Lyzr Research · October 2026 · Agent governance · A 75 minute read
The Agent
Sprawl Report.
How many agents enterprises really run, why the number keeps climbing, what an ungoverned estate costs, and the census, zoning and permit system that brings it under control.
To the CIO, the CISO, and whoever was just asked how many agents the company runs
You cannot govern what you cannot count.
Agents are cheap to make and free to forget.
Every platform now ships a builder. A business user can stand up an agent in an afternoon, connect it to live data, and move on. Nobody is paid to switch it off.
So nobody knows the number.
Only 18% of organizations keep a current, complete inventory of their agents. 82% found at least one agent last year that security or IT did not know existed.
Count them, name them, zone them, retire them.
A city that grows faster than its map does not need fewer buildings. It needs a census, a zoning code, a permit office and a demolition crew. So does an agent estate.
This is the argument
This report starts with the count, follows the sprawl to its causes and costs, and ends with a working system for the map, the zoning and the permit. Part 8 is Lyzr’s own description and is labeled that way.
Lyzr Research, October 2026
The short version.
- The countGartner says the average Fortune 500 enterprise ran fewer than 15 agents in 2025 and will run more than 150,000 by 2028. IBM expects large enterprises to pass 1,600 this year.
- The blind spot18% keep a complete agent inventory. 82% found an agent last year that IT did not know about. 13% believe their governance is right.
- The causeMade in five places at once, by people with no reason to register them and nobody paid to retire them. Blocking pushes the work into the shadows.
- The cost54 agent incidents per organization last year, 17% of them serious. 80% say an agent has taken an unintended action. 40% of agentic projects will be canceled by 2027.
- The mapA census with twelve fields per agent, built from scans, platform exports and asking people. An inventory that is 80% complete is a rumor.
- The systemOne identity, a scope, a limit and a tier per agent. Four gates, register, test, release, review. Nothing runs without an owner, nothing runs forever.
- The betBy 2028 a central agent registry is a standard control, like the CMDB and the identity directory today.
What this covers
Eight parts, from the count to the control.
How many
The census
What the counts say, and why they disagree.
Causes
Why it sprawls
Five places agents get made, and the confidence gap.
Incidents
What it costs
Incidents, leaks, canceled projects and quiet waste.
Inventory
The map
A census with twelve fields, and three ways to fill it.
Identity
The zoning
One identity, a scope, a limit and a tier per agent.
Lifecycle
The permit
Four gates from registration to retirement.
Predictions
What next
Six predictions, and the case against this report.
Lyzr
Where Lyzr fits
What applies, a first step and the questions to ask.
Gartner, April 2026
The average Fortune 500 enterprise will run more than 150,000 agents by 2028.
Agents in use at the average global Fortune 500 enterprise by 2028, against fewer than 15 in 2025
Gartner calls it a ballpark figure. The order of magnitude is the point. The estate grows ten thousandfold in three years, and most of it will be built by people who never asked IT.
Four orders of magnitude in three years
Gartner press release, April 28, 2026, and Max Goss via Computerworld, April 30, 2026.
The argument in one picture
A city that grows faster than its map.
Buildings go up overnight. Some have an address, an owner and a permit. The rest are on nobody’s map, draw power from somebody else’s meter, and never come down. An agent estate sprawls the same way. The fix is the one cities found. A census, a zoning code, a permit office and a demolition crew.
The census.
What the counts say, and why they disagree.
This part lays out every credible count of agents per enterprise, shows why the numbers range from twelve to 150,000, and ends with the three counts a CIO should be able to give from memory.
What the surveys count
Three numbers, three definitions.
Agents per enterprise, by IT leaders
Salesforce’s 2026 Connectivity Benchmark, with Vanson Bourne and Deloitte Digital, puts the average at 12 today and 20 by 2027. OutSystems, polling 1,900 IT leaders, lands on the same 12.
Agents per large enterprise, by IBM
IBM told Think 2026 that most large enterprises will operate a digital workforce of more than 1,600 agents by the end of 2026.
Agents per Fortune 500 firm, by Gartner
Gartner’s April 2026 estimate for 2028, up from fewer than 15 in 2025. Gartner’s own analyst calls it a ballpark.
Salesforce via CIO Dive, February 5, 2026, 1,050 IT leaders. OutSystems, April 7, 2026, 1,900 IT leaders. IBM Think 2026 recap. Gartner, April 28, 2026. The graphics are illustrative.
