88% of Enterprises Run AI Agents but Fewer Than 10% Generate Profits, Ronglian Cloud Reports at WAIC Forum
At the 2026 World Artificial Intelligence Conference, a striking statistic was repeatedly cited: 88% of enterprises worldwide already have AI Agents running internally, yet fewer than 10% are generating real profits from them. The gap has prompted a shift in evaluation criteria from “what can the Agent do” to “what concrete business outcomes has it delivered.”
On July 20, Ronglian Cloud hosted the fourth WAIC Enterprise Agent Forum at the Shanghai World Expo Center under the theme “Evolution and Commercial Landing of Enterprise Agents.” The company, which began with call-center and contact-platform technology and now serves 20,000–30,000 enterprises while managing over one million agent seats, has spent the past two years determining how to move Agents from “deployed” to “profitable.”
Ronglian Cloud Vice President of R&D Tang Xingcai presented the 88% versus sub-10% figures and noted that many firms previously measured intelligence by token consumption volume. That metric has lost credibility in 2026. Speakers from industry alliances, retail, finance, and electronic-signature vendors all stressed that enterprises now pay only for measurable returns rather than possibilities.
Multi-point Digital Intelligence Vice President Zhang Yu reported that clients no longer ask about system functions; they ask directly how the solution will increase sales or reduce losses. eSignBao founder Jin Hongzhou added that the ultimate test is whether customers are willing to pay and continue using the Agent successfully.
Tang Xingcai described a four-stage adoption framework derived from four years of internal deployment. Stage one is Copilot-style single-task assistance such as call summarization. Stage two enables independent task closure, for example analyzing 30 days of calls for complaint risks or missed opportunities. Stage three integrates Agents into existing human-designed business processes so one employee can supervise ten Agents. Stage four delivers fully autonomous end-to-end business loops without human intervention.
Most organizations remain between stages two and three: tools are purchased but have not been embedded into workflows, preventing value creation. Ronglian Cloud also discovered that optimal efficiency requires humans to adapt to Agent workflows rather than the reverse; contact-center agents now act as reviewers and trainers who confirm or refine Agent suggestions, continuously improving model performance.
To make Agents deliver results, Ronglian Cloud implemented three concrete measures. First, a semantic data layer connects Agents to CRM, ticketing, and financial systems so they can read and act on orders, contracts, and work orders without altering employee habits. Second, layered governance using prompts, skills, orchestration engines, and an independent quality-inspection platform controls randomness according to compliance requirements. Third, Agents are evaluated on business KPIs—order conversion rate, ticket resolution time, GMV contribution—rather than technical accuracy scores.
In June the company launched Voice Agent and Private Domain Operation Agent. The Voice Agent handles collections, customer service, and marketing with a 94% conversation completion rate and supports tiered escalation from specialist Agent to supervisor Agent to human. The private-domain Agent allows one operator to manage hundreds of thousands of customers; a benchmark healthcare client uses it to oversee 80,000 private-domain users, generating approximately 1.2 million RMB monthly GMV with 87% year-over-year growth.
Cost comparisons are compelling: a human agent costs 5,000–8,000 RMB per month and handles 150–300 calls daily after weeks of training, while an Agent costs 2,000–3,000 RMB, operates 24/7, processes over 20,000 conversations daily, and retains all accumulated experience. Although current Agents reach only 70–80% of top human performance, the combination of acceptable quality and near-zero marginal cost is already reshaping staffing models. Ronglian Cloud has begun testing outcome-based pricing in revenue-generating scenarios such as collections, sharing risk with clients via recovery-rate revenue share.
Forum participants concluded that the three-to-six-month window for establishing defensible ROI and scaling is narrow. Companies that first embed Agents deeply into real business processes and demonstrate clear returns will build the lasting competitive moat; industry know-how accumulated through daily operations cannot be purchased or easily replicated.
Related articles
Manticore Search Adds Built-in Authentication and Authorization Starting with Version 27.1.5
Manticore Search has introduced native authentication and authorization capabilities for SQL over MySQL, HTTP/HTTPS endpoints, and replication operations. The feature distinguishes between authentication, which identifies the requester, and authorization, which determines permitted actions such as read, write, schema, replication, and admin. Users can enable the feature via the auth directive in the searchd section of the configuration file, supporting both RT mode with auth.json storage and plain mode with an explicit path. Initial setup requires creating an administrator account, after which additional users can be managed through SQL commands like CREATE USER, GRANT, TOKEN, and SET PASSWORD. The system supports mysql_native_password, HTTP Basic authentication, and Bearer tokens, with mandatory SSL or HTTPS recommended for credential transmission. Detailed logging, permission checks, and phased rollout guidance are provided to minimize disruption in production environments.
OAuth Authorization Server Built Without Storing User Profiles
The article details the evolution of an OAuth Authorization Server that deliberately avoids storing user profiles, relying instead on external identity providers for authentication. It addresses three core constraints: hundreds of dynamically created isolated APIs, a public SPA client without a BFF, and the inability of resources to query the AS on every request. The design separates concerns so the AS handles only clients, tenants, grants, audiences, scopes, keys, sessions, and token issuance while the Main API owns profiles and roles. Tokens are managed securely inside a Service Worker using a custom FedCM grant, eliminating races across tabs and reducing XSS exposure. The approach minimizes blast radius, simplifies compliance, and keeps the AS replaceable without affecting product domain logic.
Why a 202-Character License Key Uses ECDSA P-256 Instead of Ed25519 or RSA
A developer building offline license verification for a .NET desktop application evaluated Ed25519, RSA, and ECDSA P-256 before selecting the last option. The decision was driven by the requirement for zero external dependencies, keys short enough for manual entry from email, and support for key rotation without breaking existing licenses. Although Ed25519 offers faster verification and a smaller public key, it is absent from System.Security.Cryptography in both .NET 8 and .NET 10, with API approval only targeted for version 11. RSA-2048 produces signatures too long for practical use, resulting in a 571-character Base32 string that users would find cumbersome. ECDSA P-256 with SHA-256 delivers a fixed 64-byte signature that becomes a manageable 202-character key when encoded in Base32, while remaining fully available in the runtime. The article also covers performance measurements, the risks of ECDSA nonce generation, and the deliberate choice of the IEEE P1363 signature format to guarantee fixed-length output.
Pilcrow Publishes Free Comprehensive Guide on Web Authentication
Author Pilcrow has released a detailed, ad-free handbook covering authentication and authorization practices for web applications. The resource draws on personal experience and includes practical examples in JavaScript and Go. It examines password-based methods, email verification, multi-factor authentication, passwordless flows, and passkeys while highlighting associated risks and usability trade-offs. The book also provides in-depth guidance on session management, token security, expiration policies, and email address handling as account identifiers. Recommendations emphasize choosing methods that match application security requirements and user expectations. Additional context is given on OWASP resources and community support channels.