# AI that acts: What IT and security teams are buying, and what it takes to trust it **Author:** G2 Research **Published:** June 2026 **Based on:** This research draws on 118 in-depth interviews with IT and security leaders, including CISOs, heads of security and IT operations, and infrastructure and endpoint owners, across a range of industries and company sizes. **Topics covered:** AI Agents & Autonomy, Software Buying G2 interviewed 118 IT and security leaders to understand how teams are using AI, what they are buying, and what they require before AI can act. The findings show a market moving from AI that answers to AI that acts, but only on unified data, within governed guardrails, and with proof buyers can audit. **Executive answer:** Buyers want AI that acts ## Additional key findings - Risk governs every decision - AI and automation top the roadmap - The next wave is a trend, not a plan **On this page:** [Key Research Findings](#key-research-findings) · [The trust gate for AI that acts](#the-trust-gate-for-ai-that-acts) · [AI is running on a fragmented, partly visible foundation](#ai-is-running-on-a-fragmented-partly-visible-foundation) · [Visibility is workable, not complete](#visibility-is-workable-not-complete) · [Buyers want AI that acts, not just answers](#buyers-want-ai-that-acts-not-just-answers) · [Acting, not just alerting, is the new expectation](#acting-not-just-alerting-is-the-new-expectation) · [Trust is the gate, and it is earned through proof](#trust-is-the-gate-and-it-is-earned-through-proof) · [Transparency and controls are non-negotiable](#transparency-and-controls-are-non-negotiable) · [Human-paced approval is the bottleneck](#human-paced-approval-is-the-bottleneck) · [Risk governs every decision](#risk-governs-every-decision) · [Emerging AI models remain on the radar](#emerging-ai-models-remain-on-the-radar) · [The next wave is on the radar, not in the plan](#the-next-wave-is-on-the-radar-not-in-the-plan) · [AI and automation lead the 6- to 18-month roadmap](#ai-and-automation-lead-the-6-to-18-month-roadmap) · [AI capability now outweighs price](#ai-capability-now-outweighs-price) · [Strategic Takeaways](#strategic-takeaways) · [Build the conditions for trusted AI action](#build-the-conditions-for-trusted-ai-action) · [Conclusion](#conclusion) · [Research Methodology](#research-methodology) · [Explore Tanium Atlas](#explore-tanium-atlas) --- ## Key Research Findings This study of 118 IT and security leaders answers three questions: what teams are doing with AI right now, what they are buying and the criteria they use to decide, and how the next wave of AI is shaping their plans. What they are buying is changing from AI that answers to AI that acts. Leaders are already pre-authorizing specific low-risk actions, but the criteria are strict and consistent. Risk governs every decision, and trust is earned through proof: transparency, validation, security, auditability, and control. Most teams are expanding AI in a governed way, but the operational foundation is still partly integrated. The next wave of AI is on the radar more than it is in the plan. The roadmap points one way: buyers want autonomy they can trust, delivered on unified, real-time data with guardrails, proof, and control. **43% — Buyers want AI that acts** 43% want AI for low-risk execution with oversight, not just advice. **99% — Risk governs every decision** 99% raised governance, security, or regulatory constraints before letting AI act. **84% — AI and automation top the roadmap** 84% name AI or automation as a planned initiative for the next 6 to 18 months. **53% — The next wave is a trend, not a plan** Among leaders asked about specific next-generation models, 53% called them a general trend rather than a roadmap factor. --- ## The trust gate for AI that acts Low-risk AI actions move forward only after they pass approval, audit, rollback, access control, and validation safeguards. Conceptual Trust Gate diagram showing proposed AI actions passing through approval, audit, rollback, access control, and validation before reaching the endpoint estate. AI action depends on governed controls: approved, logged, reversible, and low risk before it reaches the endpoint estate. --- ## AI is running on a fragmented, partly visible foundation Autonomy is only as good as the estate beneath it, and that estate is workable but incomplete. Today, AI runs in a few high-confidence workflows; before it can safely act across endpoints, blind spots and disconnected tools have to close. --- ## Visibility is workable, not complete **85%** — report partial visibility with known gaps. 85% report partial visibility with known gaps, and only 8% have unified estate visibility. Integration is also partial, with 58% partially integrated and 36% still relying on manual workarounds. The ceiling on autonomy is clear: AI cannot be trusted to act on data the organization cannot fully see. **Strategic implication:** Lead with real-time, unified visibility and control across every endpoint so AI acts on a complete, trustworthy picture rather than a partial one. --- ## Buyers want AI that acts, not just answers When asked what teams are actually buying, the answer is shifting from AI that answers to AI that acts. Buyers want execution, but only for bounded, low-risk actions under oversight. --- ## Acting, not just alerting, is the new expectation 43% want AI for low-risk execution with human oversight, just ahead of the 42% who want assistance and decision support only. Leaders are already pre-authorizing specific low-risk actions, such as isolating compromised endpoints. **Strategic implication:** Sell action, not just answers. Surfacing information is now the baseline; the difference is safely executing defined, low-risk actions within clear guardrails. --- ## Trust is the gate, and it is earned through proof Before AI is allowed to act, it has to earn the right. Buyers require transparency, validation, security, audit trails, strict access controls, and reversible actions. --- ## Transparency and controls are non-negotiable **83%** — require strong transparency, validation, and security. 55% say broader AI use depends on human-in-the-loop proof through gradual validation, and 83% require strong transparency, validation, and security. For buyers, trust is an evidence standard. **Strategic implication:** Make proof the product. Lead with explainability, full audit trails, strict access controls, rollback, and validation in the buyer's environment. --- ## Human-paced approval is the bottleneck The control buyers want is also the brake. Every decision to let AI act passes through a risk lens first, and multi-layer approval slows cleared actions. --- ## Risk governs every decision **99%** — raised governance, security, or regulatory constraints. 