Category: AI Agent Security
Salt Security's 1H 2026 State of AI and API Security Report surveyed organizations running agentic AI in production. 48.9 percent cannot monitor non-human traffic at all. 48.3 percent cannot differentiate a legitimate AI agent from a malicious bot.
Nearly half of the organizations that have deployed agents cannot see what those agents are doing on their networks.
The Speed Problem
The practical consequence of this visibility gap is a speed asymmetry that favors attackers. AI agents operate at machine speed. They make thousands of API calls, process millions of tokens, access dozens of systems, and complete irreversible actions in the time it takes a human analyst to open a dashboard. SOC workflows, alert triage processes, and incident response playbooks were designed around human-speed threats. An agent-speed threat is invisible to those workflows until after significant damage is done.
47 percent of the organizations surveyed reported API growth of 51 to 100 percent in the past year, driven primarily by agentic AI integrations. Every new API connection an agent makes is a new monitoring surface. The organizations that cannot monitor non-human traffic are watching their API surface expand rapidly while remaining blind to a growing portion of the traffic crossing it.
The Attribution Problem
The inability to differentiate legitimate agents from malicious bots is not just a detection problem. It is an attribution problem. When an incident occurs, the first question any investigation asks is which system or entity caused it. If the organization cannot distinguish its own agents from external bots in its traffic logs, that question has no clean answer. Incident response becomes a process of elimination rather than direct identification.
The root cause of the monitoring gap is the absence of verifiable non-human identity in most agent deployments. Agents that share credentials with other systems, operate under service accounts designed for human use, or authenticate with API keys that carry no agent-specific identity cannot be individually identified in traffic logs. They look identical to any other authenticated request.
Effective monitoring of non-human traffic requires that each agent carry a unique, verifiable identity that travels with every request it makes. With that foundation, the 48.9 percent blind spot becomes a solvable problem. Without it, the visibility gap grows with every new agent deployed.
Source: Salt Security 1H 2026 State of AI and API Security Report