Across 107 enterprises, agentic orchestration is not a choice of a single platform.
The typical enterprise runs three orchestration platforms at once, and selects them for flexibility across models rather than affinity to any single one. Microsoft leads primary usage while Anthropic leads forward consideration by a wide margin.
The AI control plane enterprises expect is deliberately hybrid, meaning it includes use of the leading AI providers, but also provider-independent technologies — and the risk they fear most from provider-resident control is not lock-in but the provider’s own security and permissioning limits.
One in five enterprises still has no real-time way to stop a runaway agent before the bill arrives.
This wave of VentureBeat Pulse Research examines enterprise agent orchestration: which platforms enterprises run on, what drives the choice, what they optimize for, how they expect agent control to be structured, and — most revealingly — how orchestrated their deployed “agents” actually are and how tightly they control the cost of running them.
The central finding is that orchestration has become plural. Eighty-five percent of enterprises run two or more orchestration platforms and 64% run three or more, with a mean of 3.1 platforms per organization. Microsoft AI Foundry / Copilot Studio appears in 70% of stacks and OpenAI’s Agents SDK in 68%, with Anthropic’s Claude Platform in 47%. Asked to name a single primary platform, respondents who gave one unambiguous answer put Microsoft first (41%) and Anthropic second (28%). Nobody in this sample is running one orchestration layer and calling it a strategy.
The selection logic follows from that plurality. Flexibility across models and tools is the leading purchase driver at 29%, nearly three times the share naming model gravity — native alignment with a state-of-the-art base model — at 10%. Enterprises are not choosing the orchestration environment that comes with their favorite model; they are choosing the one that does not commit them to any model. Security and permissions (17%), production reliability (15%), and control over agent execution (15%) fill out a buying logic focused on governance and optionality rather than developer convenience.
A clear majority (53%) expect a hybrid control plane by the end of 2026 — provider-native plus external orchestration — and the risk they most associate with provider-resident control is security and permissioning limitations (37%), ahead of vendor lock-in (23%) and limited visibility (22%). Investment has moved accordingly: agent monitoring and debugging leads the spend at 31%, with security and permissions enforcement at 30%, while workflow tooling draws 19%. Enterprises are spending to see and govern agents, not merely to build them.
Most companies admit that a majority of their “agents” are really just chatbots. A plurality of 47% of respondents say that between 26 and 50% of their agents are genuinely orchestrated, with 37% at a quarter or below and 16% past the halfway mark.
But fiscal control remains the soft spot: 21% of enterprises track agent spend only through post-hoc logs, with no real-time way to halt a runaway execution loop.
VentureBeat fielded this survey as part of its ongoing Pulse Research series, with this instrument focused on enterprise agent orchestration. Responses are filtered to organizations with 100 or more employees (n=107), drawn from a single July 2026 wave; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. All figures in this report come from the July fielding only. Where questions were multiple-select, shares can sum to more than 100%.
This wave draws a notably large-enterprise, technology-heavy sample, and that shapes every finding in it. By organization size, more than half sit at 10,000 employees or above: 50,000+ (26%) and 10,000–49,999 (25%) lead, followed by 2,500–9,999 and 500–2,499 (19% each) and 100–499 (11%). Technology/Software accounts for 53% of respondents, with Government/Public Sector (16%) and Manufacturing/Industrial (10%) next. By role the sample is hands-on and technical: software and ML engineers (22%), product and program managers (21%), directors of data/AI/analytics (17%), and VPs of data/AI/analytics (12%). On purchasing, 90% are recommenders, influencers, or final decision-makers for AI solutions (63% recommender/influencer, 27% final decision-maker).
A note on the primary-platform question. Forty-six of 107 respondents registered more than one selection on a question intended to capture a single primary platform. Because those responses cannot be resolved to one answer, primary-platform shares are reported on the 61 respondents who gave a single unambiguous answer, and are labeled as such wherever they appear. Platform footprint figures — which platforms an enterprise uses at all — use the full n=107 base and are unaffected. The ambiguity is worth noting on its own terms: on a question asking for one platform, more than four in 10 respondents could not or would not narrow to one, which is consistent with the multi-platform pattern documented in Finding 1.
At 107 respondents the sample is robust enough to read directionally with reasonable confidence, though it remains self-selected and is not a probability sample. Because each subgroup here only includes about 50 to 60 respondents, splits between them are less precise than the full-sample findings.
The typical enterprise runs three orchestration platforms at once
We asked which agent orchestration platforms enterprises use, and which one they treat as primary. The first answer is that almost nobody has just one.
The defining feature of this layer is plurality. Only 15% of enterprises run fewer than two orchestration platforms; the median organization runs three, and one in six runs five or more. Read that way, the platform “shares” below describe overlapping deployments rather than a divided market — Microsoft and OpenAI each appear in roughly seven of ten stacks precisely because most stacks have room for several.
Asked to name one primary platform, the 61 respondents who gave a single unambiguous answer put Microsoft AI Foundry / Copilot Studio first at 41%, Anthropic’s Claude Platform second at 28%, LangChain / LangGraph at 10%, and OpenAI’s Agents SDK at 7%, with Google, Amazon, Salesforce, and custom in-house builds at 3% each. Microsoft’s lead on primary usage alongside OpenAI’s near-equal footprint on any usage is the signature of an enterprise-weighted sample: the Microsoft platform arrives through an existing enterprise agreement and becomes the default seat of record, while other platforms are added around it for specific work.
A note on reading these shares: As described in the methodology section, the respondents are self-selected, this wave skews heavily toward large technology organizations, and the primary-platform figures rest on a 61-respondent subset. The numbers measure where this cohort has placed its orchestration bets today, within a self-selected audience of AI-active technical practitioners. A sample built this way can diverge substantially from spend-weighted market measures, and each VB Pulse survey draws its own sample with its own company-size and industry mix, so vendor figures should not be compared across our surveys, either.
Respondents rate the platforms they run at 4.17 out of 5 for overall satisfaction, 3.91 for ease of implementation, and 3.63 for value for money — with value for money the weakest of the three by a clear margin. That ordering is itself a finding: enterprises are broadly happy with what these platforms do and distinctly less happy with what they cost, which is the same nerve the fiscal-control finding touches at the end of this report. Satisfaction sits alongside a two-thirds intent to change platforms within the year; this remains a layer enterprises work with rather than settle on.
Enterprises buy the orchestration layer that doesn’t commit them
We asked what most influenced the orchestration platform choice, and optionality leads by a distance.
Flexibility across models and tools (29%) is the selection-side explanation for the multi-platform reality in Finding 1: enterprises are choosing orchestration environments on the strength of what they leave open rather than what they lock in. Model gravity — picking the orchestration layer that comes with a preferred frontier model — draws just 10%, less than a third of the flexibility share, which places the pull of any single base model well down the list of what actually decides this purchase.
The next tier reinforces the governance emphasis. Security and permissions (17%), production reliability (15%), and control over agent execution (15%) together account for 47% of responses: nearly half of enterprises pick their orchestration platform on whether they can constrain and depend on what it runs. Ease of development draws 8% and total cost of ownership 4%, an inversion of how these platforms are usually discussed in engineering circles. Performance sits last at 2% — at this stage of adoption the binding constraints are optionality and control, not raw speed.
Enterprises judge orchestration by whether it completes the work
We asked what enterprises optimize for — their primary success metric for orchestration. Reliability and multi-step workflow management lead, with developer productivity closer behind than in the buying criteria.
Task completion reliability (30%) and multi-step workflow management (27%) together account for 57% of responses: orchestration succeeds, in the enterprise view, when it reliably carries a task through multiple steps to completion. Developer productivity takes a substantial 23% — notably higher than ease of development’s 8% as a purchase driver in Finding 2, which suggests enterprises do not expect to buy developer velocity so much as to earn it once the platform is in place. End-user experience is a minor concern at 7%, consistent with orchestration being an internal execution problem rather than a UX one.
This reliability-first standard is the yardstick against which the portfolio-maturity finding later in this report should be read: enterprises define success as dependable multi-step execution, and a little over a third of them still say a quarter or fewer of their deployed agents do multi-step work at all.
The installed base and the pipeline point to different vendors
We asked whether enterprises plan to adopt a new, additional, or replacement orchestration platform in the next 12 months, and which platforms they are considering.
Two-thirds of enterprises (67%) intend to adopt a new, additional, or replacement orchestration platform within the year, but the clock runs longer than the intent suggests: the largest cohort sits at 6–12 months (28%) and only 15% expect to move within a quarter. This is deliberate re-platforming on a planning horizon, not urgent churn.
The consideration set is where this finding earns its headline. Among the 72 enterprises in motion, Anthropic leads at 43% — well ahead of Google (31%), custom in-house builds (31%), OpenAI (25%), LangChain / LangGraph (17%), and Microsoft (17%). Set that against Finding 1, where Microsoft leads primary usage and appears in 70% of stacks: the installed base and the forward pipeline point at different vendors. Anthropic draws roughly two and a half times Microsoft’s forward consideration despite trailing it on current primary usage, and custom in-house control planes draw as much interest as any external platform besides Anthropic. A further 18% of movers are evaluating with no shortlist at all.
Read alongside the flexibility-first selection logic in Finding 2, the shape of the next twelve months is legible: enterprises expect to add rather than replace, they are shopping for platforms that preserve model choice, and a substantial minority intend to solve the problem themselves rather than buy it.
Monitoring and permissions lead the spend; workflow tooling trails
We asked which orchestration-related investment will grow most next year. Observability and governance take the top two places.
Monitoring and debugging (31%) and security and permissions enforcement (30%) are effectively tied at the top and together account for 61% of planned growth. The money is going to seeing what agents do and constraining what they are allowed to do — the two capabilities that matter once agents are running in production rather than being built toward it. Workflow tooling (19%) and scaling infrastructure (18%) trail, and almost no one is standing still: just 3% report a flat budget.
The emphasis is consistent with the buying logic in Finding 2, where security and permissions was the second-ranked selection factor, and with the control-plane architecture in Finding 6. Enterprises that have decided to run agents across three platforms have a visibility and permissioning problem by construction, and they are funding it directly.
Enterprises split control, and fear the provider’s permissioning more than lock-in
We asked where enterprises expect the primary control plane for agents to live by the end of 2026, and what worries them most if that control sits inside a model-provider platform.
Hybrid control is the dominant expectation by a wide margin (53%). Taken together, the hybrid, custom in-house, and externally-abstracted options — every architecture that keeps control at least partly outside the provider — sum to 78% of enterprises, against 14% willing to hand control to a provider-managed service outright.
The reason enterprises give is worth separating from the one usually assumed. Security and permissioning limitations lead the risk question at 37%, well ahead of vendor lock-in at 23%, with limited visibility and observability close behind at 22%. Combining the security and visibility answers, 59% of enterprises name a control-and-oversight concern rather than a commercial one. The worry is less that a provider platform will be hard to leave than that it will not let them see or constrain what their agents are doing while they are on it — the same concern funding the monitoring and permissions spend in Finding 5. Only 2% say provider-resident control is not a concern at all.
“Bridging the gap” is now the modal answer on portfolio maturity
We asked enterprises to assess their portfolios honestly: What share of their deployed “agents” are true multi-step orchestrated workflows versus simple single-prompt chatbot wrappers.
The center of gravity has moved into the middle band. Just under half of enterprises (47%) now put between a quarter and half of their portfolio in genuinely orchestrated, stateful workflows, and 16% are past the halfway mark. The bottom two bands — a quarter or fewer genuinely orchestrated — account for 37%, and outright pure-chatbot portfolios have nearly vanished at 3%. Against the reliability-first success standard in Finding 3, this is a portfolio that has started to do the work the orchestration layer exists for, without most of it being there yet.
Maturity tracks platform count. Enterprises reporting a quarter or less genuine orchestration run 2.8 platforms on average; those in the 26–50% band run 3.5. The organizations furthest into real multi-step work are the ones running the most orchestration platforms at once, which is the practical case for the flexibility-first selection logic in Finding 2 — multi-step portfolios appear to accumulate platforms rather than converge on one.
One split that might be expected does not appear. Organization size makes no difference to portfolio maturity in this wave: 38% of enterprises at 10,000+ employees report a quarter or less genuine orchestration, against 37% of smaller ones, and the shares past the halfway mark are equally close (16% and 15%). Whatever separates the mature portfolios from the immature ones here, it is not headcount.
A fifth of enterprises learn about a runaway agent from the logs
Finally, we asked how enterprises enforce fiscal control over agent token consumption — the risk that an autonomous loop exhausts a budget before anyone intervenes. The approaches split four ways, fairly evenly.
One in five enterprises (21%) has no real-time, programmatic way to stop an agent before a budget-breaking bill arrives — they learn of it from the logs afterward. Another 30% lean entirely on the native caps and throttles built into their primary platform, a control only as good as the provider’s tooling and one that sits awkwardly beside the hybrid, keep-control-outside posture of Finding 6. Roughly half of enterprises — those building custom gateways (25%) or exploiting cross-model routing to arbitrage cost (24%) — are treating token burn as an engineering problem to be controlled deterministically, and the routing group is doing so in a way that only works because they run several platforms at once.
Unlike previous waves, no size split appears here: 18% of enterprises at 10,000+ employees exercise only reactive control against 23% of smaller ones, a difference well within sample noise. The gap in fiscal control in this wave is not between large and small enterprises but between those that have built a cost-control plane and those still relying on whatever their provider ships. Read against the satisfaction scores in Finding 1 — where value for money was the weakest of three ratings at 3.63 — the picture is of a cohort that is unhappy about what agents cost and, in half of cases, not yet instrumented to do much about it.
Organizations with 100 or more employees describe an orchestration strategy built around optionality rather than commitment. They run three platforms on average, choose them for flexibility across models rather than affinity to any one, and judge them on whether they carry multi-step work reliably to completion. Microsoft anchors the installed base and appears in seven of ten stacks; Anthropic leads forward consideration by a wide margin among the two-thirds planning a change; and a substantial minority intend to build their own control plane rather than buy one. Today’s footprint describes where these enterprises are, and clearly does not describe where they intend to stay.
The governance posture is deliberate and consistent. A hybrid control plane is the majority expectation, 78% intend to keep control at least partly outside the provider, and the reason is not commercial but operational — security and permissioning limits (37%) and limited visibility (22%) outrank vendor lock-in (23%) as the fear attached to provider-resident control. The budget follows the fear: monitoring and debugging and security and permissions enforcement together take 61% of planned investment growth, ahead of the tooling used to build agents in the first place.
Where the strategy thins out is cost. Portfolio maturity has moved into the middle — 47% now report between a quarter and half of their agents genuinely orchestrated, and pure-chatbot portfolios have nearly disappeared — but 21% still cannot stop a runaway agent in real time, another 30% depend on whatever caps their provider ships, and value for money is the lowest-rated attribute of the platforms they run. Enterprises have worked out how they want agents governed well before they have worked out how to meter them.
At 107 respondents in a single July wave, skewed toward large technology organizations, this reads as a clear directional signal rather than a precise measurement. The questions for subsequent waves are whether the middle band of portfolio maturity keeps climbing, whether the forward consideration for Anthropic and for in-house control planes converts into deployment, and whether fiscal control catches up to a cost that enterprises already say they are not getting their money’s worth on.
Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single July 2026 wave. This is a self-selected sample rather than a probability sample, and figures should be read directionally rather than as precise measurement. Respondents include software/ML engineers, product/program managers, directors and VPs of data/AI/analytics, enterprise architects, and directors of engineering/IT, across technology/software, government/public sector, manufacturing/industrial, and financial services organizations.
