How Many AI Agents Per Enterprise 2026? The Real Number

Published counts range from 12 to 150,000 per company. Here is why the numbers diverge, what each one actually measures, and the governance gap underneath.

How many AI agents per enterprise in 2026?

The honest answer to how many AI agents per enterprise in 2026 is: it depends entirely on what you count. The average organization runs about 12 distinct agents today (OutSystems), a large enterprise will operate roughly 1,600 agents by year-end (IBM), and Gartner projects the average global Fortune 500 will hit 150,000-plus by 2028. None of these numbers contradict each other — they measure three different things.

Walk into any 2026 board deck and you will see a wildly different figure depending on which analyst the slide cribbed from. A mid-market CIO cites 12. An IBM keynote says 1,600. A Gartner futures slide says 150,000. A security vendor says non-human identities outnumber your employees 144 to 1. People treat these as competing claims and pick the one that fits their narrative. That is the wrong instinct.

The divergence is not noise — it is a definition problem. Some counts measure distinct, named agents (the logical things a team deploys). Some measure agent instances or runtime workers (the same logical agent, replicated). And some measure non-human identities, or NHIs — every service account, token, and machine credential an agent fleet creates. Once you separate those three lenses, the numbers line up into a single, coherent story.

This article does what the stat-dump roundups do not: it reconciles every headline count into one timeline, tells you which definition each figure uses, and pairs the count with the two numbers that actually matter for risk — the NHI ratio and the share of companies that can produce a complete agent inventory (about 18%). If you only remember one thing: the question is never how many agents you run, it is how many you can name.

Why do the published AI agent counts diverge so wildly?

The counts diverge because each source measures a different unit: distinct agents (about 3-12 per org), agent instances (hundreds to ~1,600 per large enterprise), or non-human identities (tens of thousands). A 100x gap between two ‘agents per enterprise’ figures usually means one counted logical agents and the other counted credentials.

Think of it like counting an organization’s headcount. Distinct agents is like counting job roles — ‘we have a sales role, a support role, a research role.’ Agent instances is like counting the people in those roles — one support role might be staffed by 200 agents handling 200 conversations at once. Non-human identities is like counting every badge, VPN cert, and database login those people hold — which can be dozens each. All three are legitimate; they answer different questions.

The OutSystems figure of 12 is a survey of what IT leaders say they have deployed — distinct, recognized agents. The IBM 1,600 figure describes the full operational footprint of a large enterprise’s ‘digital workforce,’ which counts running instances and embedded copies, not just the dozen agents a platform team would list. The Gartner 150,000 figure for 2028 is closer to a non-human-identity projection: every task-specific agent embedded in every application, multiplied across a global Fortune 500’s app estate.

This is exactly the gap the incumbent stat roundups gloss over. They drop ’12’ and ‘1,600’ and ‘150,000’ into the same bullet list as if they describe the same thing, which is how a reader ends up confused. The fix is a single chart with each point labeled by its definition — which is what we built below.

AI agent sprawl statistics 2026: the reconciled timeline

Reconciled onto one log scale, the trajectory is clear: the average enterprise had fewer than 15 agents in 2025, runs about 12 distinct (or ~1,600 total) in 2026, climbs toward 20 distinct by 2027, and is projected past 150,000 embedded agents by 2028. The curve only looks contradictory until you label each point with the unit it counts.

Here is the core AI agent sprawl statistics 2026 picture in one place. Gartner’s baseline is that the average enterprise ran fewer than 15 AI agents in 2025. OutSystems, surveying 1,900 global IT leaders in December 2025 through January 2026, found the average organization now runs 12 distinct agents, rising to about 20 by 2027. IBM, at Think 2026, projects most large enterprises will operate over 1,600 agents (counting the full digital-workforce footprint, not just distinct ones) by the end of 2026. And Gartner projects the average global Fortune 500 will exceed 150,000 agents by 2028.

The chart plots these on a logarithmic y-axis because a linear axis would crush everything below 1,600 into a flat line. The annotation band carries the two risk numbers that the raw counts hide: non-human identities already outnumber humans 144 to 1 in cloud-native environments, and only about 18% of organizations can produce a complete inventory of the agents they are running.

