Security teams see just a third of their AI footprint

Security teams see roughly a third of their real AI footprint, per Snyk's new survey of 3,000-plus enterprise accounts. That means agent frameworks, MCP servers, retrieval systems, and vector databases, the layers attackers actually reach, run two-thirds ungoverned by whatever policy tracks the models. The ratio holds across every region Snyk measured.

Full-stack agentic architecture means production systems with orchestration, memory, and tool-calling, not a single model call. Half of organizations run it, up from 36% six months earlier, per the survey. AI-BOM tooling, the inventory layer for that stack, is turning into its own procurement line separate from model governance budgets.

Model governance built around tracking which LLMs a company uses is already behind the actual footprint. The budget line that matters is the AI-BOM, everything downstream of the model call, because that's the two-thirds security teams can't see. Watch whether AI-BOM tooling gets funded as its own procurement category in the next few quarters, or gets folded into existing AppSec budgets and starved.

The jump from 36% to 50% full-stack adoption in six months is what's turning AI-BOM from a nice-to-have into a live procurement conversation.