Across 101 enterprises, the context feeding AI agents is failing often and repeatedly. Sixty-eight percent have traced a confident but wrong agent answer to missing or inconsistent business context in the past six months, and the single most common answer is not “once” but “more than once.” The counterintuitive part is which companies report it. Enterprises building or running a governed semantic layer (a layer of company-specific definitions and relationships) report recurring failures at more than twice the rate of those without one.
The infrastructure built to fix bad context is, so far, mostly revealing how much bad context there is. Meanwhile the architecture meant to solve the problem commands no consensus at all: hybrid retrieval and outright pluralism finish one respondent apart, in a dead heat.
This wave of VentureBeat Pulse Research examines the enterprise RAG and context layer: what feeds AI agents their business context, which retrieval systems enterprises run, how they buy and measure them, where the architecture is heading, and — most revealingly — how often that context is already failing them.
The central finding is that the context failure is no longer an incident; it is a condition. Sixty-eight percent of enterprises say that in the past six months their AI agents produced confident but wrong answers they traced to missing or inconsistent business context rather than to model error. More striking than the total is its shape: 37% report the failure recurring, against 32% who saw it once. Among enterprises in a position to answer at all, the most prevalent experience of running agents on company data is being wrong repeatedly for reasons that have nothing to do with the model.
The remedy the industry has settled on — a governed semantic or context layer giving agents and BI a shared understanding of the data — is being built at scale: 32% run one in production, another 31% are piloting or building one, and 20% more are evaluating. But the cross-tabs deliver an uncomfortable result: Enterprises that have built or are building a layer report recurring context failures at 50%, against 21% for those without one. The layer isn’t causing the failures — it’s catching them, which makes it the most useful finding in the wave. The semantic layer is what makes a context defect traceable. Organizations without one are not having fewer failures so much as attributing fewer failures.
Underneath, the stack is unsettled in a way it was not expected to be. Retrieval remains the leading primary context source at 31%, and provider-native retrieval — OpenAI’s file search (46%) and Google Vertex AI Search (41%) — still runs well ahead of every dedicated vector database. But the expected architecture has no majority behind it: hybrid retrieval (30%) and “multiple architectures, chosen by use case” (29%) are separated by a single respondent. And enterprises remain firmly unwilling to hand the context layer to a provider — just 12% intend to consolidate onto a single model provider’s native context stack, against 37% holding to best-of-breed and 37% planning an explicit mix.
The buying criteria are where the failure is starting to register commercially. Access control and permissions is now tied with ease of data ingestion as the top selection factor at 24% each, and response correctness is the primary success metric for 38% of enterprises. Enterprises are beginning to buy retrieval for the properties that govern context rather than the properties that move it.
VentureBeat fielded this survey as part of its ongoing Pulse Research series. This survey focused on enterprise RAG infrastructure and the context layer — the retrieval systems, semantic layers, and context sources that feed AI agents. Responses are filtered to organizations with more than 100 employees (n=101). All responses are from a single July 2026 wave, so the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select; those shares are reported as a percentage of respondents, not of total selections, so they can sum to more than 100%.
By organization size the sample concentrates in the mid-market: 101–250 employees (34%), 1,001–5,000 (25%), and 251–1,000 (25%) lead, with 10,001+ (12%) and 5,001–10,000 (5%) above them. By role it spans managers (39%), individual contributors (29%), VPs and directors (22%), and the C-suite (9%); on purchasing authority it is buyer-credible, with 38% final decision-makers and another 43% recommenders or influencers. Technology/Software is the largest industry at 31%, followed by Healthcare/Life Sciences (14%), Retail/E-commerce (10%), and Manufacturing (9%).
A note on the context-failure base: Of the 101 respondents, 10 either do not run agents on enterprise data (5%) or do not trace root cause at that level (5%). Headline shares for the failure question are reported on the full 101; the subgroup comparisons in Finding 2 use the 91 respondents who were able to give a yes-or-no answer, since including those who cannot observe the failure would bias the comparison toward whichever group is less instrumented. Subgroup cells run from roughly 10 to 62 respondents and are correspondingly coarse; where a cell falls below 10 it is not reported as a percentage. A small number of respondents selected “Other” and gave a write-in industry (6%) or role (2%) that didn’t map to a listed category; those shares appear as not stated in the appendix rather than being redistributed.
At 101 respondents this is a modest sample and should be read as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively standing up RAG and context infrastructure rather than from the largest operators.
The most common answer isn’t “once” but “more than once”
We asked whether, in the past six months, enterprises had traced a confident but wrong agent answer to missing or inconsistent business context rather than to model error. Most had — and most of those had seen it happen again.
This is the report’s defining number. Sixty-eight percent of enterprises have had an AI agent produce a confident, wrong answer they traced to bad context — wrong metric definitions, stale data, missing documents — and the recurring case (37%) outweighs the one-off (32%). Only 22% report no such failure. Restricted to the 91 enterprises able to observe and attribute the failure at all, 76% have experienced it and 41% repeatedly.
The failure mode is specific and dangerous precisely because it does not look like a failure. The model is not visibly hallucinating; it is confidently wrong because the context feeding it was thin, stale, or inconsistent — and it delivers that wrong answer with the same authority as a right one. That the modal experience is recurrence rather than a single incident matters more than the headline share: a one-time failure is an incident to be fixed, while a repeating one indicates a structural defect in how business context reaches the agent. Everything else in this report — what enterprises retrieve, how they govern it, and what they plan to build — is downstream of this problem.
Enterprises building a governed layer report more recurring failures, not fewer
We asked whether enterprises use a governed semantic or context layer to give agents and BI a shared understanding of their data. Most are on the path — and cross-tabbing that answer against the failure in Finding 1 produces the wave’s most counterintuitive result.
Engagement with the governed context layer is broad. Sixty-three percent of enterprises either run one in production (32%) or are piloting and building one (31%), and a further 20% are actively evaluating, meaning more than four in five are engaged with the idea in some form. Only 14% have no plans.
The cross-tab is where it gets interesting. Among the 91 enterprises able to answer the failure question, those who have built or are building a semantic layer report recurring context failures at 50%, while those without one — evaluating or with no plans — report them at 21%, a gap that clears conventional significance thresholds (p=0.01) and runs in the direction opposite to what the technology is sold to do. Narrowing to enterprises with a layer specifically in production points the same way but does not carry statistical weight on this sample: 53% recurrence against 34% for everyone else, a difference that does not reach significance and should be read as directional only.
Read as causation, this is implausible — a governed definition layer does not manufacture wrong answers. Read as detection, it is the most useful result in this wave. Tracing a confident wrong answer to a specific context defect — a metric defined two ways, a stale table, a document the agent could not see — requires exactly the shared, governed definitions a semantic layer provides. Without one, the same failure occurs and gets logged as a model problem, a user error, or nothing at all. The causation almost certainly also runs backwards in part: enterprises that have been burned repeatedly are the ones who went and built the layer.
The size split points the same way, and carries significance where the production split does not. Enterprises above 1,000 employees report recurring context failures at 55%, against 30% of those between 101 and 1,000 (p=0.02) — despite the larger organizations being less likely, not more, to have a semantic layer in production (24% against 37%). Larger enterprises have more instrumentation, more auditing, and more people whose job is to ask why a number was wrong. The practical implication for readers is uncomfortable but clear: a low reported context-failure rate is not evidence of a healthy context layer. It is at least as likely to be evidence that nobody is looking.
Retrieval feeds more agents than anything else, and fails a large share of them
We asked what an enterprise’s AI agents primarily use to understand its data. Retrieval leads, but no longer by the margin the category assumes.
Retrieval remains the backbone of enterprise context at 31%, ahead of a governed semantic layer (19%) and mixed approaches (17%). But the tail has thickened in a way worth noting: long-context loading is now the primary source for 13% of enterprises, and 5% let agents run on the model’s general knowledge with no enterprise context layer at all. Between them, nearly one in five enterprises is feeding agents business context either by brute-force context window or not at all.
Cross-tabbed against Finding 1, the sources do not fail equally. Among enterprises whose primary context source is retrieval, 87% report a context-traced failure and 48% report it recurring — on the largest base of any group, 31 respondents. Those relying on a governed semantic layer report 79% and 53%; mixed approaches 79% and 36%; direct live-system queries 40% and 30%. The long-context group is the outlier in the other direction, reporting 64% any failure but only 9% recurrence.
These subgroup figures should be read with the detection caveat from Finding 2 firmly attached. Groups differ in how well they can attribute a wrong answer to a context defect as much as in how often they suffer one, and the cells here run from 10 to 31 respondents. The retrieval group’s 87% is best read as evidence that RAG-heavy enterprises both experience and notice context failures, not as a clean measurement of relative reliability.
What survives the caveat is the structural point. Because so much enterprise context flows through retrieval, and because retrieval carries that load on the widest base in the sample, the quality of retrieval is the quality of the answer. When RAG is the default source, incomplete retrieval is the main point of failure.
OpenAI’s file search and Google’s Vertex AI Search top every purpose-built system
We asked which retrieval systems enterprises run in production today. The answer continues to favor the model providers and hyperscalers over the specialists.
The dedicated vector database is not the center of the RAG stack. OpenAI’s file search (46%) and Google’s Vertex AI Search (41%) lead by better than three to one over any purpose-built alternative. Among the specialists, the most-used remain the ones enterprises already run for other reasons — Elasticsearch/OpenSearch at 20% and pgvector at 15% — while the pure-play vector databases that define the category (Pinecone, Weaviate, Milvus, Qdrant) each sit between 7% and 12%. Custom in-house retrieval stacks, at 18%, outrank every pure-play vendor.
Which system is actually primary separates retrieval from infrastructure
Usage counts alone understate the gap, because enterprises run several of these systems at once. We also asked which one is primary. The share of each system’s own users who name it their primary retrieval platform divides the field cleanly.
Elasticsearch and pgvector are widely present and rarely primary: four in five of their users retrieve mainly through something else. They are infrastructure the enterprise already ran, pressed into service at the edges of a retrieval stack whose center is elsewhere.
Model-backed and hyperscaler retrieval is not merely the most common system on the list; for most of the enterprises that adopt it, it is the system of record. Custom in-house stacks behave the same way — when an enterprise builds one, it is usually the primary, not a side project.
The primary-platform question was fielded as a single-select and 18 of 101 respondents selected more than one option, so the shares above are computed as a proportion of each system’s users rather than of the full sample. On the 83 respondents who gave exactly one answer, the ranking is unchanged: OpenAI’s file search 28%, Vertex AI Search 23%, custom in-house stack 12%, and no pure-play vector database above 8%.
The comparison worth sitting with is what this leaves for the RAG specialists. In a category built around specialist infrastructure, more enterprises have written their own retrieval stack than run any single dedicated vector database — and roughly four times as many use retrieval that arrived bundled with a model provider or cloud they already buy from. Only 7% run no production RAG at all, so this is not a story about early adoption; it is a story about where retrieval gets acquired.
Hybrid retrieval and “It depends on the use case” finish in a dead heat
We asked which retrieval architecture enterprises expect to dominate their production RAG systems by the end of 2026. No single answer comes close to a majority — and the two front-runners are separated by one respondent.
Hybrid retrieval leads at 30%, with the expectation that no single architecture will dominate at all immediately behind at 29%. The gap is one respondent, far inside the margin on a sample this size, and the honest reading is that these two finish level rather than that either is in front. Together they account for 58% of enterprises, and what unites them is more instructive than what separates them — both describe layered pipelines rather than a single retrieval technique, and neither expects the pure vector-search approach that launched the category to carry production on its own.
Two smaller answers carry the sharper signal. Fifteen percent expect tool-first or long-context retrieval to dominate without a dedicated vector layer at all — a direct challenge to the premise of the category — while 12% still expect vector-only retrieval to prevail. That the anti-vector position now edges the pure-vector one, on a three-respondent margin that is itself too narrow to call, is a notable inversion for an industry that spent three years building vector databases. Add the 15% who are unsure or expect no large-scale RAG, and the picture is of a market that agrees vector search alone is insufficient and has not agreed on what replaces it.
Consolidation onto a provider’s native context stack barely registers
We asked how enterprises will respond as model providers bundle retrieval, memory, and orchestration into their platforms. Their stated intent cuts sharply against their current usage.
Here is the tension at the heart of the stack. Provider-native retrieval leads actual usage by a wide margin (Finding 4), yet just 12% of enterprises intend to consolidate onto a provider’s native context stack. Best-of-breed standalone tools and an explicit mix are tied at the top at 37% each, and 6% intend to build and own the layer themselves — meaning 79% of enterprises expect to keep at least part of the context layer outside any single provider.
The gap between what enterprises run and what they say they want is the strategic question of the category. They are adopting bundled retrieval because it arrives with tools they already buy, while asserting they will preserve independence. Read against Finding 2, the stated preference has a rationale beyond vendor politics: the failures enterprises are trying to fix are failures of governed, consistent, access-aware business context, and that is precisely the layer they are least willing to outsource. Whether the preference survives contact with the convenience of the bundle is what the next several waves will decide.
Governance now ties ingestion as the reason a system gets chosen
We asked what matters most when enterprises choose a retrieval system, and what they treat as the primary measure of success once it is running.
The selection criteria have moved toward governance. Access control and permissions (24%) is now exactly tied with ease of data ingestion (24%) at the top, ahead of retrieval accuracy and latency and performance (15% each) and operational simplicity (14%). That puts a governance property at the top of the purchase decision for the first time in this series — and it is the property most directly implicated in the confident-but-wrong failures of Finding 1, where an agent surfaces something it should not have seen or misses something it should have.
Once systems are running, the emphasis on correctness is unambiguous: response correctness is the primary success metric for 38% of enterprises, twice the next answer, security and access control (19%). Answer relevance (17%), latency (13%), and operational stability (11%) trail. Taken together, 56% of enterprises measure their retrieval system primarily on whether its answers are right or properly permissioned, rather than on whether it is fast or stable.
Satisfaction with current systems is moderately positive: on a five-point scale, overall satisfaction averages 4.13, value for money 4.01, and ease of implementation 3.98. That is a respectable set of scores for a layer that, on this wave’s evidence, is producing recurring wrong answers in nearly four in ten enterprises — which suggests enterprises are rating the tools against expectations of what retrieval infrastructure does, not against the outcome of getting the answer right.
Vertex AI Search leads the consideration set — and so does uncertainty
We asked whether enterprises plan to change or add a retrieval provider, and which they are considering. The consideration set is broader than today’s stack.
The retrieval stack is not settled, but it is not churning, either: about half of enterprises have no plans to change, while the other half — 52 of 101 — intend to switch or add a provider within twelve months, a fifth of them within the next quarter. Among those 52 enterprises in motion, Google’s Vertex AI Search leads the consideration set at 35%, followed by Elasticsearch/OpenSearch (25%), Pinecone (23%), and OpenAI’s file search (23%).
Two patterns stand out. First, the pure-play vector specialists draw markedly more forward interest than their current footprint would suggest — Pinecone is considered by 23% of movers against 12% present usage, Weaviate 17% against 10%, Qdrant 15% against 7%, and Milvus 14% against 9%. The specialists are not winning the installed base, but they are firmly in the evaluation, and each of them roughly doubles its footprint in forward consideration. Second, 15% of movers are evaluating with no shortlist at all and 17% are considering a custom in-house stack — together nearly a third of enterprises planning a change either do not know what they want or intend to build it.
Organizations with more than 100 employees are running agents on business context they cannot yet guarantee, and the evidence has moved past anecdote. Sixty-eight percent have traced a confident, wrong agent answer to missing or inconsistent context in the past six months, and the recurring case now outweighs the one-off. Retrieval remains the default source of that context and carries the failure on the widest base in the sample — while nearly one in five enterprises has fallen back to long-context loading or the model’s general knowledge, which is not a context layer at all.
