McKinsey's Technology Trends Outlook 2026: The Agentic Boom Has an Infrastructure Problem, and It's the One Skyrelis Solves

McKinsey's sixth annual Technology Trends Outlook (September 2026) puts a number on something builders of agentic systems already feel: capital and hiring are accelerating faster than the governance layer that makes any of it safe to run in production. Two of the report's fourteen trends, agentic software development and agentic AI, are the closest thing to a roadmap of where Skyrelis's category is headed, and a supporting data point buried in the AI infrastructure chapter explains why so much of that capital isn't converting into results yet.

Here's what the report says, and where it lines up with what we've built.

The money is flooding in, but not evenly

Equity investment in agentic software development tools went from a rounding error to $61 billion in the first half of 2026 alone (admittedly juiced by the $60 billion Cursor acquisition), up from $4.9 billion for all of 2025. Agentic AI investment hit $9.9 billion in 2025, growing 952% year over year in job postings. But zoom out, and both are dwarfed by the $384 billion already committed to AI infrastructure and model architectures through mid-2026, on pace for roughly $769 billion for the full year.

The read for us: the market is still capitalizing the foundation — chips, compute, model weights — much faster than the control layer that sits on top of agentic systems once they're deployed. That's the gap Skyrelis occupies. As agentic software development and agentic AI mature from pilot to production, that governance and action-control layer becomes the bottleneck, not the models themselves.

McKinsey is describing our exact threat model

The report's language on both trends reads like a restatement of what we tell prospects in every discovery call.

On agentic coding specifically, McKinsey flags that frontier models “can autonomously discover and exploit vulnerabilities at machine speed,” creating “an asymmetry where attacks can overwhelm human-speed defenses,” and that managing this “requires a multilayered control architecture that includes access control, isolation, monitoring, human oversight, containment, and recovery processes.” Their list of “underlying technologies” for agentic software development includes a category called harness and guardrail systems “controls that define what information and processes agents can access, change, or execute.” That's runtime action control, named almost exactly the way we name it.

On agentic AI, the report goes further, dedicating a full passage to the identity and access risk created by autonomous agents: as agents move from chat interfaces into “read/write operators within enterprise databases,” they spawn non-human identities (API keys, service accounts, machine credentials) that now “vastly outnumber human identities.” McKinsey's conclusion is that CIOs “may need to deploy agentic governance frameworks to secure their organizations' technology infrastructure,” and cites Okta's push into “agent registration and access standardization” as an early example.

The AI infrastructure chapter adds the missing piece: this isn't just an access problem; it's a runtime problem. McKinsey calls out cyber-resilient AI architectures as a response to autonomous workflows expanding attack surfaces, specifically naming “guardrails against prompt injection, tool use authorization for autonomous agents, and verification of multistep reasoning before execution” as the emerging control set. That's not access control at the account level. That's exactly the runtime action-control layer Skyrelis is built around, and it's McKinsey naming it as a distinct, necessary category rather than a subset of traditional identity and access management.

The skills to build this in-house barely exist

McKinsey's talent data backs up why “build it yourself” isn't a realistic answer for most engineering orgs. Across both agentic trends, the report tracks a “talent availability ratio,” how much qualified supply exists relative to job demand. Cloud computing and Python sit near or above parity. CI/CD, the delivery skill needed to get agentic software safely into production, sits at 0.1x. Orchestration, the coordination layer for agentic AI, sits at 0.2x.

That's not a hiring problem you solve by posting a job. It's a structural talent shortage in precisely the skills, orchestration, delivery pipeline governance, and agent-to-system coordination, that determine whether an agentic deployment is safe to run unsupervised. This is McKinsey's data supporting a point we make constantly: most engineering organizations aren't going to build a control plane for agent actions in-house, because the people who'd need to build and maintain it are the scarcest hires on the market right now.

Adoption is universal. Value capture is not — and the gap is where we operate

The starkest number in the report isn't in either agentic chapter, it's a supporting stat McKinsey cites while framing the infrastructure build-out: 89% of organizations now use AI in at least one business function, but only 37% attribute any positive EBIT impact to it at the enterprise level.

McKinsey attributes the gap to fragmented data environments, cybersecurity risk, workforce readiness, and integration complexity, the same list, almost word for word, that shows up in both agentic chapters' “key uncertainties” sections: trust and reliability, governance and control, legacy integration. Our read: a meaningful share of that 52-point gap is exactly the friction we remove. Teams that can't get a security review to move at the pace their agents ship code don't capture value. They stall in pilot, the same stalling McKinsey documents as the default outcome for agentic software development (“adoption score: 3 - piloting”) and agentic AI (“adoption score: 3 - piloting”) alike. Neither trend has graduated past piloting industry-wide. The organizations that do graduate will be the ones that solved governance without slowing delivery.

What this means heading into next year

Three things from this report are worth carrying into positioning and pipeline conversations:

McKinsey is independently naming the category “harness and guardrail systems,” “cyber-resilient AI architectures,” and “agentic governance frameworks,” using different words for what we've built as one platform: bring-your-own-policy, runtime action control, zero rewrites. That's validation we can cite directly in outreach and content, especially with prospects who trust McKinsey more than they trust a vendor's own framing.

The talent data gives us a sharper answer to “why not build this ourselves,” 0.1x to 0.2x talent availability in exactly the skills required is a concrete, McKinsey-sourced number, not just an assertion.

And the 89%/37% value gap, paired with both agentic trends still sitting at “piloting” industry-wide, is a strong opening stat for any pitch aimed at a security or engineering leader who's under pressure to show ROI on agent deployments. It reframes the conversation from “do you need agent security” to “this is specifically why your agentic pilots aren't converting to scaled, value-generating deployments.”

Source: McKinsey & Company, “Technology Trends Outlook 2026” (Sixth edition), September 2026, by Michael Chui, Roger Roberts, and Tanguy Catlin. Chapters referenced: Agentic software development, Agentic AI, and AI infrastructure and model architectures. Charts recreated by Skyrelis from report data; not reproductions of original McKinsey exhibits.