150,000 Will Arrive; Only 13% Are Ready

Every job application form has the same fields: name, job title, department, permissions, emergency contact. Picture a Fortune 500 company in 2028. 150,000 new hires walk in, and not one of them is a human. Gartner projects that the average Fortune 500 company will be running more than 150,000 AI agents by 2028. The same projection carries one more number: only 13% of companies are ready to govern at that scale. 150,000 will arrive; only 13% are ready. This morning’s news is full of evidence bursting from both sides of the gap at the same time. IBM announced an identity system and control for AI agents, and Spain’s No. 4 bank chose a governance structure as the precondition for a company-wide rollout. In the meantime, an IT non-specialist used AI agents to exfiltrate 8.2 million personal records. The three events look separate, but one question runs through today’s digest: what should an organization look like to onboard 150,000 new hires?

A visualization of the post’s core concept.

The Form No One Can Fill Out

If the hire were a person, the HR system would absorb everything. An agent’s application form is different. Who owns it? Where do its permissions end? If something goes wrong, who revokes the permissions and how fast? When the cloud moves or the model changes, how does the identity carry over? On October 27, IBM restructured its enterprise AI operating model into four systems at TechXchange 2026 in Atlanta: agents, data, automation, and hybrid infrastructure. And it placed verified agent identity and permission control at the starting point. IBM named the package “Frontier Intelligence Protection for the Enterprise”. The core idea is to extend the existing infrastructure security stack to the fast-growing layer of non-human IDs. Agent Identity, built on HashiCorp Vault, records the owner, lifecycle, and permissions of each agent and enforces least-privilege access and real-time permission revocation. Vault 2.2 even embeds post-quantum cryptography. The plan is to apply Vault, already proven in systems handling trillions of dollars in transactions at ABN AMRO, BlackRock, and Expedia, directly to agents. watsonx Orchestrate discovers the agents, models, and MCP servers built on Amazon Bedrock, Microsoft Foundry, or Google Gemini by itself; contains them with isolated sandboxes and kill switches; and evaluates quality, compliance, and cost. In one line: Discover, Contain, Evaluate. It is multicloud governance premised on the reality that agents are not trapped in a single vendor platform, and the plan bundles in the NVIDIA OpenShell security runtime to compose policy-based execution environments. But there is one thing worth noting. Most of it is tech preview or a new feature. Microsoft, in a July blog post, also covered least-privilege ID, access, and tool binding for AI agents, and the big vendors as a whole are entering a phase of fully launching agent security layers. In other words, the giants are building this layer right now, and it reads as a signal that the front line of agent-native cloud is moving from model competition to governance competition. The 13% is not an exaggeration; it is today’s reality.

The Attack Side Is Already Agentic

If the defense side is still at the stage of writing the application form, the attack side has already walked in. Person A, an IT non-specialist, used AI agents and ARTEX, an open-source penetration testing tool, to exfiltrate 8.2 million personal records targeting hospitals, tutoring centers, and insurance sales companies, and was indicted in custody. According to statistics from the Korea Internet and Security Agency (KISA), cyber intrusion reports in the first half of 2026 reached 1,236, up 19.5% year over year, and generative AI-based attack automation was named the representative threat. The structure has changed. Attackers use AI models to scan for vulnerabilities, auto-generate attack code, and speed up the pace of repeated experiments. It has been confirmed that even AI penetration testing tools built for defense are being repurposed for attacks. The speed gap is extreme. Security firm Wiz used AI to find in one week a vulnerability the PHP Foundation had not found in two years, and OpenAI’s GPT-5.6 has reached the point of receiving PHP vulnerability reports. That is the backdrop for the assessment that a permanent era of AI hacking has arrived, in which both attack and defense are accelerated by AI. On October 28, simultaneous intrusion incidents hit Daishin Securities, Mirae Asset Fund Management, and even Bithumb, and 38,490 personal credit records were leaked from Daishin Securities among them. What is missing in these incidents is not a firewall. What is missing is a system that can trace identity in the ledger when something goes wrong. Attackers have already switched to the way agents work; defense is still stuck with humans watching directly.