The most important result in this wave is the one that inverts the expected direction. Enterprises building or running a governed semantic layer report recurring context failures at 50%, against 21% for those without one, and larger enterprises report them at nearly twice the rate of mid-market peers despite being less likely to have the layer built. The straightforward reading is that instrumentation reveals failures rather than causing them, and that the organizations reporting clean context records are largely the ones without the means to check. That reframes the entire finding: the 22% reporting no context failure are not the well-governed cohort, and a low failure rate should be treated as a question rather than an answer.
Meanwhile, the fix has not converged. Hybrid retrieval and architectural pluralism finish level as the expectation for production RAG by the end of 2026, one respondent apart; the anti-vector position narrowly edges the pure-vector one; and while provider-native retrieval leads usage by a wide margin — and is the primary system for most of the enterprises that run it — only 12% will consolidate onto a provider’s stack, with 79% keeping some part of the layer independent. The commercial signal is that access control has climbed to tie ease of ingestion as the top buying criterion, and response correctness is the dominant success metric — enterprises are starting to buy retrieval for the properties that govern context rather than the ones that move it.
At 101 respondents in a single July wave, skewed toward the mid-market, this is a directional read. But the direction is clear enough to act on: the context layer is the contested tier of the AI stack, the failure it produces is recurring rather than occasional, and the enterprises best equipped to see the problem are the ones reporting it worst. The open question for later waves is whether the governed context layer starts to reduce the failures it is currently so good at exposing.
Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single July 2026 wave. At this sample size the results should be read as a directional signal rather than a precise measurement — this is a self-selected sample, not a probability sample. Respondents include managers, individual contributors, VPs/directors, and C-suite leaders.
Across 108 enterprises, trust in automated agent evaluation rose sharply in July — and the failure rate it is supposed to predict did not move at all. The share of organizations that fully trust automated evaluation nearly tripled, from 5% in June to 13%, and the complaint that evaluations don’t match real-world outcomes fell 10 points. Yet the same share as last month — just under half — shipped an agent that passed its evals and then failed a customer. The reason is visible in the cross-tabs: the new trust belongs almost entirely to enterprises that have not yet been burned. Among those that have, 4% trust automated evaluation; among those that haven’t, 24% do. And getting burned does not slow the march to autonomy — it speeds it up.
This is the second wave of the VentureBeat Pulse Research agent reliability tracker, and the first fielded on an instrument identical to the month before it. That makes July the first read on direction rather than position: what moved, what held, and what the movement means.
What moved is confidence. In June, only 5% of enterprises said they fully trusted automated evaluation, and the most-cited limitation was that evaluations align poorly with real-world outcomes (29%). In July, 13% fully trust automated evaluation and the alignment complaint has fallen to 19%, no longer the leading objection. Both shifts are large enough to read as real rather than noise.
What held is the failure. Just under half of organizations (49%) deployed an agent or LLM feature in the past year that passed internal evaluations and then caused a customer-facing failure — statistically indistinguishable from June’s 50% — and a quarter (24%) have seen it happen more than once. Confidence improved; correctness did not. That is the July gap: not between autonomy and trust, as in June, but between trust and the evidence for it.
The cross-tabs explain where the new confidence comes from, and it is not from better evaluations. Trust is concentrated almost entirely among enterprises that have not experienced a false-confidence failure: 24% of them fully trust automated evaluation, against 4% of those that have. The trust curve is being lifted by inexperience. Meanwhile the enterprises that have been burned are not retreating from autonomy — 85% of them already allow zero-human deployment or are engineering toward it, against 61% of those that have not been burned. Overall the autonomy trajectory is flat at 67%, but the population inside it has shifted toward the organizations with the most direct evidence that evaluations miss things.
The vendor market, by contrast, is finally showing signs of settling. The share of enterprises running no dedicated evaluation tooling fell from 17% to 12%; specialist platforms gained, with Braintrust nearly doubling to 15% and DeepEval reaching 17%; and switching intent cooled, with those planning no change rising from 36% to 44%. Selection criteria moved with it: ease of integration overtook cost as the top factor, jumping from 27% to 39%. Enterprises are done shopping on price and have started buying on fit.
VentureBeat fielded this survey as part of its ongoing Pulse Research series. This wave — the agentic reliability and evals tracker — examines how technical leaders evaluate agent performance and reliability. Responses are filtered to organizations with 100 or more employees (n=108), drawn from a July 2026 fielding. Because the July instrument is identical to June’s, this report makes month-over-month comparisons where they are warranted; where questions were multiple-select, shares can sum to more than 100%.
Comparisons against June (n=157) are tested for significance, and only a handful of the month’s movements clear a conventional threshold: the rise in full trust in automated evaluation (5% to 13%), the fall in the real-world-alignment complaint (29% to 19%), the jump in ease of integration as a selection factor (27% to 39%), and the gain in Braintrust as a primary platform (8% to 15%). Movements described in this report as flat — the failure rate, the autonomy trajectory, the production monitoring mix, the investment ranking — are statistically indistinguishable between waves, and that stability is itself the finding. Differences of a few points elsewhere should be read as sample variation, not trend.
By role the sample is senior and buyer-credible: 44% are final decision-makers for AI purchases and another 25% recommenders or influencers, a slightly more senior mix than June. Product and program managers (18%), consultants and advisors (12%), CIOs/CTOs/CISOs (11%), and directors of engineering/IT (11%) lead the named titles, alongside a large “Other” function (30%). By organization size the sample is again mid-market-weighted: 100–499 (33%) and 500–2,499 (30%) employees lead, with 2,500–9,999 (23%), 10,000–49,999 (9%), and 50,000+ (5%) above them.
One composition change is worth flagging because it bears on the trust finding. The industry mix shifted between waves: Technology/Software fell from 23% of the June sample to 14% in July, while Retail/Consumer rose from 15% to 19% and now leads. A less technology-weighted sample plausibly carries less hands-on exposure to agent evaluation, and some of the month’s rise in trust may reflect who answered rather than what changed. The burned-versus-unburned split reported in Finding 2 holds within the July sample regardless, but readers should treat the headline trust movement as directional.
At 108 respondents the sample is large enough to support directional conclusions but should not be treated as a precise measurement; it is self-selected and is not a probability sample. Cross-tabs reported here rest on subgroups of 40 to 68 respondents and are correspondingly coarse.
Just under half still ship agents that pass evals and fail customers
We asked whether, in the past 12 months, organizations had deployed an agent or LLM feature that passed their internal evaluations but then caused a customer-facing failure. The answer is the same as last month.
Forty-nine percent of organizations shipped an AI feature that cleared internal evaluations and then failed in front of a customer — an incorrect output, a broken workflow, or a quality incident — against 50% in June. A quarter (24%) have seen it happen more than once, unchanged. Across two waves and 265 enterprises, the rate at which evaluations certify agents that then fail is stable to within a percentage point.
That stability is the anchor for everything that follows. Every other movement this month — rising trust, consolidating tooling, shifting purchase criteria — has to be read against a failure rate that has not responded. Whatever enterprises did between June and July, it did not change how often a passing evaluation turns out to be wrong.
Full trust nearly tripled, and the alignment complaint fell ten points
We asked which limitation most reduces trust in automated agent evaluations today. The distribution shifted materially from June.
Two things moved together: Full trust in automated evaluation nearly tripled, from 5% to 13%, and the objection that most directly describes a false-confidence failure — poor alignment with real-world outcomes — fell from 29% to 19%, surrendering the top spot to evaluation bias and inconsistency (22%), now tied with data-leakage concerns (22%). On the surface this reads as an evaluation layer beginning to earn its keep.
The cross-tab says otherwise. Splitting the sample by whether an organization has actually experienced a false-confidence failure, trust divides almost completely. Among the 53 enterprises that shipped an agent which passed evals and then failed a customer, 4% fully trust automated evaluation. Among the 41 that have had no such failure, 24% do — a six-fold difference, and the sharpest split in the dataset. Direct contact with the failure mode is what removes the trust.
This is the month’s central caution. The improvement in sentiment is not evidence that evaluations got better; the failure rate in Finding 1 rules that out. It is what a trust curve looks like when a cohort of less-burned organizations enters the sample and reports its priors. Enterprises reading their own rising confidence as validation of their evaluation stack are reading a number that measures inexperience.
85% of the burned are on the zero-human path, against 61% of the REST
We asked whether organizations would let an autonomous agent deploy a code or system change to production on automated evaluation results alone, with no human-in-the-loop validation. The aggregate held; the composition did not.
At the top line, nothing changed: 67% of organizations either already allow zero-human-in-the-loop deployment for low-risk agents (37%) or are actively engineering their pipelines to permit it within a year (30%), against 67% in June. The share ruling it out for the foreseeable future slipped from 22% to 18%. The autonomy ceiling stopped rising, but it did not come down.
Underneath, the picture inverts the intuitive one. Among enterprises that have shipped an evaluation-passing agent that then failed a customer, 85% are on the autonomy trajectory. Among those that have not, 61% are. Organizations with direct, expensive evidence that their evaluations miss things are substantially more likely to be removing the human check, not less — and only 11% of them rule out full automation, against 24% of those that haven’t been burned. The pattern is identical for those burned once and those burned repeatedly.
The most plausible mechanism is not recklessness but maturity: the organizations that ship agents at enough volume to hit a customer-facing failure are the same ones with pipelines sophisticated enough to automate, and they are treating the failure as a cost of operating rather than a reason to stop. That is a defensible read. It is also precisely the dynamic that turns Finding 1’s stable failure rate into a growing absolute number of incidents, since the enterprises most likely to fail are the ones scaling their capacity to deploy without review.
One June finding did not replicate. Last month, larger enterprises appeared slightly further down the autonomy path than smaller ones (70% versus 64%). In July the two converge — 65% for organizations with 2,500+ employees against 68% below that, with near-identical failure rates (48% and 50%) — which suggests the June gap was sample variation rather than a size effect. Company size is not what separates the aggressive adopters; experience of failure is.
Specialists gain, and the “Nothing at all” share shrinks
We asked which agent reliability or evaluation platform enterprises primarily use today. The field is still crowded, but it is no longer tied at the top with nothing.
The most consequential number is the one that fell. In June, having no dedicated agent-evaluation tooling was tied for the most common answer at 17%; in July it is 12% and fifth. Enterprises are acquiring evaluation tooling, and the specialists are capturing most of that movement: Braintrust nearly doubled its share of primary usage to 15%, and DeepEval reached 17%. Provider-native tooling held roughly flat — OpenAI at 18%, Anthropic at 12% — meaning the growth came at the expense of running nothing rather than at the expense of the model providers.
Counting any use rather than primary platform, the footprints are wider and the ordering is similar: OpenAI native evals reach 31% of enterprises, DeepEval 27%, Braintrust 22%, Anthropic native evals 20%, custom in-house tooling 14%, and Weave and Langfuse 11% each. Nineteen percent still report using no dedicated tooling anywhere in their stack. The category now has three plausible independent contenders where in June it had none with double-digit primary share — the first evidence in this series of an evaluation layer starting to take shape.
Half monitor whether the agent runs; under a third monitor whether it’s right
Production monitoring for an AI agent can watch two very different things. It can watch whether the system is functioning — is the agent up and responding, did each request complete, how fast, at what cost, with any errors. Or it can watch whether the agent’s output is correct — automated checks that evaluate the content of each answer as it goes out. A confidently wrong answer is invisible to the first kind: the request completes, the response is fast, no error is thrown, and every functioning-metric reads healthy. We asked which kind live production monitoring is built for today.
Grouped by what is actually being watched, the split is essentially June’s: 50% of organizations monitor only whether the agent is functioning, while 26% run automated checks on whether its answers are right. Counting ad-hoc reviewers and don’t-knows, nearly three-quarters of organizations have no automated, real-time evaluation of output correctness in production. Inline quality assertions and transaction trace logging are tied as the most common approach at 26% each on a base of 106 — no single monitoring posture leads.
This is the finding that most directly contradicts the month’s rising confidence. Trust in automated evaluation went up eight points while the runtime capacity to detect an evaluation being wrong went nowhere. Among enterprises that already permit zero-human deployment, only 28% run inline quality checks on production traffic — which means the majority of organizations that have removed the human from the deployment decision have also not replaced that human with anything watching output quality afterward. The gate is automated and the alarm is not installed.
Ease of integration overtakes cost as the top selection factor
We asked what most influenced enterprises’ choice of an evaluation vendor, and what they treat as their primary measure of success. One answer moved sharply; the other did not move at all.
Ease of integration jumped 12 points to 39% and displaced cost as the leading selection criterion, the clearest purchasing shift in the data. Evaluation accuracy rose modestly to 28%, cost fell to 23%, and breadth of observability (6%) and vendor roadmap (2%) remain marginal. Read alongside Finding 4, the two move together: enterprises adopting their first dedicated evaluation tooling are optimizing for what will slot into an existing pipeline this quarter, not for what is cheapest or most capable in the abstract. That is what a market looks like when it stops evaluating and starts installing.
What did not move is what enterprises want from the tool once installed. Evaluation consistency remains the primary success metric at 38%, essentially identical to June’s 36%, well ahead of reduction in failures (20%), speed of experimentation (18%), production visibility (16%), and compliance (7%). The priority is still repeatability — the same verdict on the same behavior every time — which is notable given that bias and inconsistency is now the top-cited trust limitation in Finding 2. Enterprises are buying for integration and measuring for stability, and are not yet getting the second. Satisfaction with current tooling remains moderate, averaging 3.9 on a five-point scale across overall satisfaction, ease of implementation, and value for money, barely changed from June’s 3.8.
And the enterprises that have been burned fund it hardest
We asked which reliability and evaluation investment will grow most over the next year. Human review edged into first place.
Human review workflows (31%) and production observability (30%) swapped positions at the top, a change small enough to be noise on its own — but the underlying pattern is the same one June identified and it has strengthened. Enterprises plan to grow spending on human reviewers faster than on the automated evaluation pipelines (19%) that would replace them, at the same moment two-thirds are engineering the human out of the deployment decision. Only 6% report a flat budget, down from 8%.
The cross-tab makes the hedge explicit. Among enterprises that have shipped an evaluation-passing agent that failed a customer, 38% name human review as their fastest-growing investment; among those that have not, 24% do, and they favor observability tooling instead. So the burned cohort is doing both things at once: it is the most aggressive on autonomy (85% on the zero-human path, per Finding 3) and the most committed to funding human reviewers. That is not a contradiction so much as a strategy — automate the deployment decision, and pay people to catch what the automation misses. Whether that scales is the open question, since human review is the one part of the stack that does not get cheaper as agent volume grows.
Those planning no change rise from a third to nearly half
We asked whether enterprises plan to adopt a new, additional, or replacement evaluation platform, and which they are considering. Fewer are shopping than last month.
A majority (56%) still intend to adopt a new, additional, or replacement platform within twelve months, but that is down from 64%, and the near-term cohort thinned from 31% to 24%. The share standing pat rose from 36% to 44%. Neither movement clears a significance threshold on its own, but both point the same direction, and they point it consistently with Finding 4: as enterprises actually acquire tooling, the population still looking for it shrinks.
The consideration set has reordered, too. Among the 60 enterprises planning a change, OpenAI’s native evals lead what they are evaluating (20%), followed by Braintrust (18%), Weights & Biases Weave (12%), and DeepEval (10%), with a further 10% actively evaluating but holding no shortlist. DeepEval led June’s consideration set at 20%; it has since converted much of that interest into primary usage, which is what a consideration-to-adoption handoff looks like. Braintrust now occupies the position DeepEval held — high interest ahead of installed base — and is the vendor to watch in the next wave.
