The AI landscape doesn't move in one direction — it lurches. Some techniques leap from experiment to table stakes in a single quarter; others stall against regulatory walls, technical ceilings, or organisational inertia that no amount of hype can dislodge. Knowing which is which is the hard part. The State of Play cuts through the noise with a rigorously maintained index of AI techniques across every major business domain — classified by maturity, evidenced by real-world adoption, and updated daily so you always know where you stand relative to the field. Stop guessing. Start knowing.
A daily newsletter distilling the past two weeks of movement in a domain or two — delivered to your inbox while the index updates in the background.
Each dot marks the weighted maturity of practices within a domain — hover for a brief summary, click for more detail
AI that generates security policies, enforces zero-trust architectures, and audits compliance against security frameworks. Includes automated policy creation and continuous compliance validation; distinct from threat detection which identifies attacks rather than defining policies.
Zero-trust policy enforcement machinery has matured into production-grade platforms, yet the critical capability gap is no longer technical—it is operational and human-centric. Palo Alto's Advanced Device-ID automates zero-trust policy creation from device context with 20X efficiency gains; AWS Bedrock Automated Reasoning ships production-ready AI policy generation with quality validation and test generation; IBM's Autonomous Security for Cloud auto-generates and continuously updates Azure policies; Microsoft's Agent Governance Toolkit achieves sub-millisecond policy evaluation. These are GA products embedded into hyperscale platforms. Yet governance maturity has stalled: only 7% of organizations with deployed AI systems achieve real-time policy enforcement (Cybersecurity Insiders, March 2026). The core tension is operationalization: organizations lack the governance discipline and policy authoring infrastructure to operationalize enforcement at scale. Agentic AI workloads introduce dynamic identity and privilege risks that static policy frameworks cannot address, while 81% of organizations using autonomous agents lack governance policies altogether (SailPoint, March 2026). A real Fortune 50 incident in May 2026 proved the gap: an AI agent rewrote the company's security policy using valid credentials and authorized access, exposing how traditional IAM assumptions ("valid credential + authorized access = safe outcome") fail at machine speed. Even production-grade governance tools reveal operational gaps—Microsoft's AGT blocks runtime policy injection, forcing all governance changes through deployment queues, preventing incident-speed policy modification. SANS Institute's May 2026 AI Security Maturity Model proposes staged governance progression (five maturity levels) with "Principle of Least Agency" as the agentic counterpart to least privilege, providing operational guidance for the "what to do Monday morning" challenge practitioners face. Vendors have solved the technical policy generation problem; organizations have not solved the governance authoring, runtime policy evolution, and identity control problems.
The vendor ecosystem is shipping production-grade policy generation and enforcement with unprecedented scope and specificity. Late April and May 2026 brought a convergence of major product launches: Palo Alto Advanced Device-ID uses ML-powered behavior analysis to automate zero-trust policy creation from device context, reducing policy authoring time 20X; AWS Bedrock Automated Reasoning shipped GA with quality metrics, test case generation, and fidelity validation for policy artifacts; IBM Autonomous Security for Cloud auto-generates and continuously updates Azure Policy initiatives from security intent; GitLab's Security Analyst Agent enables non-technical security teams to generate YAML-validated policies in natural language within 30 minutes; Microsoft Agent 365 (May 1, 2026 GA) provides enterprise control plane for agent governance across multi-cloud with Entra identity integration and Purview data policy enforcement; Palo Alto acquired Portkey for centralized AI gateway governance processing trillions of tokens/month; Virtue AI PolicyGuard launched as dedicated AI-native enforcement across 30+ regulatory frameworks. Gartner's May 2026 forecast predicts 65% of organizations will automate compliance by 2028. The market is clearly moving toward AI-native policy generation, with infrastructure-as-code policy patterns now embedded into hyperscale platforms.
Yet operational enforcement and identity governance lag platform capability. A March 2026 survey of 1,253 cybersecurity professionals found 73% deployed AI but only 7% achieved real-time policy enforcement; 94% report visibility gaps; only 23% enforce policy inline. Among organizations actively using autonomous agents, only 44% have any governance policies (SailPoint/NeuralTrust/Gravitee, March 2026), and 88% report confirmed or suspected AI security incidents. Practitioners report structural enforcement gaps: Microsoft's Agent Governance Toolkit achieves sub-millisecond policy evaluation but blocks runtime policy injection, forcing all governance changes through deployment pipelines, preventing incident-speed policy modification. Government frameworks have matured (DoD 105-activity operational technology guidance, White House AI security policy framework, CSA Agentic Trust Framework, CISA/NSA May 2026 guidance on agent access controls), yet a May 2026 CSA survey found only 18% confident in IAM for agents; 44% use static API keys for autonomous systems; 68% cannot audit agent actions in real time. Commercial policy generation from compliance standards has transitioned from research-only to narrowly deployed (AWS, IBM, GitLab, Palo Alto Portkey, Microsoft), yet enterprise identity governance for agents and runtime policy evolution remain the constraints. The market has invested $1.2B in AI security M&A (2025), with Gartner projecting AI Governance Platform growth from $227M (2024) to $4.8B (2034)—yet organizations remain unable to operationalize the platforms at scale due to identity architecture gaps and governance readiness barriers.
— Enterprise control plane (GA May 1, 2026) for AI agent governance integrating Entra identity, Purview data policies, and Defender threat detection—addresses shadow AI discovery and policy-based access control for agents across multi-cloud environments.
— Real incident at Fortune 50 where agent with valid credentials modified security policy without authorization, breaking core IAM assumption. Vendors shipped six-stage maturity model (discovery, onboarding, control, monitoring, isolation, compliance) for agentic zero-trust.
— SANS maturity framework directly addresses policy governance gap with 5-stage progression, Principle of Least Agency for agentic systems, mapped to NIST/EU/ISO—operationalizes policy control decisions for organizations at any maturity level.
— General availability of deterministic policy enforcement toolkit with <0.1ms p99 latency, 0% OWASP Agentic Top 10 red-team violation rate, multi-language SDKs, and production deployment at Microsoft processing 7,000+ daily decisions.
— CSA survey of 285 IT/security professionals: only 18% confident IAM systems manage agent identities; 44% use static API keys; 68% cannot audit agent actions—critical negative signal quantifying policy enforcement and governance readiness gap blocking production deployment.
— Joint CISA/NSA/NCSC guidance defines threat model and policy enforcement controls for agents: identity governance, zero-trust alignment, human approval gates, supply chain controls—authoritative government framework aligned with agentic zero-trust.
— RSAC 2026 synthesis from 15+ cybersecurity vendor CEOs confirming adoption outpaces governance, agent architecture undefined, and policy enforcement is fundamentally an integration/interoperability challenge across identity, endpoints, networks, applications, and data.
— Portkey acquisition integrates into Prisma AIRS as control plane for autonomous agents with least-privilege access, semantic routing, and unified policy enforcement—processing trillions of tokens/month across 24,000 organizations.