98% of companies use AI in customer service. Only 15% run it across departments

The gap between buying and running

Talkdesk's NewtonX study surveyed 252 senior decision-makers across North America, EMEA, LATAM and APAC, and the headline numbers describe two different companies. Almost every firm surveyed uses AI in customer experience: 98% do. Only 15% combine agentic AI with autonomous execution across departments. The technology arrived; the operating model did not. m:…4569

The middle of the survey fills in the picture. The study found 64% of respondents use specialised AI agents that hand work off between functions, 35% have agents that maintain context and act across systems, and 23% run persistent, long-running workflows. Meanwhile 83% expect autonomous resolution rates to rise over the next two years. The bet is placed. What is missing is the proof: only 5% of companies can clearly quantify AI's business impact. m:…4569

Security cannot define normal

The same gap shows up on the security side. Abnormal Security's 2026 State of Security report surveyed 525 cybersecurity leaders across six countries, and 46% of respondents said they are not at all effective at establishing and maintaining behavioural baselines for AI agents. More than half of organisations, 54%, maintain baselines for AI agents, yet 53% do not establish normal for machine identities at all. m:…3233

This matters because detection without a baseline is guesswork with an alert attached. The survey found 81% of respondents rely on behavioural anomaly detection to a major or extensive degree, and 90% say understanding why an anomaly triggered is very or critically important to how they respond. But 51% of teams need four hours or more to fully investigate and remediate a single behavioural detection, and one in ten teams needs at least a full day. Agents are being deployed faster than the teams watching them can keep up. m:…3233

The vendors are selling the fix

Two vendors this week are selling the same answer from different directions: the product is not the hard part, the operation is. Stacklok argues that enterprise agents need guardrails at three control points — a governed data gateway, a model gateway and infrastructure-level controls — because sandboxing alone is insufficient for agents that run asynchronously, spawn sub-agents and hold their own identity. Its point is blunt: infrastructure-level controls are necessary because agents can optimise around application-layer constraints. m:…9672

Genesys is selling the people instead. The company expanded its forward-deployed engineering teams, which work alongside customers on high-value agentic AI use cases and help them navigate integration, governance and operational requirements. Genesys says Banco de Crédito del Perú, eir and Riachuelo have used these teams to bring agentic AI use cases into production. Its cloud platform powers more than 33 billion interactions a year and serves over 7,500 customers, so the pitch is scale plus a human on site. m:…3420

What this means for buyers

The pattern across all four sources is that the agentic AI market has moved from selling capability to selling governability. Talkdesk's numbers say buyers cannot yet prove the return; Abnormal's say security teams cannot yet define normal; Stacklok and Genesys are monetising the gap between the two. For an executive signing off on an agent rollout, the implication is to budget for the control layer and the measurement layer at the same time as the agent itself, not as a later phase. m:…4569 m:…3233 m:…9672 m:…3420

There is also a spending signal worth watching. The Abnormal survey found 43% of security leaders will put their greatest behavioural-monitoring investment into AI agents over the next two years. If that money lands before the baselines exist, teams will own better detectors for behaviour they still cannot define. The first question to ask any vendor is not what the agent can do, but how the buyer will know whether it did it well. m:…3233