Industry Surveys

Deployed but ungoverned: the state of agentic security is a survey report that ServiceNow published on 20 October 2026 with Phronesis Partners. It questions 3,766 security and technology decision-makers at VP level or above across 20 countries and eight industries, all at organisations with AI agents in production. The report closes by recommending ServiceNow's own AI governance and security products.

The study scores each organisation on five domains (attack surface, security by design, visibility, accountability and audit readiness) and places it in one of four posture bands. Only 13% reach the top band, which the report calls defensible, although 56% rate their own agentic security as established. Respondents report that 90% of organisations had an agentic AI security incident in the past year, and only 36% of those contained it within 24 hours. Several of the gaps sit with engineering teams. Just 44% bring security in before agent development begins, 29% found agents running in production that had never been registered, and 66% cannot act automatically when an agent behaves anomalously. Leaders deploying agents can set its list of controls (automatic registration, mandatory deployment gates, evidence on demand) against their own practice.

The State of Agentic AI: H2 2026 is the second wave of a Nylas survey, published in full on the Nylas website with no form. Centiment fielded it between 26 August and 12 September 2026 with 1,030 US-based professionals who build, buy or influence AI systems; the previous wave ran in December 2025 with 1,026 respondents. Nylas's own products are email, calendar and agent account APIs, and the report notes that the capability closest to them ranked last among respondents' priorities.

54% report at least one agent-caused error in the past 90 days, rising to 70% at organisations running more than 20 agents. 53% can produce a full audit log of what their agents did the previous week and which agent did it. Only 26% say agents authenticate with a dedicated identity of their own, and full auditability is higher among those teams (66%) than where agents act through OAuth on a human employee's account (51%). 7.5% let agents act without human approval, up from 4.2% in December. Because the sample mix changed, Nylas compares the two waves on only eight identically worded questions.

KPMG published its 2026 US CEO Outlook on 15 October 2026. It reports the views of 400 US chief executives drawn from a global sample of more than 1,300 CEOs at large companies, and every US respondent runs a company with annual revenue above US$500 million. As an audit, tax and advisory firm, KPMG has AI and cyber consulting to offer. The US findings appear in a press release and in a report available on request.

The gap between spending and results is the contrast engineering leaders will find most useful. 84% of CEOs say AI is a top investment priority over the next three years, and 65% say they will spend at least 10% of their capital budget on AI in the next year. Only 9% report that agents are transformational for their organisation, while 39% report significant improvements in efficiency or growth with agents and 43% report moderate impacts with targeted use cases. Cybersecurity is the most cited risk. 85% expect cybercrime and cyber insecurity to affect their organisation's prosperity over the next three years, and 56% name cybersecurity as a challenge when implementing AI. 88% say they prioritise realised AI value over strict adherence to token budgets.

The New Realities of AI Governance is IBM's survey of 3,221 senior executives at organisations with 1,000 or more employees in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE. Censuswide collected the data between 14 and 24 September 2026. The report asks what happens when AI incidents reach senior leaders and whether governance is ready for agents that act without step-by-step human approval. IBM has AI governance and agent orchestration software of its own, and the customer case studies in the report are built on those products.

Eight in ten executives say an AI-related incident, such as an agent failure, data exposure or decision error, reached their board or C-suite in the past year, yet only 40% of those organisations cite a change to AI governance policy as a result. Three-quarters expect AI agents to have some autonomy over decisions by 2027, while 37% say their governance is designed to scale with agentic AI. Engineering teams building or buying agents get a measure of how far executive oversight lags deployment, and of the gaps in third-party coverage, with 54% acknowledging limits in how their governance covers AI used by vendors and partners.

Beyond Traditional Packages: How Go, Rust, and AI Artifacts are Reshaping Enterprise Dependencies is a whitepaper from Sonatype Research Labs, released on 14 October 2026 alongside a Nexus Repository product launch. It combines public ecosystem data with anonymised telemetry from Nexus Repository customers to follow Go modules, Rust crates and Hugging Face models from public publication into enterprise repositories and policy checks, using data through June 2026. The data come from Sonatype's own repository and policy products, and its customer populations are not a sample of all enterprises.

The Hugging Face data bear most directly on teams adopting open models. Hugging Face appears in nearly 6% of the measured repository population, and Q2 2026 saw nearly 4.7 times as many adopting organisations as Q2 2025. Of 9,658 audited model requests in H1 2026, 6.98% were blocked or rejected; model acceptability accounts for 55% of the 674 blocked models and security for 18.2%. Sonatype cautions that the rate reflects small volumes and customer configuration and does not show that models are inherently riskier. It recommends recording each model's origin, licence and file format at intake, as teams do for packages.

The State of Agentic AI and API Security 2H 2026, published by Salt Security on 13 October 2026, combines a survey of over 380 security and technology professionals with Salt Labs telemetry from hundreds of customer production environments. Salt Security's business is API and agentic AI security products.

Its central finding is that 49.8% of respondents confirmed or suspected that an AI agent in their organisation had taken an action in the previous 12 months that the organisation did not intend, expect or authorise. Only 12.5% say they can consistently trace a complete agent path across all agents, and 17.5% can automatically stop an agent that starts behaving unexpectedly in production. The coding results bear most directly on engineering teams. Some 83.5% estimate that AI-generated or AI-assisted code accounts for at least some of their application security findings, yet only 6.8% resolve issues inside the coding assistant at generation time. Salt Labs also reports detected MCP-related infrastructure in 21.6% of customer environments in August 2026, up from 16.7% in January.

Stack Overflow published the results of its 16th annual Developer Survey on 6 October 2026. The survey ran from 23 June to 5 August 2026 and was promoted through stackoverflow.com, the Stack Overflow blog and the company's email list. Of 39,266 responses recorded, 30,903 from 169 countries count as valid. Most questions are optional, so each result carries its own base, and 75% of respondents code as a primary job function. Stack Overflow sells knowledge-management products and data licensing to companies, and its respondents come from its own community.

The AI chapter shows coding assistants and agents as a daily tool. 73% of respondents who use AI coding assistants or agents at work use them daily, and Claude Code (66%) and GitHub Copilot (59%) are the coding agents most used in the past year. 48% trust AI output when they can easily verify it, and 9.6% usually use AI answers for development tasks as-is. Asked which AI mistakes cost their team the most time, 69% name plausible but wrong code. On governance, 30% say AI use at their organisation is mostly optional and left up to individuals.

The State of CI/CD in 2026 is JetBrains' annual report on how teams build and ship software. Its core is the CI/CD Tools Adoption Survey 2026, answered by 598 people, with added context from the Developer Ecosystem Survey 2026 and two AI Pulse surveys. JetBrains makes the TeamCity CI/CD server and recruited respondents through blogs, newsletters and community lists, so the sample leans towards engaged developers.

The report finds that 83% of respondents run CI/CD pipelines and that 48.8% of organisations use AI for at least one CI/CD-related task, yet only 8% run AI-powered steps inside a build or test. Agents mostly reach the pipeline from outside it, with 28% of respondents accessing their CI/CD tool through an MCP server or agent skills, against 10% who use an AI assistant built into the tool. Among organisations using AI in CI/CD, 36% say the volume of AI-generated changes causes review bottlenecks and 35% find it hard to judge whether those changes are reliable. That puts the strain on review and verification; AI-generated code failing the build ranks lower, at 20%.

Salesforce's fourth edition of State of Commerce draws on a double-anonymous survey of 3,450 commerce professionals in 20 countries and 13 industries, fielded from 10 April to 4 June 2026. The release covered here, dated 30 September 2026, is the Singapore announcement, which reports on the 100 Singapore respondents alongside some APAC figures. Salesforce adds a consumer survey and its own analysis of platform shopping behaviour covering more than 1.5 billion shoppers. As a seller of commerce and AI agent software, it has an interest in the framing.

Among Singapore organisations, 28% say they currently use agentic AI, and 52% of non-adopters plan to deploy it within six months. Only 25% say their customer data is fully unified across sales, service, marketing and commerce, and 81% of Singapore leaders say their vendor count has grown over the past two years. On Salesforce's platform data, traffic referred from AI chats grew between 150% and 428% year over year in every quarter measured. The report is written for commerce teams, yet those agentic adoption plans depend on unified customer data and connected channels, which is integration work for engineering.

Gartner's press release of 30 September 2026 sets out five actions it recommends chief information security officers take in the fourth quarter of 2026, drawn from its client research note The Cybersecurity Executive Outlook, 4Q26. One of those actions, treating frontier AI deployments as insider risks, rests on a Gartner survey of 297 cybersecurity leaders carried out in the second quarter of 2026.

That survey finds that 54% of organisations have no defined approach to limiting AI agent access, or rely on predefined human access. The figure suggests that in many organisations the agents engineering teams build or deploy run with permissions designed for people, or with no explicit boundary at all. Gartner advises governing multiagent systems by the actions they are allowed to take rather than by model capability, and using guardian agents to limit the blast radius. The same release reports that 51% of CISOs surveyed have not begun any postquantum cryptography activity. Only headline figures are public, and the underlying research is available to Gartner clients only.

The 2026 CFO Study from the IBM Institute for Business Value, published on 30 September 2026, surveys 1,500 CFOs and equivalent senior finance leaders in 33 geographies and 26 industries, interviewed between February and April 2026 with Oxford Economics. It asks how far finance has taken AI and how the CFO role is changing as AI spreads across the enterprise. As a seller of AI software and consulting, IBM closes the report with a playbook built around five disciplines.

The study finds that 62% of CFOs say their role has expanded into enterprise technology or AI strategy leadership, yet only 6% describe finance as transformation-ready, with AI consistently embedded in workflows and decision-making at scale. Another 48% place finance at a developing stage, where AI skills sit in particular roles, teams or use cases. Just 6% let AI recommend or execute capital reallocations within defined guardrails. These figures describe the finance partner who increasingly sets the AI investment priorities and capital allocation that engineering teams work within, and they show how few finance functions have moved AI beyond isolated use. All measures are self-reported by respondents.

The AI Enforcement Gap is the fall edition of Delinea's 2026 Identity Security Report, released on 29 September 2026. Its case for authorising AI access at the moment of action matches Delinea's own identity security and privileged access products. It combines two Delinea-commissioned surveys across eight countries, one of 2,254 IT and security leaders and one of 2,250 non-IT employees, all at organisations of 500 or more staff using or piloting AI.

The report measures the distance between written AI policy and practice. 99.7% of organisations have a formal AI data-access policy, but 51% check AI access against policy in real time. 87% of IT respondents say an AI tool or agent accessed sensitive data beyond what its task required in the past year (almost three quarters of them confirmed it; the rest suspect it). Among employees, 76% say they have bypassed the required approval at some point. Delivery infrastructure is the weakest area. 47% of organisations lack enforcement at the moment of action in at least two of six environments, with CI/CD pipelines and Kubernetes the least covered, and 55% took a full day or longer to detect their most recent scope violation.