Why Banks and Regulated Industries Went First

On the front lines where agents are actually deployed company-wide, the first thing decided was who would manage them. Major European financial institutions have moved beyond department-level pilots and are competing over a company-wide shared agent foundation. Banco Sabadell, Spain’s No. 4 bank serving about 7 million customers, signed an enterprise-wide agentic AI rollout strategy cooperation agreement on October 28 with T-Systems, a Deutsche Telekom group company. The point is not which model to use but the structure. It uses an open, modular shared agent platform that manages agents built on different technologies and models in one place and connects them to existing enterprise systems. A sovereign AI structure that does not depend on a single AI model or cloud vendor keeps control of data and core systems in the bank’s hands. The goal is to expand hyperautomation: monitoring and optimizing agent work and automating the coordination of multiple procedures. T-Systems being cited as an example in the race to lock in agent orchestration infrastructure among European telecom and cloud operators is in the same context. The UK’s £500 million sovereign AI program carries the same logic. Cosine handles model development in a co-design model in which Telefonica Tech reflects security and governance standards and enterprise customer requirements into the design. Telefonica Tech drew a line, saying sovereign models should not replace existing commercial models wholesale but be evaluated in parallel by use case. Training will put 500,000 GPU hours into the Isambard AI supercomputer, and financial, defense, and energy agencies require traceable answer grounding and operation in a closed environment with no external transmission. The Science and Technology Committee, in a recommendation on October 19, treated AI sovereignty as more than a question of data storage location, as an issue of the control scope of the model developer, operator, and using agencies, and framed it as a question of choice and resilience across the entire technology value chain. The targets are pre-access for government agencies in Q4 2026 and commercial deployment in Q1 2027. Sovereign capability is also being read in the domestic financial sector. Mirae Asset Securities’ Hong Kong subsidiary, following its January issuance using external technology, internalized in six months the entire process, from planning, issuance, and settlement to post-management, of $12.5 million in US dollar digital bonds with its in-house developed tokenization system. As the first among overseas subsidiaries of Korean financial companies, this looks like a signal of a movement to seize control in the agent era with in-house technology. The AI competition in the insurance sector has already moved to field execution on the sales side. Samsung Fire & Marine’s AI Advisor recorded a 97.5% system utilization rate and about 9,600 daily average logins during the pilot period, and Shinhan Life conducts about 70% of all policy underwriting with AI assistance. KB General Insurance has identified 45 AI projects and completed development on 22, and is expanding into specialized agents for claims, underwriting, complaints, and consultation, starting with an agent that explains fault ratios in car accidents. Samsung SDS and LG CNS clashing over full-stack AX, from AI supply through build to operation, is the same direction. Samsung SDS was selected as the preferred negotiation candidate in both Woori Bank’s build of 175 or more AI agents and BNK Financial Group’s generative AI platform project, and LG CNS secured the preferred partner rank at Anthropic CPN for the first time among Korean companies.

Four Questions

CEO Nadella said on the fiscal year 2027 first-quarter earnings call on October 28 that enterprise AI is a business that spans 10 years, not quarters. His diagnosis: long-term growth is determined not by boosting revenue through large compute purchases from a handful of big customers, but by spreading across diverse companies and taking root in core business systems. Numbers accompanied the remarks. AI-agent-generated pull requests coming into GitHub have grown sixfold in the past six months, and agents initiated more than one-third of all PRs. Copilot daily users grew more than fivefold year over year, and large customers with 50,000 or more seats grew more than eightfold. Volkswagen announced enterprise-wide adoption for more than 330,000 people. In Europe, Unilever runs agents on order and dispute handling, Rolls-Royce on a supply chain of 30,000 parts, and Raiffeisen Bank on more than 20 processes. Azure revenue grew 48% year over year, revenue for the AI development platform Foundry grew more than threefold, and Copilot customers increasing their usage-based credit consumption grew more than 75%. Microsoft’s revenue for this quarter broke past $92.3 billion, showing a structure in which broad enterprise adoption passes straight through to cloud results. Billing models expanding from per-seat subscriptions to the volume of work agents perform, and GitHub announcing Copilot Fusion, a multi-agent orchestration platform, are the same flow. The era of showing off is over, and the era of trust has begun. When trust comes, four questions are unavoidable. First, which agents are running. That is the inventory question. Second, who owns them, and where do the permissions end. That is the identity question. Third, where should they work, and where must they not. That is the boundary question. Fourth, when something goes wrong, where is the record. That is the ledger question. The companies that answer these four are precisely the 13%.

The 2028 Roster Is Different

By 2028, the Fortune 500 roster will be filled with 150,000 names. Then the difference between companies will not be which model is smarter, but whether they know where agent responsibility sits. ThakiCloud’s Paxis is an agent-native cloud that starts from this premise. Released as the formal product v1.1 GA, it treats Skills, Tools, Policies, and Audit Logs as first-class resources. The four questions raised in this article correspond one by one to Paxis’s first-class resources. What an agent can do is registered and visible as skills and tools, which answers the inventory question. Autonomy is governed per agent from L0 to L3, and policy gates with least-privilege settings answer the identity question. Execution happens inside isolated sandboxes, which answers the boundary question, and when an incident occurs, audit logs serve the role of the ledger. MCP connectors and the skills marketplace manage connections to external systems within the same framework. It supports sovereign and on-premises K8s deployments, so it runs as-is in the sovereign structure where a bank keeps control, and CostRouter picks models per task to keep the cost of a 10-year business within a manageable range. The 150,000 are on the way. The time to fill out the application is not 2028; it is now.

References

This article was written by synthesizing the following news items.

• Edaily, MS Nadella: “Practical application over showcasing AI breakthroughs”… enterprise AI agent adoption spreads
• AI Times, Spain’s No. 4 bank rolls out AI agents enterprise-wide… partnering with Deutsche Telekom on technology
• IBM Newsroom, IBM introduces identity and control for AI agents, securing frontier intelligence for the enterprise
• Easy Economy, [EZ Analysis] Insurers’ AI competition moves to the sales field… from consultation support to talent acquisition
• Realcast, Mirae Asset Securities’ Hong Kong subsidiary, first among overseas subsidiaries of Korean financial firms, issues US… with in-house technology
• IT Chosun, “From AI supply through build and operation”… Samsung SDS and LG CNS clash in the enterprise AX market
• Tokenpost, UK regulated-industry AI, co-designed by Cosine and Telefonica Tech
• Bizwatch, [Hacking Domino] ② Breached even by an IT non-specialist… the flip side of the AI era