What happened
Ninety percent of companies say they want to move toward autonomous IT operations over the next two years, with agentic AI doing the work. At the same time, 77 percent say their own organization hesitates to let AI make an operational decision without a human approving it. Those two numbers come from the same survey, and the distance between them is the story.
The survey, reported by Help Net Security, found that most companies mean autonomy with a person still at the approval step, and that few have the groundwork for even that. Only 41 percent describe their IT environment as prepared for autonomous operations, and 19 percent of their IT operations are automated today. Businesses are planning around a capability their own environments cannot yet support.
Other findings point the same way. Ninety six percent say visibility across networks, applications, endpoints and cloud matters for AI driven IT, but only 17 percent have that visibility unified. Tool sprawl is named as a factor, and security and compliance concerns top the list of obstacles, with leaders weighing them more heavily than technical specialists do. Just over half, 51 percent, say they lack enough oversight of how AI agents perform and how reliable they are, and many say they do not know enough about how employees use AI or what it costs. Specialists are less confident than leaders that their organization's governance of AI actually works, and the survey notes that leaders rate their own data more highly than the people who work with it daily.
Why this is a GRC story
Human in the loop is a control, not a strategy. Keeping a person at the approval step is a reasonable default while oversight is thin. The problem is that the same survey says oversight is thin for more than half of respondents, which means the human approval step is often the only control standing between an agent and a production system, with no testing, logging or review behind it.
Compliance concerns are cited as the top obstacle, which is a governance finding. When security and compliance are named as the reason progress stalls, the organizations in question have an unresolved question about who is accountable when an agent acts. Answering that is cheaper before deployment than after an incident.
The blind spots are the ones to worry about. Not knowing how employees use AI, what it costs, or whether agents perform reliably is the same failure pattern that shows up in every shadow IT review: capability arrives faster than visibility, and the gap is discovered during an audit or an outage rather than in advance.
What to watch
Watch how quickly unified visibility catches up with ambition. An agent diagnosing an outage needs the whole picture, and for most respondents that picture is still in pieces. That constraint, more than model capability, is what will decide whether autonomous operations arrive in 2027 as planned.
A simple test for any team: can you say today which agents are running in your environment, what they are permitted to change, and how you would explain a decision one of them made. If any of those answers is no, the approval step is doing more work than it was designed for.
Attribution: Analysis based on Help Net Security and related public reporting. This article is original commentary, not a repost of the source material.