Published on 24 September 2026, a Gartner press release pairs a prediction with survey data on supply-chain planning automation. The survey covers 243 senior leaders at organisations with annual revenue of at least $500 million, fielded between 11 November and 18 December 2025. Gartner predicts that by 2030 only 5% of organisations implementing some form of planning automation will make at least 10% of their planning decisions autonomously, citing the need for human oversight and gaps in data, technology and organisational readiness.

The survey finds that 83% of organisations had spent at least $3 million on automating supply-chain planning, including AI, with 51% spending between $3 million and $10 million. Although the source sits outside software delivery, it gives engineering leaders a reference point on the distance between heavy AI investment and decisions handed to machines. Gartner's advice is to start from the decision being automated, build the data, skills and architecture each use case needs, and measure decision quality rather than deployment. The detailed research sits behind Gartner's client paywall, so the release is the only public account of the figures.

Designing the Thinking Organization is the 2026 CHRO Study from the IBM Institute for Business Value, published on 21 September 2026. With Oxford Economics, IBM surveyed 1,500 chief human resources officers and equivalent executives across 21 geographies and 23 industries, plus 8,800 full-time employees in 28 countries, between April and June 2026. IBM's business in AI products and HR and technology consulting gives it a stake in how work should be redesigned.

The study is about the human cost of AI adoption, which engineering leaders see in code review and validation work. According to the press release, 80% of CHROs believe AI adoption creates "invisible" work for employees, such as validating recommendations, fixing mistakes and managing exceptions, and 42% of employees say AI increases their work or that their work goes unrecognised. Sixty per cent of employees worry about skills erosion, with critical thinking cited most often as declining. Accountability is unsettled too, with 43% of employees reporting that the blame falls on them when something goes wrong with AI. All of these are self-reported views. The report also finds that 46% of organisations do not involve the CHRO when AI strategy is being defined.

Published by the Capgemini Research Institute on 17 September 2026, Data and AI in government 2026: From AI ambition to operational maturity is a research brief drawing on an online survey of 600 senior executives at public sector organisations in 16 countries across Europe, Asia-Pacific, North America and the Middle East, plus more than fifteen interviews. Governments are among the clients of Capgemini's consulting and technology services.

The brief finds that adoption is widening, mostly in measurable, lower-risk work such as fraud detection and administrative automation. Only 28% of organisations report successfully moving AI initiatives from pilot to full-scale production, and 70% say AI needs more ongoing maintenance, monitoring and refinement than expected. Respondents expect AI to account for 7% of annual IT budgets by 2027, up from 5% in 2025, and about one in four organisations qualify as AI front-runners. Teams building or buying systems for public bodies will find data quality, legacy systems and poor interoperability at the centre of the scaling problem, with digital sovereignty a rising priority.

Deloitte UK's inaugural GenAI Workforce Survey asks 25,000 UK workers aged 18 to 70 how they use generative AI in their jobs. Ipsos UK ran the online fieldwork between 7 May and 10 June 2026 on a representative quota sample, weighted by age, gender, sector, region and other factors. Deloitte plans to repeat it roughly every six months, and its AI advisory business serves the employers it describes.

According to the survey, 63% of UK working adults knowingly use GenAI for work and one in six (17%) GenAI users pay for at least one tool themselves. From this Deloitte estimates annual personal spend among UK workers at £958 million. Nearly a third (31%) of GenAI users say they use it without their employer's knowledge, 65% report a lack of convincing leadership on how it should be used, and around half say they have had no formal training. Respondents report saving 70 minutes a week on average. The figures put a number on shadow AI, with a large share of staff buying and using tools outside any approved route, and that bears directly on data handling and tool governance in engineering organisations.

Gartner’s press release of 10 September 2026 reports a webinar poll of 161 chief audit executives (CAEs), conducted in May 2026, on how internal audit functions use AI. The full findings sit in Benchmarks on Audit’s Use of AI, which is available only to Gartner clients. The sample is small and self-selected through a webinar, so the figures describe the audit leaders who attended more than the profession as a whole.

The poll finds that 93% of audit leaders report some level of AI use, while 60% of audit functions have no formal AI strategy. Only 38% of CAEs say they have a strategy in place, 39% are developing one and 23% have none. Use is mostly informal, with about half of respondents reporting individualised, ad hoc use of one or more AI tools and only 15% having defined, organised use cases. A further 54% have not started measuring the return on audit’s AI use. Engineering leaders who build or approve AI systems can expect the internal audit teams reviewing that work to be at an early and uneven stage with AI themselves.

Salesforce publishes its CFO Priorities Report on 9 September 2026, based on a double-blind survey of 865 finance leaders (CFOs, chief accounting officers and finance vice-presidents) in France, Germany, Japan, the United Kingdom and the United States, fielded from 4 to 15 May 2026. Respondents did not know Salesforce had commissioned it. Because Salesforce markets AI agents and revenue-management software to finance teams, its AI findings call for some caution.

The report describes a finance function taking on AI governance. Almost three-quarters of respondents say their role widened in the past year, and managing AI use and expansion is the most cited reason, at 49%. Half say they are primary decision makers in their company's AI strategy. Among finance leaders using AI, 90% report a positive return on investment, a self-reported measure with no common definition of return. Security is the most named blocker to wider use (46%), followed by governance, integration and in-house expertise at 42% each. Engineering leaders should expect finance, as well as IT, to scrutinise AI spending and controls more closely.

Digital Sovereignty: From Policy Ambition to Executive Imperative, published by the Capgemini Research Institute on 8 September 2026, surveys 1,300 business and technology executives at organisations with more than $1 billion in annual revenue or budget across the US, the UK, six continental European countries and four APAC countries. The survey ran in April 2026 and is supported by 13 executive interviews. Capgemini offers digital sovereignty assessment and consulting, so the urgency of the findings suits its business.

The report builds a Digital Sovereignty Index for 866 organisations, scoring reliance on foreign or externally controlled supply chains, supplier concentration and the ability to switch vendors. By that measure, 86% have significant exposure. Three-quarters of organisations prioritise AI in their pursuit of sovereignty, only 14% report end-to-end visibility into dependencies across their technology ecosystem, and 59% say full digital sovereignty is not a realistic goal. The most practical figure for any plan that depends on a single model or cloud vendor concerns switching. More than a third (36%) say moving away from a critical provider would take more than 12 months.

The ServiceNow Enterprise AI Maturity Index 2026, released for India on 8 September 2026, comes from a survey that ServiceNow ran with ThoughtLab of 4,500 senior leaders worldwide, 350 of them in India. The India data sheet also draws on 250 employees. ServiceNow scores organisations with a proprietary maturity index, and the workflow and AI platform the report recommends is its own, which colours its conclusions about integrated platforms.

The index finds Indian enterprise AI investment up 119% in a year, against a global average of 110%, with AI at 16.6% of the average IT budget and projected to reach 21.3% by 2027. Governance trails that spending. Only 22% of Indian organisations have AI testing, auditing and risk-assessment processes in place, and while 54% use agentic AI, only 11% have made progress building autonomous workflows. Just 18% have replaced fragmented legacy systems with an integrated platform, and 74% of leaders cite data accuracy, access and management as their top AI challenge. The report makes testing, auditing and data integration, much of it engineering work, the condition for letting agents act on their own.

Deloitte and Docusign published their third annual study of agreement management technology, Capitalizing on AI: How automated agreement workflows drive ROI, on 8 September 2026. Its finding that end-to-end platforms deliver higher returns suits Docusign, which makes agreement management software. The survey covers more than 1,100 senior business and functional leaders across six countries and six functions (Legal, Sales, Procurement, Customer Experience, HR and IT). It includes only organisations with at least some agreement workflow automation in place.

Respondents report, on average, 36% efficiency gains through time savings or cycle-time reduction, 36% cost avoidance from mitigated risks and 29% cost savings from lower labour costs. Legal respondents report average time savings of 37%, and 61% of respondents rely on manual processes to surface insights from signed agreements. Contract work sits outside most engineering roadmaps, but the study puts self-reported return figures on AI-assisted business workflows of the kind IT teams integrate and support. The figures come from organisations that have chosen to automate and are respondents' own estimates.

Salesforce published State of Agentic AI in the Enterprise on 6 September 2026, a double-blind survey of 2,025 decision-makers who influence AI agent purchasing, in 20 countries, fielded from 14 to 28 May 2026. Respondents are grouped as deployed (30%), piloting (47%) or evaluating (23%), and most findings describe the deployers. The company's own agent platform is Agentforce, and every outcome measure in the study, including time to return on investment, is self-reported.

The survey asks what separates organisations getting returns from agents, and its answer centres on preparation. Deployers report reaching meaningful ROI in about eight months on average, with an employee adoption rate of 53%. Only 31% of deployers fully unified their data before launch; those that did report ROI in 7.3 months against 8.8 for those that fixed data gaps afterwards. Governance shows a trade-off. Organisations with lighter oversight report positive ROI in 7.2 months against 9.3 for heavier governance, but 32% of those with below-average governance found an agent operating outside its parameters only after a consequential error, against 18% with above-average governance. High Tech is among the largest deployers yet reports one of the slowest times to ROI, at 10.1 months.

Gartner announced results from its C-Suite AI Survey on 1 September 2026. The survey ran from January to April 2026 and covers 1,303 respondents from organisations with enterprise-wide annual revenue of at least $50 million in fiscal year 2025. The full analysis is available only to Gartner clients, so this entry rests on the press release.

Only 22% of organisations have scaled AI across multiple business units or adopted an AI-first approach, and roughly 11% are entirely unaware of what their function spent on AI in 2025. Spending is rising regardless, with 85% of functional leaders planning to increase AI spending in 2026 after dedicating an average of 12% of functional budgets to AI in 2025. Productivity is a key target outcome for 75% of functional leaders. The IT results are the most relevant to engineering leaders. Automated code generation and refactoring is among the most pursued IT use cases (44%), but it comes third on the list of use cases with positive returns, at 23%, behind intelligent IT asset and cost optimisation (40%) and synthetic data generation (28%).

Market Connections, the research division of GovExec, ran AI Agents Are Here, But Don't Call Them Boss, a poll of US federal staff, for Workday Government. The nine-question poll went to a random sample of 200 federal civilian and defence IT employees in June 2026, and Workday summarised the results in an article dated 24 August 2026. Workday supplies HR, finance and AI agent software to government. The full report sits behind a registration form.