Read the curve as three stacked stories, not one. The distinct-agent line (12 then 20) is the slow, governable layer — what platform teams actually manage. The instance line (1,600) is the operational reality of replication and embedding. The 2028 projection is the NHI explosion. The gap between the bottom line and the top line is, quite literally, the sprawl.

What is the non-human identity ratio in 2026?

The non-human identity ratio in 2026 is roughly 144:1 in cloud-native environments — meaning machine identities outnumber human ones 144 to 1 — up from 92:1 in the first half of 2024. Across all enterprise environments the ratio is lower but still stark, at about 45:1. This is the number that turns an ‘agent count’ into a security problem.

Every agent that does real work needs to authenticate. It needs an API key to call a model, a token to hit your CRM, a service account to read a database, a credential to post to Slack. A single distinct agent routinely holds five to ten of these. Multiply that by instances, and the credential count detonates. That is why Entro Labs measured a 144:1 NHI-to-human ratio in cloud-native and DevOps environments in its H1 research, a 56% jump from the 92:1 it saw in H1 2024. Rubrik Zero Labs puts the broader enterprise-wide ratio nearer 45:1.

The reason this ratio matters more than the agent count is accountability. Most of these non-human identities authenticate continuously, carry standing permissions that would get a human account flagged instantly, and rarely rotate. The Cloud Security Alliance found that 68% of organizations cannot clearly distinguish AI agent activity from human activity in their own logs, and a separate CSA survey reported that 82% of enterprises have unknown AI agents operating in their environments. You cannot revoke, audit, or attribute an action to an identity you never registered.

This is the pairing the incumbent roundups never make. They will quote ‘1,600 agents’ and move on. The useful version is: 1,600 agents, each carrying a handful of non-human identities, in an environment where two-thirds of teams cannot tell agent actions from human ones. That is the actual risk surface.

What percentage of companies have a complete AI agent inventory?

Only about 18% of organizations maintain a current, complete inventory of the AI agents running inside their walls, according to IBM’s Think 2026 research. Just 12% have a centralized platform to manage agent sprawl, and 70% say their existing AI governance is not fit for purpose. The governance gap, in other words, is wider than the adoption gap.

Pair that 18% with the adoption numbers and the picture sharpens. OutSystems found 96% of organizations already use AI agents and 94% are concerned that sprawl is increasing complexity, technical debt, and security risk. So nearly everyone has agents, nearly everyone is worried about them, and fewer than one in five can list them. That is not a maturity curve — it is a visibility cliff.

The OutSystems data adds a structural reason it stays bad: 38% of organizations mix custom-built and pre-built agents, producing AI stacks that are hard to standardize and secure. When agents arrive from a low-code studio, a SaaS vendor’s embedded copilot, and a homegrown framework all at once, there is no single registry that sees them all. Microsoft’s own telemetry shows more than 80% of the Fortune 500 now run active agents built with low-code and no-code tools — exactly the channel that produces shadow agents nobody centrally tracks.

The fix the major vendors are converging on is an agent control plane: a single registry plus policy layer that issues every agent an identity, enforces least-privilege, and logs every action for attribution. IBM is positioning the next watsonx Orchestrate as that control plane; Microsoft made Agent 365, with its agent registry, generally available on May 1, 2026. Whichever you pick, the metric to manage to is inventory completeness — agents you can enumerate divided by agents that exist — and today the industry average sits around that grim 18%.

Average number of AI agents per company by size and sector

The average number of AI agents per company is not a single number — it scales with company size. Fortune 500 organizations average 3.4 distinct agents in 2026, mid-market firms about 1.9, and SMBs around 1.2, while the cross-industry average of distinct deployed agents sits near 12. Financial services and technology lead on production deployment.

This size gradient explains another apparent contradiction. How can the Fortune 500 average only 3.4 distinct agents while the all-org average is 12? Because ‘distinct agents’ in the Fortune 500 dataset counts production-grade, formally deployed agents — large enterprises are conservative about what they call production. The broader 12-agent average includes the long tail of pilots, departmental experiments, and low-code copilots that smaller and faster-moving organizations spin up freely. Bigger companies run more total agents (hence IBM’s 1,600 instance count) but fewer they will formally claim.

