AI Agents: Why the Scaling Gap, Not the Model, Decides Who Wins
Updated: 4 days ago
Executive summary. AI agents have crossed from demonstration to deployment, but the market is splitting in two. A minority of large enterprises are scaling agents into production, paying for outcomes and reorganising work around them; the majority are still piloting, blocked by security, governance and the absence of an operating model. Strategic Revenue Insights estimates the global AI agents market at USD 7.80 billion in 2025, rising to USD 269.30 billion by 2035 at a 42.50 percent compound annual growth rate. The companies that will capture that growth are the ones that close the scaling gap: vendors that sell measurable outcomes with security built in, and enterprises that redesign workflows rather than bolt agents onto them. This article sets out five lessons from the vendors and enterprises moving first, with takeaways for strategy, commercial models, security, governance, operating models and revenue.
The structure of that growth matters more than the headline. Strategic Revenue Insights' AI Agents Market research finds that customer service and virtual assistants are the largest application segment, that sales and marketing automation is the fastest growing, that banking and financial services, retail and e-commerce, healthcare, telecommunications and manufacturing are the leading end users, and that North America is the largest regional market while Asia Pacific is the fastest growing. The research identifies demand for automation in customer service and IT operations, advances in machine learning and natural language processing, demand for personalised interactions and the broad availability of AI platforms as the forces behind the forecast, and data privacy, algorithmic bias, regulatory compliance and the pace of technological change as the forces working against it.
The gap between enthusiasm and execution is the defining feature of the 2026 market. Gartner's 2026 survey of chief information officers found that only 17 percent of organisations had deployed AI agents, while more than 60 percent expected to do so within two years. McKinsey's State of AI survey, published in August 2026 from 1,719 respondents across 97 countries, found that 40 percent of organisations with revenue above USD 1 billion were scaling AI agents, up from 27 percent a year earlier, while the share of smaller organisations doing so was flat at 22 percent. The technology is not the constraint. The ability to deploy it safely, govern it and change how work is done is.
Why the AI Agents Market Is Entering a New Phase
Three structural forces are converging.
The largest vendors have turned agents into a revenue line. Salesforce reported Agentforce annual recurring revenue of USD 800 million in its fiscal fourth quarter, reported in February 2026, up 169 percent year on year, with 29,000 deals closed. ServiceNow reported in July 2026 that its AI products had passed USD 1 billion in annual contract value, that agentic deployments had grown ninefold in nine months, and that it had raised its 2026 AI revenue target to USD 1.5 billion. Microsoft moved its Agent 365 platform to general availability in 2026, OpenAI launched its Presence platform for enterprise agents in July 2026, and all ten companies named in SRI's competitive landscape now sell agents as products rather than as features.
Pricing is shifting from seats to outcomes. Intercom charges USD 0.99 per resolution for its Fin agent, Zendesk prices resolutions at USD 1.50 on commitment and USD 2.00 on demand, and HubSpot cut its customer agent to USD 0.50 per resolved conversation in April 2026. Outcome pricing aligns the vendor's revenue with the customer's result, and it is spreading fastest in the customer service segment that SRI identifies as the largest application.
Security has become the gating constraint. McKinsey found that security and risk concerns are the most frequently cited obstacle to scaling agentic AI. The threat is no longer theoretical: the Cloud Security Alliance reported in April 2026 that indirect prompt injection was being exploited operationally, with adversaries seeding web content to hijack browsing agents and enterprise copilots, and Google recorded a 32 percent rise in malicious injection content between November 2025 and February 2026. A critical vulnerability in Salesforce Agentforce, in which instructions planted in a web form exfiltrated CRM data, showed that the risk reaches the market leaders. The OWASP Top 10 for Agentic Applications, released in December 2025, has become the reference framework, and the National Institute of Standards and Technology launched an AI Agent Standards Initiative in February 2026.
These forces explain SRI's forecast of a market that grows more than thirtyfold between 2025 and 2035, with growth concentrated in the vendors and enterprises that can deploy agents securely, price them on outcomes and redesign work around them.
Five Lessons From the Vendors and Enterprises Moving First
The vendors, enterprises and system integrators converting AI agents from pilots into production share a recognisable pattern. We have distilled it into five lessons, each followed by a takeaway for a specific leadership function.