The poll finds broad but shallow adoption. Of the respondents, 96% say they have incorporated AI into their workflows, but 42% say AI is having a positive impact on their work and 27% say it lets employees spend more time on higher-value work. Security is the main brake, with 85% naming potential security vulnerabilities as a concern for expanding AI. Three in five report that humans review some or most agentic workflows and outputs, and only 20% believe AI is or will lead to headcount reductions. The sample is small and specific to the US federal government, but engineering leaders can check whether their own organisations show the same gap between reported adoption and reported benefit.

Sonatype Research Labs released The AI-Era Software Assembly Line on 18 August 2026, alongside new features for its Sonatype Guide product. The report follows a fixed cohort of enterprise applications continuously scanned by Sonatype from June 2022 to June 2026, so that changes in risk reflect the software ecosystem rather than a changing customer base. Sonatype defines March 2024 as the start of the "AI era", and the data comes from the composition-analysis and dependency-management tools it sells.

On average, an enterprise application carries 4.31× more Critical and High risk in June 2026 than in June 2022, or 3.91× when legacy applications newly brought under management are excluded. Remediation is faster, with the median age of unresolved violations falling by more than half between January 2024 and May 2026, yet automation catches only about 8% of new violations on the same day. Newly affected component versions are 46 times the pre-AI rate. In Maven Central, nearly two-thirds of vulnerable dependency selections by AI-era applications occur when a lower-risk version is available. Sonatype does not isolate the cause of the faster vulnerability discovery, and says greater vulnerability research, better disclosure and AI-assisted security research may all contribute.

Gartner published this survey of 3,566 B2B and B2C customers on 4 August 2026, as a question-and-answer release with Eric Keller of its Customer Service & Support Practice. The survey was conducted in February and March 2026 and asks customers how they feel about companies using generative AI for customer service. The full analysis appears in the client-only report Customer Insights 2026: Align GenAI Investments With New Customer Behaviors.

Customers report mixed views. Half (50%) say their interactions are easier when companies use GenAI, yet 87% say it is essential for companies using GenAI to provide an option to reach a human agent. Among customers unwilling to use AI, the ability to switch to a human is the most common thing that would change their mind. Of customers who use GenAI, 58% have used it to complete a task on their behalf, rising to 74% in B2B settings. In the survey, human escalation becomes a design requirement for AI support channels, and the task figures point towards agents that complete tasks such as bookings and orders.

Released on 3 August 2026, the CrowdStrike 2026 Threat Hunting Report draws on investigations by the company's OverWatch threat hunters and its Counter Adversary Operations intelligence between 1 July 2025 and 30 June 2026. The data come from activity CrowdStrike observes across customers of its endpoint, identity and cloud security products, so the figures cover what its platform sees and not the whole market.

The report's main theme is that adversaries now use AI throughout their operations and treat AI systems and developer ecosystems as targets. The supply chain material bears most directly on engineering teams. CrowdStrike reports that the North Korea-linked adversary STARDUST CHOLLIMA injected a malicious npm package into 131 trusted Mastra AI framework packages, and that 87% of software registry threats it identified in the first half of 2026 involved malicious npm packages. Another adversary compromised more than 300 software dependencies in a single day to harvest credentials. On exploitation speed, 88% of observed exploitation of vulnerabilities with a public proof of concept happened within 48 hours of its release in the first half of 2026.

Harness published the 2026 State of AI in FinOps on 29 July 2026. It is based on an online survey of 700 engineering leaders and practitioners at organisations with at least 1,000 employees in the United States, United Kingdom, France, Germany and India, conducted in May and June 2026. Cloud and AI cost management is Harness's own market, and the report's recommendations point towards it.

The report treats AI as a budget line large enough to need an owner. Respondents report that 67% of their organisations spend more than $250,000 a month on AI and 20% more than $1 million, while 52% say there is no clear, dedicated owner for AI costs. Cost surprises are common, with 72% reporting an unexpected AI cost spike or surprise bill in the past year and 79% saying they would need at least a full day to trace one to its source. Organisations estimate that 26% of AI spend is wasted. Closest to engineering, respondents estimate that on average 45% of engineers understand the cost of what they build, and 57% say their organisation encourages maximising AI use regardless of value.

Veracode, which makes application security testing and remediation tools, released its 2026 GenAI Code Security Report on 28 July 2026. It tests how often large language models produce secure code when given no security-specific prompting. Across four testing snapshots and more than 100 models tracked since the programme began, each model completed code-generation tasks spanning several languages and vulnerability categories under standardised conditions. The tests ran against raw models, without agents, extra tooling, guardrails or human review.

The average security pass rate is 56%, virtually unchanged from the previous year's report, while syntax pass rates are close to 100%. OpenAI's GPT-5.5 leads the Summer 2026 leaderboard of 11 models at 68%. Coding-specialised models average 51% against 52% for general-purpose models, and model size makes little difference (53% for large models, 51% for medium and small). Reasoning models score 56% against 51% for non-reasoning models. By language, Python reaches 63% and Java 30%. Picking a different model will not make AI-generated code secure; Veracode says it should be scanned and fixed like any unreviewed code.

The Netskope AI Report: 2026, published by Netskope Threat Labs on 27 July 2026, draws on aggregate usage data from the Netskope One security platform for a subset of Netskope customers between June 2025 and July 2026. The AI gateway, data loss prevention and inspection controls the report recommends are Netskope products, and the sample is its own customer base. The report tracks how enterprises use AI apps, agents and the Model Context Protocol (MCP), and the data-policy violations that result.

The average organisation sees 69 upstream data-policy violations a week, where users or agents send sensitive data to AI services against policy, up from 44 a year earlier. Downstream violations, where an AI service returns data the user is not authorised to see, have more than doubled from 12 to 31 a week, and from 72 to 206 a week in the top quarter of organisations. Netskope links the downstream rise to a 4x increase in MCP traffic. Coding agents spread fast, with 75% of organisations using Claude Code and 58% using Codex, both under 1% a year earlier. Shadow AI persists, with 30% of AI users relying only on personal AI apps.

BCG's Center for Digital Government published the findings of its 2026 Digital Government Citizen Survey on 21 July 2026, under the title "Citizens Are Open to Public AI Services. Governments Must Seize the Opportunity." The biennial survey covers 48,500 respondents in 44 countries and asks how citizens use AI and how they want governments to use it. BCG advises governments on digital services, and the publication argues for faster public-sector adoption.

Because the survey measures how ordinary people use AI, it gives engineering leaders a baseline for the users and staff their products serve. BCG finds that 64% of citizens in the 44 countries use AI weekly, up 26 percentage points in two years. Sixty per cent of proficient users (intermediate and above) say they are comfortable letting AI agents act on their behalf, and nearly two-thirds of citizens want human oversight built into the structure of digital services. Attitudes vary by region. Europe has the lowest comfort level, 9 percentage points below the global average, while Middle East and Africa has the highest. BCG also reports that lower satisfaction with government correlates with a belief that governments are moving too slowly on AI.

The cost of intelligence: How CIOs can manage AI demand at scale is a McKinsey Quarterly article published on 20 July 2026 by authors from QuantumBlack, AI by McKinsey, and McKinsey's Technology and AI group. Its figures come from the McKinsey Enterprise AI FinOps survey of May 2026, which had 120 enterprise participants and 75 qualified respondents across five major industries, a small base. McKinsey also offers paid advisory services in this area.

The survey finds that AI spend increases nearly fourfold as organisations move from isolated use cases to enterprise-wide adoption. While 62% of organisations have moved beyond experimentation into active deployment, 93% of respondents report exceeding their AI budgets, and a majority expect AI spend to rise by at least 25% over the next 12 months. Only 20 to 25% of companies have mature AI FinOps practices, and organisations with high forecasting maturity save 10% more on AI spend than their peers on average. Token consumption by agents, coding tools and citizen developers appears in the article as a cost to forecast, attribute and govern, with model routing, prompt caching and limits on agent loops among the levers.

State of AI-Driven Software Releases 2026 is a survey by LeadDev and Harness of 500 engineering leaders on how release processes are coping with the volume of AI-generated code. Harness, whose products cover continuous delivery, feature flags and experimentation, presents those practices as the remedy in its public write-up, published on 14 July 2026, so the framing deserves care. The full report sits behind a form.

The survey finds that only 49% of organisations have specific guardrails in place for AI-generated code, and 52% of respondents cite a lack of clear metrics as their biggest challenge when working with it. Some 57% require a manual human review of every line of AI-generated code regardless of risk, and 32% saw release sizes grow after introducing it. Smaller companies are less protected, with vulnerability detection in use at 44% of large enterprises against 16% of smaller ones. Only 29% of organisations measure the impact of AI tools on their teams at all. Review and release controls have not kept pace with code generation, and the measurement gap makes the trade-offs hard to judge.

The second annual AI Security Report from Check Point Research, published on 13 July 2026, draws on the company’s own incident work, product telemetry and case studies from the preceding twelve months. Half of the report covers attackers using AI, including cases where AI tools ran intrusions with little human direction. The other half looks at the exposure organisations create as they adopt AI. The report ends by recommending approaches that match Check Point's own AI security products.

Its telemetry finds that high-risk enterprise AI prompts doubled over the year, from roughly one in every 50 interactions to one in every 25, and that between 87% and 93% of organisations experience at least one high-risk AI interaction each month. Detections of long, malicious prompt-injection payloads rose roughly fivefold between March and May 2026, which Check Point takes as a sign that indirect prompt injection has become a working attack path. One technique it describes applies directly to teams running AI coding agents. Attackers plant instructions in files the agents load automatically, such as CLAUDE.md, so that every new session inherits the bypass.

SANS 2026 AI in Cybersecurity, published by the SANS Institute on 13 July 2026, is the second annual edition of its AI survey. It draws on 536 security and IT practitioners worldwide and a separate module answered by 57 senior security leaders, including CISOs. Fourteen companies sponsored the research, and SANS says they had no role in survey design or analysis. The full white paper requires a SANS account.

The survey tracks how security teams use AI and see attackers using it. In the past year, 78% of organisations report confirmed or suspected AI-enabled attacks, and 95% of respondents believe threat actors are using AI. Among practitioners, 63% report significant AI shortcomings in threat detection and response, up from 45% in 2025, and 27% describe their AI deployment as mature production. Security teams are taking on oversight of AI across the business, and 76% hold a governance role for enterprise AI, up from 68% in 2025, though more than half say no formal audit frameworks support that role. Among leaders, 63% have shifted priority towards using AI for defence and 16% towards defending against AI threats. AI changed their team's training requirements in 2026, according to 73% of practitioners.

Google Cloud's second annual State of AI Infrastructure report, titled 2026 State of infrastructure in the agentic AI era, is summarised in a blog post of 7 July 2026 by Drew Bradstock. It draws on a survey of 1,402 senior IT leaders worldwide. The compute, storage and agent-governance products the post recommends are Google Cloud's own, so the framing favours its platform.