June found a gap between the autonomy enterprises were granting their agents and the trust they placed in the evaluations meant to govern it. July finds that gap closing from the wrong side. Trust rose — full confidence in automated evaluation nearly tripled and the complaint that evaluations miss reality fell ten points — while the thing that trust is supposed to track held exactly still. Just under half of enterprises still ship agents that pass their evals and then fail a customer, the same as last month.
The cross-tabs locate the new confidence precisely, and it is not in the evaluations. Twenty-four percent of enterprises that have never had a false-confidence failure fully trust automated evaluation; 4% of those that have do. Trust in this market is a function of exposure, not of evidence. And exposure does not produce caution: the burned cohort is the most autonomous in the sample, with 85% already deploying without human review or building toward it. What it produces instead is a hedge — the same organizations fund human review workflows hardest, at 38%, while removing humans from the deployment gate.
The vendor market is the month’s genuinely encouraging story. Running no dedicated tooling fell from 17% to 12%, specialists gained real share for the first time in this series, buyers shifted from price to integration fit, and switching intent cooled as adoption completed. An evaluation layer is finally forming. But the runtime picture has not followed: half of enterprises still monitor only whether their agents are running, and among those that already deploy without human review, just 28% run real-time checks on output quality.
At 108 respondents in a mid-market-weighted, self-selected sample, and with an industry mix that shifted away from technology between waves, this is a directional read. The direction, though, is legible: enterprises are tooling up, buying for fit, and growing more confident — and none of that has yet changed how often a passing evaluation turns out to be wrong. The question this series carried out of June was whether assurance would catch up to autonomy. July’s answer is that confidence caught up first, which is the harder problem, because an enterprise that trusts a broken gate has less reason to fix it than one that knows the gate is broken.
This report presents the July 2026 wave of an ongoing longitudinal series on enterprise AI agent reliability and evaluation, based on 108 qualified respondents at organizations with 100 or more employees. Comparisons are drawn against the June 2026 wave (n=157), fielded on an identical instrument. At this sample size, results should be read as a directional signal rather than a precise measurement — the sample is self-selected, not a probability sample. Respondents span final decision-makers, technology recommenders/influencers, and end business users, across a mid-market-weighted range of industries and company sizes.
Across 116 enterprises, agents are in production and so are the incidents: A majority have already had a confirmed agent security event or a near-miss. Two-thirds of enterprises enforce scoped permissions at runtime. Barely one in five isolates its hig…
Across 170 enterprises, AI infrastructure has moved decisively into production — two-thirds now run AI workloads live and three in 10 run them at scale — while the ability to account for what that infrastructure costs has not kept pace. Enterprises have quietly demoted cost in the buying decision: performance and GPU availability now outrank total cost of ownership, and reliability outranks price as the measure of success. That reordering is rational for teams under production pressure, but it lands on an uncomfortable fact — fewer than half can rigorously track what their AI compute costs, most GPUs still run at half capacity or less, and the next dollar is aimed at specialized clouds that fewer than one in twenty of them actually use.
This wave of VentureBeat Pulse Research examines enterprise AI infrastructure and compute: where organizations are in their deployment journey, what they run AI on today, how they buy and measure it, where the next investment is aimed, and — most revealingly — how well they can see the economics of the compute underneath it all.
This is an operational cohort. Two-thirds of enterprises (66%) have AI workloads running in production, and 29% describe AI in production at scale, with only 4% not yet running AI workloads at all. That maturity shows in the stack: the average enterprise runs three infrastructure platforms, with OpenAI (49%), Google Gemini (48%), Microsoft Azure (47%), and Google Cloud (42%) all present in roughly half of them. Asked to name one primary platform, Azure leads at 26%.
The most consequential shift is in how enterprises decide. Integration with the existing cloud and data stack remains the top selection factor at 40%, but performance — latency and throughput — has climbed to second at 35%, and access to GPU availability to third at 24%, both ahead of total cost of ownership at 22%. The same ordering governs measurement: uptime and reliability is the primary success metric for 51% of enterprises and developer productivity for 39%, ahead of cost per million tokens at 31%. Enterprises under production pressure are buying and measuring for speed and availability, and have moved cost down the list.
That would be unremarkable if the economics were under control, but they’re not. Among the 155 enterprises that operate their own GPUs, 69% report utilization of 50% or less and only 23% clear the halfway mark; 12% do not measure utilization at all. Fewer than half (47%) rigorously track what their AI compute costs and returns, and even among enterprises running AI in production at scale that figure only reaches 56%. Value for money is the weakest of three satisfaction scores at 3.87, against 4.14 for overall satisfaction — the softness landing precisely on the dimension hardest to judge without measurement.
The next round of spending points away from the current stack. AI-specialized clouds are the top planned evaluation area at 44% and carry the strongest net momentum of any infrastructure approach (+36), yet CoreWeave and Lambda each registers at 3.5% of current usage and the rest of the neocloud field sits below 3%. Non-Nvidia accelerators draw 39%. And 62% of enterprises intend to switch or add a provider within 12 months — though the consideration set is dominated by the same incumbents they already run.
VentureBeat fielded this survey as part of its ongoing Pulse Research series, this one focused on enterprise AI infrastructure, compute, and inference economics. Responses are filtered to organizations with more than 100 employees (n=170; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single July 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends; all figures are drawn from the July fielding only. Several questions were multiple-select, so those shares can sum to more than 100%.
By organization size this wave reaches further up-market than the mid-market skew this series usually carries: 251–1,000 employees (28%) and 1,001–5,000 (25%) lead, with 10,001+ (19%), 101–250 (15%), and 5,001–10,000 (12%) filling out the rest — meaning 57% of respondents sit above 1,000 employees. By role it spans managers (48%), individual contributors (27%), the C-suite (12%), and VPs and directors (9%); on purchasing authority it is buyer-credible, with 39% final decision-makers and another 43% recommenders or influencers for AI solutions. Technology/Software is the largest industry at 35%, followed by Manufacturing (14%), Financial Services (12%), and Healthcare/Life Sciences (9%).
At 170 respondents the sample is large enough to read directionally with reasonable confidence, but it should still be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively building and operating AI infrastructure rather than from the largest hyperscale operators.
Three in 10 now run AI in production at scale
We asked where organizations sit in their AI deployment journey. This cohort has largely moved beyond experimentation.
Two-thirds of enterprises (66%) have AI workloads running in production, and 29% describe AI in production at scale. Only 30% remain in proofs of concept and just 4% have not started. This is a materially more operational sample than this series has typically drawn, consistent with its up-market composition — 57% of respondents sit above 1,000 employees.
That maturity is the frame for everything that follows. The infrastructure decisions in this report are being made largely by organizations with production workloads and real bills, not by teams still sizing a pilot. It explains the reordering of buying criteria in Finding 5, where performance and availability displace cost — the priorities of teams running live systems. It also raises the stakes on Findings 6 and 7: an enterprise that cannot measure utilization or cost during experimentation has a planning problem, while one that cannot measure them in production at scale has an operating one.
The specialized GPU clouds still barely register
We asked which providers and platforms enterprises currently use to run their AI, and which one they treat as primary. The answer remains the incumbents — several of them at once.
The current stack is hyperscaler-and-API, and it is plural: enterprises name three platforms on average. The general-purpose clouds and the major model APIs account for essentially all current deployment, with four platforms — OpenAI, Gemini, Azure, and Google Cloud — each presents in more than four of every 10 enterprises. Asked to pick one primary platform, Microsoft Azure leads at 26%, with Google Cloud second at 19%; the model providers together take 35% of primary status when OpenAI (14%), Gemini (14%), and Anthropic (8%) are combined.
The specialized “neocloud” GPU providers that dominate AI-infrastructure headlines remain marginal in practice. CoreWeave and Lambda each appear in 3.5% of stacks, Baseten in 3%, and Crusoe, Nebius, Fireworks, Together, and Anyscale each at or below 2%. Combined, they are named as the primary platform by 1% of enterprises. Meanwhile 13% run a custom open-source self-managed stack and 9% operate their own GPU clusters — both larger footprints than the entire specialized-cloud category. That contrast is what makes the evaluation intentions in Finding 3 worth reading closely.
A note on reading these shares: As described in the methodology section, this sample is self-selected and this question counted every provider a respondent uses — an average of 3.0 selections each — so the figures measure presence in the stack rather than spending or primary status. The separate primary-platform question is the better guide to where the center of gravity sits. A sample built this way will show a different provider mix than a spend-weighted census of the broader market; read these shares as a portrait of what this AI-active cohort runs today, and treat gaps against industry-wide market share estimates as a property of the sample rather than a contradiction of either.
AI-specialized clouds top the evaluations list and carry the strongest momentum
We asked where enterprises plan to evaluate AI infrastructure over the next 12 months, and whether they expect to do more or less with each category of infrastructure. Both answers point away from the stack they run today.
Here is the report’s sharpest tension, and it is the same one this series has now recorded across successive waves. The single most-cited planned evaluation area — AI-specialized clouds, at 44% — is the category that 3.5% of these enterprises actually use (Finding 2). Nearly four in 10 (39%) intend to evaluate non-Nvidia accelerators, a quarter next-generation Nvidia silicon, and even decentralized compute networks draw 18%.
The direction-of-travel question corroborates it rather than merely repeating it. Asked whether they expect to do more, less, or about the same with each approach, enterprises put specialized AI clouds at the highest net momentum (+36, with 42% doing more against 6% doing less), ahead of inference APIs (+34) and hyperscalers (+30). On-prem and co-located infrastructure is the laggard at +5, the only category where a substantial share — 22% — report pulling back. Every off-premises approach is net-expanding; the specialized clouds are expanding fastest from the smallest base.
Read against current usage, this is not incremental adjustment. It is the leading edge of a re-platforming that enterprises have been signaling for several waves and have not yet executed. The gap between a 44% evaluation rate and a 3.5% usage rate is the single widest intent-to-action spread in this dataset, and how it resolves — whether the neoclouds convert evaluation into deployment, or whether the hyperscalers absorb the demand with their own AI infrastructure — is the open question of the category.
High churn intent, but the consideration set is the stack they already run
We asked whether and when enterprises plan to switch or add an infrastructure provider, and which providers they are considering.
For a category as foundational as compute, this is a substantial amount of intended movement: 62% of enterprises intend to switch or add a provider within 12 months, and 29% within the next quarter alone. Only 39% plan to stand still.
Where that interest points is the more useful signal. The providers drawing the most switching consideration are the ones enterprises already run — OpenAI and Google Cloud (29% each), Microsoft Azure (28%), Gemini (25%), Anthropic (16%), Oracle Cloud (14%), and AWS (13%). The specialized clouds that top the evaluation list in Finding 3 draw far less concrete switching consideration: CoreWeave 4%, Lambda 3.5%, and the remainder at or below 2%. A further 8% are evaluating with no shortlist yet.
The two findings are not in conflict; they operate on different clocks. The neocloud interest in Finding 3 is a 12-month evaluation thesis about where AI compute should eventually run. The switching in the next quarter is mostly incumbents trading share and enterprises consolidating spend among providers they already hold contracts with. Vendors reading the 44% evaluation figure as near-term pipeline should weigh it against a 4% consideration rate.
Total cost of ownership falls below latency and GPU availability
We asked what matters most when enterprises select an AI infrastructure provider, and what they treat as the primary measure of success once it is running. Both answers have moved away from price.
Integration with the existing stack remains the top selection factor at 40%, which is consistent with a cohort running three platforms and unwilling to add a fourth that does not fit. What has changed is everything below it. Performance sits second at 35% and GPU access and availability third at 24%, both ahead of total cost of ownership at 22%. Fine-grained autoscaling draws 18% and cost per million tokens 16% — no longer the outlier it once was in this series, but still last.
Measurement follows the same logic. Uptime and reliability is the primary success metric for 51% of enterprises, well ahead of developer productivity and deployment speed (39%), cost per million tokens (31%), latency (27%), and throughput (25%). Taken together, the operational metrics dominate the economic one by a wide margin.
This is a coherent posture for the production cohort in Finding 1 — teams running live workloads care first about whether the system stays up and how fast they can ship on it. But it sits uneasily beside Finding 7. Total cost of ownership has been demoted to fourth as a buying criterion at exactly the moment when 53% of enterprises still cannot rigorously track what their compute costs. The uncomfortable reading is that cost has fallen down the list partly because it remains the hardest thing in the stack to see, and criteria that cannot be measured tend to lose to criteria that can.
Roughly seven in 10 GPU operators report 50% utilization or less
We asked what share of their GPU capacity enterprises actually utilize. Figures here are reported on the 155 enterprises that operate their own GPUs; 15 consume exclusively via API and run none.
The compute already in place runs cold, though less so than this series has recorded before. Roughly seven in ten GPU-operating enterprises (69%) report utilization at or below half capacity, with the 26–50% band alone accounting for 46%. About a quarter (26%) run at 25% or below. Against that, 23% now clear the 50% mark — a meaningful efficient minority rather than a rounding error.
The remaining 12% who do not measure utilization at all are the more troubling number, because they are invisible in both directions: they cannot claim efficiency and cannot detect waste. And utilization does not improve with maturity in the way one might expect — among enterprises running AI in production at scale, 22% clear the 50% mark, statistically indistinguishable from the 24% among everyone else. Scale is not, by itself, producing better-utilized fleets.
Idle accelerators are expensive accelerators, and this remains the clearest single measure of the gap in this report: enterprises are planning to evaluate specialized clouds and next-generation silicon (Finding 3) while the capacity they already own sits substantially unused. The efficiency headroom in the current fleet is large, and for one in eight enterprises, entirely unmeasured.
Rigorous cost tracking reaches only 56%, even among at-scale operators
We asked whether enterprises can quantify the cost and return of their AI infrastructure spend, and how satisfied they are with what they run. Confidence in the ledger still lags the spending.
Measurement trails money. Fewer than half of enterprises (47%) rigorously track the cost and return of their AI compute; the majority track only partially (39%), cannot quantify it yet (15%), or have not prioritized it (6%). Maturity helps but does not solve it: among enterprises running AI in production at scale, rigorous tracking reaches 56%, against 43% for everyone else. Even in the most operationally advanced segment of this sample, more than four in ten cannot account precisely for what their AI compute costs or returns.
Satisfaction with current infrastructure is moderately positive and tellingly uneven. On a five-point scale, overall satisfaction averages 4.14 and ease of implementation 4.04, while value for money trails at 3.87 — the softness landing on the one dimension that requires measurement to assess. Enterprises are, in effect, expressing dissatisfaction with an economic relationship most of them cannot yet quantify.
Read with Finding 5, the picture is self-reinforcing rather than merely inconsistent. Cost has slipped to fourth among buying criteria while remaining the least visible property of the stack, and the least visible property is the one enterprises rate lowest. Better instrumentation would not necessarily change what enterprises buy — but it would let them know whether the trade they are making for performance and availability is a good one.
Dell and Nvidia lead a scattered field, and one in five has no view
We asked how enterprises would address the emerging constraint in large-scale inference — the shift from GPU compute to memory, specifically KV-cache capacity. The field remains early and fragmented.
The memory frontier is real but barely governed. Dell leads at 24% and Nvidia follows at 21%, with the remainder scattering across open-source tooling (12%), model-level efficiency techniques such as MLA and quantization (11%), and a long tail of storage vendors each in low single digits. No approach commands anything close to a majority, and the two leaders together account for less than half the field.