Why the counts disagree.
The curve
From under 15 to 150,000 in three years.
The 2025 count is what IT could see. The 2028 count is what will exist. Between the two sits every builder, copy, personal assistant and SaaS automation that nobody wrote down. The shape is a step function, not a slope, because each new builder platform adds a floor of agents at once.
What the organizations building them report.
OutSystems, April 2026
96% of organizations use agents in some capacity. 94% worry about sprawl.
Organizations using AI agents, in a survey of 1,900 IT leaders. 94% say sprawl is increasing complexity, technical debt and security risk
Adoption and anxiety arrived together. The same leaders who report near universal use report near universal concern. Only 12% have put a central platform in place to manage it.
Everyone has them, almost nobody manages them
OutSystems 2026 State of AI Development, April 7, 2026. A vendor survey.
IBM Institute for Business Value, April 2026
Only 18% of organizations keep a current, complete inventory of their agents.
Organizations with a current and complete AI inventory, from IBM’s orchestration research
The other 82% are governing from memory. SAP LeanIX’s 2026 survey found fewer than half of organizations have any inventory of their agents at all. The count is the control that every other control depends on.
No inventory, no governance
IBM IBV, AI orchestration layer report, April 2026, via IBM Think 2026 recap. SAP LeanIX Agentic AI Survey 2026 via SAP News, August 3, 2026.
IBM and Oxford Economics, June 2026
11% of technology executives say they are fully prepared for the agent volume coming within a year.
CIOs and CTOs fully prepared for expected agent deployment volume, from 2,000 executives across 33 geographies
Two-thirds say they are accountable for AI systems they do not fully control. 77% say adoption has outpaced their governance. They expect 38% more agents by 2027, on top of what they already cannot see.
Accountable without control
IBM IBV with Oxford Economics, 2,000 CIOs and CTOs, fieldwork January to April 2026, published June 8, 2026.
Three counts
Three counts every CIO should be able to give from memory.
Agents running today
Not built. Not approved. Running, anywhere, with a credential that works. The honest answer is usually a range, and that is fine to start.
Agents with a named owner
A person who will answer for it at 2am. The share without one is the first number to drive to zero.
Agents retired this quarter
If the answer is none, the estate only grows. A healthy estate retires agents as routinely as it ships them.
Our framing. The graphics are illustrative.
Questions for Monday
Four questions to ask on Monday.
How many agents are running right now?
Ask three people and compare the answers.
Which platforms in the company can create an agent without a ticket?
Who was the last person to retire an agent, and when?
If an agent misbehaved tonight, who would we call, and how would we stop it?
Why it sprawls.
Five places agents get made, and the gap between what leaders believe and what their people do.
This part explains the mechanics. Why creating an agent now costs nothing, why copying beats reusing, why nobody retires one, and why the executives most confident in their visibility are the ones most surprised.
Five places agents get made.
Where they hide
Most of the estate is outside the platform IT chose.
A discovery scan of one estate finds agents across clouds, clusters and laptops. The sanctioned platform holds a minority. The rest were built where the builder happened to be sitting. Treat every surface that can call a model as a place agents are born.
The economics
Four reasons the estate only grows.
Creating one costs nothing
A seat license already covers it. No budget line, no ticket, no review. The marginal agent is free to the person who makes it.
Copying beats reusing
Finding and trusting someone else’s agent takes longer than cloning it. So every team has its own version of the same thing.
Nobody is paid to retire one
Shipping an agent earns credit. Switching one off earns nothing, and might break something. So they stay.
Every tool has its own console
Each platform shows its own agents, keys and bill. No console shows all of them. The gaps between consoles are where sprawl lives.
Our synthesis. The graphics are illustrative.
IBM and Oxford Economics, June 2026
70% say business teams deploy technology faster than IT can track it.
CIOs and CTOs reporting that business teams outpace IT’s ability to track deployments
This is not a failure of IT. It is the design of the tools. When a builder sits inside the product a team already pays for, the deployment happens before anyone thinks to mention it.
The tools are built to bypass the ticket
IBM IBV with Oxford Economics, 2,000 CIOs and CTOs, published June 8, 2026.
Veeam and Censuswide, September 2026
67% say employees are building autonomous workflows that IT cannot fully track.