Lesson 1: Adoption Is Wide, but Scale Is Narrow
Almost every large enterprise is experimenting with agents, and only a minority are running them at scale. McKinsey's finding that 40 percent of large organisations are scaling agents against 22 percent of smaller ones, and Gartner's finding that 17 percent have deployed at all, describe a market in which the leaders are pulling away. The reasons are not primarily technical. Scaling an agent means giving it access to systems, data and the authority to act, and that requires security controls, governance, integration and process redesign that pilots do not.
The enterprises moving first have treated scaling as the objective from the start. They pick a bounded, high-volume process, usually in customer service or IT operations, the segments SRI identifies as leading demand, build the identity, permission and monitoring controls before the agent goes live, measure the outcome in resolved cases or hours saved, and expand from there. The enterprises still piloting have typically launched many small experiments without a path to production, and McKinsey's data suggest that only about 6 percent of organisations qualify as high performers that capture meaningful value.
For vendors, the implication is that the sale is no longer the pilot; it is the scaling. The agent platforms gaining share are the ones that ship the controls, connectors and templates that take a customer from the first use case to the fiftieth.
"Every enterprise has an agent demo. A few dozen have an agent in production with a budget line, an owner and a security review. The market is going to be built by the second group."
Takeaway on strategy. Set the objective as agents in production at scale, not pilots in flight. Choose a small number of bounded, high-volume processes, fund the security, integration and governance work as part of the programme rather than after it, and measure progress by outcomes delivered and processes converted. Vendors should sell and price the path to scale, and should treat the customer's first production deployment as the real win.
Lesson 2: The Business Model Is Moving to Outcomes
The economics of agents are being rewritten by the vendors moving first. Salesforce's Agentforce revenue, ServiceNow's billion-dollar AI contract value and the spread of per-resolution pricing at Intercom, Zendesk and HubSpot show a market converging on a simple principle: charge for what the agent does, not for who has access to it. Outcome pricing lowers the barrier to adoption, aligns incentives and makes the value visible to the buyer's finance function.
That shift has consequences on both sides. For vendors, revenue becomes variable and tied to agent performance, which rewards accuracy, resolution rates and integration depth, and punishes agents that create work for humans. For enterprises, outcome pricing turns agent spend into a cost of service that can be benchmarked against labour, and it raises the question of what counts as a resolution, which requires measurement and governance that many organisations do not yet have.
SRI's research identifies customer service as the largest application and sales and marketing automation as the fastest growing; both are segments where outcomes are countable, which is why they are where outcome pricing has arrived first. The segments where outcomes are harder to define, such as software development and compliance, are still priced on consumption or seats, and the vendors that solve the measurement problem there will unlock the next pricing shift.
Takeaway on commercial models and pricing. Price agents on outcomes wherever the outcome can be counted, and build the measurement, attribution and dispute mechanisms that make that credible. Vendors should model revenue on resolution volume and quality, not on seats, and should invest in the integrations that raise resolution rates. Enterprises should define what a resolution means before signing, benchmark agent cost per outcome against the human alternative, and negotiate for transparency on how outcomes are counted.
Lesson 3: Security Is the Gating Constraint, and It Is Now Operational
The most frequently cited obstacle to scaling agents is security, and 2026 is the year the threat became real. Indirect prompt injection, in which an attacker plants instructions in content an agent will read, moved from research to exploitation in the wild, and the Agentforce vulnerability demonstrated that a web form could turn a sales agent into a data exfiltration channel. The OWASP agentic framework's leading risks, goal hijacking and identity and privilege abuse, describe exactly how agents fail: they are tricked into pursuing the wrong objective, or they act with permissions they should not have.
The enterprises and vendors moving first have accepted that there is no complete fix for prompt injection and have designed accordingly. They give agents the minimum permissions needed for the task, separate the agent that reads untrusted content from the agent that takes consequential actions, require human approval for high-risk steps, log every action for audit, and test agents adversarially before and after deployment. Vendors are competing on these controls as product features: OpenAI's Presence platform was launched explicitly with guardrails and escalation to people, and Microsoft has mapped its agent platform to the OWASP framework.
SRI's research lists data privacy and regulatory compliance among the market's central restraints. Security is where those restraints become concrete, and it is also where the market leaders are building their moat, because the enterprises scaling agents are the ones that trust the controls.
"An agent that can read the open web and act in your systems is a new employee who believes everything they read. The companies scaling agents are the ones that hired accordingly."