Most telling is that roughly one in five enterprises (19%) either do not recognize the constraint (7%) or have not begun to address it (12%). For a shift that will reshape inference cost and architecture, this is an early and unsettled market. It is also consistent with the measurement gap in Finding 7 — enterprises that cannot yet quantify what their current compute costs are in a poor position to anticipate which constraint will drive that cost next. The memory bottleneck is arriving while most of this cohort is still working to see the one in front of it.
Organizations with more than 100 employees have moved AI infrastructure into production — two-thirds run live workloads, three in ten at scale — and their buying behavior has matured accordingly. They run three platforms on average, select on integration and performance, and measure success on uptime and developer velocity. For teams operating live systems, that is the right set of priorities.
What has not matured is the accounting. Total cost of ownership has fallen to fourth among selection criteria and cost per million tokens sits last, at the same moment that 53% of enterprises cannot rigorously track what their compute costs, 69% of GPU operators run at half capacity or less, and 12% do not measure utilization at all. Value for money is the lowest-rated attribute of the infrastructure they run — a judgment most of them are making without the instrumentation to support it. Cost has not become unimportant; it has become invisible, and the buying criteria have quietly reorganized around what can actually be seen.
Meanwhile the next round of spending points past the current stack. Specialized AI clouds are the top evaluation target at 44% and carry the strongest net momentum of any approach, against a 3.5% usage rate and a 4% near-term switching consideration — the widest intent-to-action spread in the data. Non-Nvidia accelerators draw 39%. And the constraint after this one, the shift from compute to memory in large-scale inference, is unrecognized or unaddressed by one enterprise in five.
At 170 respondents in a single July wave, reaching further up-market than this series typically does, this is a directional read — but the direction is consistent. Enterprises have become good operators of AI infrastructure and have not yet become good accountants of it. The open question for later waves is whether the instrumentation catches up before the re-platforming arrives, or whether enterprises buy the next layer of compute as blind to its economics as the last.
Based on survey responses from 170 qualified enterprise respondents (100+ employees), drawn from a single July 2026 wave. This sample is self-selected and directional rather than a precise measurement, and reads cross-sectionally with no month-over-month trend claims. Respondents include managers, individual contributors, C-suite, and VPs/directors, with purchasing authority weighted toward decision-makers and recommenders, across technology, manufacturing, financial services, healthcare, and other industries. Note: Figures for the switching-timeline, GPU-utilization, and cost-tracking questions are reported as a percentage of unique respondents rather than selections; individual categories for these three questions may sum to more than the reported total.
Across 107 enterprises, AI agents are being given real access to systems and data while the controls meant to contain them lag behind. More than half have already had a confirmed agent security incident or a near-miss; only about a third give every agent its own scoped identity, and most agents still share credentials; and only three in ten isolate their highest-risk agents. The security stack is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents, spending remains a thin slice of the security budget, and enterprises are evenly split on whether their defenses are keeping pace with AI-enabled attackers. The result is an agent security gap — autonomous agents proliferating faster than the identity, isolation, and enforcement controls needed to hold them.
This wave of VentureBeat Pulse Research examines how enterprises secure their AI agents: what tooling they run, how they manage agent identity and isolation, what has already gone wrong, how much they spend, and whether they believe their defenses are keeping pace with AI-enabled attackers.
The central finding is an agent security gap — the distance between the autonomy enterprises are granting their agents and the controls in place to contain them. More than half of organizations (54%) have already experienced a confirmed agent security incident (18%) or a near-miss caught before harm (36%). The structural weakness beneath those numbers is identity: only about a third (32%) give every agent its own scoped, managed identity, while the rest report that some agents share credentials or that agents mostly run on shared API keys and human or service-account credentials. When agents share credentials, a single compromised or over-permissioned agent carries a wide blast radius — and only three in ten enterprises (30%) isolate their highest-risk agents in sandboxes to bound that radius.
What makes the gap notable is how comfortable enterprises are inside it. The security stack is overwhelmingly provider-native — OpenAI’s guardrails (51%), Google’s and Microsoft’s cloud controls, and Anthropic’s managed-agent controls dominate, while the dedicated agent-security specialists barely register — and satisfaction with that borrowed stack is high, averaging 4.2 out of 5. Yet spending remains a thin slice of the security budget, only a third of enterprises believe their AI defenses are ahead of AI-enabled attackers, and a clear majority plan to change tooling within the year. Enterprises are satisfied with controls they are simultaneously preparing to replace.
VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent security — the tooling, identity, isolation, and enforcement controls organizations use to secure autonomous AI agents. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.
By role the sample is senior and buyer-credible: 45% are final decision-makers for AI purchases and another 30% recommenders or influencers. Managers (43%), individual contributors (24%), VPs and directors (15%), and the C-suite (11%) make up the seniority mix. By organization size the sample is mid-market-weighted: 251–1,000 (42%) and 101–250 (25%) employees lead, with 1,001–5,000 (19%), 5,001–10,000 (8%), and 10,001+ (7%) above them. Technology/Software is the largest industry at 23%, followed by Manufacturing (15%), Retail/E-commerce (14%), and Healthcare/Life Sciences (13%).
At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It skews toward the mid-market, so it is best read as the view from organizations actively standing up agent security rather than from the largest operators.
Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 82 of the 107 qualified respondents.
More than half have had an agent security incident or near-miss
We asked whether organizations had experienced an agent security incident — a confirmed breach, or a near-miss caught before harm. Most that run agents in production had.
This is the report’s defining number. More than half of organizations (54%) have already had an agent security event — 18% a confirmed incident and 36% a near-miss caught before it caused harm. Only 42% report nothing, and a small remainder either run no agents in production or don’t track such events. That so many report near-misses rather than only confirmed incidents is telling: enterprises are catching problems, but they are catching them close to the edge. The controls examined in the rest of this report — identity, isolation, enforcement — are what determine whether the next near-miss stays a near-miss.
Exposure scales with company size, but containment does not. The incident-or-near-miss rate rises from 49% in the mid-market (companies with 101-1,000 employees) to 63% at larger enterprises (above 1,000 employees), while sandbox isolation of high-risk agents falls from 35% to 20%, and satisfaction with security tooling drops from 4.36 to 3.97. The organizations running the most agents across the most systems carry the most incidents and the least of the one control that bounds an incident’s blast radius.
Only a third give every agent its own scoped identity
We asked how enterprises manage the identity of their AI agents — whether each agent has its own credentials, or agents share them. Full per-agent identity is the exception.
Rolled together, the overlapping answers show 69% of enterprises (74 of 107) with credential sharing somewhere in the agent fleet. Identity is the structural weakness beneath the incidents. Only about a third of enterprises (32%) give every agent its own scoped, managed identity — the precondition for least-privilege access and clean attribution. Nearly half (48%) say some agents have scoped identities but many still share credentials, and another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. (Respondents could describe more than one pattern across their agent fleet, so these overlap.)
The consequence is direct: when agents share credentials, an over-permissioned or compromised agent can act with far more reach than intended, and forensics after an incident cannot cleanly tell which agent did what. The non-human identity problem — giving every agent its own governed identity — is the single largest unfinished piece of enterprise agent security.
Moreover, a company’s agent credential posture is correlated with incidents. Organizations with credential sharing anywhere in the fleet were hit — with an incident or a near-miss in the past twelve months — at 63.5% (47 of 74). Organizations where every agent carries its own scoped identity were hit at 40.9% (9 of 22). The fully-scoped group is small, so for now the relationship is an association rather than proven causation, and the gap is concentrated in the mid-market — but within a single survey, a twenty-three point difference in incident rate suggests significance.
Only three in 10 sandbox their highest-risk agents
We asked what an organization’s agent security posture looks like in practice — whether they observe, enforce, isolate, or some combination. The control that bounds damage is the least common.
Monitoring and enforcement are reasonably common; containment is not. Roughly half of enterprises observe agent activity (47%) or enforce scoped permissions at runtime (49%), but only 30% isolate their highest-risk agents in sandboxes that bound the blast radius when the other controls fail. That ordering is backwards from a defense-in-depth standpoint: observation tells you what happened, enforcement tries to prevent it, but isolation is what limits the damage when prevention fails — and it is the control enterprises have adopted least. Combined with the identity gap in Finding 2, the picture is of agents that are watched and permissioned but rarely boxed in, which is precisely the configuration in which a single failure propagates.
Guardrails from OpenAI, Google and Microsoft dominate; specialists barely register
We asked which agent security tooling enterprises use, and which is their primary layer. The answer favors the model providers and hyperscalers over the dedicated security vendors.
Enterprises are securing agents with tools that came bundled with their models and clouds. OpenAI’s guardrails lead at 51%, followed by Google’s and Microsoft’s cloud-native controls and Anthropic’s managed-agent controls — and when asked to name their single primary security layer, 82% name one of these provider-native offerings. The purpose-built agent-security category — Palo Alto’s Prisma AIRS, CrowdStrike, Cisco AI Defense, Zenity, HiddenLayer, Check Point’s Lakera, Okta for AI Agents, non-human identity platforms — barely registers, each in the low single digits, and only 5% run no dedicated tooling at all. As with retrieval and evaluation elsewhere in this series, the provider bundle is winning the default: enterprises reach first for the guardrails their platform ships, and the independent security layer that would address the identity and isolation gaps has not yet been adopted at scale.
The provider-default pattern is consistent across both Q2 survey waves. In April–May (n=110), usage was led by the same names — OpenAI’s controls at 26%, Azure at 15%, AWS at 14%, Google at 12% — with every dedicated agent-security specialist at 3% or below and one in ten using no dedicated tooling at all. The common finding from the two surveys: Enterprises are defaulting to the solutions provided by the platform they’re using, and the specialist category vendors have yet to become big players here.
(A note on reading these shares. As described in the methodology section, the respondent sample is self-selected and skews mid-market, and the usage question counted every vendor or approach a respondent has in place — so the figures measure presence in the security stack rather than spending or exclusivity. Individual vendor percentages therefore carry all the usual sample caveats. The structural pattern, however, held across both Q2 waves on two differently worded questions: provider-native and hyperscaler controls lead, and dedicated agent-security specialists remain in low single digits. Read the individual shares loosely and the pattern with confidence.)
Satisfaction is high, even as incidents mount and identity lags
We asked how satisfied enterprises are with their current agent security tooling. The comfort is notably out of step with the exposure documented above.
Satisfaction with agent security tooling is high — 4.2 out of 5 overall, and 4.1 for value for money — among the most positive readings in this series. That is the striking part: enterprises are highly satisfied with a stack that is mostly borrowed provider guardrails, even though more than half have already had an incident or near-miss and only a third give their agents scoped identities. The comfort appears to rest on the convenience and low friction of provider-native controls rather than on demonstrated containment. It is a false comfort in the making — the same enterprises expressing satisfaction are, as Finding 8 shows, a clear majority planning to change tooling within the year, which suggests the confidence is thinner than the score implies.
Most spend under a tenth of the security budget on agents
We asked what share of the security budget enterprises allocate to securing AI agents. For a fast-emerging risk, the allocation is modest.
Spending on agent security is still a thin slice. The most common allocation is 6–10% of the security budget (46%), and a third of enterprises (34%) spend 5% or less; only a quarter (24%) devote more than a tenth. Given the incident rate in Finding 1 and the identity and isolation gaps in Findings 2 and 3, the budget looks like a lagging indicator — the risk has arrived faster than the funding to address it. The enterprises spending more than a tenth of their security budget on agents are a distinct minority, and they are likely the ones building the scoped-identity and isolation controls the rest have not.
Only a third think their AI defenses are ahead of AI-enabled attackers
We asked how enterprises assess the balance between their AI-enabled defenses and AI-enabled attackers. Confidence is far from settled.
Enterprises are split on whether they are winning. Only about a third (35%) believe their AI-enabled defenses are ahead of AI-enabled attackers; the rest are less sure — 32% call it roughly even, 21% think attackers are ahead, and another 21% say it is too early to tell. Taken together, a clear majority (53%) rate the balance as even or tilted toward the attacker. That uncertainty sits uneasily beside the high satisfaction of Finding 5: enterprises are content with their tooling yet unconvinced it is winning the contest it exists to win. In a domain where the offense is also compounding with AI, an even race is not a comfortable place to be.
Nearly six in 10 plan to adopt or switch tooling within a year
We asked whether enterprises plan to adopt a new, additional, or replacement agent security solution, and which they are considering. Few intend to stand pat.
The security stack is not settled. While 41% have no plans to change, a clear majority (59%) intend to adopt a new, additional, or replacement agent security solution within twelve months, and 29% within the next quarter — a strong signal that, high satisfaction notwithstanding, enterprises know the current stack is provisional. Incidents are what start the buying cycle.
Among organizations that have been hit, 42.1% plan to adopt, add, or replace agent security tooling within the next ninety days, against 14.0% of organizations with no incident — and after a confirmed incident it becomes majority behavior, at 52.6%. Getting hit also changes the threat assessment: 33.3% of hit organizations say AI-armed attackers are ahead of their defenses, against 8.0% of the unhit. Experience, in this data, is the strongest predictor of both urgency and pessimism.
The consideration set still leans provider-native (OpenAI 34%, Google 30%, Anthropic 29%, Azure 25%), but the dedicated security vendors — Cloudflare, Cisco, Palo Alto, Okta, Check Point’s Lakera — draw early interest in the mid-to-high single digits, more than their current footprint.
What the shopping does not yet include is the identity layer specifically. Twelve percent of the respondents include an agent-identity product — Okta for AI Agents, Microsoft Entra Agent ID, or a non-human identity platform — anywhere in their consideration set, and among the credential-sharing organizations that have already had an incident, identity consideration is essentially unchanged, at roughly one in ten. The control most directly implicated by the incident data is the one largely missing from the purchase plans. Whether this wave hardens the provider-native default or finally opens the door to purpose-built agent security — the identity and isolation controls the incidents call for — is the question this series will keep tracking.
Organizations with more than 100 employees are giving AI agents real reach into systems and data while securing them with controls built for something else. More than half have already had an incident or near-miss; only a third give every agent its own scoped identity, and most still share credentials; only three in ten isolate their highest-risk agents; and the stack doing this work is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents.
The uncomfortable pairing is confidence with exposure: satisfaction with the current tooling is among the highest in this series, yet spending is a thin slice of the security budget, only a third believe their defenses are ahead of AI-enabled attackers, and a clear majority are already planning to replace what they have. At 107 respondents in a single wave this is a directional read, skewed toward the mid-market — but the direction is clear: agent adoption is running ahead of agent security, and the controls that matter most when something fails — scoped identity and isolation — are the ones enterprises have built least. The agent security gap is not a coverage problem that a provider guardrail will close on its own; it is a problem of identity, isolation, and enforcement built for autonomous software. The open question for later waves is whether enterprises close it deliberately — or whether a confirmed incident closes it for them.
Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. This is a directional read, not a precise measurement — the sample is self-selected and skews mid-market, so it’s best read as the view from organizations actively standing up agent security rather than from the largest operators. Respondents are senior and buyer-credible (45% final decision-makers, 30% recommenders/influencers), spanning managers through the C-suite, and drawn primarily from Technology/Software, Manufacturing, Retail/E-commerce, and Healthcare/Life Sciences.
Across 107 enterprises, AI infrastructure spending is accelerating well ahead of the ability to see or steer its economics. Most organizations run their AI on a familiar base of hyperscalers and model-provider APIs, yet the next dollar is aimed at specialized compute almost none of them use today; a majority intend to switch or add providers within the year, many within a quarter. Buying decisions turn on integration and total cost of ownership rather than headline token price — which is fortunate, because most enterprises cannot yet see their unit economics clearly: GPUs sit at half utilization or less, and fewer than half rigorously track what their compute actually costs. The result is a compute gap — heavy, fast-moving investment running ahead of the visibility needed to control it.