The survey asks how ready infrastructure is for agentic AI in production. The headline finding is that 83% of organisations say they need infrastructure upgrades to support production-grade agentic AI. Cost is the second theme, with 62% reporting a significant inference tax from data egress fees, storage bloat and idle specialised hardware, and 81% citing operational complexity as a hidden cost of scaling AI. Asked about the main challenge to scaling inference, 79% name security, governance and MLOps. Other findings cover hybrid multicloud (used by 52%), data residency and energy use. Teams planning agent deployments have reason to budget for platform, cost and governance work alongside the agents themselves, though all the figures are respondents' own assessments.

A Widening Skills Gap Is Making It Harder to Absorb Your AI Investment is a Workday research article from July 2026, written by Ross Brooks. It analyses more than 25,000 job listings from over 300 companies that use Workday Recruiting, spanning technology, financial services, healthcare and professional services between July 2025 and April 2026. Workday describes the findings as early, directional signals, and the sample is limited to its own recruiting customers.

The analysis sorts skills into four groups (technical AI, AI fluency, learning and training, and project delivery) and tracks how often listings mention each. Demand for technical AI skills rose in every sector, by 130% in healthcare and 21% in technology, while mentions of learning and training skills fell by between 14% and 21% and project delivery skills by between 6% and 13%. In technology, technical AI skills appeared in 7.4% of new postings in September 2025 and 9% in April 2026. Workday argues that companies are hiring people to build AI while cutting the roles that help staff use it, which leaves engineering organisations building AI capability without the training and delivery capacity needed to put it to use.

KPMG LLP released the Q2 2026 edition of its AI Quarterly Pulse Survey on 24 June 2026. It polls 204 US-based C-suite and business leaders at organisations with annual revenue of $1 billion or more, fielded between 28 April and 25 May 2026. KPMG's own business includes AI advisory and transformation services.

This edition centres on the cost of running AI. Leaders plan to invest a weighted average of $202 million over the next 12 months, against $207 million in Q1 2026. Two-thirds have AI cost monitoring dashboards (66%), yet only 26% report full, real-time visibility into what their AI systems cost to operate. Thirty-five per cent cite AI cost and economic literacy, including token and inference pricing, as a barrier to deploying agents. Agent deployment stands at 53%, against 55% the previous quarter, while the share orchestrating multiple agents across workflows doubles from 9% to 18%. Employee resistance to agents rises to 20% from 5%, and resistance driven by added workload or complexity rises from 28% to 51%. On hiring, 40% of leaders say they would offer a 6–10% premium for candidates with strong AI skills and 38% would pay 11–15% more.

The Flexera 2026 State of ITAM Report surveys 512 professionals with IT asset management responsibilities worldwide, drawn from an independent panel in the first months of 2026. The problems it measures are the ones Flexera's IT asset management and FinOps software is built to address. It covers how ITAM teams are converging with FinOps, audit exposure, wasted spend and, new to this edition, the management of AI software.

AI is the area of weakest control. Only 31% of organisations report accurate visibility into AI software, and 59% say wasted spending on AI software increased over the past year. Tracking or adopting new AI applications is the top combined ITAM challenge, cited by 84% of respondents. Practices are uneven, with 48% tracking usage and rightsizing AI contracts and 45% looking for shadow or unsanctioned AI, while 51% of ITAM teams support AI spend visibility. Anyone approving AI coding tools and model subscriptions is relying on ITAM teams that often cannot yet see that spend. Nearly half of organisations (48%) also received a software audit in the past year.

The 2026 AI Accountability Report from GitLab, released on 23 June 2026, is based on a survey by The Harris Poll of 1,528 developers and technology buyers across six countries. It asks whether organisations can account for the AI-generated code they ship. GitLab, a DevSecOps platform vendor, presents governance of AI code as a platform problem.

AI coding tools are standard in the sample. Ninety-one per cent of organisations have two or more in active use and 54% have three or more. Respondents report gains, with 78% citing faster code output and 73% saying overall code quality has improved, but 79% see individual developer productivity improve without delivery accelerating at the same pace. The bottleneck has moved, according to 85%, from writing code to reviewing and validating it. Provenance is weak. Forty-three per cent cannot reliably distinguish AI-generated code from human-written code in their own codebase, only 28% say their lifecycle tools are fully integrated with shared data and workflows, and 34% of organisations that had an incident in the past year could not determine whether AI code contributed. These are self-reported views, and 82% expect AI code to create technical debt they are not yet prepared to manage.

CrowdStrike published key findings from its State of Cloud Detection and Response (CDR) Survey in a blog post on 22 June 2026. The report page describes the sample as 1,000 global security leaders, and the summary gives no fieldwork dates. The findings are framed around the gaps that CrowdStrike's own cloud security and detection and response products address.

Respondents report that 94% of organisations have experienced cloud intrusions that resulted in data exposure or exfiltration, and 73% cannot consistently guarantee detection of cloud intrusions, 95% say not all cloud workloads and instances are covered by security sensors or agents, and 68% take 15 minutes or more to detect a cloud intrusion. Among respondents, 83% run AI or ML workloads in the cloud, and 81% have experienced incidents targeting those environments. Teams running services in the cloud will see how far detection depends on telemetry from both the control plane and workloads. Manual work fills the gaps, with nearly 80% relying heavily on manual investigations when responding to cloud threats.

Agentic coding and persistent returns to expertise is an Anthropic research report on how people use Claude Code, Anthropic's own coding agent. It analyses about 400,000 interactive sessions from about 235,000 people between October 2025 and April 2026, using Claude-based classifiers checked against session telemetry, and excludes headless, SDK and third-party IDE use. Since the product is Anthropic's own, the data describe its users only.

About 56% of sessions involve writing, fixing, testing or orchestrating code. Over the seven months the share of sessions spent fixing broken code falls from 33% to 19%, while operating software rises from 14% to 21%. Anthropic estimates, by comparison with freelance job postings, that the value of the average session rose 27% between October and April, while stressing that the estimates are coarse. Users make about 70% of planning decisions and Claude about 80% of execution decisions. Sessions rated expert reach verified success more than twice as often as novice ones, and users outside software occupations succeed at coding tasks at rates within a few points of software engineers. On this evidence, domain knowledge governs how much work an agent can be trusted with, and coding skill counts for less.

PwC's 2026 Global AI Jobs Barometer, titled Two futures for jobs in an AI era, is the firm's annual study of how AI is changing jobs, wages and productivity. It analyses over one billion online job advertisements across six continents and links them to company financial data and PwC's own AI exposure index. The report closes with advice for business leaders, the clients of PwC's AI consulting practice.

For workers, the headline finding is a wage premium. Roles that require AI skills advertise salaries 62% higher than comparable roles that do not, up from 57% in the 2025 Barometer. On companies, PwC reports that the top fifth of the most AI-exposed firms achieve 163% productivity growth, measured as revenue per employee against a 2018 baseline. Skills for the most AI-exposed jobs are changing more than twice as fast as for the least exposed, and the most AI-exposed junior roles are seven times more likely to ask for traditionally senior skills such as leadership. Software developers are classed among the jobs AI is 'democratising', meaning tasks shift towards less expert work. These findings bear on engineering leaders' hiring costs, the price of AI skills and how junior roles are designed.

The 2026 State of AI Coding Report, introduced on the New Relic blog on 10 June 2026, is a survey of 200 US technology decision-makers at manager level and above, conducted by Hanover Research for New Relic. It asks how much code AI now produces and how that code behaves after release. The report concludes that observability, New Relic's own product category, is the answer, so the framing deserves caution. The sample is small and all figures are leaders’ own estimates.

Respondents report heavy use, with 67% saying AI generates or significantly refactors between 51% and 75% of their organisations’ weekly code output. They also report problems after release, with 82% saying they have had at least one major production failure caused by AI code in the past six months, and 74% saying at least 25% of AI-generated code needs significant rework after deployment. Meanwhile 94% rate AI code as higher quality than human code at review, and 62% say their teams often or always ship it without line-by-line manual verification. Engineering managers who rely on review to catch problems will see a sharp contrast between how AI code looks at review and how it behaves in production.

Software Improvement Group, the Amsterdam firm behind the Sigrid software-portfolio analysis platform and related consulting, publishes State of Software 2026 on 9 June 2026. The report draws on SIG's benchmark of more than 30,000 systems and over 400 billion lines of code, using the systems analysed over the past year, set against independent research. Because the systems are those SIG's customers chose to have measured, and the quality ratings are SIG's own, the results describe its benchmark and cannot stand for all enterprise software.

SIG argues that AI amplifies whatever engineering discipline an organisation has. It finds that 1.9% of enterprise production code is AI-generated, and that in its testing AI-generated code carries roughly double the security risk violations of human-written code. Beyond AI, 86% of code falls below SIG's recommended maintainability rating, 71% has a low degree of security controls and 50% scores below its recommended architecture rating. SIG estimates that reducing code-level technical debt can save €870,000 in developer time per system per year, and puts technical debt at between 21% and 40% of total IT spending. For engineering leaders, the report gives a measured counterweight to self-reported figures on AI's share of code.

The Future of Application Security in the Era of AI, Checkmarx's 2027 Industry Outlook, was published on 9 June 2026. Censuswide ran the survey for Checkmarx, questioning 2,350 CISOs, AppSec managers and developers across 14 countries, the largest sample in the series to date. As a vendor of application security testing, Checkmarx ends the report by making the case for agentic security tools.

Respondents report that 49% of production code is AI-generated and that 75% of organisations knowingly deploy vulnerable code. Checkmarx segments respondents by the share of their code that is AI-generated and finds that organisations at 81-100% ship vulnerable code at 3.4 times the rate of those at 1-20%. Only 9% of organisations fix more than 90% of vulnerabilities within 90 days. The survey also compares the three roles, and their answers diverge. Asked whether their organisation had no breaches in the past 12 months, 11% of CISOs say yes, against 8% of developers and 1% of AppSec managers. The report links AI-assisted coding to a growing remediation gap. Although 96% of developers have AI-based security tooling in their IDE, only 18% apply security continuously as code is written.

AI at Work: Strategy Matters More Than Tools, published by Boston Consulting Group on 3 June 2026, presents BCG's fourth annual global AI at Work survey. It covers close to 12,000 frontline employees, managers and leaders in more than a dozen markets. Its conclusion that leadership-led work redesign matters more than tool access sits close to BCG's own AI strategy and transformation consulting business.

