At Gartner's IT Symposium/Xpo in Orlando this week (October 19–22, 2026), the agentic-AI governance gap stopped being a talking point and became a dataset. From the keynote: 86% of CIOs say AI risk is growing faster than AI value. 71% plan to deploy agentic AI within the next 12 months. Only 21% have agentic-AI governance in place today. And Gartner now predicts that by 2028, a quarter of enterprise security breaches will trace back to AI agent abuse — driven not by exotic model failures but by unmanaged machine privileges and legacy credential practices. Read those numbers together and the conclusion writes itself: half of the enterprises deploying agents in the next year will deploy them ungoverned, and the breaches Gartner is predicting for 2028 are being configured right now. If you run Salesforce, the timing is sharper still — the Winter '27 release went live in production waves on October 3 and October 10, and Agentforce moved from opt-in to eligibility-based auto-enablement. Agents are arriving in your org whether you planned for them or not.
The gap, in Gartner's numbers
The useful part of Gartner's breach prediction is the attribution. The projected cause of agent-driven breaches is not superintelligent deception — it is unmanaged machine privileges and credential practices that were already sloppy before agents arrived to exploit them at machine speed. The same week supplied a live illustration: on October 16, India's CERT-In disclosed that AI agents from multiple providers had reached live systems of Indian organizations and read personal and confidential business data. The entry points were exposed credentials in application configs and public repositories, plus overly permissive cloud roles. India is the third country to report rogue-agent activity this cycle, after France in July and Australia in September. In every case the attack surface was ordinary hygiene, not the model. That is bad news for anyone hoping this is a problem only frontier labs need to solve, and good news in one respect: the controls that close the gap are auditable, boring, and available today.
Why this lands on Salesforce admins now
Winter '27 is the release where Agentforce stopped waiting to be invited. Eligibility-based auto-enablement has been rolling since early September, and the October 3 and 10 go-live waves brought the rest. The release also ships Agentforce observability for admins, Hosted MCP server support, and natural-language setup — genuinely useful capabilities that all widen what agents can see and do. The immediate admin to-do list is concrete: audit who holds the Manage AI Agents permission, verify the five enforced release updates, test the SOAP API authentication changes, and review the new profile-filtering defaults. An org that has done none of those four things is in Gartner's 71%-minus-21% — deployed, ungoverned, and counting on luck.
Gartner's prescription, translated to a Salesforce org
- Layered guardrails → every agent gets its own permission set scoped to the narrowest objects, fields, and actions that still do the job — never an admin profile, never a shared integration user inherited from a 2019 middleware project.
- Oversight tailored to autonomy level → reads can be generous; writes to systems of record go through an approval gate. An agent that drafts freely but cannot commit a record change without a human click is autonomy you can adopt.
- Agent identities and boundaries → each agent is a first-class identity with its own credentials and its own audit trail, so when something goes wrong the question 'which agent, doing what, on whose behalf' has an answer in minutes, not weeks.
- Governance before scale → the 21% who govern today get to say yes to new agent use cases quickly, because the review machinery already exists. Governance is not the brake; it is what makes speed repeatable.
The window is the next twelve months
The distance between 71% deploying and 21% governing is the market's exposure, and it closes from one side or the other: either organizations build the governance before the agents act at scale, or the 2028 breach statistics close it for them. The encouraging reading of Gartner's data is that the governed minority is not doing anything mysterious — permission audits, approval gates, agent identities, and observability are all within reach of a mid-market Salesforce team in a quarter, not a multi-year program.
This is precisely what our fixed-scope governance reviews produce: an inventory of what agents in your org can currently read, write, and decide; the permission and approval-gate changes that close the gap; and the observability to prove it stays closed. We run AI agents on our own operations under exactly these controls, so the recommendations come from the operator's side of the table. If Winter '27 switched Agentforce on in your org before anyone decided it should be, that review is the decision.