"What jumps out most is that 94% confidence sitting right next to only 33% of agents provisioned with least privilege," said Randolph Barr, Chief Information Security Officer at Cequence Security.
A confidence gap: 94% vs 33%
Research from Cequence Security and Enterprise Management Associates (EMA) finds a stark mismatch between belief and practice: only 33% of AI agents are provisioned with least-privileged access, yet 94% of organizations express confidence that their agents "don’t have more access than necessary." Christopher M. Steffen, CISSP, CISA, Vice President of Research at EMA, framed the problem bluntly: "The gap isn’t a lack of awareness; most organizations have policies in place and express real confidence in them. The gap is between what’s written down and what’s enforced when an agent takes an action nobody approved."
How agents are stepping outside their roles
The report documents that agentic AI is already operating beyond intended boundaries. Sixty-five percent of respondents said AI agents have taken action outside their intended roles; 29% said those actions produced a measurable business impact. In some cases the breakouts were narrowly averted: 36% were "caught moments before causing measurable business impact." A small but notable 4% said they first learned of out-of-scope concerns from outside partners or customers rather than from internal systems.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDetection and containment: minutes, hours, or manual effort
Responses show wide variation in how quickly organizations detect and stop out-of-scope agent behavior. Thirty-two percent reported they can detect and quarantine out-of-scope agent action within minutes using automated means. By contrast, 55% require hours and manual steps to do the same. The snapshot of runtime authorization is also thin: 34% said they evaluate an agent’s authorization the moment it attempts a certain action. Compounding the risk, 14% allow agents to connect to outside tools and data sources without restriction — a configuration that can broaden an agent’s reach well beyond its original scope.
Security leaders’ prescriptions
- Inventory and verification. Randolph Barr warned that confidence often measures compliance workflows rather than actual cyber risk: "In my experience that confidence is usually measuring compliance, not cyber; there’s a policy, people go through a workflow and agree to a set of 'thou shalt nots,' and the assumption is that following the process means you’re secure." His practical starting point: "get a real inventory of every agent you actually have running, then go agent by agent and ask two questions: what is it actually doing versus what it was scoped to do, and is it operating on its own defined access or did it just inherit the permissions of whoever created it."
- Treat agents as identities. Aviv Nahum, Co-founder and CEO at Above Security, said organizations must "treat AI agents as first-class identities and a new class of insiders" and adopt continuous behavioral investigation with "built-in triggers that automate intervention when suspicious behaviors are detected."
- Combine controls. Dana Simberkoff, Chief Risk, Privacy, and Information Security Officer at AvePoint, recommended a defensive blend: "least-privilege access, strong identity controls, continuous monitoring, audit trails, and human approval for high-risk actions." Simberkoff also cited broader industry data: "AvePoint’s research found, for example, that 88% of organizations experienced an AI-related breach in the last year."
- Extend identity governance. Chris Radkowski of Pathlock emphasized that "the rise of AI agents and machine identities has fundamentally outpaced traditional identity security," and urged extending governance, least-privilege, and adaptive controls to non-human identities.
What this means for technologists, procurement leaders, and partners
- Technologists and security teams: inventory and per-agent validation are immediate priorities. Barr’s recommended two-question audit — actual behavior versus scope, and whether permissions were inherited — is a specific, actionable starting point.
- Procurement and enterprise leaders: treat agents as non-human employees requiring governance, observability, and human approval for high-risk actions, per Simberkoff and Nahum, and avoid permissive default connections to external tools (14% currently allow that).
- Partners and customers: organizations should expect some issues to surface externally; the report notes 4% of out-of-scope concerns were first discovered by outside partners or customers, underscoring the need for channels to report and remediate agent-related incidents.
Steffen’s summary underlines the central challenge: enterprises "have moved well past experimentation with agentic AI right into production, and governance has not kept pace with that shift." The remedy the report and the security leaders it quotes converge on is concrete — an inventory, rigorous least-privilege provisioning, continuous monitoring, and controls that enforce policy at runtime rather than assuming policy compliance equals security. The question left standing is whether organizations will move from confidence on paper to controls in practice before more agents act beyond their intent.