EMEA enterprise IT, data and security leaders, from 1,000 respondents at organizations with 500 or more employees
70% say those workflows touch sensitive data without full oversight. In Germany the figures are 79% and 81%. The survey ran in April 2026, before most of these organizations had a registry to check against.
Germany, 79% building, 81% touching sensitive data
Veeam Research, Censuswide, 1,000 respondents, fieldwork April 21 to 27, 2026, published September 9, 2026. A vendor survey.
The confidence gap.
Confidence against discovery
The leaders most sure of their visibility are the ones most often surprised.
Two bars from the same survey. The first is how many security leaders say they have high visibility into their agents. The second is how many of them found an agent last year that nobody had told them about. The gap between the bars is the sprawl.
Why people go around the approved path.
Three patterns
Three agents you will find in every estate.
Nine agents that do one job
Sales, support, finance and three regions each built an invoice lookup. They disagree on the answer and all have write access.
An owner who left in March
It still runs on their credentials. Nobody knows what it does, so nobody dares switch it off.
A pilot that never ended
Built for a demo, wired to production, forgotten. It reads customer data nightly and sends it nowhere, until someone changes a table.
Composite patterns from published incidents and our own observations. The graphics are illustrative.
Agent washing adds to the count.
The temptation
Blocking agents does not work, and Gartner says so.
Employees who cannot use sanctioned tools turn to shadow AI, which carries more risk, not less.
The goal is a balance between governing agents and letting people innovate with them.
If you have no visibility of them, that is the huge risk for the organization.
Expect some agentic tools to fail
That is how you learn where they work.
Max Goss, Gartner, at the Digital Workplace Summit, London, April 2026, via Gartner’s press release and Computerworld. Paraphrased.
What it costs.
Incidents, leaks, canceled projects and the quiet waste nobody invoices.
This part puts numbers on the damage. Incidents per year and how serious they are, what agents did when nobody was watching, two incidents that made the papers, the leaky plumbing underneath, and the costs that never show up as an incident at all.
IBM and Oxford Economics, June 2026
Organizations averaged 54 agent incidents last year.
Unintended or harmful agent occurrences requiring human correction, per organization, in the past year
One a week. 17% were high severity, meaning more than four hours to contain. Organizations that embed control into their systems report 25% fewer incidents and deploy 16 times more agents.
One a week, and one in six is serious
IBM IBV with Oxford Economics, 2,000 CIOs and CTOs, published June 8, 2026.
A year of incidents
Fifty-four in a year, nine of them serious.
Each tick is an incident that needed a person to step in. The orange ones took more than four hours to contain. At this rate a large estate is never fully quiet, and the question stops being whether an agent will misbehave and becomes how fast you can find the one that did.
What the serious incidents did.
SailPoint, 353 professionals
What agents did when nobody was watching.
Reached unauthorized systems
Agents accessed systems or resources they were not meant to touch.
Shared sensitive data
Sensitive or inappropriate data shared by an agent, in a third of organizations.
Downloaded sensitive content
Content pulled down by an agent with no human asking for it.
Gave up credentials
Agents tricked into revealing access credentials. Almost one in four.
SailPoint, AI agents, the new attack surface, Dimensional Research, 353 respondents, May 28, 2025. 80% reported at least one unintended action. A vendor survey. The graphics are illustrative.
Two incidents that made the papers.
Fudan University and Central South University, May 2026
40.55% of live remote MCP servers expose tools with no authentication at all.
3,233 of 7,973 live remote Model Context Protocol servers found with no authentication
Of the 119 OAuth servers the researchers fully tested, every one had at least one authentication flaw. 96.6% had a dynamic client registration flaw. Nine CVEs came out of the study. These servers are the tools your agents call.
Every tested OAuth server had a flaw
Zhou, Zhang et al., A First Measurement Study on Authentication Security in Real-World Remote MCP Servers, arXiv 2605.22333, submitted May 21, 2026.
The plumbing underneath is leaky.
The quiet costs
The costs that never become an incident.
Complexity over value
More than four in five IT leaders say agent proliferation will bring more complexity than value, because of integration and silos.
Applications, 27% connected
The average organization manages 957 applications. Only 27% are connected. Every new agent lands on that fragmentation.
No real-time view of AI spend
85% lack full real-time visibility into AI spend. Duplicate agents mean duplicate model bills nobody can separate.
Projects canceled by 2027
Gartner’s forecast for agentic projects, on cost, unclear value or inadequate risk controls. Canceled projects leave agents running.