This wave of VentureBeat Pulse Research examines enterprise AI infrastructure and compute: where organizations are in their deployment journey, what they run AI on today, how satisfied they are, what would make them switch, where they plan to evaluate their investments, and — most revealingly — how well they can measure and control the economics of the compute underneath it all.
The central finding is a compute gap — the distance between how aggressively enterprises are investing in AI infrastructure and how little of its economics they can see. Only about one in five (21%) run AI in production at scale, yet spending intentions are outrunning that maturity: the single largest planned area enterprises plan to evaluate over the next year is AI-specialized clouds (45%), a layer almost none of these enterprises use today. Meanwhile the compute already in place runs cold — 83% report GPU utilization of 50% or less — and fewer than half (44%) can rigorously track what their AI compute costs. Enterprises are buying more infrastructure faster than they can account for what they already own.
Enterprises are not settled on their infrastructure vendors, either: A clear majority (64%) plan to switch or add an infrastructure provider within twelve months, and 38% within the next quarter — unusually high churn intent for a category this foundational. When they choose, they choose on integration with the existing stack (41%) and total cost of ownership (35%), not on headline price: cost per million tokens is the deciding factor for just 8%. And the frontier constraint that will shape the next round of decisions — the shift from GPU compute to memory bandwidth as inference scales — is barely on the radar, with roughly one in five enterprises either unaware of it or yet to address it.
VentureBeat fielded this survey as part of its ongoing Pulse Research series, this survey focused on enterprise AI infrastructure, compute, and inference economics. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.
By organization size the sample concentrates in the mid-market: 101–250 employees (36%) and 251–1,000 (27%) lead, with 1,001–5,000 (22%), 5,001–10,000 (8%), and 10,001+ (7%) above them. By role it spans managers (38%), individual contributors (28%), VPs and directors (19%), and the C-suite (13%); on purchasing authority it is buyer-credible, with 45% final decision-makers and another 30% recommenders or influencers for AI solutions. Technology/Software is the largest industry at 26%, followed by Healthcare/Life Sciences (15%), Financial Services (13%), and Retail/E-commerce (12%).
At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It also skews toward the mid-market and toward earlier-stage adopters, so it is best read as the view from organizations actively building out AI infrastructure rather than from the largest hyperscale operators.
Only one in five run AI in production at scale
We asked where organizations sit in their AI deployment journey. Most are still building toward production rather than operating at scale.
The maturity curve is front-loaded. Three-quarters of enterprises (76%) are either experimenting or running only some workloads in production, and just 21% describe AI in production at scale. This matters for everything that follows: the infrastructure decisions in this report are being made largely by organizations still early in deployment, whose compute footprint — and whose costs — are about to grow. The evaluation and switching intentions in Findings 3 and 4 are the leading edge of that build-out, not the settled preferences of operators who have already found what works.
The specialized GPU clouds barely register — today
We asked which providers and platforms enterprises currently use to run their AI. The answer is a familiar one: the incumbents.
The current stack is hyperscaler-and-API. Google Cloud leads at 48%, and the general-purpose clouds (Google, Microsoft, AWS, Oracle) together with the major model APIs (Gemini, OpenAI, Anthropic) account for essentially all current deployment. The specialized “neocloud” GPU providers that dominate AI-infrastructure headlines — CoreWeave, Lambda, Crusoe, Nebius and peers — register at or near zero among these enterprises today. Only 6% run their own on-prem GPU clusters and 4% a custom open-source stack. Enterprises are, for now, running AI on the providers they already buy from — which makes the evaluation intentions in Finding 3 all the more striking.
(A note on reading these shares. As described in the methodology section, this sample is self-selected and skews mid-market, and this question counted every provider a respondent uses — an average of 2.1 selections each — so the figures measure presence in the stack rather than spending or primary status. A sample built this way will show a different provider mix than a spend-weighted census of the broader market; Google’s strength here, for example, is consistent with its long-standing position among smaller enterprises building on AI. Read these shares as a portrait of what this AI-active cohort runs today, and treat gaps between these figures and industry-wide market share estimates as a property of the sample rather than a contradiction of either.)
AI-specialized clouds top the evaluations list
We asked where enterprises planned to evaluate AI infrastructure over the next 12 months. Their answers point away from the stack they run today.
Here is the report’s sharpest tension. The single most-cited planned evaluation area — AI-specialized clouds, at 45% — is the very category almost none of these enterprises use today (Finding 2). Nearly a third (32%) intend to evaluate non-Nvidia accelerators, and 28% in next-generation Nvidia silicon; even decentralized compute networks (16%) and sovereign compute (11%) draw meaningful interest. Read against current usage, this is not incremental — it is the leading edge of a re-platforming. The direction-of-travel question tells the same story: every infrastructure approach is net-expanding, but specialized AI clouds carry the highest net momentum (+24), edging out even the hyperscalers (+22). Enterprises are preparing to move a meaningful share of AI compute off the general-purpose cloud.
This continues a trend we saw in our April-May survey wave. Back then, usage of the AI-specialized clouds was equally marginal — CoreWeave at 3%, Lambda at 4%, Crusoe at 2% of enterprises. When we asked enterprises what change they planned in their AI infrastructure strategy over the next twelve months, the most-cited answer was moving workloads to specialized AI clouds, at 33%. Asked in April-May which emerging compute option they were most likely to evaluate AI-specialized clouds again drew the most responses. Two waves, two differently worded questions, one consistent picture: the type of cloud enterprises are most eager to assess is the type they have barely begun to use.
Six in 10 plan to change providers within a year — many within a quarter
We asked whether and when enterprises plan to switch or add an infrastructure provider. Very few intend to stand still.
For a category as foundational as compute, this is a remarkable amount of intended movement. Only 36% have no plans to change, meaning a clear majority (64%) intend to switch or add a provider within twelve months — and 38% within the next quarter alone. Where that interest points is telling: the providers drawing the most switching consideration are again the incumbents — Microsoft Azure and Google Cloud (33% each), OpenAI (30%), and Gemini (22%) — which suggests much of the near-term movement is reshuffling among the majors and consolidating spend rather than defecting to new entrants. The neocloud interest in Finding 3 is a 12-month evaluation thesis; the switching in the next quarter is mostly incumbents trading share.
(Method note: Respondents who selected both “no plans to change” and a specific switching window are counted as switchers, on the logic that naming a timeframe is the more specific answer; three respondents were reclassified under this rule.)
Integration and total cost of ownership decide — not sticker price
We asked what matters most when enterprises select an AI infrastructure provider. Headline price finished last.
Enterprises do not buy AI infrastructure on pricing, which is the place vendors compete on hardest. Integration with the existing stack (41%) and total cost of ownership (35%) dominate, while the headline metric — cost per million tokens — is the deciding factor for just 8%, dead last. The pattern is coherent: buyers are optimizing for how a provider fits and what it truly costs to operate, not for the advertised unit rate. It also foreshadows Finding 7 — enterprises say TCO matters most, yet most cannot yet measure it rigorously. The stated priority and the measured capability are out of step.
83% report GPU utilization of 50% or less
We asked what share of their GPU capacity enterprises actually utilize. The answer is a well-known but rarely quantified inefficiency.
Disclosure: Band percentages count every selection against all 107 qualified respondents; 14 respondents selected more than one band, so bands overlap. At the respondent level, 83 of the 100 GPU-operating enterprises reported utilization at or below 50%
The compute already in place runs cold. Adding the bands at or below half capacity, 83% of enterprises that operate GPUs report utilization of 50% or less, and nearly half (49%) run at 25% or below. Only 12% clear the 50% mark, and a further 8% do not measure utilization at all. Idle accelerators are expensive accelerators, and this is the clearest single measure of the compute gap: enterprises are planning to buy more GPUs and specialized compute (Finding 3) while the capacity they already own sits substantially unused. The efficiency headroom in the current fleet is large — and largely unmeasured.
Fewer than half rigorously track what their compute costs
We asked whether enterprises can quantify the cost and return of their AI infrastructure spend, and how satisfied they are with what they run. Confidence in the ledger lags the spending.
Measurement trails money. Fewer than half of enterprises (44%) rigorously track the cost and return of their AI compute; the majority track only partially (39%), cannot quantify it yet (20%), or have not prioritized it (6%). That gap is consequential given Finding 5, where total cost of ownership was the second-ranked buying criterion — enterprises are choosing providers on an economic basis they mostly cannot yet measure. Satisfaction with current infrastructure is moderately positive but not enthusiastic: on a five-point scale, overall satisfaction averages 4.0, with ease of implementation (3.8) and value for money (3.9) trailing slightly — the softness landing, tellingly, on cost. Enterprises are spending quickly and accounting slowly.
As inference shifts from compute to memory, the field scatters
Finally, we asked how enterprises would address the emerging constraint in large-scale inference — the shift from GPU compute to memory, specifically KV-cache capacity. The responses reveal a frontier that is not yet a priority.
The memory frontier is real but barely governed. Asked which approach they would rely on as the binding constraint in inference shifts from compute to memory bandwidth, enterprises scatter: Dell leads at 31%, Nvidia follows at 16%, and the rest fragments across storage vendors, open-source tooling, and model-level efficiency techniques. Most telling is that roughly one in five (18%) either do not recognize the constraint or have not begun to address it. For a shift that will reshape inference cost and architecture, this is an early and unsettled market — and, consistent with the measurement gap in Finding 7, one where many enterprises simply do not yet have a view. It is the next chapter of the compute gap, arriving before most have closed the current one.
Organizations with more than 100 employees are investing in AI infrastructure faster than they can measure it. Most are still early in deployment, yet their spending intentions point past their current stack — toward specialized clouds and alternative accelerators almost none of them run today — and a clear majority intend to change providers within the year. They buy on integration and total cost of ownership rather than headline price, which is rational; the difficulty is that most cannot yet see those economics clearly.
The visibility gap is concrete. The GPUs enterprises already own run at half utilization or less for the overwhelming majority, and fewer than half can rigorously track what their compute costs or returns. Satisfaction is decent but unenthusiastic, softest on value for money — the dimension hardest to judge without measurement. And the next constraint, the shift from compute to memory in large-scale inference, is arriving while most enterprises are still unaware of it. At 107 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market and earlier-stage adopters — but the direction is consistent: the appetite to spend is running well ahead of the instrumentation to spend well. The compute gap is not a capacity problem that more hardware will solve on its own; it is, first, a problem of seeing what the hardware already costs. The open question for later waves is whether enterprises build that visibility before the re-platforming arrives — or buy the next layer of infrastructure as blind to its economics as the last.
Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the results read cross-sectionally rather than as a month-over-month trend, and at 107 respondents this is a directional signal rather than a precise measurement — the sample is self-selected, skews mid-market, and leans toward earlier-stage adopters rather than the largest hyperscale operators. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with buyer-credible purchasing authority, across Technology/Software, Healthcare/Life Sciences, Financial Services, Retail/E-commerce, and other industries.
Across 101 enterprises, the infrastructure that feeds AI agents their business context is being built faster than it can be trusted. Retrieval-augmented generation is already the default context source, and provider-native retrieval has quietly overtaken the dedicated vector databases that define the category — yet a majority of enterprises have already watched their agents produce confident, wrong answers traced to missing or inconsistent context. A governed semantic layer is emerging as the fix, but most are still building it; the field is converging on hybrid retrieval; and even as provider-native tools lead in practice, a plurality say they intend to keep best-of-breed. The result is a context gap — agents that sound authoritative running on a foundation their owners do not yet fully trust.
This wave of VentureBeat Pulse Research examines the enterprise RAG and context layer: what feeds AI agents their business context, which retrieval systems enterprises run, how they buy and measure them, where the architecture is heading, and — most revealingly — how often that context is already failing them.
The central finding is a context gap — the distance between how confidently enterprise agents answer and how reliable the context beneath them actually is. A majority of enterprises (57%) report that in the past six months their AI agents produced confident but wrong answers they traced to missing or inconsistent business context, and more than half of those said it happened more than once. This is not a fringe failure: retrieval is the primary context source for 38% of enterprises, more than any other approach, so when retrieval is thin or inconsistent, the errors it produces are wearing the agent’s authority. The infrastructure to fix it is being built — 58% already run or are building a governed semantic layer — but for most it is not yet in production.
Underneath, the market is consolidating in a direction that surprises. Provider-native retrieval — OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) — already leads every dedicated vector database, and enterprises expect hybrid retrieval to dominate by the end of 2026 (34%). Yet a plurality (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack, and a majority (57%) plan to switch or add a provider within the year. Stated preference and actual usage are pulling in opposite directions — the market is buying provider-native while insisting it wants independence.
VentureBeat fielded this survey as part of its ongoing Pulse Research series. This survey focused on enterprise RAG infrastructure and the context layer — the retrieval systems, semantic layers, and context sources that feed AI agents. Responses are filtered to organizations with more than 100 employees (n=101); the survey drew no responses from organizations of 100 or fewer, so the full sample qualifies. All responses are from a single Q2 2026 (June) wave, so the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.
By organization size the sample concentrates in the mid-market: 251–1,000 employees (31%) and 101–250 (31%) lead, with 1,001–5,000 (20%), 5,001–10,000 (12%), and 10,001+ (7%) above them. By role it spans managers (39%), individual contributors (27%), the C-suite (16%), and VPs and directors (14%); on purchasing authority it is buyer-credible, with 46% final decision-makers and another 26% recommenders or influencers. Technology/Software is the largest industry at 20%, followed by Healthcare/Life Sciences (11%) and a broad spread across retail, transportation, financial services, manufacturing, and education.
At 101 respondents this is a modest sample and should be read as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively standing up RAG and context infrastructure rather than from the largest operators.
More than half have traced agent errors to bad context
We asked whether, in the past six months, enterprises had traced a confident but wrong agent answer to missing or inconsistent business context. Most had.
This is the report’s defining number. A majority of enterprises (57%) have already had an AI agent produce a confident, wrong answer they traced to bad context — wrong metrics, stale definitions, or missing documents — and more than half of those have seen it happen more than once. Only 28% report no such failure, and a small remainder either don’t run agents on enterprise data or don’t trace root cause closely enough to know.
The failure mode is specific and dangerous: the model is not obviously hallucinating; it is confidently wrong because the context feeding it was thin or inconsistent. Everything else in this report — what enterprises retrieve, how they govern it, and what they plan to build — is downstream of this problem.
Retrieval feeds more agents than any other method
We asked what an enterprise’s AI agents primarily use to understand its data. Retrieval leads by a wide margin.
Retrieval is the backbone of enterprise context. For 38% of organizations, RAG over documents or a vector index is the primary way agents understand the business — nearly twice the share of the next approach, a governed semantic layer or ontology (21%). Mixed approaches (14%), direct live-system queries (10%), and long-context loading (6%) fill out the rest, and only 2% let agents run on the model’s general knowledge alone. The concentration matters in light of Finding 1: because so much enterprise context flows through retrieval, the quality of that retrieval is the quality of the answer. When RAG is the default source, thin retrieval is not an edge case — it is the main failure surface.
One approach is notable for its absence from these answers: customizing model weights, also known as fine-tuning. Every leading source of business context is injected at run time. Our most recent direct measurement of fine-tuning comes from our April–May survey wave (a separate survey, n=136), where fine-tuning capabilities ranked last of six factors in model selection at 5% — even as 26% of that sample still named fine-tuning and customization an investment they expect to grow. Fine-tuning has fallen out of the primary selection conversation; context injection is how enterprises make agents knowledgeable about their business.
OpenAI file search and vertex AI search top the dedicated tools
We asked which retrieval systems enterprises run in production today. The answer favors the model providers and hyperscalers over the specialists.
