What did the Rubrik Zero Labs agent report find?

In a survey of more than 1,600 IT and security leaders published in September 2026, 86% expect AI agents to outpace their organisation's security guardrails within a year, only 23% report full visibility into the agents running in their environment, more than 80% say agents require more manual oversight than they save in efficiency, and 88% say they cannot roll back agent actions without disrupting systems.

What is the agent 'shadow workforce'?

Rubrik's term for the non-human identities created for AI agents that proliferate faster than enterprises can track or govern them. These identities typically hold persistent access with limited oversight, which creates pathways for misuse, compromise and lateral movement — the same risk profile as unmanaged service accounts, at higher volume and with autonomous behaviour attached.

Do AI agents actually save enterprises time in 2026?

Not yet, according to this data. More than 80% of the 1,600+ leaders surveyed said their agents require more manual oversight than they save in efficiency. That is a supervision-cost problem rather than a capability problem: the model does the work, but a human still has to verify it because there is no reliable way to undo a bad action.

Why is agent rollback such a common gap?

Agents act across many systems that have no shared transaction boundary — a CRM write, an email send, a config change and a file deletion cannot be reversed atomically. 88% of surveyed leaders reported they lack the ability to roll back agent actions without system disruption, which is why recovery, not prevention alone, is emerging as the primary control gap.

Quick Answer

Rubrik State of the Agent Report 2026: The 23% Problem

Published: September 8, 2026

The Short Answer

Rubrik Zero Labs’ report The State of the Agent: Understanding Adoption, Risk, and Mitigation, released in September 2026, surveyed more than 1,600 IT and security leaders and found that enterprises are running AI agents they cannot see, cannot supervise economically, and cannot undo.

Four numbers carry the whole report:

Finding	Figure
Expect agents to outpace their security guardrails within a year	86%
Report full visibility into agents in their environment	23%
Say agents need more manual oversight than they save in efficiency	>80%
Cannot roll back agent actions without system disruption	88%

Rubrik notes the 23% visibility figure is probably an over-estimate, since respondents are reporting on their own coverage. That caveat matters: the real number is likely worse.

Why These Four Numbers Are the Same Problem

Read individually they look like four separate complaints. They are one causal chain.

You cannot see the agents (23%). Nobody maintains a reliable inventory of which agents exist, what identities they hold, or what they can reach.
So you cannot bound their blast radius. Uninventoried access means undefined worst case.
So every action needs a human check (>80%). Supervision is the compensating control for missing visibility — and it eats the efficiency gain that justified the deployment.
And when something goes wrong, you cannot reverse it (88%). Which is why leaders keep the human in the loop even when the model is good enough to trust.

The efficiency loss is not a model-quality problem. It is a control problem. Better models do not fix it. Anthropic, OpenAI and Google can ship a smarter agent every quarter and that 80% figure will not move until visibility and rollback exist.

The Shadow Workforce

Rubrik’s framing for the identity layer is a “shadow workforce”: non-human identities tied to agents, proliferating faster than enterprises can track or govern them, typically holding persistent access with limited oversight.

This is the old unmanaged-service-account problem with three new properties:

Volume. Agent frameworks create identities per agent, per tool, per environment. A team shipping ten agents can generate dozens of credentials in a sprint.
Autonomy. A service account executes a defined job. An agent decides what to do next, so its access pattern is not predictable from its purpose.
Chaining. Agents call other agents and tools, so effective permissions become the union of everything downstream — which nobody has computed.

Rubrik’s separate Zero Labs data has 90% of IT and security leaders naming identity-based attacks as the single largest threat to their organisation. Layering a fast-growing population of poorly-inventoried non-human identities on top of that is the specific concern the report raises.

The Recovery Gap Is the Novel Finding

Plenty of 2026 research says agent adoption is outrunning governance. The distinctive contribution here is the emphasis on recovery rather than prevention.

88% cannot roll back agent actions without system disruption, and nearly nine in ten leaders are worried about meeting recovery objectives as agent-driven threats increase.

The reason is architectural. An agent’s work crosses systems that share no transaction boundary:

Action	Reversible?
Database write	Usually, with point-in-time recovery
CRM/SaaS record change	Sometimes, via audit log replay
Email or message sent	No
External API call with side effects	No
Payment or order placed	Only via compensating transaction
File deletion	Only if backups cover it

There is no ROLLBACK for a multi-system agent run. Every serious mitigation is therefore a compensating design — approval gates before irreversible steps, dry-run modes, scoped credentials, immutable backups — not an undo button.

The Threat Direction

Nearly half of respondents expect agentic systems to drive the majority of attacks in the coming year. Rubrik frames this as autonomous systems compressing attack timelines, scaling operations, and blurring the line between insider risk and external compromise.

That last point deserves emphasis. A compromised agent identity is not cleanly “external” — it is a legitimate credential doing legitimate-looking work at machine speed. Detection logic built around anomalous human behaviour does not fire on it.

Kavitha Mariappan, Rubrik’s Chief Transformation Officer, framed the takeaway as moving past whether AI is risky to “maintaining operational safety in an increasingly autonomous landscape” as decision-making shifts from human to machine.

How to Read This If You Are the Vendor’s Target Market

Rubrik sells backup, recovery and identity resilience. A report concluding that recovery is the critical gap is aligned with what Rubrik sells. That does not make the survey data wrong, but it does explain the framing emphasis, and you should read the recovery-first conclusion accordingly.

The survey figures themselves — 1,600+ leaders, self-reported — are consistent with the broader 2026 picture: high embedding of agents in enterprise applications, far lower rates of production deployment, and persistent pilot failure. The visibility and rollback numbers are the parts worth quoting.

What to Actually Do About It

In priority order, cheapest first:

Inventory before you govern. You cannot fix 23% visibility with policy. Enumerate every agent identity, its credentials, and its reachable systems. This is unglamorous and it is the whole game.
Make irreversibility explicit. Classify each tool an agent can call as reversible or irreversible. Approval-gate the irreversible ones and nothing else — blanket approval on everything is how you get the 80% oversight tax.
Scope credentials per agent, not per team. Shared credentials make attribution impossible after an incident.
Expire access by default. Persistent access is the specific property that turns a forgotten agent into an attack path. Short-lived credentials turn abandonment into automatic decommissioning.
Test recovery, don’t assume it. If you have never restored from a bad agent run, your recovery objective is a guess.
Log agent actions to an immutable store. Post-incident, you need to answer “what did it touch” without trusting the compromised environment.

Last verified: September 8, 2026.