Salesforce Connectivity Benchmark via CIO Dive, February 2026. IBM IBV, June 2026. Gartner, June 25, 2025. The graphics are illustrative.
Okta, May 2026
58% of executives report an AI security incident or close call in the past year.
Executives reporting an AI related security incident or near miss in the past twelve months, from 292 executives in seven countries
The same executives are 95% confident they can detect an agent acting out of scope. Among employees using unapproved tools, 39% share confidential documents and more than 20% share login credentials.
Confident, and breached
Okta AI Agents at Work 2026, Apprize360, fielded March 2026, published May 27, 2026. A vendor survey.
What sprawl costs, by who pays.
For the board pack
Five questions the board will ask, in order.
How many agents do we run, and how sure are we of that number?
Which of them can touch customer data, money or production systems?
Who owns each one, and what happens when that person leaves?
How do we stop one, and how long does it take?
What did we retire last quarter?
The map.
A census with twelve fields per agent, and three ways to fill it in.
This part is the inventory. What a record holds, where to look, how to find agents that were never registered, Gartner’s six steps, and a score for how much of your own estate is on the map today.
A census, not a spreadsheet
A census asks the same twelve questions of every agent, and asks again every quarter.
A spreadsheet is filled in once and decays. A census is a process with a form, a deadline and a follow-up for the ones who did not answer. Every agent gets a record. Every record gets an owner. Every owner gets a date to confirm it is still true.
What a record holds. Twelve fields.
Three ways to find them
Three ways to fill the census in.
Read-only discovery
Scan clouds, clusters, CI pipelines and laptops for model calls, framework packages and agent processes. This finds what nobody declared.
Platform exports
Every builder platform can list its agents. Pull them all, weekly, into one place. This finds what was built in the open.
Ask the people
A two question form to every team. What agents do you run, and who owns them. This finds what the scan cannot see, and makes owners real.
Our method, consistent with the Cloud Security Alliance’s advice to treat agent creation as a governance event. The graphics are illustrative.
Where to look first.
The six steps Gartner names.
Gartner, April 2026
Only 13% of organizations believe they have the right agent governance in place.
Organizations that believe their AI agent governance is right, per Gartner
Seven in ten executives told IBM their existing governance is slowing their AI transformation. The map is the part of governance that makes the rest possible, and it is the part most often skipped.
Governance without a map is a policy nobody can check
Gartner press release, April 28, 2026. IBM Think 2026 recap, May 2026.
What a good map lets you say
Four sentences a good map lets you say.
We run 1,284 agents
A number, with a date and a method. Not a range someone guessed in a meeting.
Every one has an owner
And a deputy. When someone leaves, their agents move with their laptop and their badge.
Forty-one touch customer data
And here is the list, the tier, and the review date for each one.
Any of them stops in a minute
By its owner, by security, or by a policy that trips on its own.
The 1,284 figure is from a vendor’s illustrative dashboard, used here only as an example of the shape of the answer. The graphics are illustrative.
How much of your estate is on the map?
Five questions, scored one to five. Be honest. The score is for you.
Your map score
Unmapped. Start with the count this week.
If nothing is retired, the estate only grows. Put a review date on every record.
Questions for Monday
Four questions to ask on Monday.
How many model API keys exist across all our provider accounts, and who created each?
Which builder platforms can export a list of agents, and has anyone ever pulled it?
Which agents have no owner in the directory, because their owner left?
What is the one field on the census form we could not fill in for most agents?
The zoning.
One identity, a scope, a limit and a risk tier for every agent.
This part is about what each agent may touch. Why shared keys are how an estate loses its locks, what human controls do not translate, the three things every agent should carry, and the tiers that let controls scale with blast radius.
Okta, May 2026
Only 34% of organizations always apply the same security controls to agents as to people.
Organizations that always hold AI agents to the same security controls as human employees
Nearly two-thirds apply weaker controls to agents than to the people who built them. Yet 96% of executives say they are confident their identity systems protect non-human identities. The confidence and the controls are not in the same building.
Weaker controls, higher confidence
Okta AI Agents at Work 2026, 292 executives, published May 27, 2026. A vendor survey.
One key, many agents
A shared key is how a city loses its locks.
On the left, one API key serves a dozen agents. Rotate it and all of them break. Leak it and all of them are compromised. Nobody can say which one made the call. On the right, each agent carries its own identity. One can be revoked, limited, billed and blamed without touching the others.
