The Visibility Gap in Autonomous AI Agents

Most organizations lack comprehensive visibility into their autonomous AI agents as adoption scales, according to findings from the Cloud Security Alliance's Securing Autonomous AI Agents survey commissioned by Strata. Only 21 percent maintain a real-time registry or inventory of agents. Thirty-two percent rely on non-real-time records, 32 percent plan to build one in the next year, 8 percent have no registry, and 9 percent are unsure. When registries exist, approaches vary and often provide only partial views. Sixty percent of organizations use a custom or standalone database, 42 percent an identity provider, 34 percent an internal service registry or fabric, and 17 percent a third-party agent platform or orchestration tool. Agents operate in public clouds at 66 percent of organizations, on premises at 37 percent, private clouds at 36 percent, and hybrid configurations at 38 percent. Traceability of agent actions is also limited for most. Twenty-eight percent can reliably trace agent actions to a human or system across all environments. Forty-six percent can do so only in some environments, 9 percent cannot at all, and 16 percent are unsure. Monitoring practices include end-to-end session tracing at 45 percent of organizations and context-aware audit logging at 43 percent, while 19 percent have none of these controls. Sixty-eight percent of respondents rate human-in-the-loop oversight as essential or very important in response to visibility shortfalls. Such oversight is required for access to sensitive data by 69 percent, system changes by 68 percent, financial transactions by 62 percent, and granting permissions by 51 percent. The report indicates organizations are in a time-to-trust phase while developing capabilities for continuous discovery, real-time registries, traceable identity orchestration, and audit-friendly observability.