82% of companies don't know which AI agents are operating in their systems: governance lags adoption

By El Ecosistema Startup · November 11, 2026.

Eighty-two percent of organizations responding to a Cloud Security Alliance survey had unknown AI agents operating in their technology environment, according to consultancy Noventiq. In other words, systems with access to databases, CRMs or accounts that nobody inventoried or authorized.

Other studies point in the same direction. An EY survey of 202 AI executives at listed companies with more than $1 billion in revenue (reported by ZDNET) found that 26% cannot detect unauthorized agents and 41% lack visibility into all the AI tools used internally. Thirty-six percent reported incidents with a material negative impact: data loss, financial harm or operational disruption.

Salt Security, surveying more than 380 security and IT professionals (cited by TechTarget), found that nearly half suspected or confirmed that an agent had acted without authorization in the past 12 months. Only 17.5% could automatically stop an agent behaving unexpectedly. And according to Salesforce (via ZDNET), agents in production rose from five in 2024 to an average of 13 in 2026.

The Latin American context is one of early adoption. According to Colombia AI Pulse (Endeavor, August 2026), 61% of Colombian companies surveyed see AI as a strategic priority, but 93.5% are still in exploration and development; only 0.2% have advanced maturity. The ILIA 2026 index (Cepal and Cenia) estimates that 27.6% of large companies in the region use AI, versus 6.8% of small ones.

Noventiq recommends five measures before deploying an agent. Among them: its own digital identity with a human owner, least-privilege permissions (only what is essential for its function), traceability of operations, and human oversight of sensitive tasks with the ability to stop it. "We can delegate execution, but we cannot delegate business accountability," said César Tejada, general manager of Noventiq Colombia.

**Our take.** These figures come from surveys with different samples and methodologies, and they should not be added up as if they were a single census. What they do show is a consistent pattern: agents are being deployed faster than companies are learning to inventory them. It is the same pattern we saw with "shadow IT" (software procured outside the IT department), but with one serious difference: an agent does not just store data, it acts on it.

Our thesis is that the competitive advantage of the coming years will not lie in deploying more agents than the competition, but in being able to audit, limit and reverse what each one does. Whoever can show what an agent does, with what permissions and who answers for it, will earn the trust of customers, investors and regulators.

There is also an asymmetry problem. Large companies have security, compliance and audit teams; startups and SMEs do not, and they are the ones racing hardest not to fall behind. An incident a multinational absorbs through its legal department can be fatal for a small company.

The practical advice is cheap and concrete: inventory within a few days the AI tools each department uses, revoke write permissions until auditable logs exist, and assign an owner to each agent. Without that, governance is a document nobody puts into practice.

In the short term, this phase will be uncomfortable: incidents, fraud and losses that will fuel skepticism. But the long term remains promising. Agents that research, manage and coordinate at scale are part of the path toward an abundance in which routine work disappears. Getting there without losing control requires governance to grow at the same pace as autonomy, not after it.