Human controls, and what happens to them with agents.
Three things every agent carries
Three things every agent should carry.
Its own, not a person’s
A credential issued to the agent, bound to its owner, revocable on its own. Shared keys are retired as agents are registered.
A list of what it may call
Tools, connectors, data classes and systems, named. Anything not on the list is refused before the call is made, not reported afterward.
A cap it cannot cross
Spend per day, calls per minute, rows per query, and the actions that need a person. The cap is a breaker, not a dashboard.
Our framing. Consistent with Gartner’s third step and the CSA’s least privilege guidance. The graphics are illustrative.
Four tiers, set by what the agent can do.
Non-Human Identity Management Group, 2025
73% of secrets held by non-human identities carry excessive permissions.
Share of non-human identity secrets with more permission than their job needs. More than 5.5% of AWS machine identities hold full administrative rights
An agent inherits the permissions of whatever credential it was handed. If the credential was over-privileged before the agent existed, the agent is over-privileged on day one. Zoning starts by shrinking what the key can do.
The agent is only as scoped as its key
NHIMG, 2025 State of Non-Human Identities and Secrets, as cited by Suzu Labs, July 24, 2026.
What zoned looks like in practice.
Three violations
The three zone violations to catch first.
Reads beyond scope
An agent built for one region pulls customer records from all of them because the key allowed it. Nobody notices until an export.
Writes without approval
A tier 1 agent gains a write path through a new connector. The change was a settings toggle, not a release.
Calls an unlisted tool
An agent discovers a new MCP server and starts using it. 40% of remote servers need no authentication, so it just works.
Composite patterns. The MCP figure is from Zhou, Zhang et al., May 2026. The graphics are illustrative.
Questions for Monday
Four questions to ask on Monday.
How many agents run on a credential that belongs to a person?
Which agents can write to a system of record, and who approved each one?
Which MCP servers and connectors are approved, and where is that list?
What is the single most over-privileged key in the estate, and what calls it?
The permit.
Four gates from registration to retirement, so nothing runs without an owner and nothing runs forever.
This part is the lifecycle. The gates an agent passes, evals as a release gate, the controls that run on every call, when to retire an agent, the quarterly review, and a ninety day plan to put all of it in place.
Four gates
Every agent passes four gates, and the last one is a loop.
Register it, so it has a record and an owner. Test it, so it has evidence. Release it, with a canary and a way back. Review it, on a date, and retire it when the review says so. The first three gates are events. The fourth is a habit.
The four gates.
Evals as a release gate
An eval is a permit inspection.
A fixed set of cases
Real tasks with known right answers, plus the ugly ones. The set grows every time production finds a new failure.
Attacks, by tier
Prompt injection, data exfiltration, tool misuse. Tier 3 agents face more of them, and a person reads the results.
A number that blocks the release
Below it, the agent does not ship. The number is written down before the test, not after.
Our framing. The graphics are illustrative.
Controls that run on every call.
OutSystems, April 2026
12% of organizations have a centralized platform to manage agent sprawl.
Organizations with a central platform for managing agent sprawl, from 1,900 IT leaders
38% mix custom-built and pre-built agents, which makes the stack hard to standardize and secure. 52% rely on a human-on-the-loop model. A gate only works if there is one place the gate stands.
One in eight has somewhere to put the gate
OutSystems 2026 State of AI Development, April 7, 2026. A vendor survey.
Retirement debt
An agent that was never onboarded will never be offboarded.
Agents arrive in a steady stream. Without a review, none leave, and the estate becomes a pile of pilots, duplicates and orphans. With a review date on every record, the ones that no longer earn their place come down, and the estate stays the size of the work it does.
When to retire an agent.
The quarterly review
The quarterly review, in four questions.
Does the work still exist?
The process it served may have changed. Ask the owner to describe last month’s runs.
Does it do only what the record says?
Compare the trace against the scope. New tools and new data classes are a re-registration.
Is the owner still here and still willing?
An owner who has not looked in a quarter is not an owner.
Does the result justify the spend?
Cost per usable result against the human alternative. If it has lost, retire it with thanks.
Our template. The graphics are illustrative.
A ninety day plan.
Questions for Monday
Four questions to ask on Monday.
Which agents went to production without an eval anyone can show?
