What moved the register
This week the index moves on execution, not announcement. Every dimension that rose did so on named production evidence, and the pattern across them is one story told three ways: agentic systems are crossing from demonstrable to dependable, and the enterprises that redesign around them are booking returns the ones that bolt them on are not.
Start with the organization category. Presenc AI reports 78% of the Global 2000 running at least one AI workload in production, up from 41% two years prior, with a 2.4x median ROI. BeamSec calls the experimentation-to-operations shift complete. Read against the Compiled Corporation lens, this is the quiet part: firms are automating core operating steps function by function, with engineering and operations leading and HR and marketing trailing. The CAIO data from Value Add VC and ProfessionLens confirms AI leadership is now a standing executive seat, though the self-reported 76% figure is inflated by title fuzz and the verified Fortune 500 number sits closer to the low forties.
The governance line is where I hold firm. EverythingCloud reports only 38% of organizations have a formal AI governance policy, and 63% of firms that suffered an AI breach lacked one. NeuralTrust documents the specific failure: agentic patterns, multi-step action chains, cross-system tool access, memory persistence, outrun the frameworks built to govern them. Governance sits at the top of the organization category because policy intent is mature. It does not rise this week because runtime enforcement is not. This is the central tension in the Identity Control Surface framework: every agent deployed is a non-human identity that needs governing, and the NVIDIA/Microsoft push to run agents natively on Windows endpoints multiplies those identities faster than anyone is governing them.
The product category carried the most evidence. OpenAI's Sophos case puts a production agent on 52% of managed-detection cases with human oversight preserved, which is the Decision Surfaces pattern executed correctly: the human directs, the agent acts, the interface between them is designed rather than assumed. Oracle rebuilt specialist workflows across recruiting, engineering, and operations. LegalOn and Asana reframed value as cost at constant output. Microsoft Research's Agent Lightning lowers the cost of improving agents already in production. The gate on agentic deployment is now reliability engineering, not model capability.
The brand category stays stuck in the Active band, and that is the honest read. Agent-ready infrastructure rose on real endpoint and open-model evidence, but messaging, market perception, content readiness, and orchestration all held flat for lack of a clean catalyst. The Janus Brands question remains open: as AI messaging becomes an executive function, does it stay consistent with legacy identity or inflate into claims the product cannot back? The gap between IBM's 76% and LinkedIn's verified figure is the AI-washing risk made visible.
The read for operators: the capability gap has closed enough that your constraint is no longer the model. It is governance that enforces at runtime, workflows actually rebuilt, and identity controls for the agents you are already deploying. The firms pulling ahead treat agents as infrastructure under governance. The rest treat them as innovation projects, and the breach statistics are already telling us how that ends.