Recap of our recent webinar with Jozu CEO Brad Micklea.
The window to get AI right is closing from both sides.
On one side, adoption. Gartner projects that over 40% of enterprise applications will embed AI agents by the end of 2026, up from 5% in 2025. Based on the organizations we talk to every week, 40% is probably an underestimate.
On the other side, risk. Documented AI failures, attacks, and misuse rose more than 55% in 2025 alone, and the pace has continued into 2026.
In our recent webinar, Jozu CEO Brad Micklea walked through why the security stack most organizations rely on breaks down under agentic AI, the two gaps that actually get companies hurt, and what closing them looks like in practice. Here's the short version.
The five levels of AI adoption
Most organizations move through the same progression:
Level 1: Chatbots in the browser. Employees use ChatGPT, Claude, or Gemini for daily work. The gains are real. So is the risk: data leakage. AI adoption took off in sales, marketing, and support as fast as it did in engineering, and many of those teams have less experience recognizing what counts as sensitive data. Written policies help, but they depend entirely on individual judgment.
Level 2: Individual agents. Employees adopt agents like Claude Code or a Salesforce agent for their own work. The subtle risk here is permission creep. Agents ask for access constantly, and eventually people grant broad permissions just to stop the interruptions.
Level 3: Agents in team workflows. Marketing signals feed a targeting agent, which feeds an outreach agent, which hands hot leads to sales. Output multiplies. So does blast radius. When an agent makes a mistake inside a fast-moving automated workflow, the damage amplifies before any human notices. Human reaction time can't keep pace with agent speed.
Levels 4 and 5: Cross-team and organization-wide automation. Few companies are here yet, but the trajectory is clear. Every expansion of impact is an equal expansion of risk. Far enough along, a failure doesn't stay internal. It makes headlines.
Here's the uncomfortable part
Ask yourself where your organization sits on that curve. Now add one level.
In every conversation Brad has had with enterprise and government teams, where they think they are and where they actually are differ. There are always people ahead of the approved boundary, using unapproved agents because they've seen what those tools can do. That means your security posture is calibrated to a level below your actual usage. That gap is where the ugly incidents happen.
The takeaway: governance can't be a policy document. It has to be automated, running at the same speed as adoption, covering the people who are already past where you told them to stop. Because some of them always are.
The two gaps that will bite you
Gap 1: The AI supply chain. As teams move past browser chatbots, they start pulling open-weight models, agents, and MCP servers from public sources and running them on laptops and shared servers. Most organizations scan code packages and containers. Almost none scan AI artifacts for AI-specific vulnerabilities. Hundreds of malicious MCP servers have already been found in the wild, masquerading as useful tools while stealing secrets or damaging systems.
Gap 2: The runtime. Once an agent is running, it invokes tools, pulls packages, modifies repositories, and touches databases. AI is non-deterministic. The question isn't whether an agent will go off the rails. It's when, and how much damage it can do when it does.
This isn't theoretical
Three recent incidents Brad walked through:
The npm compromise. Days before the webinar, attackers compromised 868 npm packages representing over two billion downloads. They gained access to the build pipeline and shipped validly signed packages containing malicious code. Signed, trusted, and poisoned: the definition of a back-door entry.
The Postmark MCP impersonation. An attacker copied Postmark's legitimate MCP server (distributed only via GitHub) and published it to npm under Postmark's name. They shipped 15 clean releases, waited until 300+ enterprises had adopted it, then added a release that silently BCC'd every email to an attacker-controlled mailbox. Identity and DLP tools couldn't catch it, because sending email is exactly what that MCP server is supposed to do. Nothing in the stack inspected the content of what the agent actually did.
The GitHub Copilot exploit. An attacker filed a public issue on an organization's repository claiming to be the org maintainer and asking for private keys to be posted in a comment. Copilot read the issue, tried to be a good helper, and posted the secrets publicly. GitHub has since closed the loophole, but the lesson stands: these attacks come through doors you'd never think to watch.