Among frontline employees who are regular AI users, 42% report saving at least a workday per week, with higher shares in marketing (60%), IT (53%) and HR (50%). Regular use among frontline workers has reached 74%, up 23 percentage points from 2025. Yet 66% receive limited or no guidance on what to do with the time saved, and more than half say they are not reinvesting it in more strategic work. Close to half or more report spending more time reviewing and correcting AI output or managing and directing AI, and 41% report increased mental strain. The share saying their organisation has integrated AI agents into workflows rose to 30% from 13%, while half say their companies lack clear governance for teams of people and AI. The time savings are respondents' own estimates.

OpenAI published The Next Era of Knowledge Work on 2 June 2026, a short report on Codex, its own coding agent, built on usage data from the product. The report mixes these figures with customer case studies and policy proposals, and it does not explain how users are classified or how task types are measured, so the numbers are vendor telemetry without a stated method.

The report says Codex has more than 5 million weekly active users, up more than 6x since the desktop app launched in February 2026. Knowledge workers in roles such as product management, design and research make up about 20% of users and are adopting Codex more than 3 times as fast as developers. Roughly 50% of users have more than one Codex task running at once at some point in the day, up from less than one third in mid-April. The data point to coding agents reaching staff outside engineering who build their own tools, which raises questions about who reviews, owns and supports software written beyond the engineering team.

Agents on a leash, a Stack Overflow blog post published on 27 May 2026, reports a pulse survey of 1,100 developers and working professionals fielded from late April. It asks how people use AI agents at work and compares several answers with the 2025 Developer Survey.

59% of respondents use agents at work at any frequency, against 31% in the 2025 Developer Survey, with most of the growth in daily use. Daily use is highest among architects (52%) and senior executives (50%), with developers at 40%. Autonomy remains limited. 63% rarely or never let agents run entirely on their own, 60% block agents from making unapproved system changes and 68% prefer predictable single-agent setups to multi-agent configurations. GitHub Copilot (61%) and Claude Code (51%) are the most used code assistants over the previous six months. Accuracy and security are the top two concerns, though the share strongly agreeing that accuracy is a barrier falls from 57% to 47%. Taken together, the results show agent use spreading quickly within single-agent workflows that keep a human reviewing the work.

AI Agents at Work 2026 is Okta's survey of how organisations govern AI tools and agents. Apprize360 fielded it for Okta in March 2026, polling 292 executives with authority over IT, security, data and engineering and 492 knowledge workers who had used AI in the previous three months, across seven countries. The write-up recommends Okta's own identity and access management products, including those for securing AI agents.

The survey sets executive confidence against what employees report. While 90% of executives are confident in their visibility into AI tools, 52% of knowledge workers say they have used AI tools without approval. Among those unapproved users, 54% have shared internal messages and emails, 45% HR-related information and 39% confidential company documents with those tools. In the past 12 months, 58% of executives report an AI-related security incident or close call, and only 34% say their organisation always applies the same security controls to AI agents as to human staff. The two findings that stand out are the gap between stated policy and what employees do, and the low share of organisations treating agents as identities subject to the same controls as people.

Accenture published AI-ready data: New rules of data for the advanced AI era on 26 May 2026. It combines a survey of executives at 2,000 companies in 15 countries and nine industries with proprietary modelling and expert interviews, and asks whether company data can support advanced AI, which Accenture defines as generative, agentic and physical AI. The report's maturity model and recommendations follow the lines of Accenture's own data and AI consulting business.

The report finds that 64% of respondents say their businesses have moved beyond pilots or begun coordinated enterprise-wide efforts on advanced AI, but only 7%, which Accenture calls data reinventors, have reached the data readiness needed to scale it. A further 72% lack trusted data of the right quality with standardised governance, and more than 80% delay, limit or alter AI initiatives at least occasionally because of data-related risks. Accenture estimates that data reinventors hold a 4.5 percentage point EBIT margin advantage over peers. Teams scaling agents and generative AI will find data quality, governance and business context treated as the main limit.

Verizon published the 2026 Data Breach Investigations Report, the 19th edition, on 19 May 2026. It analyses more than 31,000 real-world security incidents, over 22,000 of them confirmed data breaches at organisations in 145 countries, using data from almost a hundred contributors (law enforcement, forensic firms, insurers and others) alongside Verizon's own investigations. The incidents date from late 2024 to late 2025. Managed security services are part of what Verizon Business offers.

For the first time in the report's history, exploitation of vulnerabilities is the most common initial access vector for breaches, at 31%, while credential abuse falls to 13%. Only 26% of critical vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalogue were fully remediated in 2025, and the median time to full resolution rises to 43 days. Breaches involving a third party reach 48% of the total, and 45% of employees are regular users of AI on corporate devices, up from 15%. For engineering leaders, the findings make patching speed and supplier risk central to breach prevention.

The 2026 State of AI Infrastructure Report is Flexential's third annual survey of enterprise IT leaders. In February 2026 the company surveyed 354 IT decision-makers at director level or above at organisations with more than $100 million in annual revenue, all with knowledge of their organisation's AI infrastructure. Flexential's business is data centre colocation, interconnection and cloud services, the infrastructure the report discusses.

The report finds that infrastructure constraints now outweigh budget concerns for AI expansion. Some 55% of respondents rank power cost or pricing differences as the top factor in where AI workloads are deployed, 72% are concerned that electricity-price volatility will affect AI operating costs, and 96% experienced at least one network-related performance issue affecting AI workloads in the past 12 months. Return expectations are more cautious. The share expecting measurable financial returns from AI within one year fell from 51% in the previous edition to 36%, and 55% now measure AI success through cost reduction and operational efficiency. Tariffs play a part too, with 40% saying they delayed or scaled back AI infrastructure purchases. Those power, network and cost constraints shape where engineering teams can host AI workloads.

The Copy/Paste Economy: Why Task-Oriented AI Is Failing the Enterprise is a Workday report, announced on 14 May 2026, on why AI tools have not reduced the manual work of moving information between systems. The Harris Poll surveyed 6,100 finance, HR, IT and operations professionals for Workday between 2 and 24 March 2026, all active AI users at organisations with 500 or more employees. The report argues for AI embedded in core systems, which is how Workday's own HR and finance products are built.

The survey finds that 82% of employees say they spend significant time copying and pasting information between systems, 77% must reconcile conflicting data from different tools, and 20% lose more than seven hours a week to manual integration. Only 27% of organisations have embedded AI into core workflows. Where they have, 60% of employees report time savings of 25% or more; where AI sits outside core systems, less than a quarter report savings that large. These are self-reported savings. Among IT professionals, 25% say integration work defines their day, and the report points to data integration and system access as the constraint on AI's usefulness.

Gartner announced its 2026 CMO Spend Survey on 11 May 2026 at its Marketing Symposium in London. The survey was fielded from January to March 2026 among 401 CMOs and other marketing leaders in North America, the United Kingdom and Europe, most at companies with annual revenue above $1 billion. Gartner's business is selling research and advice, and the full report is available only to its clients.

CMOs allocate an average of 15.3% of marketing budgets to AI initiatives. 70% say becoming an AI leader is a critical goal for 2026, but only 30% report mature or fully developed AI readiness capabilities, and 70% say their internal marketing processes are not mature enough to implement and scale AI. Overall marketing budgets are effectively flat at 7.8% of company revenue, up from 7.7% in 2025, and 56% of CMOs say they lack the budget to deliver their 2026 strategy. The survey shows demand for AI outside engineering, with marketing moving a sizeable share of a flat budget into AI. Gartner's analyst warns that CMOs risk buying tools faster than they build the data foundations, processes, governance and talent needed to scale them.

Microsoft published its 2026 Work Trend Index Annual Report on 5 May 2026. It combines an online survey of 20,000 full-time or self-employed knowledge workers who use AI at work, run by Edelman Data x Intelligence across 10 markets between February and April 2026, with anonymised Microsoft 365 and Copilot telemetry. Copilot and the agent platforms the report discusses are Microsoft products, and the sample covers only people who use AI at work.

The report argues that organisational conditions drive most of the AI impact people report. In its modelling, culture, manager support and talent practices account for 67% of reported AI impact against 32% for individual mindset and behaviour. Only one in four AI users (26%) say their leadership is clearly and consistently aligned on AI, and just 19% fall into what Microsoft calls the Frontier, where individual readiness and organisational support are both high. Respondents also report that 66% spend more time on high-value work because of AI. Engineering managers looking for where adoption stalls should start with the alignment and manager-support findings, though every measure here is self-reported.

The IBM Institute for Business Value released its annual CEO study on 4 May 2026. Conducted with Oxford Economics, it surveyed 2,000 CEOs and equivalent senior leaders across 33 geographies and 21 industries between February and April 2026. Its recommendations favour AI-first operating models, which suit IBM's AI software and consulting businesses.

The study finds that 76% of surveyed organisations have a Chief AI Officer in 2026, up from 26% in 2025. 64% of CEOs say they are comfortable making major strategic decisions based on AI-generated input, and by 2030 they expect 48% of operational decisions where consistency and guardrails can be codified to be made by AI without human intervention, compared with 25% today. CEOs estimate that only 25% of the workforce uses AI regularly as part of their job, although 86% believe their employees have the skills to collaborate with AI. The jump in Chief AI Officers points to new reporting lines for AI accountability, and 85% of respondents say all functional leaders must become technology experts in their domain.

Split Decisions: The BCG CEOs and Boards Survey is the first edition of a Boston Consulting Group survey, published on 4 May 2026 under the article title "CEOs and Boards Are Aligned on AI in Theory, but Divided in Practice". It questions 625 leaders (351 CEOs and 274 board members) at companies with annual revenue of $100 million or more, and 44% of respondents are based in the US. BCG sells AI strategy and transformation consulting to these same executives.

The survey compares how CEOs and their boards view AI, which bears on the targets and timelines engineering leaders are given. BCG finds that 35% of CEOs think their boards overestimate what AI can replace, and about 60% believe their boards are rushing AI transformation. Boards see themselves differently, with 75% of board members believing their AI knowledge is on par with or more advanced than that of their peers. The two groups also disagree about leadership. Forty-seven per cent of CEOs say they are heading up AI implementation, against 39% of board members who say the same, and fewer than 10% of either group think a chief AI officer should lead AI strategy. All figures are opinions.

Cybersecurity Insiders produced the 2026 Securing the AI Transformation Report with Check Point, which sponsors it and writes the foreword. It surveys 1,042 cybersecurity and IT professionals, from CISOs to analysts, drawn from the Cybersecurity Insiders community in early 2026, and asks whether security architecture is keeping up with enterprise AI. The report’s closing recommendation of a unified hybrid mesh architecture matches Check Point’s own network and AI security offering.