When did we last test a kill switch, and how long did the stop take?
Which agents have had no runs in sixty days?
What would it take to retire ten agents by the end of the quarter?
What comes next.
Six predictions we expect to be held to, and the strongest case against this report.
Each prediction comes with a date, a confidence, the reason we believe it, what would prove us wrong and the signals to watch.
Prediction 01 of 06 · Lyzr’s view
The agent registry becomes a standard control, like the CMDB and the directory.
Why we believe it
Gartner’s second step is a central inventory. IBM, the CSA and every identity vendor say the same. Auditors already ask for the list of service accounts. The list of agents is the same question.
What would prove us wrong
If the major platforms each ship a good enough inventory of their own agents, enterprises may accept five partial maps instead of one.
Signals to watch
- Audit frameworks add an agent inventory requirement
- Cyber insurers ask for the count
- Board packs carry a running agent number
Prediction 02 of 06 · Lyzr’s view
Per-agent identity replaces shared keys for anything that writes.
Why we believe it
Shared keys cannot be revoked one agent at a time, and 73% of non-human secrets are already over-privileged. Identity vendors shipped agent identity products in 2025 and 2026.
What would prove us wrong
If model providers make per-key scoping and spend caps good enough, teams may keep one key per team and scope inside it.
Signals to watch
- Provider consoles show agents, not keys
- SCIM and OIDC extend to agents by default
- Breach reports name the agent, not the service account
Prediction 03 of 06 · Lyzr’s view
Retirement rate joins deployment rate in the metrics a CIO reports.
Why we believe it
Gartner expects 40% of agentic projects to be canceled by 2027. The agents those projects leave behind are the next sprawl. A retirement number is the cheapest evidence of control.
What would prove us wrong
If agents become so cheap to run that nobody minds the zombies, retirement may stay a hygiene task rather than a reported number.
Signals to watch
- Platforms add last-run and auto-pause by default
- FinOps reports show per-agent spend
- CIO dashboards carry an agents retired figure
Prediction 04 of 06 · Lyzr’s view
Policy enforcement moves into the request path, and after-the-fact reporting stops counting as governance.
Why we believe it
A report after a bad call is a confession. Gateways that refuse out-of-policy calls exist today, and the incident numbers make the case for them.
What would prove us wrong
If latency or cost of an enforcement layer proves too high for high-volume agents, teams may accept monitoring plus fast rollback instead.
Signals to watch
- RFPs ask whether policy applies before or after the call
- Incident post-mortems cite missing gateways
- Insurers price in enforcement
Prediction 05 of 06 · Lyzr’s view
Agent counts converge, because the definition does.
Why we believe it
Twelve, 1,600 and 150,000 cannot all be the number. As registries spread, an agent will be defined by what it can do, and surveys will count the same thing.
What would prove us wrong
If platforms keep inventing new units, assistants, flows, skills, copilots, the definitions may fragment further before they settle.
Signals to watch
- Two major surveys use the same definition
- Standards bodies publish an agent definition
- Inventories distinguish agents that act from assistants that draft
Prediction 06 of 06 · Lyzr’s view
A regulator names an agent in an enforcement action, and boards start asking for the map.
Why we believe it
58% of EMEA leaders say they are now subject to new accountability laws, and 40% are concerned about personal liability. An agent that acts without a record is a case waiting to be made.
What would prove us wrong
If the first cases are settled quietly, or blamed on the vendor, boards may keep treating agents as an IT topic for another cycle.
Signals to watch
- An enforcement action cites an autonomous agent’s action
- Directors’ questionnaires add agents
- D&O insurers ask about agent governance
The strongest case against this report.
Where Lyzr fits.
Where it helps, and where to look elsewhere.
This part describes Lyzr’s relevant products in Lyzr’s own words, labeled as such, and a first step you can take without them.
Lyzr’s own description
Opencontroller, the control plane for agent sprawl.
Read-only discovery
Scans clouds, clusters and laptops and surfaces unregistered agents, by runtime and by owner.
Registry and release gates
A named owner, purpose, tools and risk tier per agent. Per-agent identity replaces shared keys. Evals gate the release.
Policy on every call
Gateways with virtual keys and team budgets, guardrails for injection, personal data and secrets, and traces tied to an owner and a cost.
Failures become tests
Production failures are grouped, fixes are validated on held-out cases, and each fixed issue becomes a new test.