Why the current stack falls short
AI gateways inspect network traffic between apps and models. They can't find vulnerabilities inside an agent or MCP server, can't govern tool use (which happens inside the agent), and can't see agent-to-agent activity. And they only cover the AI services they were configured for. A new AI service nobody registered bypasses the gateway entirely.
Guardrails inspect prompts and responses for policy violations. Useful, but a guardrail won't stop an agent from dropping a database table or force-merging a commit. Those are tool invocations, not text.
Human review doesn't scale past a few dozen decisions a day. When an agent asks for approval every two minutes, people stop reading and start clicking yes. Put a human on every hop of a multi-agent workflow and you've destroyed the speed you adopted agents for.
Agent identity is necessary but coarse-grained. It keeps a marketing agent out of finance systems. It doesn't stop an email agent from sending sensitive data to an attacker's address, because sending email is its job.
The common thread: if a compromised artifact enters through the back door, runtime controls won't save you. You've invited the thief in while the cameras watch the front.
What closing both gaps looks like
Jozu is one platform covering AI security and governance from the AI supply chain through the runtime. If you haven't heard of Jozu, you may have used our open source: we maintain KitOps and co-authored the ModelPack specification, both CNCF projects with well over 260,000 downloads across research labs, AI-native startups, regulated enterprises, and governments.
In the demo (worth watching in full), Brad showed:
Sensitive data protection with any AI. An HR user pastes a candidate record into ChatGPT, not realizing it contains a Social Security number and date of birth. Jozu Agent Guard redacts the sensitive fields in transit while letting the rest of the analysis proceed. The interaction stays useful; the data never leaves. This works with any AI service, including ones launched tomorrow, because policy enforcement sits with the user, not with a per-vendor integration.
A curated catalog of scanned, approved AI. Import a model from Hugging Face into Jozu Hub and it's automatically scanned for AI-specific vulnerabilities that code and container scanners miss, including PII hiding in training datasets and malicious prompts encoded as base64 "gibberish." Approved artifacts get signed. Your teams pull from a vetted internal catalog instead of the open internet. Everything is packaged as a KitOps ModelKit, an open, vendor-neutral standard, so there's no lock-in.
A protected runtime for agents. Claude Code running inside a micro-VM on a laptop, isolated from the host. An unsigned agent definition? Blocked before the VM even starts. An MCP server from an untrusted registry? Blocked. A package install from npm? Blocked by policy, with the block message visible to the AI itself, so the agent can reason about the constraint and suggest a safe alternative instead of failing silently and confusing everyone.
Fleet visibility and layered policy. Admins see every Agent Guard instance across the organization, including audit log sync status, and air-gapped environments are fully supported. Policies layer: a small set of no-exception corporate rules (always redact SSNs), departmental variations (finance can handle card data but can't email; marketing is the reverse), and team-specific constraints for specialized missions.
Every decision, from a supply chain scan to a prompt redaction to a blocked tool call, lands in a cryptographically chained audit log ready for incident analysis and compliance evidence.
Four things to do this quarter
- Find your real highest-risk AI. It's probably not what you think, and it will tell you where you actually sit on the adoption curve.
- Decide where you'll be in 12 months. That sets where your governance bar needs to be today, because you'll get there faster than you expect.
- Get three teams in the room: security, data science/ML, and platform/IT. Each sees a different slice of the risk, and all three need to agree on what mature governance looks like.
- Decide: buy, build, or accept. For each gap, choose deliberately. Startups may accept more risk. Regulated industries and government agencies can accept almost none.
Watch the full webinar
The demos are the best part. Watch the full session here: https://youtu.be/lSBUB-Z0o8Q
Want to know where your organization actually sits on the curve? Book a free 30-minute architecture review with our team. We'll help you map where your AI is today, where you're headed, and what the specific gaps mean for your industry. No obligation. Email brad@jozu.com or info@jozu.com to set it up.