85% of enterprises now have AI agent pilots running. Only 5% have shipped an agent to production, according to Cisco’s own customer data. The usual read on that gap is “leadership is still cautious about AI.” The release-engineering read is different: teams don’t have a pipeline they can trust to gate a production deploy, and the data backs that up.
The gap is a testing gap, not a trust gap
A VentureBeat Pulse survey of 157 qualified enterprises found that 66% already allow some production deployment without human review, or plan to within 12 months — while only 5% say they fully trust the automated evaluations behind those release decisions. Half of enterprises have shipped an agent that passed internal evals and still caused a customer-facing failure, and a quarter of those said it happened more than once. That is exactly the failure mode CI/CD was built to catch in traditional software: tests pass, production breaks anyway, because the test suite doesn’t match the real traffic shape.
The same survey found containment lagging just as badly as evaluation: 47% of enterprises observe agent activity, 49% enforce scoped runtime permissions, but only 30% isolate their highest-risk agents in a sandbox that bounds the blast radius when the other controls fail. That’s a rollback strategy most infra teams would never accept for a database migration, applied instead to a system that can take autonomous actions.
Confidently wrong is a data problem, not a model problem
A separate VB Pulse survey of 101 enterprises found that 57% have traced a confidently-wrong agent answer to missing or inconsistent business context in the last six months, and 31% said it happened more than once. Only 25% run a governed context layer in production today; 34% are building one. The uncomfortable finding: even among teams already running or building a context layer, 78% still report a confident-wrong failure. A context layer helps, but it isn’t the whole fix if it isn’t tested under the same rigor as the agent itself.
What “testing an agent” should actually mean
A practice worth watching closely is intent-based chaos testing: a pre-production gate that checks whether an agent stays inside its intended behavioral boundaries under realistic failure conditions, instead of relying only on offline evals against a fixed dataset. It’s the same instinct that made chaos engineering standard for microservices a decade ago, applied to a system whose failure mode is a wrong decision instead of a dropped request.
Three gates worth treating as non-negotiable before an agent reaches production:
- Evaluation you’d actually bet on — if your team wouldn’t gate a database migration on it, don’t gate an agent’s autonomy level on it either.
- Scoped, per-agent identity — 54% of enterprises have already had an AI agent security incident, and 69% still share credentials across agents instead of issuing per-agent, scoped access.
- A sandbox for the highest-risk agents — not full observability everywhere, but at minimum a bounded blast radius for the agents that can take irreversible actions.
Platform launches won’t close this gap for you
Nvidia and OpenAI are racing to own the deployment layer — Nvidia’s Agent Toolkit launched at GTC 2026 with 17 enterprise adopters including Adobe, Salesforce and SAP, and OpenAI’s newly announced “Presence” platform ships with built-in guardrails and pre-deployment simulations, but only through a limited program staffed by forward-deployed engineers, not self-service. Useful tooling, but it doesn’t replace an internal release pipeline. A SailPoint-backed survey of 353 IT and security professionals found that 8 in 10 companies report agents took actions they weren’t meant to — unauthorized system access, inappropriate data sharing, downloading sensitive content — and only 54% claim full visibility into what data their agents can even access. No vendor platform fixes that without the engineering team building the identity, sandboxing and monitoring layers themselves.
Gartner’s forecast that over 40% of agentic AI projects will be canceled by 2027 isn’t a verdict on agents — it’s a forecast about teams that never built the release pipeline in the first place.
The teams closing the gap treat this as an engineering problem
McKinsey finds only around 10% of organizations have any single business function running agents at real scale, even though 88% use AI somewhere and 72% use generative AI. The 85/5 gap won’t close because a model gets smarter. It closes when agent releases go through the same discipline as any other production system: evals you’d bet the pipeline on, scoped identity instead of shared credentials, sandboxing for the highest-risk paths, and chaos tests before the first real user hits it. Where does your agent pipeline actually stand against those four gates today?