CS Atlas Clients/Subscribers: Log in to CS Atlas with the email tied to your subscription to read the earnings and event notes we publish through the week, and to ask the Atlas Agent questions. The agent answers using only Creative Strategies research and data, and it shows the source reports behind each answer. This report comes with a companion data packet in Atlas that has the answer counts for every survey question, our key measures split by company size and industry, and all of the exhibits. If you missed our launch post, here is our introduction to CS Atlas.
Expanded coverage in CS Atlas since Thursday
- [Applied Optoelectronics Q3 2026: Orders Run Ahead of Parts, Power and Production Lines](https://portal.thediligencestack.com/notes/applied-optoelectronics-q3-2026-earnings-read/)
- [After the Midterm Selloff, AI Supplier Multiples Sit Below Our Growth Forecasts](https://portal.thediligencestack.com/notes/ai-supplier-multiples-after-midterm-selloff/)
- [Cloudflare Q3 2026: Growth Speeds Up Again, and Agents Are Choosing Workers](https://portal.thediligencestack.com/notes/cloudflare-q3-2026-earnings-read/)
We continue to believe that studying the enterprise adoption cycle of AI is one of the most fruitful exercises we can do, if not the most fruitful, to understand both current and future compute demand and the economics needed to fund the AI buildout. We emphasize that enterprise adoption, and budget expansion around AI, is the single thing that decides whether this early cycle gets funded. We have also been clear that what we are seeing right now is the traditional diffusion of innovation curve. The early adopters, in this case the more tech-savvy enterprises, adopt first, go through the hard lessons, and create a learning loop that others will follow. Our main concern for the longevity of this cycle has been twofold. First, the remaining 80% of the enterprise market will move more slowly to adopt, integrate and pay for AI at scale. Second, security will prove a harder hurdle to clear, forcing a much broader review and transformation of business processes before AI can scale safely in enterprises large and small.
Our CIO/CTO survey series is designed to capture the broader enterprise adoption cycle. With this report we introduce our first CISO survey, focused on the security gates that have to be cleared for agentic AI, the new and underappreciated role cybersecurity and resilience play in enterprise adoption of agentic AI, and how the people deciding how and when AI can scale look at security. We surveyed 200 US security leaders in September, alongside the 200 CIOs and CTOs in the second version of our E/AI Index.
The number we highlight in the survey comes from the approval step before production. Of the 143 security leaders who reviewed an AI project for production in the last 90 days, 49 (34%) delayed or rejected the most recent one mainly for security reasons, and only 16 of those 49 have funding approved to fix the problem. CIOs see the same thing from their side, with 31% naming security approval as the main requirement for their next AI expansion, ahead of the 26% who name returns approved by finance. Security now sets the pace of enterprise AI deployment, and with it the pace of the token and compute demand these customers create.
We have heard in our qualitative conversations that agents were running wild, ungoverned or unsecured, in the enterprise and we wanted to test this quantitatively. In our survey, 71 of the 200 organizations let business agents take actions in production, and 59 of those 71 (83%) have at least one of three basic gaps in credentials, rollback or the ability to cut off an agent's access. We think AI-related security spending is growing, that most of it goes through the security vendors enterprises already use, and that controls for agents are the next large budget line.
Inside the Full Report
- Investment implications: four conclusions ranked by how confident we are, covering budget size, how the money reaches vendors, and timing
- The approval funnel: how many AI projects security approved, held or rejected, how few held projects have funding, and where holds are most common by company size
- The missing controls behind security holds, and how closely they match where CISOs are adding budget
- How one production incident would change deployment plans and control budgets, from a randomized split of the sample
- Agents in production: control coverage across 127 organizations, and the credential and rollback gaps among the 71 with agents that take actions
- AI inside security operations: where it is allowed to act and what it has measurably changed
- AI labs against established security vendors, pricing, and the effect on managed security providers
- Companies covered: Palo Alto Networks, CrowdStrike, Microsoft, Zscaler, Netskope, Okta, SailPoint, Cloudflare, SentinelOne, Rubrik, Alphabet (Google Cloud), Amazon (AWS), Anthropic, OpenAI, and managed security providers
- 11 exhibits and two tables, including a map of likely winners ranked by our confidence
- A companion data packet in CS Atlas, with answer counts for every survey question and key measures by company size and industry
The Diligence Stack, built on the back of Creative Strategies decades of industry research, delivers analyst-grade research built on our own surveys, models, and industry work. Paid subscribers get the full report, access to CS Atlas, and the companion data packet. Click below to subscribe.