The dedicated vector database is no longer the center of the RAG stack. OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) lead — provider-native and hyperscaler-native retrieval — ahead of every purpose-built vector database. Among the specialists, the most-used is the one enterprises already run for other reasons (Elasticsearch/OpenSearch, 20%) and the open, embedded option (pgvector, 12%); the pure-play vector databases that define the category — Weaviate, Qdrant, Pinecone, Milvus — each sit in single digits to low double digits. Notably, 13% of enterprises say they still run no production RAG at all. As with the platforms in the parallel infrastructure wave, enterprises are gravitating to retrieval that comes bundled with tools they already buy.
The shape of this finding held across both Q2 waves. In April–May (n=161), provider-built retrieval led usage there too, while every dedicated vector database remained marginal — the most-used standalone vector database peaked at 8% of that sample — and the hybrid, pluralistic future was already the consensus expectation (34% expected hybrid retrieval to dominate, with another 29% expecting multiple architectures by use case). Two waves, consistent picture: the category that coined the “vector database” term is being collected by the platforms enterprises already buy from.
A plurality resist consolidating onto a provider’s native stack
We asked how enterprises will respond as model providers bundle retrieval, memory, and orchestration into their platforms. Their stated intent cuts against their current usage.
Here is the tension at the heart of the stack. Even as provider-native retrieval leads in practice (Finding 3), a plurality of enterprises (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack — well ahead of the 21% who plan to consolidate. Another 21% expect a mix, and 9% intend to build and own the layer themselves. The gap between what enterprises run and what they say they want is the strategic question of the category: they are adopting bundled retrieval for convenience while asserting they will preserve independence. Which impulse wins — the pull of the provider bundle or the stated preference for modular control — will shape the retrieval market more than any single tool.
Vector-only retrieval is already seen as insufficient
We asked which retrieval architecture enterprises expect to dominate their production RAG systems by the end of 2026. The field is converging — with a large share still unsure.
The architecture is settling on hybrid. A third (34%) expect hybrid retrieval — embeddings combined with reranking and access controls — to dominate their production systems by the end of 2026, three times the 11% who expect vector-only retrieval to prevail. That is a notable signal: the pure vector-search approach that launched the category is already viewed as insufficient on its own, superseded by pipelines that add reranking for accuracy and access controls for governance — the very access controls whose absence produces the failures in Finding 1. Tellingly, the second-largest answer is uncertainty: 17% simply don’t know, and another 14% expect to move beyond a dedicated vector layer entirely toward tool-first or long-context retrieval. The consensus is not a single tool but a layered pipeline — and it is not yet fully formed.
Most run or are building a semantic layer — few in production
We asked whether enterprises use a governed semantic or context layer to give agents and BI a shared understanding of their data. Most are on the path; fewer have arrived.
The fix for the context gap is under construction. Well over half of enterprises (58%) either run a governed semantic layer in production (25%) or are piloting and building one (34%), and a further 17% are actively evaluating — meaning three-quarters are engaged with the idea in some form. But the balance is telling: more are building than have shipped, so for most enterprises the shared, governed definition layer that would prevent the “confident but wrong” failures of Finding 1 is still a work in progress. The semantic layer is the industry’s answer to inconsistent context; this wave catches it mid-construction, ambition well ahead of production.
Selection favors operability; monitoring favors correctness and security
We asked what matters most when enterprises choose a retrieval system, and what they track once it is running. Both answers lean practical.
Enterprises choose retrieval systems on operability. Ease of data ingestion (36%), latency and performance (32%), and operational simplicity (29%) lead the selection criteria — ahead of retrieval accuracy and access control (23% each), the two factors most directly tied to the failures in Finding 1. Once systems are running, the emphasis shifts toward trust: the most-tracked metrics are response correctness (42%) and security and access control (38%), ahead of latency (28%), operational stability (27%), and answer relevance (23%).
Satisfaction with current systems is moderately positive but not enthusiastic — on a five-point scale, overall satisfaction averages 4.0, with ease of implementation and value for money both near 3.9. Enterprises buy for how easily a system runs and watch it for whether it can be trusted.
A majority plan to change providers — and the vector specialists are gaining interest
We asked whether enterprises plan to change or add a retrieval provider, and which they are considering. The consideration set differs from today’s stack.
The retrieval stack is not settled. While 43% have no plans to change, a small majority (57%) intend to switch or add a provider within twelve months, and a quarter (26%) within the next quarter. The consideration set is where it gets interesting: provider-native retrieval still leads what enterprises are evaluating (OpenAI 22%, Vertex AI Search 21%), but the open-source vector specialists punch above their current footprint — Qdrant (14%) and Milvus (13%) draw more switching interest than their present usage (10% and 6%) would suggest. Read with Finding 4, the picture is a market in flux: enterprises run provider-native today, are evaluating a broader field, and say they want to keep their options open. The reshuffle ahead will test whether best-of-breed intent survives contact with the convenience of the bundle.
Organizations with more than 100 employees are wiring agents into their business faster than they can guarantee the context those agents run on. Retrieval is the default source of enterprise context, and it increasingly comes from the model providers and hyperscalers rather than the dedicated vector databases — yet a majority of enterprises have already watched agents answer confidently and wrongly because that context was thin or inconsistent. The failure is not exotic; it is the predictable result of pointing authoritative-sounding agents at an unreliable foundation.
The industry’s answer — a governed semantic layer, hybrid retrieval with reranking and access controls — is being built but is mostly not yet in production, and enterprises are pulled between the convenience of provider-native bundles and a stated preference for best-of-breed independence. At 101 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market — but the direction is clear: the context layer is the next contested tier of the AI stack, and right now agents are running ahead of it. The context gap is not a retrieval-volume problem that more documents or bigger indexes will solve on their own; it is a problem of governed, consistent, access-aware context. The open question for later waves is whether enterprises finish building that layer before the confident-but-wrong failures move from the lab into decisions that matter.
Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. At this sample size the results should be read as a directional signal rather than a precise measurement — it’s a self-selected sample, not a probability sample, and skews toward the mid-market. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with strong purchasing authority, across technology, healthcare, retail, transportation, financial services, manufacturing, and education.
Across 157 enterprises, organizations are granting AI agents more autonomy while trusting the evaluations meant to gate that autonomy less. Half have already shipped an agent that passed their internal evaluations and then failed a customer in production; only one in twenty fully trusts automated evaluation today; and the most-cited weakness is that evaluations do not align with real-world outcomes. Yet two-thirds already allow, or are actively engineering toward, deploying agent changes to production on automated evaluation alone — with no human in the loop. The result is an evaluation gap — the distance between how much autonomy enterprises are handing their agents and how far they trust the tests that are supposed to catch the failures.
This wave of VentureBeat Pulse Research examines how technical leaders measure agent performance: which reliability and evaluation platforms they use, how they select and trust them, what breaks in production, and how far they are willing to let agents run without a human in the loop.
The central finding is an evaluation gap — the distance between the autonomy enterprises are granting their agents and the trust they place in the evaluations meant to govern it. Half of organizations (50%) have, in the past year, deployed an agent or LLM feature that passed their internal evaluations and then caused a customer-facing failure, and a quarter have seen it happen more than once. Trust in the tests themselves is thin: only 5% say they fully trust automated evaluation today, and the single most-cited limitation is that evaluations align poorly with real-world outcomes (29%). Enterprises are discovering that a passing eval is not the same as a working agent.
What makes the gap consequential is the direction of travel. Two-thirds of organizations (66%) already permit fully automated, zero-human-in-the-loop deployment for low-risk agents (34%) or are actively engineering their pipelines to allow it within twelve months (33%). At the same time, the evaluation stack that would have to earn that trust is fragmented and immature: the most common primary tools are the model providers’ native evals, tied with having no dedicated tooling at all (17% each); and only about a quarter of enterprises run real-time quality checks on live production traffic. The autonomy is arriving faster than the assurance.
VentureBeat fielded this survey as part of its ongoing Pulse Research series, this survey — the Agentic Reliability & Evals tracker — focused on how technical leaders evaluate agent performance and reliability. Responses are filtered to organizations with 100 or more employees (n=157), drawn from a single survey in June 2026; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Where questions were multiple-select, those shares can sum to more than 100%.
By role the sample is senior and buyer-credible: 38% are final decision-makers for AI purchases and another 34% recommenders or influencers. Product and program managers (15%), consultants and advisors (10%), directors of engineering/IT (8%), and CIOs/CTOs/CISOs (8%) lead the named titles, alongside a large “Other” function (37%). By organization size the sample is mid-market-weighted: 100–499 (37%) and 500–2,499 (27%) employees lead, with 2,500–9,999 (20%), 10,000–49,999 (10%), and 50,000+ (6%) above them. Technology/Software is the largest industry at 23%, followed by Retail/Consumer (15%), Healthcare/Life Sciences (12%), and Manufacturing (10%).
At 157 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It skews toward the mid-market, so it is best read as the view from organizations actively standing up agent evaluation practices rather than from the largest operators.
Note: This survey was rebuilt for the June wave from the earlier “LLM observability and evaluations” survey; because the questions and sample differ, no comparisons are made to the April–May data.
Half have shipped an agent that passed evals, then failed a customer
We asked whether, in the past 12 months, organizations had deployed an agent or LLM feature that passed their internal evaluations but then caused a customer-facing failure. Half of those that run evaluations had.
This is the report’s defining number. Half of organizations (50%) have shipped an AI feature that cleared their internal evaluations and then failed in front of a customer — an incorrect output, a broken workflow, or a quality incident — and a quarter have seen it happen more than once. Only 36% report no such failure, and the remainder either run no pre-deployment evaluations (8%) or don’t track the root cause closely enough to know (6%). The failure is precise and expensive: the evaluation said the agent was ready, and it was not. Everything that follows — how enterprises trust their evals, what they monitor, and how much autonomy they grant — is shaped by this experience.
The top complaint: Evals don’t match real-world outcomes
We asked which limitation most reduces trust in automated agent evaluations today. Only a sliver of enterprises had no complaint at all.
Trust in automated evaluation is scarce, and specific. Only 5% of organizations say they fully trust automated evaluation as it stands — meaning 95% name a limitation that holds them back. The most common, at 29%, is the one that most directly explains Finding 1: evaluations align poorly with real-world outcomes, passing agents that later fail. Bias or inconsistency (21%) and a lack of explainability (18%) follow — enterprises cannot always tell why an evaluation reached its verdict — and 17% cite data-leakage or privacy concerns in the evaluation process itself. The tests meant to certify agents are not yet trusted to certify them, which is precisely why the autonomy trajectory in Finding 3 is so striking.
Two-thirds already allow, or are building toward, zero-human deployment
We asked whether organizations would let an autonomous agent deploy a code or system change to production on automated evaluation results alone, with no human-in-the-loop validation. The trajectory runs straight through the trust gap.
Here is the paradox at the heart of the report. Even though almost no one fully trusts automated evaluation (Finding 2), two-thirds of organizations (66%) either already allow zero-human-in-the-loop deployment for low-risk agents (34%) or are actively engineering their pipelines to permit it within a year (33%). Only 22% rule it out for the foreseeable future. The direction is unambiguous: enterprises are moving to let evaluations gate production autonomously — removing the human check — at the same moment they say those evaluations don’t reliably match reality. The autonomy ceiling is rising faster than the assurance beneath it, which is the mechanism by which the false-confidence failures of Finding 1 will scale rather than shrink.
Notably, the autonomy bet is not just a small company phenomenon. Splitting the sample by company size, larger enterprises are slightly further down the path toward zero human review than smaller companies (70% versus 64%) and slightly more likely to have shipped an evaluation-passing agent that then failed a customer (54% versus 48%). The assumption that large, regulated organizations are holding the human in the loop longest is, in this sample, backwards. To be sure, these are directional figures, since the survey was not a huge sample — 57 respondents from companies with 2,500+ employees and 100 from companies smaller than that.
Provider-native evals lead — tied with no dedicated tool at all
We asked which agent reliability or evaluation platform enterprises primarily use today. The market has no clear leader — and a large share has nothing dedicated.
The evaluation layer is early and unconsolidated. Provider-native tooling leads — OpenAI’s native evals and traces (17%) and Anthropic’s Claude Console evals (13%) together outweigh any independent platform — but it is tied at the top by a striking answer: 17% of enterprises use no dedicated agent-evaluation tooling at all, a notable gap for organizations shipping agents to customers. The specialist evaluation vendors — DeepEval (12%), Braintrust (8%), LangSmith, Weave, Promptfoo, Langfuse, Arize — are scattered across single to low double digits, and 11% have built their own. No independent platform has yet become the category standard, which leaves most enterprises evaluating agents with provider-native tools, home-grown scripts, or nothing.
Only a quarter run real-time quality checks on live traffic
Production monitoring for an AI agent can watch two very different things. It can watch whether the system is functioning — is the agent up and responding, did each request complete, how fast, at what cost, with any errors. Or it can watch whether the agent’s output is correct — automated checks that evaluate the content of each answer as it goes out: did the agent give the right answer, take the right action, stay within policy. The distinction matters because a confidently wrong answer is invisible to the first kind of monitoring: the request completes, the response is fast, no error is thrown, and every functioning-metric reads healthy. We asked organizations which kind their live production monitoring is built for today.
Grouped by what is actually being watched, the split is stark: 51% of organizations monitor only whether the agent is functioning, while 23% monitor whether its answers are right. Counting the ad-hoc reviewers and the don’t-knows, roughly three-quarters of organizations run no automated, real-time evaluation of output correctness in production — they can see that the system is up and what it costs, and they are taking the correctness of its answers on faith. That blind spot is the runtime counterpart to the pre-deployment gap in Finding 1: the same organizations engineering the human out of the deployment decision mostly cannot see, in real time, when the deployed agent starts getting things wrong.
Price and integration drive selection; evaluation consistency is the goal
We asked what most influenced enterprises’ choice of an evaluation vendor, and what they treat as their primary measure of success. Both answers are pragmatic.
Enterprises buy evaluation tooling on economics and trust it on repeatability. Cost of evaluations (28%) narrowly leads selection, just ahead of ease of integration (27%) and evaluation accuracy (24%) — breadth of observability (13%) and vendor roadmap (4%) matter far less. On what success looks like, more than a third (36%) name evaluation consistency — getting the same verdict on the same behavior every time — well ahead of speed of experimentation (19%), reduction in failures (18%), production visibility (13%), and compliance (11%). The emphasis on consistency is telling: before enterprises can trust an evaluation’s verdict, they need it to be stable — the very property whose absence (bias and inconsistency) ranked among the top trust limitations in Finding 2. Satisfaction with current tooling is only moderate, averaging 3.8 on a five-point scale across overall satisfaction, ease of implementation, and value for money.
Investment is flowing to oversight, not just automation
We asked which reliability and evaluation investment will grow most over the next year. The money is going toward watching agents more closely — including with people.
The second-largest planned investment — behind only production observability — is human review workflows, at 26%. Read against Finding 1, that is the report’s quietest contradiction: at the same moment two-thirds of enterprises are engineering the human out of the deployment decision, more of them plan to grow spending on human reviewers (26%) than on the automated evaluation pipelines (16%) that would replace them. The zero-human trajectory and the human-review budget are rising in the same companies at the same time. Indeed, only 8% report that their budget is not increasing.
Taken together, enterprises are hedging: building toward autonomy while spending to watch agents more closely and keep humans available for the calls that automated evaluation cannot yet be trusted to make.
Nearly two-thirds plan to adopt or switch platforms within a year
We asked whether enterprises plan to adopt a new, additional, or replacement evaluation platform, and which they are considering. Few intend to stand pat.