Respondents report that 70% of organisations run generative AI in production and 64% have AI agents in pilot or production, while 54% have had an AI-related security incident. Controls are thin. Only 17% have broadly deployed runtime LLM controls such as input validation, output filtering and tool-use authorisation, and 56% have no formal security testing for GenAI applications or test only ad hoc. Just 7% always scan AI models for vulnerabilities or malicious code before deployment. By these figures, most teams release AI applications without the testing and runtime checks they would expect for other production software.

The AI Coding Paradox, published by Qodo on 30 April 2026, reports a survey of 500 US IT engineering leaders, engineers and developers conducted by Censuswide between 3 and 6 March 2026. Its recommendations point towards AI code review and automated quality gates, which are Qodo's own products.

The survey sets developer confidence against production outcomes. It finds that 89% of organisations have had at least one AI-related production incident and 25% have had a production outage caused by AI-generated code. Security vulnerabilities are the most reported incident type, cited by 53%. Among the largest enterprises (10,001 or more employees), 40% report an outage caused by AI-generated code, the highest rate of any size group. At the same time 94% of respondents say they are confident in AI-generated code, and 95% say knowing code is AI-generated changes how closely they review it. Review time divides, with 41% reporting more time on manual review than before AI coding tools and 45% saving time. The report puts numbers on the review load AI shifts onto engineers, though incidents and time spent are self-reported.

The State of Teams 2026 is Atlassian's annual report on teamwork, published on 27 April 2026 by its Teamwork Lab. It rests on a double-blind survey, run in January and February 2026, of 12,035 knowledge workers in the US, UK, Australia, India, Germany and France and 172 Fortune 1000 executives, plus interviews with 25 executives. The report argues for organising AI use around teams, which suits a company selling collaboration and work-tracking software.

Individual AI use is widespread but rarely built into team workflows. Some 85% of knowledge workers use AI at work, but only 29% have embedded it in their workflows. Among executives, 89% say AI has increased speed, yet only 6% are sure they can point to specific ROI across their organisation. Atlassian calls the cost of uncoordinated AI use a fragmentation tax and estimates it at $161 billion a year for the Fortune 500. The 14% of teams it identifies as top performers are up to 9.4 times more likely to say AI increases collaboration. A Fortune 500 CTO quoted in the report makes the point for software teams, saying a 20% productivity gain for one developer does not mean a 20% gain for the whole cycle.

Datadog published State of AI Engineering 2026 on 21 April 2026. The report analyses LLM telemetry from more than a thousand Datadog customers running AI in production. Those customers buy Datadog's observability software, including LLM observability, and the company says they skew towards cloud adoption and close attention to infrastructure.

The report treats AI applications as production systems with familiar operational problems. In February 2026, 5% of all LLM call spans reported an error and 60% of those errors were caused by exceeded rate limits. In March 2026, 2% of spans returned an error, with rate limits behind almost a third. More than 70% of organisations use three or more models, and OpenAI's share has fallen to 63% from 75% a year earlier. Agent framework adoption nearly doubled, from more than 9% of organisations in early 2025 to almost 18% at the start of 2026. System prompts account for 69% of input tokens, yet only 28% of LLM calls on caching-capable models show any cached-read tokens. Capacity planning, retry handling, model sprawl and prompt caching therefore sit alongside model choice as reliability concerns.

PwC released its 2026 AI Performance Study on 13 April 2026. It asks 1,217 senior executives at director level and above, mostly at large listed companies across 25 sectors, about the revenue and efficiency gains they see from AI and how they deploy it. PwC measures AI-driven performance as the revenue and efficiency gains attributable to AI, adjusted against industry medians, and scores 60 management and investment practices in what it calls an AI fitness index. PwC advises clients on AI, and the gains are respondents' own reports with no check against company accounts.

The study finds that 74% of AI's economic value is captured by 20% of organisations. Those leaders are twice as likely to redesign workflows to incorporate AI, and are increasing the number of decisions made without human intervention at 2.8x the rate of peers. They are also 1.7x as likely to have a Responsible AI framework and 1.5x as likely to have a cross-functional AI governance board. For engineering leaders, the study ties reported returns to workflow redesign and governance, with more automated decisions paired with more formal oversight.

Faros AI published The AI Engineering Report 2026: The Acceleration Whiplash, with a summary of ten takeaways, on 12 April 2026. The report uses two years of telemetry from 22,000 developers and more than 4,000 teams on the Faros platform, comparing metrics between each organisation's periods of lowest and highest AI adoption. The data comes from customers of Faros's engineering analytics and AI spend tooling who instrument their delivery pipelines.

Output rises with adoption. Epics completed per developer are up 66%, task throughput per developer 33.7% and PR merge rate per developer 16.2%. Quality and review measures worsen. Code churn rises 861%, the incidents-to-PR ratio rises 242.7%, bugs per developer rise 54% (against 9% in Faros's 2025 report) and median time in review rises 441.5%. Pull requests merged with no human or agentic review are up 31.3%. Faros calls the review burden a senior engineer tax and says teams with mature DevOps practices and high DORA scores show the same deterioration. The findings are correlations within organisations over time, which Faros describes as statistically significant.

Which AI Coding Tools Do Developers Actually Use at Work? is a JetBrains Research blog post published on 2 April 2026. It reports the January 2026 wave of the JetBrains AI Pulse survey, which reached over 10,000 professional developers worldwide in eight languages, and compares it with the September 2025 AI Pulse and earlier Developer Ecosystem surveys. JetBrains' own AI coding tools, including AI Assistant and Junie, appear in the rankings.

The post gives engineering leaders a vendor-by-vendor view of tool adoption at work. In January 2026, 90% of developers regularly used at least one AI tool at work, and 74% had adopted specialised AI coding assistants, editors or agents rather than only chatbots. GitHub Copilot is the most widely adopted tool at 29%, rising to 40% in companies with over 5,000 employees, but its growth has stalled. Claude Code is used at work by 18% of developers, a sixfold increase from roughly 3% in April to June 2025, and has a satisfaction score of 91% and an NPS of 54. OpenAI's Codex is used at work by 3%, in data collected before the public launch of the Codex desktop app.

The Cloud Security Alliance's survey report Identity and Access Gaps in the Age of Autonomous AI looks at how organisations manage identity and access for AI agents. CSA ran the online survey in January 2026 and received 228 responses from IT and security professionals. Aembit, a vendor of identity and access management for AI agents and workloads, commissioned and paid for the study and co-wrote the questionnaire; CSA analysts did the analysis.

The report finds that 68% of organisations cannot clearly distinguish human activity from AI agent activity, and 74% say agents often receive more access than necessary. Agents tend to borrow identities, with 52% of organisations using workload identities, 43% shared service accounts and 31% letting agents operate under human user identities. Only 22% report that access frameworks are applied very consistently to AI agents, and a third do not know how often agent credentials are rotated. Ownership is split, with security leading in 28% of organisations and IAM teams in only 9%. With 85% of respondents running agents in production, weak attribution and over-broad permissions are the immediate risks.

The fifteenth annual Flexera 2026 State of the Cloud Report surveys 753 technical professionals and executive leaders worldwide, drawn from an independent panel and fielded in winter 2025. It tracks cloud spending, waste, governance and the arrival of generative AI workloads, and compares results with earlier editions. Its emphasis on cost control fits Flexera's market in cloud cost and software asset management tools.

Respondents estimate that 29% of IaaS and PaaS spend is wasted, a slight rise after five years of decline that Flexera links to cost complexity from AI and new services. Cost is the leading cloud challenge for 85%, ahead of security at 82%, and 68% rank optimising cloud costs as their top initiative. FinOps teams are present at 63% of organisations, up from 59% the year before, and 49% use unit economics, up from 40%. All respondents report using generative AI services from public cloud providers, with 45% using them extensively. AI workloads are therefore adding to cloud bills that most organisations already struggle to control.

GitGuardian, which sells secrets detection and remediation tools, publishes the fifth edition of The State of Secrets Sprawl on 17 March 2026, summarised in a blog post by Anna Nabiullina and Carole Winqwist. The report rests on GitGuardian's own scanning of public GitHub, where commits reached about 1.94 billion in 2025, plus other datasets it monitors.

It finds 28.65 million new hardcoded secrets added to public GitHub commits in 2025, up 34% on the previous year, and 1,275,105 leaked secrets for AI services, up 81%. GitGuardian reports a 3.2% secret-leak rate for commits assisted by Claude Code, against a 1.5% baseline across public commits, and 24,008 unique secrets in MCP configuration files. Remediation is the weakest point. Of credentials GitGuardian confirmed as valid in 2022, more than 64% remain valid when retested in January 2026, down from nearly 70% in January 2025. The retest figures put the larger problem in revocation, and the Claude Code and MCP figures show AI coding tools and agent configuration adding new places for credentials to leak.

Ria Gopu and David Apirian wrote 60 million Copilot code reviews and counting, a GitHub blog post published on 5 March 2026. It reports usage of Copilot code review, the AI review agent GitHub launched in April 2025 and sells as a premium Copilot feature. The figures come from GitHub's own product data, and the post does not explain how they were counted.

The post's title gives 60 million reviews. GitHub reports that usage has grown tenfold since launch and that the tool now accounts for more than one in five code reviews on GitHub, with more than 12,000 organisations running it automatically on every pull request. It also gives quality measures from production. Copilot leaves actionable feedback in 71% of reviews and says nothing in the other 29%, averaging about 5.1 comments per review, and a move to an agentic architecture produced an initial 8.1% increase in positive feedback. GitHub measures quality through developer reactions to comments and whether flagged issues are resolved before merging. The post shows how far automated review has entered ordinary pull request workflows on GitHub, and which signals the vendor uses to judge whether its reviews help.

The CrowdStrike 2026 Global Threat Report, released on 24 February 2026, is the security vendor's annual review of attacker activity in 2025. It draws on CrowdStrike's own intelligence and threat hunting across its customer base, covering more than 280 named adversaries. The data reflect what the company's endpoint, identity and cloud security products and its analysts observe.

The report finds that the average eCrime breakout time, the time from initial access to lateral movement, fell to 29 minutes in 2025, with the fastest observed at 27 seconds. Attacks by AI-enabled adversaries rose 89% year on year, and 82% of detections were malware-free. Attackers also targeted AI systems directly, injecting malicious prompts into legitimate GenAI tools at more than 90 organisations and exploiting AI development platforms. 42% of vulnerabilities were exploited before public disclosure. Engineering teams' AI tools, development platforms and the identities attached to them all count as attack surface in the report, and the breakout times show how little time defenders have once an intruder is inside.

Unit 42, the threat intelligence and incident response team at Palo Alto Networks, released its 2026 Global Incident Response Report on 17 February 2026. It draws on more than 750 incident response cases handled between 1 October 2024 and 30 September 2025, for organisations in over 50 countries, combined with threat research. The report recommends a unified platform approach, the kind of security platform Palo Alto Networks sells. Unit 42 notes that its caseload leans towards larger organisations.