Takeaway on security and risk. Treat agent security as an architecture decision, not a review step. Apply least privilege to every agent, separate reading untrusted content from taking consequential action, require approval for high-risk steps, log and monitor every action, and red-team agents against the OWASP agentic risks before and after launch. Choose platforms on the strength of their identity, permission and audit controls, and make the chief information security officer a co-owner of the agent programme.
Lesson 4: Governance Has Deadlines, and Breathing Room
Regulation is shaping the agent market, but not in the way most enterprises expected. The European Union's Digital Omnibus, Regulation 2026/1744, entered into force on 27 July 2026 and deferred the AI Act's high-risk obligations for standalone systems to 2 December 2027 and for AI embedded in regulated products to 2 August 2028, citing the absence of finished technical standards. The transparency obligations under Article 50 have applied since 2 August 2026, with a grace period on watermarking to December 2026. In the United States, NIST's AI Agent Standards Initiative is a multi-year effort whose first deliverables are expected in late 2026, and Singapore published a model governance framework for agentic AI in January 2026.
The practical effect is that enterprises have time to comply with the high-risk regime but no excuse to wait on governance. The enterprises moving first are building internal agent governance now, drawing on the OWASP framework, NIST's identity and authorisation concept paper and the ISO/IEC 42001 management system standard, and are treating transparency, documentation and human accountability as current obligations. SRI's research names regulatory compliance and ethical considerations as restraints; for the leaders, a documented governance system is becoming a condition of enterprise sales.
The deferral also changes the competitive dynamic. Vendors that build conformity, documentation and risk management into their platforms now will be ready when the 2027 deadline arrives and will sell more easily to regulated industries in the meantime. Those that wait will face a compressed compliance programme at exactly the moment the market matures.
Takeaway on governance and regulation. Build agent governance now against the frameworks that exist, and treat the 2027 and 2028 EU deadlines as the backstop rather than the start date. Establish an inventory of agents, their permissions, data access and owners; document purpose, testing and human oversight for each; comply with transparency obligations already in force; and adopt a management system standard that regulated customers recognise. Vendors should ship conformity documentation as part of the product.
Lesson 5: The Operating Model Is Where Value Is Captured
The clearest finding in McKinsey's 2026 data is that adoption has outrun value. The share of organisations reporting any earnings impact from AI was unchanged at 37 percent, and only about 6 percent qualified as high performers. The difference between the two groups is not model quality or vendor choice; it is whether the organisation redesigned workflows, reassigned responsibilities and changed how it measures work when it deployed agents.
The enterprises moving first treat an agent as a change to the operating model, not an addition to the software stack. They redesign the process end to end, decide which steps the agent owns and which a person owns, retrain the people whose work changes, and hold a business leader accountable for the outcome. They also measure differently, by resolutions, cycle time and cost per outcome rather than by licences or hours of use, which is the same metric shift that outcome pricing demands on the vendor side.
The capabilities that decide who captures this demand are specific:
A path from pilot to production that includes security, integration and governance from the first use case.
Outcome-based commercial models with credible measurement and attribution.
Agent architectures built on least privilege, separation of duties, approval gates and audit.
A documented governance system aligned to the OWASP, NIST and ISO frameworks and ready for the EU deadlines.
Workflow redesign, talent reskilling and business ownership of agent outcomes.
Companies evaluating these competitive dynamics in greater detail can use SRI's AI Agents Market analysis to assess type, technology, application, end-user and regional segments and the positioning of the leading platform, model and enterprise software providers.
Takeaway on operating model and talent. Deploy agents as process redesigns owned by business leaders, not as tools owned by IT. Map every step the agent will own, reassign and retrain the people whose work changes, and measure the programme by resolutions, cycle time and cost per outcome. Build a small central team for platforms, security and governance, and push deployment into the functions where the outcomes are counted.
Where the Opportunity Is Concentrating
Value is moving toward production deployment, outcome pricing and the controls that make both possible.
By type, single-agent systems dominate current deployments, while multi-agent and orchestrated systems are where the vendors moving first are building, because they allow agents to be composed across processes with separation of duties.
By technology, large language models and natural language processing underpin most agents, with reinforcement learning and computer vision expanding the range of tasks agents can perform in operations and the physical world.
By application, customer service and virtual assistants are the largest segment and the first to adopt outcome pricing, sales and marketing automation is the fastest growing, and software development, IT operations and finance and compliance are scaling as measurement improves.
By end user, banking and financial services and retail and e-commerce lead on volume and measurable outcomes, healthcare and telecommunications are growing on service automation, and manufacturing is adopting agents for operations and supply chain.