The evaluation market is wide open. While 36% have no plans to change, a clear majority (64%) intend to adopt a new, additional, or replacement platform within twelve months, and 31% within the next quarter. The consideration set points where current usage is thinnest: Confident AI’s DeepEval leads what enterprises are evaluating (20%), ahead of OpenAI’s native evals (13%) and Braintrust (9%) — the open-source specialists drawing more interest than their present footprint.
Given that so many enterprises today rely on provider-native tools or nothing at all (Finding 4), this is less a defection than a first real wave of tooling adoption — the moment the evaluation layer starts to consolidate. Which platforms earn that trust, in a market where almost no one trusts automated evaluation yet, is the open question this series will keep tracking.
Organizations with 100 or more employees are granting AI agents more independence than they trust their evaluations to support. Half have already shipped an agent that passed its evals and then failed a customer; almost none fully trust automated evaluation, chiefly because it doesn’t match real-world outcomes; and most watch production for uptime and cost rather than for whether the agent’s answers are right. Yet two-thirds already allow, or are actively building toward, deploying to production on automated evaluation alone.
The vendor market is early and unsettled: the most common primary evaluation tools are provider-native evals, tied with no dedicated tooling at all, and a clear majority plan to adopt or switch platforms within the year. Encouragingly, the next dollar is going to observability and — pointedly — human review, suggesting enterprises sense the gap even as they engineer past it. At 157 respondents in a single wave this is a directional read, skewed toward the mid-market — but the direction is clear: autonomy is being granted on the strength of evaluations that the people granting it do not yet trust. The evaluation gap is not a coverage problem that more tests alone will close; it is a problem of evaluations that reflect reality and can be trusted to gate it. The open question for later waves is whether assurance catches up to autonomy — or whether the false-confidence failures move from customer incidents into changes that deploy themselves.
Based on survey responses from 157 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. This is a directional read rather than a precise measurement — the sample is self-selected, not a probability sample, and skews toward the mid-market. Respondents include product and program managers, consultants and advisors, directors of engineering/IT, and CIOs/CTOs/CISOs, among other functions, across technology/software, retail/consumer, healthcare/life sciences, manufacturing, and other industries.
Across 101 enterprises, agent orchestration is consolidating onto model-provider platforms — Anthropic’s Claude leads by a wide margin — chosen for the gravity of the underlying model and judged on reliable multi-step execution. But the ambition runs well ahead of the reality: most deployed “agents” are still chatbot wrappers, the control plane enterprises expect is deliberately hybrid to avoid lock-in, and real-time fiscal control over token burn remains the exception.
This wave of VentureBeat Pulse Research examines enterprise agent orchestration: which platforms enterprises run on, what drives the choice, what they optimize for, how they expect agent control to be structured, and — most revealingly — how orchestrated their deployed “agents” actually are and how tightly they control the cost of running them.
The central finding is a gap between orchestration ambition and orchestration reality. Enterprises are consolidating fast onto the major model platforms: Anthropic’s Claude is the primary platform for 40%, more than double any rival, followed by Microsoft (18%) and OpenAI (13%). The choice is driven by “model gravity” — native alignment with a state-of-the-art base model (21%) — and success is judged by reliable, multi-step execution (task completion reliability 32%, multi-step workflow management 28%). Yet asked to assess their portfolios honestly, 71% say a quarter or fewer of their deployed “agents” are true multi-step orchestrated workflows rather than single-prompt chatbot wrappers, and only 10% have crossed the halfway mark. The orchestration layer is being built well ahead of the orchestrated portfolio it is meant to run.
That gap shapes the architecture enterprises are putting in place. By the end of 2026 a clear majority (51%) expect a hybrid control plane — provider-native plus external orchestration — and only 6% expect to hand control to a provider-managed service, because vendor lock-in (35%) is the risk they fear most if control lives inside a model provider. Investment follows the build-out: agent workflow tooling leads the spend (34%), with security and permissions enforcement (25%) behind. And fiscal control lags throughout — more than a quarter (27%) have no real-time way to stop a runaway agent before the bill arrives.
VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent orchestration. Responses are filtered to organizations with 100 or more employees (n=101), drawn from a single June 2026 wave; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends.
By organization size the sample is spread evenly across the enterprise bands: 100–499 employees, 2,500–9,999, and 50,000+ (21% each), with 10,000–49,999 and 500–2,499 (19% each). By role it is senior and buyer-credible: product and program managers (15%), CIO/CTO/CISO (13%), consultants and advisors (13%), and a spread of data, AI, and engineering directors and VPs, with an “Other” function at 18%. On purchasing, 81% are recommenders, influencers, or final decision-makers for AI solutions (66% recommender/influencer, 15% final decision-maker). Technology/Software is the largest industry at 44%, followed by Financial Services (17%) and Healthcare/Life Sciences (8%).
At 101 respondents the sample is robust enough to read directionally with reasonable confidence, though it remains self-selected and is not a probability sample.
Anthropic’s Claude leads; open frameworks are marginal
We asked which agent orchestration platform enterprises primarily use today. The answer concentrates on the major model providers — and on one in particular.
A note on reading these shares. As described in the methodology section, the respondents are self-selected, and this question asked them for a single primary platform — so the figures measure which platform leads each enterprise’s deployment, within a self-selected audience of AI-active technical decision-makers. A sample built this way can diverge substantially from spend-weighted market measures, and each VB Pulse survey draws its own sample with its own company-size mix, so vendor figures should not be compared across our surveys either. Read these shares as a portrait of where this cohort has placed its primary orchestration bet today, rather than as market share.
The model platforms dominate. Anthropic, Microsoft, OpenAI, Google, and Amazon together account for roughly 80% of deployments (81 of 101), while the open frameworks (LangChain/LangGraph) and custom in-house builds that anchor engineering discussion sit in single digits. Anthropic’s lead — 40%, more than double the next platform — mirrors the “model gravity” selection logic in Finding 2: enterprises are choosing the orchestration layer that comes with the model they want to build on. As with the security vendors in the prior agent-security wave, the tools that define the category in technical circles are not yet where enterprise deployment concentrates. A small 3% are not orchestrating at all.
Respondents rate the platforms they run at 3.94 out of 5 overall (109 answered), with “value for money” specifically at 3.94 and “ease of implementation” the weakest score, at 3.85 — placing orchestration near the bottom of our five-tracker satisfaction range, ahead of only evaluation tooling. A rating just under 4 out of 5, from users of whom 96% plan to change their orchestration approach within the year, reads as provisional acceptance: the platforms work well enough to run today, and not well enough to stop the search for something better. The ratings sit alongside near-universal intent to change; this is a layer enterprises tolerate more than they love.
The base model, not the tooling, decides the platform
We asked what most influenced the orchestration platform choice. The single largest factor is the pull of the underlying model — though flexibility and ease of development follow close behind.
Model gravity leading is the selection-side explanation for Anthropic’s platform lead: enterprises pick the orchestration environment closest to the frontier model they have standardized on. But the next tier complicates the picture — flexibility across models and tools (17%) and ease of development (17%) say enterprises also want to avoid being trapped by that choice, foreshadowing the lock-in fear in Finding 6. Security and permissions (14%) and total cost of ownership (11%) round out a pragmatic buying logic. Performance (latency/memory) sits last at 4%, a reminder that at this stage of adoption the binding constraints are model fit and optionality, not raw speed.
Enterprises just orchestration by whether it completes the work
We asked what enterprises optimize for — their primary success metric for orchestration. Reliability and multi-step workflow management dominate; developer- and user-facing metrics trail.
Task completion reliability (32%) and multi-step workflow management (28%) together account for 59% of responses (60 of 101): orchestration succeeds, in the enterprise view, when it reliably carries a task through multiple steps to completion. Developer productivity (17%) matters but is secondary — the inverse of its prominence in framework discussion — and end-user experience (9%) is a minor concern, consistent with orchestration being an internal execution problem rather than a UX one. This reliability-first standard is exactly what makes the Chatbot Trap finding so pointed: enterprises define success as dependable multi-step execution, yet most of their deployed “agents” do not yet do multi-step work at all.
The trap is not evenly distributed. Splitting the sample by organization size, 77% of smaller enterprises say a quarter or fewer of their agents do true multi-step work, against 62% of larger ones. Larger enterprises are meaningfully further into genuine multi-step deployment; the chatbot trap is, directionally, a mid-market condition.
Three strategic moves are nearly tied for the year ahead
We asked what major change enterprises anticipate in their orchestration strategy over the next 12 months. Three moves cluster at the top, almost evenly split.
The top three — building in-house control (25%), standardizing on one framework (24%), and moving agents from sandbox to production (23%) — are statistically indistinguishable and tell a single story: enterprises are moving from experimentation to operational consolidation. They want fewer frameworks, more production exposure, and more ownership of the control layer; only 4% expect no change. The appetite for custom in-house control planes is notable alongside the platform concentration in Finding 1 — enterprises are standardizing on model-provider platforms while simultaneously planning to wrap them in control logic they own, the hybrid posture that Finding 6 makes explicit.
The strategic change enterprises anticipate (previous finding) comes with vendor motion attached. Asked whether they plan to adopt a new, additional, or replacement agent orchestration platform in the next twelve months, more respondents are moving here than in any other layer we track.
Asked which platforms they are considering, the most common answer among those in motion is none yet: 29% of all respondents are evaluating without a shortlist, the largest single response after “not considering a change.” Among named candidates, OpenAI leads at 16%, followed by LangChain/LangGraph at 12% and Anthropic at 7% — and notably, the independent frameworks draw roughly double their current usage footprint in forward consideration, the same pattern our security tracker found for specialist vendors. Read with this report’s concentration and lock-in findings, the picture completes itself: the major model-platform providers hold roughly four-fifths of today’s primary usage, vendor lock-in has become the leading fear, 96% anticipate a strategic change — and now the purchase intent to act on all of it, with the largest bloc of buyers still undecided. The most concentrated layer of the agentic stack is also, as of June, the least settled.
Tooling and permissions lead the spend; monitoring trails
We asked which orchestration-related investment will grow most next year. Agent workflow tooling leads, with security and permissions enforcement behind.
Workflow tooling leading (34%) is the budget-side expression of the reliability-and-multi-step priority in Finding 3: the money is going to the machinery that strings steps together dependably. Security and permissions enforcement (25%) and scaling infrastructure (20%) follow — the investments required to take agents from sandbox into production, the strategic move in Finding 4. Monitoring and debugging draws a smaller 11%, with another 11% reporting flat budgets. The weight on tooling, permissions, and scaling over pure observability signals that enterprises are spending to build and harden orchestration, not merely to watch it run.
Enterprises expect to split control between providers and their own layer
We asked where enterprises expect the primary control plane for agents to live by the end of 2026, and what worries them most if that control sits inside a model-provider platform. A clear majority expect a hybrid model — and vendor lock-in is the reason.
Hybrid control is the dominant expectation by a wide margin (51%), and only 6% expect to hand control to a provider-managed service outright. Read together, the hybrid, custom, and externally-abstracted options — every architecture that keeps control at least partly outside the provider — sum to 88% (89 of 101). The reason surfaces directly when we asked about the risk of provider-resident control: vendor lock-in leads at 35% (35 of 101), ahead of security and permissioning limitations (28%) and inflexibility across models and tools (21%). The pattern echoes the prior wave’s “don’t trust the model to police itself” posture — here, enterprises will build on a provider’s platform but decline to be governed entirely by it. The hybrid control plane is the architectural hedge against the lock-in they most fear.
The June figure asserting a preference for a hybrid control plane marks movement from earlier. In the April–May survey (n=145), only 34% expected a hybrid control plane, and a greater number (12%) expected to hand control fully to a provider-managed service. These two snapshots don’t yet measure a confirmed longitudinal trend — but the direction of the conversation is unambiguous: toward keeping control.
Lock-in is also a new arrival as a top concern. In the April–May wave, the leading concern was security and permissioning limitations (32%), with lock-in second at 24%; by June the two had traded places. The worry about provider platforms appears to be maturing from whether they can be secured to whether they can be replaced.
Enterprises admit most deployments are still chatbot wrappers
We asked enterprises to assess their portfolios honestly: what share of their deployed “agents” are true multi-step orchestrated workflows versus simple single-prompt chatbot wrappers. The answer is the defining finding of this wave.
This is the gap at the center of the report. Combining the bottom two bands, 71% of enterprises (72 of 101) say a quarter or fewer of their deployed “agents” are genuinely orchestrated — and just 10% (10 of 101) have crossed the halfway mark. The ambition documented in the earlier findings — model-provider platforms, reliability-first success metrics, production rollouts, a deliberate control architecture — runs well ahead of the deployed reality, which remains overwhelmingly single-prompt assistants dressed as agents. This is less a contradiction than a roadmap: the platforms, budgets, and strategies are being put in place precisely because the orchestrated portfolio is still so thin. The open question for later waves is how fast the reality closes on the ambition.
Only a minority can stop a runaway agent before the bill arrives
Finally, we asked how enterprises enforce fiscal control over agent token consumption — the risk that an autonomous loop exhausts a budget before anyone intervenes. Most rely on native caps or after-the-fact monitoring; real-time programmatic control is the exception.
More than a quarter of enterprises (27%) admit they have no real-time, programmatic way to stop an agent before a budget-breaking bill arrives — they learn of it from the logs afterward. Another 32% lean entirely on the native caps and throttles built into their primary platform, a control only as good as the provider’s tooling and one that ties back to the lock-in concern of Finding 6. The enterprises building custom gateways (23%) or exploiting cross-model routing to arbitrage cost (19%) are the ones treating token burn as an engineering problem to be controlled deterministically. As with orchestration maturity, fiscal control is an area where the operational reality lags the ambition: agents are moving toward production faster than the cost-control plane around them is being built.
It’s worth noting, a split appears according to company size: roughly one in three enterprises under 2,500 employees (34%) exercises only reactive control of agent spend, against 20% of larger enterprises — directional figures, but consistent with the chatbot-trap split. The mid-market is running the least mature agents on the least instrumented budgets.
Organizations with 100 or more employees describe an orchestration strategy that is consolidating quickly and maturing slowly. They are standardizing — for now — on model-provider platforms, which collectively hold roughly four-fifths of primary usage, chosen for the gravity of the underlying model, and they judge success by reliable multi-step execution. Investment is flowing to workflow tooling and permissions, the strategy is to consolidate frameworks and push agents into production, and the control plane they expect is deliberately hybrid, because vendor lock-in is the risk they fear most. But the standardization is provisional: 68% plan to adopt a new, additional, or replacement orchestration platform within twelve months — the highest switching intent of any layer we track — and the largest group of those movers has not yet shortlisted a candidate. Today’s concentration describes where enterprises are, and visibly does not describe where they intend to stay.
But the honest self-assessment punctures the ambition. Seventy-one percent say a quarter or fewer of their deployed “agents” are truly orchestrated, only 10% are past the halfway mark, and more than a quarter cannot stop a runaway agent in real time. The orchestration layer — the platforms, the budgets, the control architecture — is being built ahead of the orchestrated portfolio it is meant to run. At 101 respondents in a single June wave this reads as a clear directional signal rather than a precise measurement: enterprises have decided how they want to orchestrate agents well before most of their agents are doing anything an orchestration layer is for. The questions for subsequent waves are whether the deployed reality closes the gap on the ambition — and, with nearly seven in ten buyers in motion and most of them undecided, which platforms the settled stack finally lands on.
Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, results read directionally rather than as a confirmed trend. Respondents include product and program managers, CIOs, CTOs and CISOs, consultants and advisors, and directors and VPs of data, AI, and engineering, across Technology/Software, Financial Services, Healthcare, and other sectors.