Most agent-readiness talk, ours included, is about the front door: can an agent find your docs, read your pages, call your API or MCP server? That's half the question. The other half is the one enterprise buyers keep asking: when agents do get in, can you tell which agent did what, limit what it can do, and stop it?
Two surveys published in October 2026 put numbers on that gap.
Being reachable by agents is the easy half. The harder half is being reachable by the right agents, with each action attributable and each agent containable. Most organisations already run agents but can't yet do that.
What the Surveys Found
Salt Security, State of Agentic AI and API Security 2H 2026 (13 October; 380+ security and technology professionals, plus Salt's own customer telemetry):
- 86.4% have at least one AI agent operating in their organisation.
- Only 12.5% can consistently trace a complete agent path across all their agents.
- Only 17.5% can automatically stop an agent that starts behaving unexpectedly in production.
- 32.9% have found an unauthorized, shadow or misconfigured MCP server.
- 49.8% confirmed or suspect an agent took an action they didn't intend or authorize.
- In Salt's telemetry, MCP infrastructure showed up in 21.6% of customer environments in August 2026, up from 16.7% in January.
ServiceNow with Phronesis Partners, Deployed but ungoverned: the state of agentic security (20 October; 3,700+ senior security and technology leaders in 20 countries, 97% at companies with $250M+ revenue):
- 90% experienced an agentic AI security incident in the past year, and only 36% of those contained it within 24 hours.
- 29% found agents running in production that had never been registered.
- 76% say they keep a complete, current map of every agent's access, but only 19% can see more than 90% of their agents in real time.
- 66% can't act automatically when an agent behaves anomalously.
Both are vendor surveys: Salt and ServiceNow sell agent security, so read the numbers as the vendors' own. But they agree on the shape. Adoption has run ahead of control. The gap isn't whether agents can get in. It's whether anyone can see, attribute and stop them.
The Market Is Already Selling "Agent-Ready" as Governed
On 13 October, Workday made its HR and finance system available to outside agents through MCP tools, which it calls Agent-Ready Tools. Agents work "under the same Workday permissions, approvals, and audit trails" as the person they act for. The same day, Workday announced a definitive agreement to acquire C1.ai, an identity platform for people and agents that limits their access, enforces policy and logs actions. The deal is expected to close by the end of January 2027.
When a Fortune 500 vendor sells agent access, the selling point is the controls around it, not the access alone.
What a Site Can Show From the Outside
Most governance happens inside a company: an inventory of agents, logs of who called what, the ability to revoke. A scanner can't see any of that. But several public signals show whether a service is built to be governed, and the Agent Readiness Score checks them:
| Signal | What it shows | ARS check |
|---|---|---|
| A standard auth challenge with RFC 9728 metadata | An agent can find out how to authenticate, instead of a person sharing a key | agent-auth-www-authenticate, oauth-rfc9728-prm |
| The challenge names a scope (SEP-835) | Access can be asked for narrowly and stepped up when needed | mcp-auth-scope-challenge (new in ARS 3.3) |
| Scoped permissions in the auth metadata | Tokens can be limited to what a task needs | auth-scoped-permissions |
readOnlyHint / destructiveHint on MCP tools | An agent or its supervisor can tell a lookup from a delete before calling it | mcp-tools-readonly-hint, mcp-tools-destructive-hint |
| A Server Card in the AI Catalog | The server says who runs it and where its endpoints are, so it can be inventoried | mcp-server-card (new in ARS 3.3) |
On the safety annotations, the public picture is mixed. In our study of 3,000 remote MCP servers, 56.7% declared readOnlyHint on at least one tool and 50.5% declared destructiveHint. On the other hand, 82.7% of servers that required auth gave a challenge an agent could follow.
What a Site Can't Show
Some of the most important controls are invisible from outside:
- Whether the server checks a token's audience. In both official MCP SDKs the fix for accepting tokens issued for another service ships turned off. See the MCP auth fix that ships turned off.
- Whether agent calls are attributed. Logs that record which agent, acting for whom, called which tool.
- Whether an agent can be stopped quickly. Revocation and kill switches.
- Whether unregistered MCP servers are running. The 29% and 32.9% figures above are about servers nobody inventoried.
These need a review from the inside: configuration, logs and an inventory of agents and MCP servers. A public score that claimed to measure them would be guessing, and ARS doesn't.
What to Do
- Make the visible signals right. Standard auth challenges with RFC 9728 metadata, scopes in the challenge, safety annotations on every tool, and a Server Card listed in
/.well-known/ai-catalog.json. - Turn on audience validation if you use the MCP SDKs' bearer auth. Upgrading alone doesn't do it.
- Inventory your MCP servers and agents, including ones teams set up themselves.
- Log calls with attribution: which agent, on whose behalf, which tool, with what result.
- Make sure you can stop an agent: revoke its tokens or block its client without taking the service down.
Sources: Salt Security press release (13 October 2026), ServiceNow press release (20 October 2026), Workday press releases (13 October 2026), all read on 23 October 2026. Disclosure: Glintbase sells agent-readiness scoring.
Run a Free AI Readiness Audit
Identify broken parameter signatures, missing Model Context Protocol schemas, and sitemap issues in your developer documentation.
