Ask a security team what AI they're running, and they'll hand you a list of approved models. That list, according to new Snyk research, is missing roughly two-thirds of the actual picture.
"Models are the visible tip. The composition is the iceberg," said Manoj Nair, Snyk's chief technology and innovation officer. "Every security leader we talk to can tell us which models are approved. Almost none of them can tell us what's actually invoking those models, what data those systems can reach, or what they're doing with the access they've been given."
That's the headline finding of Volume II of Snyk's State of Agentic AI Adoption research, drawn from more than 3,000 enterprise accounts and roughly 1.39 million scanned code repositories. Beyond the models themselves, the real AI footprint includes agent frameworks, MCP servers, retrieval systems, vector databases, datasets, and the tools those agents call — collectively about three times the size of what a model inventory alone shows, and the ratio held steady across every region Snyk measured.
The gap is widening faster than anyone can govern it
Six months ago, Snyk's first report found 28% of organizations running agentic architecture, with 36% of those running the full stack — agent frameworks and MCP servers together. Volume II puts overall adoption at 33%, but the share of adopters running the complete stack has jumped to 50%. In practical terms: organizations that commit to agentic AI aren't dabbling in one layer anymore. More than half go all-in on the full execution architecture within months.
"We've watched a lot of technology shifts happen in security, and normally the adoption curve gives you time to build governance alongside it," said Anthony Larkin, Snyk's VP of product marketing. "This one doesn't. Full-stack agentic adoption increased significantly in the time it took most security teams to finish their last risk assessment."
Randall Degges, who works on Snyk's developer relations team, described what this blind spot actually looks like at the code level, in a conversation ahead of Black Hat USA 2026. Figuring out what an agent can actually do, he said, means going well beyond reading the code that invokes a model. "You have to look at the agent's prompts — what it uses to operate — and then you also look at what tools it has accessible to it, so the way you figure that surface area out is by looking at what MCP connectors they have." Snyk's approach traces those connectors back to the MCP servers themselves, maps the tools and permissions each one exposes, and builds what Degges called "a spider web kind of looking tree" of the resulting access. Because that reasoning isn't reducible to fixed rules, the last step relies on an LLM to reason about the risk surface rather than a deterministic check. "There is no great standardized solution just yet for it," he said. "It's still a little bit up in the air."
Half of model-deploying organizations can't trace their own data
The research surfaces a second governance gap sitting underneath the first: among organizations running at least one deployed model, only 51% declare any dataset in their code repositories at all. For roughly half of model-deploying organizations, there's no visible, code-level link between a production model and whatever data trained or fine-tuned it — a pattern that held even in regions with more mature AI-specific regulation. "Even the organizations doing this well can't answer where their model's behavior actually came from," Nair said. "That's an audit, incident-response, and compliance problem waiting to happen."
The report also tracked where enterprise model usage is actually landing: Anthropic's share of enterprise model occurrences rose from 4% to 11% over the past six months, while OpenAI's share fell from 44% to 35%, with Hugging Face and the broader open-weight ecosystem picking up real share as well — evidence the model layer itself is getting more heterogeneous even as the governance gap around it widens.
What ships to close the gap
Snyk's answer, announced alongside the research, is the general availability of Evo Continuous Offensive Security (COS) — the company's broadest platform expansion to date, built around four actions: discover the full attack surface, remediate the existing backlog, validate what's actually exploitable, and prevent new risk from rebuilding it.
The core distinction Snyk is drawing, in Nair's words, is one that's held for twenty years and is now breaking down: "Scanners find bugs. Pentesters find flaws." Scanners catch commodity issues like XSS and SQL injection at scale. Flaws — architectural and business-logic issues that require actually understanding what an application was designed to do — have historically needed a human pentester, running an engagement that typically takes 15 days and costs $20,000 to $100,000. That leaves the other 350 days of the year uncovered, while both development and attackers keep moving. Evo COS is built to close that gap continuously rather than on a schedule, drawing context from Snyk's existing code, open source, and API/web scanning to focus its AI pentesting where those tools can't reach.
A second capability shipping alongside it, Agent Red Teaming, targets a newer problem: behavioral, non-deterministic risk in running AI agents and LLM-integrated applications themselves — simulating prompt injection, tool and agent abuse, and data exfiltration continuously as an organization's AI footprint changes, rather than as a one-time assessment.
The broader release also includes upgrades to Snyk's AI-SPM (posture management) with new MCP server and skills risk analysis; the general availability of Snyk Secrets, a detection and prevention tool built specifically for agentic development pipelines with an ML engine tuned to cut false positives; and an early look at Evo Agentic AppSec, including a remediation agent now in public preview that fixes vulnerabilities automatically, plus a malicious code defense capability in private preview.
Why "just prompt an agent to pentest it" doesn't scale
Degges was blunt about the gap between AI pentesting as a marketing claim and as something that actually works at enterprise scale. Plenty of vendors, he said, are "basically giving an agent a prompt that says, hey, you're an AI pen tester, I want you to go off and find issues in this thing" — a generic approach that's both insufficient and expensive. He pointed to reported research showing that running a frontier reasoning model across the Firefox codebase to surface roughly twenty vulnerabilities cost in the neighborhood of a million dollars. "Imagine doing that in an enterprise codebase with two million lines of code," he said. "You're going to be broke pretty fast." His view is that meaningful AI-native pentesting has to be built around real context — the same logic behind Snyk feeding Evo COS from its existing code and API scanning results, rather than treating a pentest as a blank-slate prompt.
What individual developers should actually check
Asked what a developer shipping fast with an AI coding agent should be asking themselves that they're probably not, Degges came back to inventory first. "Do you actually understand the full inventory of things you're shipping? Almost no one knows what they're actually shipping, which is kind of hilarious." The second piece is a warning against relying on any single LLM-based reviewer to catch everything in a pull request. Research has shown these tools lose precision the more different kinds of issues they're asked to check for in one pass, he said — formatting, logic errors, security, robustness all at once, over a long session. His recommendation is to break the pipeline into separate, explicit stages instead: linting for formatting, compilation and type-checking, then dedicated security testing — both deterministic and LLM-based — as its own distinct step, each with its own scope and context rather than one tool trying to catch everything at once.
The bigger picture
Degges closed with a broader observation from a recent AI Engineer World's Fair talk that stuck with him: open-weight models are closing the capability gap with frontier models faster than most people in the room expected, based on an informal poll where predictions of "within a year" collapsed to "within months" almost as the talk was happening. His takeaway for developers is less about any specific model and more about the trend line: as raw intelligence gets commoditized faster than anyone's governance catches up, the cost of skipping security work in the AI development pipeline keeps compounding. "You just can't not care about security," he said. "Everything is going to get hacked unless you are extremely proactive about getting the stuff in the pipeline."