Lyzr, Opencontroller product page, October 2026. A vendor description. The sample figures are from an illustrative dashboard, not independent findings. The graphics are illustrative.
Opencontroller against the four gates in this report.
Lyzr’s products, in one line each.
Where Lyzr fits, and where to look elsewhere.
A first step, one week of discovery.
Six questions to ask any vendor, including us.
About Lyzr
The full-stack agent infrastructure platform for enterprises and governments that want to own their intelligence.
Founded in New York in 2023. Agent Studio, Architect, Opencontroller, Open Cowork, Openfinetuner, Optimus and Madison cover building, governing, running and owning agents. Deploys in your AWS, Azure or GCP account, a dedicated tenant, SaaS, on bare metal, fully air-gapped, or on the Optimus appliance.
Backed by Rocketship.vc, BGV, Accenture Ventures, GFT, the Partnership Fund for New York City and Plug and Play.
Sources and notes
Every fact, and where it came from.
- Gartner, Gartner Identifies Six Steps to Manage AI Agent Sprawl, press release, April 28, 2026.
- Computerworld, Gartner sees untamed growth in agentic AI, April 30, 2026, quoting Max Goss.
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027, press release, June 25, 2025, read via W.Media.
- IBM, Managing agentic AI’s speed, scale and sprawl, Insights from Think 2026, May 2026.
- IBM Institute for Business Value with Oxford Economics, CIOs and CTOs Face Growing AI Control Gap, 2,000 executives, June 8, 2026, read via MarketScale.
- CIO Dive, IT leaders grapple with AI agent sprawl, on the Salesforce 2026 Connectivity Benchmark, 1,050 IT leaders, February 5, 2026.
- OutSystems, 2026 State of AI Development, 1,900 IT leaders, April 7, 2026.
- SAP News, AI Agent Sprawl, Why AI Governance Is Now a Board-Level Issue, on the SAP LeanIX Agentic AI Survey 2026, August 3, 2026.
Sources and notes
Every fact, continued.
- Cloud Security Alliance, The Shadow AI Agent Problem in Enterprise Environments, on the CSA and Token Security survey, April 28, 2026.
- Okta, AI Agents at Work 2026, Apprize360, 292 executives and 492 workers, May 27, 2026.
- SailPoint, AI agents, the new attack surface, Dimensional Research, 353 respondents, May 28, 2025.
- Veeam Research with Censuswide, EMEA Organizations Facing a Shadow Agent Crisis, 1,000 respondents, September 9, 2026.
- Zhou, Zhang, Zhang, Zhang, Zhang and Yang, A First Measurement Study on Authentication Security in Real-World Remote MCP Servers, arXiv 2605.22333, May 21, 2026.
- Suzu Labs via Security Boulevard, The Agent Identity Problem, July 24, 2026, compiling CSA, NHIMG, GitGuardian, Entro and Google Threat Intelligence figures. A secondary source for those figures.
- Mintive, on the Replit agent production database deletion of July 2025, April 1, 2026, citing Business Insider, The Register, Gizmodo and SFGate.
- Microsoft, Looking back on Microsoft’s FY26, July 28, 2026, for the Atos, Chow Tai Fook, Cactus and Navien figures. Vendor published.
Figures were checked in October 2026. Where a figure reached us through a secondary source we say so on the slide. Vendor surveys are labeled as such. Lyzr’s own descriptions appear only in Part 8 and are labeled as vendor descriptions.
Sources and notes
The ideas, and who had them.
- Urban sprawl and the tools cities built for it. The census, the zoning code, the permit office.Count, zone, permit, retire
- Gartner’s six steps to manage agent sprawl, April 2026.Inventory first, then identity, then monitoring
- The Cloud Security Alliance’s framing of agent creation as a governance event, and retirement debt.Onboarding decides offboarding
- Linux Foundation, Agentic AI Foundation, December 9, 2025, with more than 10,000 published MCP servers.Open standards make the estate larger, and the map possible
The twelve field record, the four tiers, the four gates, the retirement signals, the ninety day plan and the map score are our own, offered to be argued with.
Your next step
Count one estate first.
Leave with a first count, a shadow list and an owner beside every agent on it. One week, read-only, and an honest view of what a full census would show.
01
Scan it
One cloud account and one builder platform, read only.
02
Name it
An owner for every agent found, or a pause.
03
Scope it
Three high tier agents given their own identity.