Ask a boardroom whether their AI agents are under control, and 82% will tell you yes — existing policies have it covered. Ask the engineers who run those agents to show the logs, and more than half can't. Not "won't." Can't. The logs don't exist.

That's not a rhetorical flourish. Both numbers come from the same survey.

The gap, measured

Gravitee's State of AI Agent Security 2026 report surveyed 900+ executives and technical practitioners, and the deltas between what leadership believes and what practitioners report are the whole story:

• 81% of teams are past the planning phase — agents are in testing or production now.
• Only 14.4% of deployments have full security approval.
• Less than half of deployed agents (47.1%) receive active monitoring or security measures — meaning more than half operate with no security oversight or logging at all.
• 88% of organizations confirmed or suspected an agent-related security incident in the past year. In healthcare, 92.7%.
• And yet: 82% of executives feel confident that existing policies protect against unauthorized agent actions.

Sit with that last pair. Nearly nine in ten organizations have had (or suspect they've had) an incident, and eight in ten executives are confident it can't happen. Both groups work at the same companies.

Why confidence survives contact with the incident rate

The confidence isn't dishonest. It's an artifact of how approval works today.

An agent gets reviewed once — at deployment, if at all — and the sign-off gets filed. From the boardroom, "we have a policy" and "the policy is enforced on every action" look identical, because nothing in the reporting chain distinguishes them. The policy document exists. The enforcement point doesn't.

Meanwhile the thing that was approved doesn't hold still. Models get swapped, prompts get tuned, tools get added, and — per the same survey — 25.5% of deployed agents can create and task other agents, which means the population itself grows without anyone re-running the review. The deployment-time approval describes an agent that no longer exists, running alongside agents that were never approved by anyone, human or otherwise.

Confidence based on a point-in-time review of a system that changes continuously isn't a control. It's a memory.

August stopped forgiving this

Two things happened this month that turn the confidence gap from an internal awkwardness into an external liability.

First, EU AI Act enforcement is live. Article 50's transparency obligations took effect August 2 — we covered what the Digital Omnibus delay didn't delay — and regulators now have inspection and fining powers of up to €15M or 3% of global turnover. An inspector does not ask how confident your executives feel. They ask for records. "More than half of our agents produce no logs" is a sentence you do not want to say in that meeting.

Second, the adversaries are running agent fleets with better operational discipline than most defenders. In mid-August, researchers disclosed what's being called the first end-to-end autonomous AI cyberattack: suspected China-linked operators used coordinated AI agents to attack Taiwan's government — breaching 85 accounts and exfiltrating thousands of personnel records across a multi-day, largely unsupervised operation. The offense is autonomous, coordinated, and persistent. A defense posture that consists of a policy PDF and a confident steering committee is not symmetrical with that.

Closing the gap: three substitutions

The fix is not more confidence and it is not less. It's replacing each felt assurance with a countable artifact. Three substitutions do most of the work:

Replace deployment-time approval with per-action policy decisions. A sign-off six months ago says nothing about what the agent did this morning. VeriSwarm Gate evaluates every agent action against policy tiers and returns an explicit allow, review, or deny — each one recorded. "Is this agent approved?" becomes "here is the decision log for everything it did," which is the version of approval that survives an audit. Gate runs on the free tier, always on.

Replace periodic review with continuous scoring. The survey's 47.1% monitoring figure counts anything as monitoring, including a dashboard someone checks weekly. Behavioral trust scoring is stricter: every event an agent emits moves its score, and drift shows up in the number before it shows up in the postmortem. An agent that was fine at approval time and isn't fine now is exactly the case point-in-time review structurally misses.

Replace "we log things" with logs you can prove. Ordinary application logs are mutable, scattered, and — per the survey — absent for most agents entirely. VeriSwarm Vault writes agent activity to an immutable, hash-chained audit ledger: every entry linked to the one before it, chain integrity verifiable on demand, exportable when a regulator, customer, or your own incident review asks what actually happened. The difference between logging and evidence is whether it holds up when someone hostile checks.

And for the day the evidence says stop: Guard's kill switch exists so that "we found a problem" and "we contained it" happen in the same minute, not the same quarter.

The uncomfortable question

The 82% aren't wrong to want confidence. They're wrong about where it comes from. Confidence that comes from a policy document is a feeling; confidence that comes from a decision log, a live trust score, and a verifiable audit chain is a measurement. Only one of them changes when your agents do.

Here's the test: if someone asked you right now to produce a complete record of what your agents did yesterday — every action, every decision, every deny — could you? The 14.4% can. Joining them starts at $0: register an agent with Gate and the logging you're currently confident you have becomes the logging you actually do.