Two numbers sit side by side in the new enterprise AI security data, and they refuse to reconcile. Eighty-eight percent of organizations report confirmed or suspected security incidents involving AI agents. Only twenty-two percent treat those agents as distinct identity entities with scoped access and audit trails.
That is a sixty-six-point gap. The ledger never lies, only the narrative obscures. When a machine acts with production credentials but holds no accountable identity, you have not deployed an assistant. You have deployed an unregistered signer — one that transacts, moves data, and calls tools, with nothing on the record that binds its actions to a responsible principal.
I spent the past three weeks pulling the public claims around this gap apart, the same way I once audited forty-five ICO whitepapers for tokenomics rot. What surfaced is not a new security category. It is an old one, wearing new vocabulary, and the on-chain world has been quietly solving a version of it for a decade.
The execution layer is the new attack surface, and it looks remarkably like a settlement layer.
Context: the gateway nobody named
The focal point of the enterprise discussion is the execution-layer gateway. In plain terms, it sits between an autonomous agent and the tools that agent calls, brokering credentials, inspecting calls, and logging behavior. One vendor's version, DigitalOcean's Action Gateway, reaches more than five hundred suppliers and over sixteen thousand tools, and it proxies credentials outside the agent itself.
The category exists because the risk moved. Two years ago, enterprise AI security meant filtering what a model said. Today it means governing what a model does — which tools it calls, which data it reads, which systems it writes to. That shift is why eighty-five percent of organizations sit in trial while only five percent reach production, and why nearly sixty percent of security leaders name security as the primary obstacle. The execution layer is where a helpful assistant becomes an unmonitored operator.
That design is familiar. A gateway that brokers credentials and mediates execution is structurally a smart contract with a signer policy attached. The credentials never touch the agent; the gateway holds the keys and applies policy at call time. That is not novel architecture. It is the same pattern Ethereum enforced in 2015, minus the transparency.
The risk language is converging too. OWASP's 2026 Agentic Applications list names tool misuse, unexpected code execution, tool-chain cascade failures, and runaway agents that exceed their defined boundaries. Translate those into on-chain terms and you get re-entrancy, arbitrary call execution, composability failure, and unauthorized signer scope. The vocabulary changed. The failure modes did not.
MCP deserves separate attention, because it is the quiet amplifier. The protocol that lets agents call external tools also lets a single malicious tool definition reach every agent connected to it. Tool poisoning, rug-pull changes to a tool's description, and confused-deputy attacks all ride the same rail. In 2021 I watched the same dynamic play out on-chain, when a single compromised approval contract drained wallets that had never interacted with it directly. Connectivity is not a feature. It is a liability that compounds with every endpoint you add.
Meanwhile, adoption tells a colder story. Eighty-five percent of organizations are in trial. Five percent are in production. Nearly sixty percent of security leaders call security the primary blocker. An algorithm does not sleep, nor does it feel fear — but the humans who sign the procurement orders clearly do.
Core: what the on-chain record already proved
Here is where my day job earns its keep. I track non-human behavior on-chain for a living. Wallets, contracts, and bots are all non-human identities, and they have operated at scale for years under one governing rule: every action is attributable, permanent, and verifiable. That is the exact property the enterprise agent stack is now scrambling to reproduce.
Three structural lessons carry over directly from the chain to the enterprise stack.
First: identity must precede permission. On-chain, a wallet cannot spend what its signature scope does not authorize. The enterprise world runs the reverse — it grants broad production access first and audits later. The result is the 88/22 gap. When I mapped five hundred thousand transactions across CryptoPunks and Bored Ape wallets in 2021, sixty percent of the volume traced to a single coordinated entity running wash trades. The market saw activity. The ledger saw one actor. Identity is what separated the two.
Second: the gateway is the concentration risk, and nobody is auditing it. A system that proxies sixteen thousand tools' credentials behind one policy engine is a master key. If it is compromised, the blast radius is not one agent; it is every tool, every session, every credential in scope. In on-chain terms, this is a single custodian holding all signers. The enterprise literature treats the gateway as the solution. It never asks what happens when the solution fails. The hardened point is the centralized point. That sentence should be the first line of every architecture review.
Third: compensating controls are not root-cause fixes. The enterprise framing calls this an operational control problem, not a model alignment problem. That distinction is honest about engineering and dishonest about strategy. Prompt injection remains the upstream trigger for tool misuse and boundary escape. A gateway that filters calls is a compensating control — a firewall around a door that does not lock. On-chain, we learned this with MEV: you cannot filter your way out of a protocol-level incentive. You redesign the incentive.
There is a fourth observation the enterprise framing omits, and it is structural. Security is a cost line, and agents have not yet proven they are a revenue line. Companies will deploy the agent first and backfill governance later, which means the security spend arrives after the value is validated — or never, if the agent is quietly shelved. Correlation is a suggestion; causality is a truth, and the causal chain here runs from agent adoption to security demand, not the reverse. Vendors selling a secure-first, deploy-second sequence are selling against the order in which procurement actually happens.
The vendor map, stripped of marketing
Microsoft extends Entra, Purview, and Defender to agents, launching first in government cloud — a signal that compliance-heavy buyers are the first to pay for governance. Snowflake acquired Natoma in May and ships Cortex AI Gateway with Agent Identity generally available, anchoring security to the data warehouse boundary. Palo Alto runs Prisma AIRS 3.0 across gateway, identity, and runtime. CrowdStrike centers its play on the endpoint. DigitalOcean bundles observability into fifty and two-hundred-dollar tiers. The pattern is uniform: every one of them already owns the customer relationship the agent now needs governed.
Read that list as an investor and the message is blunt. The incremental security demand flows to incumbents — Okta, SailPoint, and Saviynt appear as Snowflake integration partners precisely because agent governance lands inside existing identity systems. The only pure startup in the story, Natoma, was acquired. That is not a growth market. That is a consolidation window, and it opened before the category finished defining itself.
Contrarian: correlation is a suggestion; causality is a truth
The seductive reading is that gateways fix the incident problem. The data does not support that leap. An eighty-eight percent incident rate proves agents are risky. It does not prove gateways reduce risk, because no third-party red-team benchmark quantifies interception rates against prompt injection at scale. That is the honest reading, and it is the one the marketing decks skip.
Worse, the headline figure traces to an unnamed industry survey with no disclosed methodology — plausibly the same source as the twenty-two percent identity number. Same origin, same bias. Trust the hash, not the headline. Two statistics from one unverifiable instrument are one statistic wearing a costume.
And note whose interests the operational control versus alignment split serves. Security vendors sell operational control. Model vendors sell alignment. The framing quietly sides with the party writing the check for the gateway. Nobody in the debate has priced the scenario where the gateway itself is the breach.
The standards race compounds the confusion. NIST opened a request for information in January and a concept paper in February, but the SP 800-53 overlay for agents still carries no release date. OWASP moved faster and published its risk taxonomy first. That sequence matters: when government guidance lags vendor innovation, product definitions become de facto standards, and enterprises that buy early lock themselves into whatever the loudest vendor shipped. The compliance vacuum is not neutral. It transfers pricing power to whoever defines the vocabulary.
Takeaway
Watch the NIST SP 800-53 overlay. It still has no release date, which means enterprises are locking architecture decisions during a compliance vacuum — and rework is the predictable cost. The signal to track next quarter is not another vendor launch. It is the first public post-mortem of a compromised agent gateway, because the sixteen-thousand-tool broker is the highest-value target in the building, and its defenders have not yet admitted it exists. The first breach will teach the market, faster than any framework, that a control plane is only as trustworthy as the audit trail behind it.
