, generative AI use cases to widespread agentic systems within their organizations, according to a Deloitte report. The professional services firm surveyed more than 500 tech leaders and conducted interviews with 20 executives and data science leaders for insights. 

Although roughly half of technology leaders say they have a clear view of their future AI operating models, only 15% of organizations have actually been able to scale multiagent systems. Most said they are unprepared when it comes to their workforce, business processes, ecosystem partnerships, security and governance policies.

Tech leaders should realize that the shift isn’t about adding more agents, but changing the way work happens within their organizations, China Widener, vice chair and U.S. technology, media and telecommunications industry leader at Deloitte, told CIO Dive. “It's a multiyear journey because it's going to continue to evolve, frankly, as the technology around the agents continues to improve.”

Enterprise spending has trended more toward agentic systems in 2026, but readiness for full-scale deployment is still far off for most organizations. 

Tech leaders surveyed by Deloitte said that most organizations were at least three or four years away from having half of business processes redesigned around AI agents and from having the agents work autonomously and collaboratively with each other. 

Currently, many organizations are applying AI agents on top of existing processes instead of redesigning processes from the ground up, which can take years. It’s a quick path to implementing the technology, but it doesn’t reap the true benefits of the technology, Deloitte’s report said.

A lack of a unified and accessible data foundation, inability to trust and govern agents and the cost and complexity of integration were among the technical challenges companies faced with agentic AI adoption. Organizational challenges included workforce readiness and underprepared business processes, according to Deloitte.  

Because of AI's breakneck pace, CIOs are in a constant state of evolution, Widener said. AI strategies should be developed parallel to the changing technologies, she said. 

“You have the technical components, the governance components, the data components, and the human components all evolving at the same time,” Widener said. “That is what contributes to the difficulty in the transformation.” 

Agentic AI is providing most companies some positive impact, according to a recent Accenture report, but few organizations say they’re seeing sustained business value — impact that can be reported to a company’s board — from their AI investments. 

CIOs looking to deepen their agentic AI use in a meaningful way should realize that it’s a drastically different type of technology than the linear, generative AI models that most companies have deployed over the last few years, Widener said. 

With automated models, a task or query will follow the same steps each time, but agentic models work less predictably. It’s a user's job to validate the outcome, which is a very different way of working than most are used to, Widener said. 

“We're entering a different time where the technology and the agentic solution has the ability to think and take those outcomes and arrive at the best path of travel to get there without being told all the steps,” Widener said.

Despite agentic AI's potential for enterprise transformation, CIOs and other tech leaders face challenges deploying the technology in a meaningful way within their organizations, Tom Zehren, CEO of Info-Tech Research Group said at the company’s conference keynote. 

Security measures, IT budgets, AI strategy and employee buy-in all factor into tech leaders’ success with AI. 

“We're living in a world where we have a significant tension between AI value creation on the one side and AI governance and risk management on the other side,” Zehren said.

Some organizations stay stuck with their AI adoption goals because of fear of risk, Zehren said. Saying no to AI projects blocks the risks, but it also blocks potential value, he said.

More than one-third of organizations are including AI governance in their regular IT strategy, according to surveys Info-Tech conducted over the last year. Half said they have a dedicated AI strategy that is board-governed, and only focused on AI, which triples the odds of getting value from AI, Zehren said. 

A four-step framework, based on survey responses and the company’s industry research, can help tech leaders find an AI strategy with measurable value, the CEO said. First, a company needs to set its “own AI foundation,” Zehren said, a set of mandates that include AI literacy, an operating model, a budget and ownership structure. 

Secondly, using clean data, smart architecture, partnerships and agile funding to determine which projects will have longevity. The third step is enforcing AI and creating conditions to scale. Safe experimentation happens when an organization creates sandboxes that are easy to use and make sense for their employees. In this phase, organizations train the governance muscles that they set up in step one, and are testing the limits and value of their systems. 

In the final step, organizations seek to prove the value of their AI projects, track the benefits, scale prototypes, collect insights and either stop or reinvest in them.

Successful AI strategy

Teams that find success will be the ones that already have a good handle on their business workflow, logic and teams, and who understand the technology at the same time. 

“Our advice is: Don't fire half your team, don't reduce capacity massively in IT,”  Zehren said. “Repurpose it.”

The CIO role is changing to become managers and orchestrators of these system overhauls, Zehren said. CIOs are more commonly taking on a broader set of responsibilities like measuring business outcomes, and taking on roles in digital, data, transformation and even product departments. 

But successful technological adoption could allow them to move up, Zehren said — 67% of CIOs say they aspire to be CEO, according to a Deloitte report

 “CIOs have to step up to become exponential IT leaders and really drive exponential value for the organizations using the technologies,” Zehren said. “If you do that, there's a ton of new career pathways that open up.”