Identity runs through the findings. Identity was an attack surface in 89% of intrusions, and identity weaknesses played a material role in nearly 90% of investigations. 87% of intrusions involved activity across multiple attack surfaces, and 48% involved the browser. In the fastest attacks, the time from initial access to data exfiltration fell to 72 minutes, a fourfold increase in speed over the year. Attacks involving third-party SaaS applications account for 23% of cases, as attackers abuse OAuth tokens and API keys. In over 90% of breaches, preventable gaps such as limited visibility or excessive identity trust materially enabled the intrusion, and the report asks defenders to embed security in the software and AI development lifecycle.

Snyk's 2026 State of Agentic AI Adoption report draws on anonymised AI bill of materials (AI-BOM) telemetry from more than 500 AI discovery assessments run with Evo by Snyk, covering a subset of pre-approved customers. Evo is part of Snyk's application and AI security tooling, so the sample consists of its users and describes organisations actively looking for AI risk. The full report sits behind a registration form, and the public landing page gives only its headline claims.

According to Snyk, 1 in 4 organisations in the sample have moved beyond prompt-based AI to autonomous systems, and a system-level view of AI components reveals an AI footprint three times larger than counts of models alone suggest. The report also benchmarks AI adoption, complexity and risk across industries including healthcare, financial services and technology. Security review and governance need a full inventory, since agent frameworks, model calls and related components embedded in real codebases add up to more AI than a list of approved models shows.

State of FinOps 2026 is the FinOps Foundation's sixth annual survey of the practice, with 1,192 respondents representing more than $83bn in annual cloud spend. The Foundation publishes it openly as an interactive report with a data library, and the results are self-reported by FinOps practitioners.

FinOps is spreading beyond public cloud. 98% of respondents manage AI spend, up from 63% in 2025 and 31% in 2024, and AI cost management is the skillset teams most want to add. 90% manage SaaS or plan to in the coming year, alongside licensing (64%), private cloud (57%) and data centre (48%), and an emerging 28% are beginning to or plan to include labour costs. 78% of practices report to the CTO or CIO. The report also describes FinOps teams moving into pre-deployment architecture costing and working with platform engineering, and says measuring credit for developers' shift-left savings remains unsolved. Many organisations report being asked to fund AI investment from optimisation savings.

Zscaler released the ThreatLabz 2026 AI Security Report on 27 January 2026. It analyses 989.3 billion AI and machine learning transactions generated by about 9,000 organisations on the Zscaler Zero Trust Exchange between January and December 2025, alongside red-team tests of enterprise AI systems. The data comes from Zscaler's own security platform, which the release ends by recommending, so the sample is limited to Zscaler customers.

The report finds that enterprise data transfers to AI and ML applications grew 93% year over year to 18,033 terabytes in 2025, and that the number of applications driving AI/ML transactions quadrupled to more than 3,400. It counts 410 million data loss prevention policy violations tied to ChatGPT alone, including attempts to share source code. In red-team testing, the median time to first critical failure in enterprise AI systems was 16 minutes. The report flags AI features embedded by default in SaaS tools as a growing route for company data to reach AI models without oversight, and among them it names Atlassian’s Jira and Confluence, which many engineering teams use for planning and documentation.

KPMG publishes its 2026 US Technology Survey on 22 January 2026, with a report titled From automation to AI: Tech leaders are focused on ROI. KPMG interviewed 2,500 technology professionals worldwide, including 648 senior US technology executives at companies with more than $100 million in revenue. Its own technology consulting includes technical-debt and AI programmes.

The report describes a gap between ambition and delivery. Only 10% of US firms describe their technology implementation as fully scaled and continually evolving, down from 25% the year before, while 47% expect to reach that point by 2026. Technical debt is the main brake. 56% say the cost of fixing it prevents investment in new technology programmes, and weekly disruptions from flaws in foundational IT systems affect 40% of US firms, 18 points fewer than in the previous survey. In the survey, 62% of respondents say they aim to be as fast and cost-effective as possible, accepting trade-offs in security, scalability and data standardisation. The survey ties technical debt directly to the capacity to fund AI and other new work, although every measure is self-reported by executives.

The Pulse of Agentic AI 2026 is Dynatrace's first global study of agentic AI, released on 22 January 2026. Y2 Analytics, a Qualtrics partner, surveyed 919 senior leaders responsible for agentic AI development and implementation at enterprises with annual revenue of $100 million or more, in November and December 2025. Dynatrace is an observability vendor, and the report presents observability as the basis for trusting agents in production.

Respondents report that about half of agentic AI projects are at proof-of-concept or pilot stage and that 69% of agentic AI decisions are verified by humans. Only 13% of organisations use fully autonomous agents. Security, privacy or compliance concerns (52%) and the technical difficulty of managing and monitoring agents at scale (51%) are the top barriers to production. IT operations and DevOps are the most common place to deploy agents (72%), followed by software engineering (56%). Budgets are rising, with 74% expecting them to increase again next year and 48% anticipating increases of at least $2 million. For engineering leaders, the survey places agent deployments mainly in operations and engineering, with human review of agent output the common practice and monitoring at scale named as a main obstacle.

Deloitte released The State of AI in the Enterprise: The Untapped Edge on 21 January 2026 at Davos. The survey covers 3,235 business and IT leaders, from director to C-suite, who are directly involved in their companies' AI initiatives. Respondents come from 24 countries and six industries, and fieldwork ran from August to September 2025. The series has run for seven years, and Deloitte has AI consulting and implementation services to sell.

The finding most relevant to engineering leaders concerns scaling. Only 25% of respondents have moved 40% or more of their AI pilots into production. Workforce access to sanctioned AI tools rose from under 40% to around 60% of workers in a year. On depth of use, 34% say they are using AI to deeply transform their business, while 30% are redesigning key processes around AI and 37% use AI only at a surface level. Close to three quarters of companies plan to deploy agentic AI within two years, but only 21% have a mature governance model for agents. Taken together, the pilot and governance figures point to the delivery, integration and operations work that sits between an AI experiment and a production service.

The 29th Global CEO Survey from PwC, released at Davos on 19 January 2026, collects responses from 4,454 CEOs in 95 countries and territories between 30 September and 10 November 2025, with global and regional figures weighted to country nominal GDP. It covers revenue confidence, returns from AI, tariffs, cyber risk and investment plans. The executives it surveys are the kind PwC's AI and transformation consultancy serves.

On AI, 56% of CEOs say they have seen no significant financial benefit to date, 33% report gains in either cost or revenue, and 12% say AI has delivered both. CEOs reporting both gains are two to three times more likely to say they have embedded AI extensively across products and services, demand generation and strategic decision-making. Those whose organisations have strong AI foundations, such as Responsible AI frameworks, are three times more likely to report meaningful financial returns. Only 30% of CEOs are confident about revenue growth over the next 12 months, down from 38% in 2025. Engineering leaders can expect chief executives to press for financial returns from AI spending.

BCG published the third annual AI Radar on 15 January 2026, under the title "As AI Investments Surge, CEOs Take the Lead". The survey covers nearly 2,400 executives, including 640 CEOs, across 16 markets, and asks how companies plan to spend on AI and who owns the decisions. BCG's consultants advise on AI strategy and implementation, and the article's grouping of CEOs into Followers, Pragmatists and Trailblazers is its own.

The survey shows engineering leaders where AI budgets and accountability sit. Nearly three quarters of CEOs call themselves their organisation's main decision maker on AI, twice the share in the previous year's survey, and about half believe their job is at risk if AI does not pay off. Companies expect to double their AI spending in 2026, from 0.8% to about 1.7% of revenues, with tech companies and financial institutions each planning about 2%. Over 90% plan to keep investing at current or higher levels even if returns do not materialise in the next year. Confidence varies by role, falling from 62% of CEOs to 48% of non-tech executives outside the C-suite. All of these figures are respondents' own expectations and plans; the survey measures no outcomes.

Inside the C-suite: How AI is quietly reshaping executive decisions is a research brief from the Capgemini Research Institute on how senior executives use AI in strategic decisions. It surveys 500 C-suite executives, including 100 CEOs, at organisations with annual revenue above $10 billion in 16 countries, fielded in August and September 2025, alongside interviews with industry leaders. Capgemini is itself a provider of AI consulting and services.

The brief finds that 17% of executives actively use AI in strategic decision-making on a regular basis, a share they expect to reach 38% within one to three years, and 41% of CEOs are experimenting with it. Technology executives (CIOs, CTOs, chief data and chief AI officers) lead, with 26% active use now and 53% expected. Few organisations plan to tell anyone, with only 11% of executives saying they publicly disclose, or plan to disclose, the use of AI in business decisions. Executives worry most about legal risk, explainability and data quality. AI is moving into board-level decisions with little external transparency, which leaves open who owns the data and governance behind them.

The Capgemini Research Institute's research brief The multi-year AI advantage: Building the enterprise of tomorrow came out on 15 January 2026, ahead of the World Economic Forum Annual Meeting in Davos. It rests on a November 2025 online survey of 1,505 director-level and above executives at organisations with more than $1 billion in annual revenue in North America, Europe, APAC and Latin America, all of which have deployed AI at limited or full scale. Capgemini is itself an AI consulting and implementation firm.

The brief finds that 38% of organisations are operationalising generative AI across their businesses, and six in ten are exploring agentic AI. Organisations expect to allocate 5% of annual business budgets to AI by 2026, up from 3% in 2025, and more than half are prioritising AI investment in sales, marketing and IT operations. 66% report measurable improvements in productivity and decision quality through human and AI collaboration. Every respondent's organisation uses AI, so the figures describe adopters, and engineering leaders comparing them with surveys of the wider market should allow for that.

Beyond Productivity: Measuring the Real Value of AI, released by Workday on 14 January 2026, is a survey of 3,200 full-time employees who actively use AI at organisations with more than $100M in annual revenue across North America, APAC and EMEA. Hanover Research fielded it for Workday in November 2025. It asks whether the time employees save with AI turns into better results. Workday's own HR and finance software has AI built in, and its release contrasts that approach with generic tools.

Respondents report that nearly 40% of AI time savings are lost to rework, such as correcting errors, rewriting content and verifying output. While 85% of employees report saving one to seven hours a week with AI, only 14% consistently get clear, positive net outcomes. Among daily users, 77% review AI-generated work as carefully as human work, if not more. In 89% of organisations, fewer than half of roles have been updated to reflect AI capabilities. For engineering leaders measuring AI tools by hours saved, the survey suggests counting the time spent checking and fixing output as well. All figures are self-reported.