By geography, North America is the largest market on vendor concentration and enterprise adoption, Asia Pacific is the fastest growing, and Europe is where governance and the AI Act timeline will shape which vendors win regulated industries.
At the Horizon: What to Watch Over the Next Three Years
The scaling gap. Whether the share of smaller organisations scaling agents moves off its 22 percent plateau will determine whether the market broadens or stays concentrated in large enterprises and their vendors.
Outcome pricing beyond customer service. The first credible outcome models for software development, compliance and operations agents will unlock the next wave of growth, and the vendors that define the metrics will set the terms.
The security record. A major, public agent-driven breach would reset enterprise risk appetite; a year of scaled deployments without one would accelerate adoption. The controls deployed in 2026 will decide which happens.
"The next phase of competition in AI agents will not be won by the company with the best model. It will be won by the one that can put a thousand agents into production, under control, and show the finance director what each of them did."
The Strategic Revenue Opportunity
For platform and model vendors, the task is to sell the path to scale: outcome-priced agents with security, integration and governance built in. For enterprises, the priority is to convert pilots into production in bounded, measurable processes, with security architecture and operating-model change funded from the start. For system integrators and consultancies, the opportunity is the scaling gap itself, because most organisations cannot close it alone. For investors, the signal is production revenue tied to outcomes, not announced pilots.
Market intelligence turns these questions into decisions. Segment-level sizing shows where spend is concentrating, competitive benchmarking shows where platform vendors are strong and where specialist agents are taking share, and regional analysis shows which markets will scale first. This is the path from market signals to strategic insight to revenue impact.
Takeaway on revenue. Treat AI agents as four revenue pools with different buyers and sales cycles: outcome-priced service and sales agents, agent platforms and orchestration sold to enterprise IT, security, identity and governance tooling for agents, and the integration and change services that close the scaling gap. Each needs its own proof of outcome and control. Enter where the process is bounded, the outcome is countable and the buyer has already discovered that the pilot is not the hard part.
The Next Leg: Preparing for the Journey Ahead
The defining shift in AI agents is that the constraint has moved from the model to the organisation. The technology works; the question is whether an enterprise can deploy it securely, govern it, price it and change how it works. That changes the buyer, the business case and the pace. The companies moving first are not the ones with the most advanced demos; they are the ones who have put agents into production, under control, with outcomes the finance function can count.
The next three years will decide which vendors, enterprises and integrators own the agentic layer of the enterprise for the following decade. Decision-makers should set scale as the objective, price and buy on outcomes, treat security as architecture, build governance ahead of the deadlines, and redesign the operating model rather than the software stack. Companies evaluating growth opportunities in this market can use Strategic Revenue Insights' AI Agents Market report to assess market size, competitive dynamics, regional opportunities and strategic growth priorities.
Related analysis: Data Center Cooling: Why 120 kW AI Racks Are Rewriting a USD 72.02 Billion Market; 800G Optical Transceivers: Why AI Clusters Drove a USD 23.8 Billion Optics Year; 5G Enterprise: Why Private Networks Are Becoming the Factory's Nervous System.
Frequently Asked Questions
How big is the AI agents market?
Strategic Revenue Insights estimates the global AI agents market at USD 7.80 billion in 2025, rising to USD 269.30 billion by 2035 at a 42.50 percent compound annual growth rate.
What is the AI agents scaling gap?
A minority of large enterprises are scaling AI agents into production, paying for outcomes and reorganising work around them, while most are still piloting, blocked by security, governance and the lack of an operating model.
Which AI agent applications lead?
Customer service and virtual assistants are the largest application segment and sales and marketing automation is the fastest growing. Banking and financial services, retail, healthcare, telecom and manufacturing are leading end users.
What are the main risks for AI agents?
Data privacy, algorithmic bias, regulatory compliance and the pace of technological change are the main restraints. Vendors that build security in and sell measurable outcomes are best placed to close the scaling gap.
About the authors: This article was prepared by the Strategic Revenue Insights research team, which combines market intelligence, competitive analysis and strategic advisory for growth-stage, mid-market and enterprise organisations across the information and communications technology, semiconductor and electronics sector. Sector analyst: Lukas Schmidt, Technology and Infrastructure Analyst. Our market estimates combine primary research (interviews, surveys and expert panels) with secondary data (industry reports, databases and public disclosures); read more about how Strategic Revenue Insights works. To discuss this market with our analysts, contact our team.
Comments