By sector, the OutSystems and Microsoft data agree that software and technology firms lead, followed by manufacturing and financial services, with financial services and tech reporting the highest share of agents actually in production rather than pilot. The 2027 projection of about 20 distinct agents per org represents the pilots that survive — and given that Gartner expects more than 40% of agentic AI projects to be canceled before end of 2027, the gap between agents launched and agents kept will be a defining metric.

For planning, treat these as the working numbers: small teams should expect to manage a handful of distinct agents but dozens of non-human identities; large enterprises should plan governance for thousands of instances even if their ‘official’ distinct-agent count is in single or low double digits. Size your control plane for the instance and identity count, not the tidy distinct-agent number on the slide.

What the divergent agent counts mean for governance in 2026

The practical takeaway is that no single ‘agents per enterprise’ number should drive your strategy — the spread between your distinct-agent count and your non-human-identity count is the metric that predicts risk. Govern to the gap, not to the headline. Companies that close inventory completeness before scaling agents avoid the sprawl that 94% of their peers already fear.

Operationally, that means three moves. First, instrument identity issuance, not model calls — register every agent and every credential it holds at creation time, so your inventory is complete by construction rather than reconstructed after the fact. Second, enforce least-privilege per agent identity with policy on every path, so a compromised non-human identity cannot delete a database in nine seconds (the failure mode IBM uses to dramatize the governance gap). Third, make agent actions attributable in logs, because 68% of organizations currently cannot tell an agent’s action from a human’s — and an audit trail that cannot do that is already broken.

The vendors have read the same data. IBM, Microsoft, and the broader control-plane category are all selling registry-plus-policy as the answer, and the convergence is telling: Microsoft folded its Entra agent registry into Agent 365 as it went GA, signaling that identity, not orchestration, is the center of gravity. Whether you adopt a vendor control plane or build your own, the scoreboard is the same — inventory completeness, NHI-to-agent ratio, and action attributability.

So when someone asks how many AI agents per enterprise in 2026, the precise answer is: about 12 you would name, roughly 1,600 actually running, tens of thousands of credentials behind them, and on a trajectory toward six figures by 2028 — and the only one of those numbers you fully control today is the 18% you can actually see.

Builder’s take

I run an agent fleet in production at Cyntr, so I read these headline counts the way an SRE reads a dashboard with three different y-axes. Here is what I actually watch for:

• The number that matters is not ‘how many agents do we run’ — it is ‘how many agent identities can we name, revoke, and attribute an action to.’ Those are different fleets, and the second is always smaller.
• Most ‘1,600 agents’ counts are really credential counts. One logical agent at Cyntr can spawn dozens of short-lived workers, each needing a token. If you measure non-human identities you get a scary number; if you measure distinct agents you get a boring one. Both are true.
• Sprawl is a credential-lifecycle problem before it is an AI problem. The day you cannot tell an agent’s action from a human’s in your logs is the day your audit trail is already broken — independent of how ‘smart’ the agent is.
• The honest internal metric is the inventory-completeness ratio: agents you can enumerate divided by agents that exist. At ~18% industry-wide, most companies are flying on 1-in-5 visibility.
• If you only instrument one thing this quarter, instrument identity issuance, not model calls. You cannot govern what you never registered.

Frequently asked questions

Primary sources

• Managing agentic AI’s speed, scale and sprawl: Insights from Think 2026 — IBM
• IBM says enterprises will run 1,600 AI agents by year-end; 70% can’t govern the ones they have — Beam AI
• Agentic AI Goes Mainstream in the Enterprise, but 94% Raise Concern About Sprawl — OutSystems
• Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026 — Gartner
• More Than Two-Thirds of Organizations Cannot Clearly Distinguish AI Agent from Human Actions — Cloud Security Alliance
• New CSA Survey Reveals 82% of Enterprises Have Unknown AI Agents in Their Environments — Cloud Security Alliance
• The Non-Human Identity Crisis: Why Your Machine Identities Are Your Biggest Governance Gap — The Hacker News
• 80% of Fortune 500 use active AI Agents: Observability, governance, and security shape the new frontier — Microsoft Security
• AI Agent Adoption 2026: 120+ Enterprise Data Points — Digital Applied
• Microsoft Agent 365, now generally available, expands capabilities and integrations — Microsoft Security

Last updated: June 2, 2026. Related: Governance.