THE GAP BETWEEN DEPLOYING AND SECURING

DFEI.011's main issue cites Gravitee's own survey data, run across multiple waves, showing enterprise agent estates doubling in four months while 48 percent of production agents remain unsecured and 54 percent of organizations have already had an incident. The report's own title for this finding, "Adoption Is Outpacing Control," describes a trend, not a cause. This VSR treats the gap as a diagnosable problem rather than an inevitable maturity lag, and provides a structured way to identify the specific, addressable reasons it persists inside a given organization.

"Security is still catching up" is the default explanation for why agent deployment consistently outpaces agent security coverage, and it's rarely interrogated further. Gravitee's own data suggests the gap isn't closing as the category matures, it's widening across survey waves, which is inconsistent with a simple maturity story. The specific failure this VSR addresses: organizations accept the gap as a natural feature of a fast-moving category, rather than diagnosing which specific organizational blocker (budget, ownership, tooling, process) is sustaining it.

Gravitee's report, fetched directly and updated as recently as April 2026 with a sample of 750 senior technology leaders, frames its own headline finding explicitly as "Adoption Is Outpacing Control": agent estates have doubled in four months since December 2025, 48 percent of production agents are running unsecured, and 54 percent of organizations have already had a security incident. This is the second survey wave described in the report's own framing, meaning the gap is a tracked trend, not a single snapshot, and the trend is not visibly narrowing.

This matters for the Table's central question in DFEI.011 because it grounds an otherwise abstract observation, that permission and identity infrastructure isn't keeping pace with deployment, in something an individual organization can actually act on. "The industry is still maturing" isn't a lever anyone inside a single organization can pull. A named, specific blocker is.

What is specifically blocking coverage from matching deployment pace, by name?

This reframes the conversation from a category-level trend ("security lags adoption industry-wide") to an organization-level, actionable question ("what, specifically, is stopping us from closing this gap here").

5.1 Blocker Categorization

Blocker Categorization answers:

Which of a small set of recurring, nameable causes is actually driving the gap in this organization?

Examples: - Ownership gap: no single team or role is accountable for agent security coverage specifically, as distinct from general application security - Velocity mismatch: deployment approval is fast (a business unit can stand up an agent quickly) while security review is slow, creating structural incentive to deploy first and seek coverage later, or never - Tooling gap: the organization has identity/permission tooling but it wasn't built or configured for agent-specific access patterns, leaving a coverage illusion (a tool exists, but it doesn't actually cover the relevant risk) - Visibility gap: the organization doesn't have a complete inventory of deployed agents at all, making coverage impossible to assess, let alone close

Failure pattern:

Organizations default to "we need more security headcount" without first identifying which of these categories is actually driving their specific gap, and frequently add headcount to a process problem that headcount alone doesn't fix.

5.2 Gap Trend Direction

Gap Trend Direction answers:

Is this organization's specific coverage gap narrowing, holding steady, or widening, tracked over time, not assumed?

Examples: - Compare deployment count and secured/reviewed count at two points in time, at least one quarter apart - If the gap is widening, that rules out "we're maturing at a normal pace" as an adequate explanation, matching Gravitee's own industry-level finding - If the gap is narrowing, identify what specifically changed, so it can be reinforced rather than left to chance

Failure pattern:

Organizations assume their own gap is narrowing because the category overall is "maturing," without ever actually measuring their own trend, which is exactly the assumption Gravitee's own repeated survey waves argue against at the industry level.

Unnamed Accountability

No specific person or team owns closing the gap, so it persists by default, not by decision. Everyone agrees it's a problem; no one is accountable for the number moving.

Maturity Fatalism

The gap is treated as an inevitable feature of a fast-moving category that will resolve as the category matures, rather than a process failure that requires a specific fix. Gravitee's own data, showing the gap tracked across multiple waves without closing, argues directly against this framing.

Coverage Illusion

The organization has security tooling that technically exists but wasn't built or configured for agent-specific risk, creating a false sense that the gap is smaller than it is. This is functionally the same failure LiteLLM/TeamPCP (VSR-02) demonstrates at the dependency layer: a control existed, and the breach happened anyway, because the control didn't cover the actual exposure.

Purpose

Produces a documented, named diagnosis of what's driving an organization's specific agent security coverage gap, and an owner for closing it, replacing "we're still maturing" with an actionable cause.

Use when

• Coverage gap concerns are raised (internally, by a board, or by an incident) without a specific named cause already identified
• Periodically, alongside any broader security or governance review, to verify the gap is being actively tracked rather than assumed to be improving

What it creates

A single register naming the organization's specific blocker category, its trend direction, and an accountable owner for closing it.

Technical version

coverage_gap_root_cause:
  date_assessed:
  agent_inventory_complete: true/false
  deployment_count:
  secured_or_reviewed_count:
  coverage_percentage:
  trend_vs_last_assessment: narrowing/steady/widening
  primary_blocker_category: ownership_gap/velocity_mismatch/tooling_gap/visibility_gap
  blocker_description:
  accountable_owner:
  planned_remediation:
  next_review_date:

Manual / no-code alternative

A shared document reviewed quarterly, naming the current coverage percentage, its trend since the last review, the primary blocker category, and who owns closing it.

Output

A documented, trackable diagnosis, replacing an assumed maturity narrative with a specific, owned, addressable cause.

Failure prevented

Treating a persistent security-coverage gap as a natural maturity curve that will close on its own, when it is actually being sustained by specific, addressable organizational blockers.

A coverage gap that widens across multiple survey waves isn't immaturity. It's a process that isn't working, and needs a named cause.

Applied to Gravitee's own industry-level finding: a 48 percent unsecured rate and a widening gap across survey waves rules out simple maturity as a sufficient explanation, the same category has now been measured twice, months apart, without the gap closing. An organization running the register against its own numbers might find, for instance, a visibility gap (no complete agent inventory exists, so coverage can't even be measured accurately) sitting underneath what initially looks like a tooling problem. Naming that specific blocker, rather than citing industry-wide immaturity, is what turns the diagnosis into something an accountable owner can actually act on.

This VSR does not claim its four blocker categories (ownership, velocity, tooling, visibility) are exhaustive; an organization's specific gap may be driven by a cause outside this framework, and the register should be treated as a starting diagnostic, not a complete taxonomy. It also does not claim that closing an identified blocker guarantees adequate security coverage, only that it replaces an unnamed, unowned gap with a named, owned one, which is a precondition for closing it, not a guarantee of success.

The distinction this VSR exists to hold: "adoption is outpacing control" is an accurate description of a trend and an inadequate explanation of a cause. Gravitee's own data, tracked across survey waves, shows the gap isn't closing as the category matures, which means whatever is driving it is not simply immaturity that time will resolve. Somewhere inside every organization running that 48 percent unsecured statistic is a specific, nameable reason coverage isn't keeping pace, an ownership gap, a velocity mismatch, a tooling gap, or a visibility gap. Naming it is the first structural difference between an organization that closes the gap and one that keeps citing industry-wide numbers as an explanation for why it hasn't.

DFEI.011 :: VSR-04 :: The Gap Between Deploying and Securing Dispatches From Emerging Intelligence