Analysis shows how AI agents, non-human identities, and unmanaged devices are reshaping enterprise exposure and where security teams can focus to reduce attacker opportunities
SAN JOSE, Calif., July 22, 2026 /PRNewswire/ — Vectra AI, the leader in AI-native security and observability, today released its 2026 State of Threat Exposure Management Report, offering new research into how AI is reshaping enterprise environments and driving the evolution of exposure management.
Based on anonymized telemetry aggregated across diverse enterprise environments, the report found that AI agents, unmanaged assets, cloud services and non-human identities are creating increasingly dynamic enterprise environments that traditional exposure management approaches cannot keep pace with. Notably, 98% of analyzed environments contained at least one attacker-relevant exposure condition, underscoring the need for continuous operational visibility into what is operating, how systems interact and where risk is emerging.
“AI is fundamentally changing enterprise environments, and exposure management must evolve alongside it,” said Mark Wojtasiak, SVP of Market Research and Strategy at Vectra AI. “The findings reinforce that exposure management is no longer just about identifying vulnerabilities. It requires continuously understanding how assets, identities, AI agents and systems interact so security teams can reduce attack exposure before it becomes an incident.”
Rapidly Changing Enterprise Environments Are Creating Visibility Gaps
The report found that modern enterprise environments are changing continuously as new assets, device types, and infrastructure roles are introduced. At the same time, many of those assets remain outside the reach of traditional endpoint solutions, creating blind spots that obscure exposure and provide opportunities for attackers to operate undetected.
Key findings include:
- 100% of analyzed environments observed newly discovered devices within 14 days
- 90% observed new device roles
- 83% observed new device types
- On average, more than 30% of enterprise devices were unmanaged because endpoint agents could not be deployed
AI Agents and Non-Human Identities Are Becoming a Material Part of the Attack Surface
As AI adoption accelerates, the report highlights how AI agents outnumber devices and how non-human identities are becoming active operational actors across enterprise environments. As these entities authenticate, move data, and trigger downstream actions, exposure management must increasingly account for AI agents, automation workflows, APIs, service accounts and other non-human identities.
Key findings include:
- The typical environment contained 1.17 AI agents per device
- The most extreme environment observed 96 AI agents to a single device
- 35% of environments contained more AI agents than devices
Attacker-Relevant Exposure Conditions Remain Widespread
Even as organizations modernize their environments and invest in new security technologies, attacker-relevant exposure conditions remain widespread. Rather than isolated vulnerabilities, organizations continue to face combinations of legacy protocols, credential risks and cryptographic weaknesses that can contribute to exploitable attack paths.
Key findings include:
- 98% of environments contained at least one attacker-relevant exposure condition
- 63% exhibited exposure across multiple risk themes, including weak cryptography, credential exposure, legacy protocols and exposed remote access
- Among the most observed conditions were deprecated TLS clients (96%), expired certificates (91%), NetBIOS (86%), plaintext passwords (85%) and deprecated TLS servers (82%)
The findings demonstrate that effective exposure management requires more than periodic assessments and static inventories. Organizations that understand how managed and unmanaged assets, identities, AI agents and systems interact will be better positioned to prioritize risk, reduce attack exposure and strengthen resilience as enterprise environments continue to evolve.
To download the full 2026 State of Threat Exposure Management Report, visit: https://www.vectra.ai/resources/2026-state-of-threat-exposure-management
To learn more about how Vectra AI proactively reduces exposure for modern enterprises, visit www.vectra.ai/platform
About Vectra AI
Vectra AI is the leader in AI-native security and observability for the AI enterprise. As artificial intelligence changes who and what works inside the enterprise, attackers are exploiting more attack paths, abusing trusted identities, and automating attacks at unprecedented speed and scale. Rooted in more than a decade of behavioral AI and machine learning innovation, Vectra AI helps security teams observe behavior across the enterprise, understand attacker activity, signal what matters, and act with confidence. The result is reduced attack exposure, faster attack response, and improved SOC efficiency. With 39 patents, recognition as a Leader in the 2025 and 2026 Gartner® Magic Quadrant™ for Network Detection and Response, and the trust of more than 2,000 organizations worldwide, Vectra AI helps organizations build attack resilience in the AI era.
SOURCE Vectra AI