Organizations are adopting AI applications and agents faster than security teams can adapt. Gartner reports that only 33% of organizations report having already deployed enterprise-built, customer-facing GenAI agents in limited and broad production use.
Additionally, 50% of CISOs report uncertainty about long-term costs for specialized cybersecurity controls, and 43% see them as too expensive relative to their perceived value.
The Gartner Hype Cycle for Secure AI, 2026 helps security leaders cut through the hype. It shows which AI security technologies are ready to invest in now, which are still emerging, and where API threat protection sits on the curve.
API Threat Protection at Salt
- Discover every API your agents can reach. Agentless discovery finds the APIs, MCP servers, and shadow endpoints nobody inventoried.
- Stop the attacks other tools miss. Salt Protect detects and blocks logic-based abuse, like enumeration and data scraping, right where actions happen.
- Keep the stack you have. Salt plugs into your WAF, gateway, and SOC tools, so they block what Salt detects. Nothing to rip out or reroute.
In this report, you’ll find:
- Hype Cycle placement for 24 AI security technologies, including AI agent identity, MCP cybersecurity, AI runtime defense, AI security testing, and AI usage control
- APIs are the new attack surface. AI agents and MCP run on APIs, and attackers use GenAI to find and exploit them faster than ever.
- A full API Threat Protection profile covering the definition, business impact, drivers, obstacles, and user recommendations, including why API discovery should come first
- The Gartner framework for separating AI security into distinct use cases, from governing employee use of third-party AI tools to securing enterprise-built AI applications and agents
- The Gartner perspective according to us: discover first. Inventory and risk-rank every API, monitor continuously, and layer your defenses. If your WAF falls short, look at specialist vendors.
Where to find Salt? Scroll to the end of the report. Salt Security is named as a Sample Vendor in the API Threat Protection profile, near the back of the document.
Get The Gartner guidance on building a security approach for AI agents, from discovery and access control to security testing and runtime defense.
Download the Gartner Hype Cycle for Secure AI, 2026.
Gartner, Hype Cycle™ for Secure AI, 2026, Jeremy D'Hoinne, Dionisio Zumerle, Jeff Arias, 12 October 2026
Gartner and Hype Cycle are trademarks of Gartner, Inc., and/or its affiliates.
Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.