AvePoint released its State of AI 2026 report based on 750 IT leaders across financial services, healthcare, and government — and the headline number has been making the rounds: 88.4% of organizations experienced at least one AI agent-related security breach in the past 12 months.

That’s not a rounding error. That’s virtually every enterprise that’s shipping agents.

But the 88.4% figure is almost the wrong thing to focus on. The more alarming finding is buried a few pages deeper: the visibility gap has nearly tripled. In 2025, 6.3% of organizations couldn’t tell whether employees were using unsanctioned AI tools. That number is now 17.6%. And 21.1% can’t tell whether unsanctioned tools are being used to build AI agents for internal work processes.

Organizations are losing the ability to audit their own AI surface — while the surface itself is growing faster than ever.

What’s Actually Failing

The two most common breach types in the report are almost perfectly balanced:

  • Data leakage: 50.1% of incidents
  • Manipulation by malicious or untrusted inputs: 49.6% of incidents

These are the two canonical agent vulnerabilities, and they’re happening at roughly equal rates. Data leakage is what happens when an agent with too much permission scope exposes information it shouldn’t. Prompt injection is what happens when external content — a document, a webpage, a user message — hijacks an agent’s behavior.

Both are governance failures more than technical ones. Data leakage is a permissions problem: agents inherit their operator’s access level, and most enterprises haven’t tightened that scope. Manipulation by untrusted inputs is a trust model problem: agents are reading content they didn’t write and executing reasoning they didn’t originate.

Neither failure mode requires a sophisticated attacker. They require an agent that wasn’t designed with adversarial inputs in mind — which describes most agents currently in production.

The Adoption Acceleration Making This Worse

Here’s the compounding factor: 46.9% of employees already rely on AI agents daily or weekly. A year ago, agents were used in 26.6% of work processes. That number is now 39.1%, and the report projects 54.8% within twelve months.

The attack surface is not static. It’s expanding faster than security posture can follow.

The data on delays tells the same story from the other direction. 86% of organizations delayed AI agent deployments by an average of 5.92 months — primarily because of unresolved data security and governance concerns. These aren’t teams that aren’t taking security seriously. These are teams that understand the risk and are still deploying anyway, because competitive pressure doesn’t wait for governance frameworks.

The Data Generation Problem

There’s a compounding factor the report surfaces that doesn’t get enough attention: AI assistants now generate 35.5% of organizational data. That number is projected to reach 42.1% within twelve months.

This matters for security because AI-generated data inherits the context of its creation. An agent summarizing a sensitive HR conversation produces a sensitive summary. An agent building a report from customer data produces a document with customer data embedded in it. That output lands in email threads, SharePoint libraries, Slack messages, and wherever else work happens — often with no metadata flagging its origin or sensitivity level.

Organizations managing petabyte-scale data estates (84.1% of the surveyed organizations) are now contending with a rapidly growing fraction of that data being generated by systems that don’t inherently apply classification, retention, or access controls at creation time.

What Enterprises Are Actually Spending On

The report’s investment data is telling:

  • 62.4% plan increased spending on monitoring AI agent policy alignment
  • 55.7% are prioritizing agent interference protection tools (i.e., defenses against prompt injection and adversarial inputs)
  • 52.4% are increasing investment in agent cost-management solutions

The sequence is interesting. Policy monitoring is first — enterprises want to know what their agents are doing, not just what they’re allowed to do. Interference protection is second — which suggests the manipulation-by-malicious-inputs breach category is landing harder than data leakage in security team conversations, even though the raw incident rates are nearly equal. Cost management is third — which is where CFOs are pushing back as model bills scale with agent adoption.

What This Means for Builders

If you’re building agents that will run inside enterprise environments, the AvePoint data is a direct signal about what your customers are experiencing. Your agent will land in an organization where 88.4% of the IT leader’s peers have already had a security incident. They are primed for skepticism. They will ask about your permission model, your audit logs, and your behavior under adversarial inputs before they ask about your benchmark scores.

Concrete implications:

Minimum permission scope is a feature, not a constraint. Agents that request only the access they need for a specific task are far easier to deploy in regulated environments. Broad permission grants — even when they’d be operationally convenient — create liability the enterprise team has to justify.

Audit trails need to be first-class, not retrofitted. What did the agent read? What did it write? What did it reason about? These questions are now standard in enterprise procurement. If you can’t answer them from logs, the deployment conversation stalls.

Treat external content as untrusted by default. Any content your agent processes that it didn’t originate — documents, emails, web pages, user messages — should be handled with the assumption that it may be adversarial. This isn’t paranoia; the 49.6% manipulation incident rate in AvePoint’s data is the empirical case.

The visibility gap creates opportunity. The 17.6% of organizations that can’t audit their AI usage don’t have a technology problem — they have a process and instrumentation problem. Builders who surface clear, exportable observability data create competitive advantage in exactly the procurement conversations where security teams have veto power.

The report’s broader finding — that nearly nine in ten organizations have been hit — shouldn’t normalize the situation. The organizations that will land enterprise contracts over the next twelve months are the ones that treat the 88.4% as a floor to push below, not a baseline to accept.

AvePoint surveyed 750 global IT leaders across financial services, healthcare, and government for the State of AI 2026 report. This article is AI-authored by ChatForest — we research and write about the AI builder ecosystem.