Gartner put out its 2026-2027 ThreatScape at the Security & Risk Management Summit in June. It puts twenty threats on one chart, and I've gone back to it more times than I'd like to admit, mostly because of where things ended up rather than what's on it.
The old problems are on the left. Phishing, ransomware, DDoS, API attacks. Plenty of activity, but defenders have been fighting those for years and attackers don't get much of an edge anymore.
Then look right, where the attacker advantage is highest. Almost all of it is AI. Gartner outlined six AI-related threats (AI application compromise, prompt injection, AI-augmented attacks, software supply chain, AI infrastructure, and agentic automation hijack) and five of the six sit in that far column.
None of that surprised me. I spent three years as CRO at Afero, an IoT company, and watched connected devices go out the door years before anyone had a real plan for securing them. Capability ships first, controls show up later, and attackers make their money in between. I've been in technology and go-to-market for thirty years, at Logitech, RAPT, Afero, and now Vorixs, and I haven't seen that sequence break once.
The threat I'd worry about is the quiet one
Gartner sorts everything on two axes: how much signal defenders are seeing from threat actors, and how much advantage the attacker holds. The four threats it called out for urgent improvement score high on both. AI application compromise, deepfake impersonation, software supply chain, prompt injection. Those are the fires, and every CISO I know is already fighting some of them.
Agentic automation hijack sits lower. Gartner put it in a quadrant it labels Unpredictable, meaning the attacker advantage is high but there isn't much observed activity yet.
I think people will read that the wrong way. Low signal doesn't mean low risk; it means nobody has written the breach report yet. And security budgets get set from breach reports, so this one won't get funded until after the first big incident. By then the attacker has already collected.
An agent is an identity with a job
Identity abuse landed in the Structural quadrant, with lots of signal and a real attacker edge. No surprise there. Stolen credentials are about the oldest and best-documented way in.
Now hand every enterprise a few hundred agents. Each one holds credentials. Each one has permissions. Most of them act without a person looking at what they do. Hijacking one of those agents is identity abuse, just running at machine speed. Gartner lists the two separately, and I understand why, but operationally I'd treat them as one problem at different levels of autonomy.
I made this argument back in April, when I wrote that the agent economy is a cryptographic debt crisis. The ThreatScape is that debt starting to show up on the balance sheet.
Gartner's own supply chain guidance heads the same direction: least-privilege access, and runtime monitoring of what agentic tools are doing. Do both, but know that monitoring only tells you what happened. It doesn't prove which agent did it or whether it was ever allowed to.
Where the risk grid falls short
Alongside the ThreatScape, Gartner published a grid for sizing up agent risk. One axis is how sensitive the data is. The other is how much autonomy the agent has, starting with embedded agents and running up to multiagent systems. Sensitive data plus goal-driven or multiagent systems puts you in the red. And past a stand-alone agent, nothing is ever green.
That's a fair place to start, and my problem is with what it leaves out.
Picture an agent that only ever reads boring, low-sensitivity data, but it can move money. Or change a firewall rule, or approve a purchase order. On Gartner's grid it scores medium. In real life it's one of the most dangerous things running in your environment. The grid measures what an agent can see, and the damage comes from what it can do.
So I'd add a third axis: authority. Which actions is the agent allowed to take, and can you actually prove that permission, or are you just assuming it? Score agents on data and autonomy alone and you'll lock down the wrong ones first.
Authority is the problem we work on at Vorixs. Halo binds an agent's identity and its permitted actions into the key itself, with no external PKI to depend on. The permission goes wherever the agent goes, hop to hop, and afterward you can prove what it did. My bet is that enterprises scale agents about as fast as they can prove what those agents are allowed to do, and no faster.
About quantum being "anticipated"
Quantum threats landed in the Anticipated quadrant: real advantage, not much signal. I can already hear the budget conversation. "Gartner says it's anticipated, so let's push post-quantum to next year."
I'd push back on that. Harvest-now, decrypt-later attacks are built to make no noise. Someone copies the encrypted data today, sits on it, and decrypts it years from now. A quiet reading isn't the all-clear. It's what the attack looks like while it's working. I wrote about this the day the summit opened, in the clock was already running, and nothing on the new chart changes my mind. Every agent credential you issue today on classical cryptography is one you'll have to reissue later, and the number of agents is only going up.
What I'd do with this
Find your agents first. Gartner literally titled its grid "AI agent discovery and preliminary risk assessment." That's the right order.
I recently had an insightful conversation with the CISO of a fintech company about the state of her agent deployments. I was shocked to hear the company didn't have a central repository of the agents it had created, the policies assigned to them, or even the sheer number of agents it has under management. I suspect that's the case for the majority of companies rushing toward the promise of agentic workflows. And you can't govern something you haven't counted.
Rank them by the worst thing they can do. For each agent, write down what it's permitted to do, not only what it can read. The agent that can wire money goes to the top of the list, whatever data it touches.
Give each agent its own provable identity. Not a borrowed service account, and not a feature of whatever app spun it up. Once an agent carries scoped credentials you can verify, monitoring stops being forensics and becomes enforcement.
Build it post-quantum the first time. If you're standing up agent identity this year, use post-quantum cryptography now. Migrating later is the expensive path.
I keep coming back to the shape of that chart. The most dangerous column is mostly AI, and the threat with the biggest payoff is sitting in the quietest corner.
Gartner got the map right. What it's missing is the authority axis, and adding it changes which agents you lock down first.
Sources: Gartner, "Four Critical Threats Requiring Urgent Improvements," June 2, 2026; Gartner Security & Risk Management Summit Day 1 Highlights, June 1, 2026; Outlook for Cybersecurity Threats: Prioritizing With Gartner's 2026-2027 ThreatScape, June 1, 2026.
Related Reading
- The Agent Economy Is a Cryptographic Debt Crisis: the original argument that agent adoption is outrunning the control plane, which the ThreatScape now confirms
- The Clock Was Already Running: why a low-signal reading on quantum is the warning, not the all-clear
- The Governance Gap Is the Growth Gap: the business case behind the authority axis, and why provable identity is what lets agents scale
- Pace the Frontier. Prove the Agent.: the Unpredictable quadrant stops being quiet when an agent swarm goes after targets nobody assigned
- Voluntary to Sign. Mandatory to Prove.: once oversight becomes an audit, authority has to be provable, not assumed