99% raised governance, security, or regulatory constraints, and 67% require human approval before AI takes action. 75% report multi-layer or decentralized approval friction, so the path forward is to move the decision earlier by pre-authorizing low-risk actions within clear guardrails. **Strategic implication:** Replace human-paced approval with governed autonomy: pre-authorized low-risk actions, clear ownership, audit, and human authority over high-stakes decisions. --- ## Emerging AI models remain on the radar Adoption has real momentum, but it is governed momentum. Most teams are past pilots, yet the expansion stays measured because the foundation, proof, and governance are not fully in place. --- ## The next wave is on the radar, not in the plan 69% are in targeted operational rollout and 22% are scaling more broadly. Among those asked directly about specific next-generation models, 53% called them a general trend rather than a factor in their plans, and few reported actual use. **Strategic implication:** Equip executive sponsors with the foundation, proof, and governed-autonomy model to scale today's rollout and operationalize the next wave when it moves from radar to roadmap. --- ## AI and automation lead the 6- to 18-month roadmap Asked what is on the roadmap for the next 6 to 18 months, leaders point in the same direction: AI and automation lead, and AI capability now outweighs price when evaluating endpoint or exposure management. --- ## AI capability now outweighs price **84%** — name AI or automation as a planned initiative. 84% name AI or automation as a planned initiative, with AI at 68% and automation at 53%. When evaluating endpoint or exposure management, 47% name AI and automation capabilities as what matters most, ahead of cost at 13% and vendor relationship at 10%. **Strategic implication:** Lead with capability, not price. AI and automation are what leaders are funding next and what increasingly decides evaluations. --- ## Strategic Takeaways The research points to a practical path from cautious AI pilots to trusted autonomy: unify the data foundation, prove every action, and keep human authority where risk is highest. --- ## Build the conditions for trusted AI action **Unify the data foundation before automating action.** Autonomy is only as reliable as the estate beneath it, and 85% of leaders report only partial visibility. **Move the value proposition from answers to action.** Surfacing information is now the baseline; 43% want AI that can execute bounded, low-risk actions with oversight. **Make proof part of the product experience.** 55% need human-in-the-loop validation and 83% require transparency, validation, and security before they broaden AI use. **Shift approvals from one-off review to governed autonomy.** 99% weigh governance, security, or regulatory risk, and 67% still require human approval before AI acts. **Prepare for the next wave without overclaiming it.** 69% are in operational rollout, but only 22% are scaling broadly, and emerging AI models remain more radar item than roadmap driver. **Strategic implication:** Lead with a complete data foundation, visible proof, and pre-authorized low-risk actions so autonomy can scale without removing human control. --- ## Conclusion AI in IT and security has reached a clear but conditional turning point. Leaders want AI that acts, not just advises, but they keep it bounded, human-approved, and proven before they let it touch anything consequential. The constraint is not capability; it is trust, a fragmented foundation, and human-paced approval. The direction is set: from AI that answers to AI that acts, on unified, real-time data, within guardrails leaders trust. The demand for AI that acts is real, but it is conditional. Vendors that deliver action on real-time data, with the proof and control to back it, will earn the right to lead. --- ## Research Methodology This report was prepared by G2 AI Custom Research for Tanium. This research draws on 118 in-depth interviews with IT and security leaders, including CISOs, heads of security and IT operations, and infrastructure and endpoint owners, across a range of industries and company sizes. Interviews used a conversational format so respondents could describe their actual environments, AI use, and decision-making rather than select from preset options. Percentages are rounded to the nearest whole number; where a chart shows a distribution, figures may be adjusted so they total 100%. Many figures reflect qualitative responses coded into themes, so multi-select figures do not sum to 100%. Some topics, including awareness of specific next-generation models, were explored with a subset of respondents; where noted, those figures are reported against that subset rather than the full sample. G2, AI that acts: What IT and security teams are buying, and what it takes to trust it, June 2026. --- ## Explore Tanium Atlas **Sponsored** The research points to a clear requirement: IT and security leaders want AI that can act, but only when it is grounded in trustworthy endpoint data and constrained by controls they can validate. Tanium Atlas is agentic AI built on real-time endpoint intelligence across the entire estate. It helps teams surface issues, explain what is happening, understand scope and risk, and move from recommendation to action inside governed workflows. With Tanium, low-risk actions can be reviewed, approved, executed, logged, and validated from the same operating foundation. **Real-time endpoint truth** Give AI current visibility into endpoints, applications, vulnerabilities, configurations, and health across the estate. **Governed action at scale** Move from insight to remediation with approval, access control, audit trails, and rollback safeguards. **Proof leaders can trust** Validate outcomes after action so teams can show what changed, why it changed, and whether risk was reduced. [Learn More](https://www.tanium.com/autonomous-it-platform/?utm_source=g2&utm_source_platform=direct&utm_asset=autonomousg2&utm_medium=nativecontent&utm_campaign=rwsite-g2-engm-mofu-all-GBL-atlas-assetdwnld-EN&utm_content=prospect&utm_id=701PI000030GL0wYAG&utm_marketing_tactic=content_engagement&utm_creative_format=native_content) --- *Source: G2 Research — "AI that acts: What IT and security teams are buying, and what it takes to trust it" (June 2026). Based on G2 first-party research. Markdown edition structured for answer-engine optimization (AEO).*