In 2025, the average global Fortune 500 enterprise had fewer than 15 AI agents in use. Gartner expects that number to explode to more than 150,000 by 2028 . Only 13 percent of organizations think they have the right governance for today, and AI is evolving and moving faster than any other technology paradigm in our history. Today, most security leaders face an agentic Sophie’s choice: allow AI adoption without the right controls and hope for the best, or block it and become the obstacle to a priority the business has already set (while adoption continues in the shadows, anyway). But there is a third option, one in which organizations fully tap into the transformative power of agentic agents without having to live in fear of a catastrophic security failure. The good news is history has already shown how to get there. How technology gets adopted

Historically, technology adoption has followed a reliable pattern. A capability spreads, each vendor and team builds its own approach, the inconsistency becomes expensive and ineffective, leading the industry to agree to a shared baseline. Adoption then accelerates. Take the credit card industry, for example. The big credit brands each ran their own security programs, and merchants had to satisfy every one. This was, of course, cumbersome for the vendors, but also for the customers, too. Every time a customer wanted to adopt a new technology, they had to manually build out security and adoption plans, adding significant adoption and procurement delays. Rather than continue on their own, the credit card companies came together to create PCI DSS 1. 0 in December 2004 and formed the PCI Security Standards Council in 2006. Buyers now had one thing to ask for, and auditors had one thing to check. Collaboration overcame complexity, and everyone benefited. Security-minded technologists can find another example closer to home in the Center for Internet Security (CIS). In the early days of the internet, cybersecurity was a veritable wild west. Enter the CIS, which was founded in 2000 because the industry lacked prescriptive, recognized hardening standards. To this day, each CIS Benchmark is built by consensus among volunteer experts, vendors, and academics. Docker itself is no stranger to the development and furthering of shared standards. As just one example, in 2015, Docker contributed its image format and runC runtime to the Open Container Initiative. A shared baseline at the runtime layer let registries, runtimes, and clouds interoperate. Each of these examples played a different role: PCI mandated, CIS guided, and OCI standardized. Agents will need elements of all three. Where enterprise AI is on that curve

Agents are in the everyone-builds-their-own phase. Each product solves a real piece of the problem, but which piece, and how the pieces fit, is rarely clear. “Agent governance” or even “AI governance” can mean almost anything. Adoption is incremental. A developer allows common commands, widens filesystem access, then connects GitHub, a cloud tool and an MCP server, each through a prompt that makes sense on its own. The logs mostly record that the developer acted. Security is often the last to know. The risks: familiar and new

Much of the risk is familiar. Shadow adoption looks a lot like early SaaS and cloud. Credential sprawl and supply chain exposure are old problems. Inventory, least privilege, audit, and joiner-mover-leaver discipline still apply. Several things are new, however:

Runtime reprogramming. Users — and the agents themselves — can change what an agent does in plain language, with no release cycle. Borrowed identity. An agent typically assumes the user’s identity, so anything the user can read, change, or delete, the agent can too. Autonomy. Agents act asynchronously, spawn sub-agents, and pass authority down the chain. A bad instruction can become an action before anyone steps in. Risky combinations. A tool with no known vulnerability can still complete a path from untrusted input to sensitive data to external communication. A shorter response window. Containment has to revoke credentials and sessions, not only kill a process…