Sonar's State of Code Developer Survey report 2026, released on 8 January 2026, is based on an online survey of 1,149 professional developers worldwide, fielded throughout October 2025. All respondents had used AI at work in the previous year. The report's argument for verifying AI output sits close to Sonar's own code quality and security analysis products.

The survey finds AI coding routine. Among developers who have tried AI tools, 72% use them every day, and respondents report that 42% of the code they commit is AI-generated or assisted. Trust lags use. Some 96% do not fully trust that AI-generated code is functionally correct, yet only 48% always check AI-assisted code before committing it, and 38% say reviewing AI code takes more effort than reviewing a colleague's. On technical debt, 88% report at least one negative effect of AI, most often code that looks correct but is unreliable (53%), while 93% report at least one benefit, led by improved documentation (57%). The findings give engineering leaders a measure of the gap between how much AI code is committed and how much is checked.

LinkedIn's Economic Graph Research Institute issued Building a Future of Work That Works as its January 2026 Labor Market Report. It draws on hiring and skills data from LinkedIn's network of more than 1.3 billion members, comparing hiring with pre-pandemic levels up to October 2025, and adds surveys of members and executives from September and October 2025. Several of its figures describe the effect of LinkedIn's own recruiting and learning products.

The report finds global hiring 20% below pre-pandemic levels, with technology, information and media down 27% and professional services down 29%, while India is up 40% and the UAE up 37%. LinkedIn attributes slow hiring to economic uncertainty and monetary policy shifts, and says AI is not the cause. In the US, jobs requiring AI literacy grew 70% year on year, and employers created at least 1.3 million AI-related job opportunities worldwide over two years. On average 3% of US members list AI skills, with engineering and product management at 10% each. Among global executives surveyed, 70% believe AI tools make their employees more efficient. Demand for AI skills is rising against a weak hiring market for technology roles.

CodeRabbit's State of AI vs Human Code Generation Report compares the review findings on AI-co-authored and human-only pull requests. CodeRabbit, an AI code review vendor, analysed 470 open-source GitHub pull requests, 320 flagged as AI-co-authored and 150 treated as human-only, classified issues with its own taxonomy and compared rates per 100 PRs. It acknowledges that it cannot confirm every 'human' PR was written without AI, because authorship was inferred from co-authorship signals.

By its count, AI-co-authored pull requests contain about 1.7 times as many issues overall, 10.83 per PR against 6.45 for human-only PRs. Logic and correctness issues are 75% more common, readability issues more than three times as common, and error-handling gaps nearly twice as common. Security issues are up to 2.74 times higher, mostly around password handling and insecure object references, and excessive I/O findings are about eight times as common, though small in number. No issue category is unique to AI code. The findings suggest that teams reviewing AI-assisted changes should concentrate on logic, error paths and security, and leave style rules to automated checks.

Canaries in the Coal Mine? Six Facts about the Recent Employment Effects of Artificial Intelligence is a Stanford Digital Economy Lab working paper by Erik Brynjolfsson, Bharat Chandar and Ruyu Chen, revised in November 2025. It uses high-frequency administrative payroll records from ADP covering millions of US workers, with data through September 2025, to look for early signs of generative AI changing employment.

The paper finds that workers aged 22 to 25 in the occupations most exposed to AI show a 16% relative decline in employment compared with their peers, in estimates that adjust for firm-level shocks. More experienced workers in the same occupations show no comparable decline. The declines are concentrated where AI use automates tasks instead of complementing workers, and adjustment shows up in employment rather than pay. The authors present these as descriptive indicators and do not claim them as causal estimates. Software engineering is one of the exposed fields the paper discusses, which ties it directly to decisions about entry-level hiring as AI tools take on coding work.

Octoverse 2025, GitHub's annual report on activity across its platform, is published on 28 October 2025. It covers the Octoverse year from 1 September 2024 to 31 August 2025 and, by default, public activity. GitHub owns Copilot, so its figures on AI adoption describe use of its own product on its own platform.

The report counts more than 180 million developers on GitHub, with over 36 million joining in the past year, more than one every second on average. It records 630 million total repositories and more than 1.12 billion contributions to public and open source projects. TypeScript overtakes both Python and JavaScript in August 2025 to become the most used language on GitHub, which GitHub links to AI-assisted development. On AI tools, GitHub reports that nearly 80% of new developers on GitHub use GitHub Copilot within their first week. For engineering leaders, the report suggests that developers entering the workforce now expect an AI assistant from the start, and it gives a platform-wide view of language and tooling shifts that bear on hiring and stack choices.

The State of Developer Ecosystem 2025, published by JetBrains on 15 October 2025, reports the company's annual Developer Ecosystem Survey. This edition is based on 24,534 developers across 194 countries who responded between April and June 2025, with responses balanced by geography, employment, programming language and JetBrains product use. As a maker of IDEs and AI coding tools, JetBrains counts its own users in the sample.

The survey finds that 85% of developers regularly use AI tools for coding and development and 62% rely on at least one AI coding assistant, agent or code editor, while 15% have not adopted AI tools in their daily work. Nearly nine in ten developers report saving at least an hour a week, and one in five reports saving eight hours or more. Developers say they would hand AI repetitive work such as boilerplate and documentation and keep debugging and application logic for themselves, and the inconsistent quality of AI-generated code tops their list of concerns. Some 66% of developers do not believe current metrics reflect their true contributions. With a sample this size, the survey is a large international baseline for AI tool adoption and for how developers view productivity measurement.

Google Cloud's DORA team announced the 2025 DORA Report, State of AI-assisted Software Development, on 23 September 2025. It is based on survey responses from nearly 5,000 technology professionals around the world and more than 100 hours of qualitative data. DORA's research programme sits within Google Cloud, a seller of AI development tools and cloud platforms.

Among survey respondents, 90% report using AI at work, and more than 80% believe it has increased their productivity, while 30% report little or no trust in AI-generated code. The central finding differs from the 2024 report. AI adoption now shows a positive relationship with software delivery throughput and product performance, but it continues to have a negative relationship with delivery stability. DORA describes AI as an amplifier of a team's existing strengths and weaknesses. Teams in loosely coupled architectures with fast feedback loops see gains, while those constrained by tightly coupled systems and slow processes see little or no benefit. The report identifies seven capabilities that magnify AI's positive impact and finds that 90% of organisations have adopted at least one internal platform. For engineering leaders, it links AI gains to strong automated testing, mature version control and fast feedback loops.

The third Anthropic Economic Index report, Uneven geographic and enterprise AI adoption, was published on 15 September 2025. Anthropic classifies a random sample of 1 million Claude.ai Free and Pro conversations from 4 to 11 August 2025, and 1 million first-party API transcripts from August 2025, against the O*NET task taxonomy using privacy-preserving methods. It is the first edition to break usage down by country and US state and to examine enterprise API traffic. The data come from Anthropic's own products and so describe Claude users only.

Computer and mathematical tasks, mostly coding, account for 36% of sampled Claude.ai conversations and 44% of API traffic. Within coding, creating new code rose from 4.1% to 8.6% of conversations since the earlier edition, while debugging fell from 16.1% to 13.3%. Directive conversations, where users delegate a whole task, rose from 27% to 39%, and 77% of API transcripts show automation patterns. The API data show how businesses deploy models programmatically, with software development the dominant use.

The AI section of the 2025 Stack Overflow Developer Survey, published on 29 July 2025, draws on 49,009 responses from 177 countries collected between 29 May and 23 June 2025. Respondents were recruited mainly through Stack Overflow's own channels, so highly engaged users are more likely to be represented.

84% of respondents use or plan to use AI tools in their development process, up from 76% the year before, while positive sentiment falls to 60% from more than 70% in 2023 and 2024. More developers distrust the accuracy of AI tools (46%) than trust it (33%). The biggest frustration, cited by 66%, is AI solutions that are almost right, but not quite, and 45% say debugging AI-generated code is more time-consuming. Most developers do not plan to use AI for deployment and monitoring (76%) or project planning (69%). On agents, 38% have no plans to adopt them. About 70% of agent users say agents reduced time spent on specific development tasks, but only 17% say agents improved collaboration within their team, and 87% of respondents are concerned about accuracy.

Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity is a randomised controlled trial by METR, a non-profit AI research group. Sixteen experienced developers from large open-source repositories (averaging over 22,000 stars and a million lines of code) worked on 246 real issues from their own projects. Each issue was randomly assigned to allow or disallow AI; when allowed, developers mostly used Cursor Pro with Claude 3.5 and 3.7 Sonnet. Developers recorded their screens, self-reported implementation time and were paid $150 an hour.

The study finds that developers take 19% longer to complete issues when AI tools are allowed. Before starting, they forecast that AI would cut completion time by 24%, and afterwards they estimate it had cut time by 20%. Experts in economics and machine learning predicted reductions of 39% and 38%. METR examines 20 possible explanations, finds evidence that five likely contribute, and says the result should not be read as showing AI fails to speed up most developers. For engineering leaders, the gap between perceived and measured speed is the main lesson, because it makes developer self-reports a weak guide to productivity effects.

DORA, the research programme run by Google Cloud, published Impact of Generative AI in Software Development on 24 April 2025, announced on the Google Cloud blog by DORA lead Nathen Harvey. Built on DORA's survey data and developer interviews, it looks at how generative AI affects individual developers, teams and software delivery. Google has AI coding tools to sell, though DORA reports results that cut against AI adoption as well as for it.

The report finds that 89% of organisations are prioritising the integration of AI into their applications and 76% of technologists use AI in some part of their daily work. It estimates that a 25% increase in AI adoption is associated with a 2.1% increase in individual productivity, but also with a 1.5% decrease in delivery throughput and a 7.2% decrease in delivery stability. Adoption is higher where organisations give developers dedicated work time to experiment (a 131% increase in team adoption) and where they set clear acceptable-use policies (a 451% increase). The report ties these delivery losses to AI enlarging batch sizes, which makes automated testing and fast code review more important.

HackerRank's 2025 Developer Skills Report combines a survey of 13,732 developers, engineering managers, recruiters, executives and students in 102 countries, fielded in the fourth quarter of 2024 and early 2025, with data from more than 3 million assessments a year on its platform. Technical hiring and skills assessment software is HackerRank's business, and much of the report concerns hiring practice.

The report finds AI assistants close to universal among developers. Some 97% use at least one, 61% use two or more at work, and 89% name ChatGPT among their most-used AI tools for work. Respondents say AI generates 29% of their code on average, rising to 48% among those who almost always use AI tools, while 15% say it writes more than half their code. AI helps 85% complete projects faster, they say, and 67% report that it has increased pressure to deliver faster, so engineering managers face rising delivery expectations alongside adoption. On hiring, 74% of developers report struggling to land jobs and 73% say it is unfair to lose out to AI-assisted candidates.