Licensed
to Act

AI is now common in the functions closest to the infrastructure that keeps a business running. It is most widespread in IT operations and service management, then cybersecurity operations, data analysis and software development — and it reaches every function the study asked about Q1.

Across these functions, AI is becoming embedded in the parts of the business where an instruction directly turns into an action. Enterprises are letting agents make decisions and changes without regular human intervention.

In this report, an “AI agent” is a system that doesn’t just produce an answer — it acts on it. It calls other systems, changes configurations, and completes multi-step tasks. That ability to act, not the underlying model itself, is what turns an AI agent deployment into a security boundary issue.

Close to a third would let AI investigate and fix security issues with no human review Q6c, Q6d. As many would let an agent cut off a compromised device on its own. That means taking a machine off the network without waiting for anyone to approve it.

For every activity assessed, only a small minority said they would never be comfortable letting AI perform it Q6a–k. Even shutting down systems, the most refused task in the study, leaves almost nine in ten willing to let AI pull the plug under some circumstances.

Most decision-makers agree their organization is willing to accept higher risk to realize the benefits of AI Q7a. And that risk appetite is growing. More than half accept more AI-related cyber risk than they did a year ago Q3.

The clearest consequence is in who now signs off. Most organizations now let AI make decisions and take actions that once needed a person’s approval Q7b.

Among those accepting more risk, about half now let AI act, not just advise, including on its own in live production. Its reach has widened with that freedom: to the internet, to sensitive data, and to privileged identities that carry administrator-level access Q4.

Nearly all are also confident they could contain a compromised or out-of-role AI system before it reached critical systems or data Q17.

But that confidence doesn’t match what teams can actually track. When asked what their security team can observe, fewer than half (49%) said they can see and audit every action an AI agent takes Q8. The rest have a less complete view. Thirty-two percent see most actions but not all. Twelve percent see only the outcomes, not the individual actions behind them. And a small minority (6%) have limited or no visibility Q8.

That is a 35-point gap between the visibility organizations claim and what they can prove.

That confidence extends to the controls wrapped around those AI systems. Nearly all trust their own guardrails to stop an AI model acting outside its intended role, and almost as many trust the ones their AI providers supply Q12a, Q12b.

But organizations do not need to predict every decision an AI agent might make to control its impact. They can control what it can access, where it can connect, and what it can do.

Some of these issues come from outside: attackers using AI to write phishing lures or pose as someone else to get in. These tools have lowered the barrier to entry for criminal groups. They make it easier to run targeted campaigns at scale.

Inside, the failures take several forms. The most common was an AI tool suggesting a security step that would have added risk if followed. These risky recommendations were caught because a human was still in the loop to review suggested actions.

Behind it sits a cluster of boundary failures: agents linking to systems without approval, reaching data they should not, and taking actions no one allowed Q14. Whatever their underlying cause, these events became security failures because the agent could reach systems, data, or actions without an effective boundary stopping it.

These internal incidents reflect the most common AI fears held by IT and security decision-makers. Their top worry is sensitive data getting out, then AI-powered attacks from outside.

Public attention is often drawn to the dangers of AI in the hands of attackers, while overlooking how risky internal AI systems can be. But fear of outside attacks is about level with fear of their own AI getting too much access, or going past its role Q10. Yet, AI tools essentially have a head start – while attackers must find a way in, a company’s own AI has already been handed all the credentials it needs.

That inherited access matters more because the defenses around it are growing less effective. Two-thirds of leaders (66%) say keeping systems patched is no longer sufficient to prevent compromise, and 61% say blocking known bad behavior no longer works as a primary security strategy Q9d, Q9g. The controls built to keep attackers out were never designed for something that starts on the inside holding valid credentials.

Decision-makers were asked to pick two primary controls for managing what AI systems can do. Three came out at broadly similar rates Q11. Internal guardrails are the policies, instructions, and behavioral constraints applied to the AI itself. External containment controls restrict what AI can access or affect when something goes wrong. Human oversight was the third. The real story is at the bottom of the list. Explicitly defined permitted actions, or allow-listing, ranked last Q11.

Looking at wider AI security strategy, 34% say their primary approach to securing AI systems and agents is to prevent risky actions through policies, filters, and guardrails Q13, while a similar 33% focus on tightly controlling access.

Organizations are putting more money behind AI security. Many are raising their overall security spending. Many have also set aside new budget just for AI risk.

But more spending doesn’t always mean more priority for the controls that restrict movement and contain impact. Of the ten capabilities assessed, network segmentation ranks last, with incident containment just above it Q16. Organizations have accepted that reach is the thing to control. Yet they rank the controls that actually limit reach at the bottom of the list.

Writing rules for what AI must not do is a losing race. Nobody has ever finished a list of everything that could go wrong. Security has run this race before with firewall rules, application control, and identity. Each time, it won by flipping the question. The list of forbidden behavior is effectively endless. The list of allowed behavior is short enough to write down, agree on, and enforce.

Applied to AI, that is the practical logic of Zero Trust: start with what the agent needs to do and explicitly define the identity, access, connections, and actions required to do it.

Europe offers the opposite surprise. Despite strict European regulation, France has moved furthest of any market on risk appetite. Sixty-six percent of French organizations accept more cyber risk than they did 12 months ago, compared with 56% globally. DACH also sits above average at 61% Q3. France pairs that jump in risk appetite with the lowest priority on segmentation. Just 16% say frontier AI has made segmentation more important, compared with 27% globally Q16.

In the U.S., just over half of respondents (51%) are very comfortable with the risk they now accept Q5. That’s the highest share of any market. And 71% are very confident they could contain a compromised AI system, second only to the Middle East at 73% Q17. Despite this higher confidence, U.S. willingness to take on more risk than a year ago (56%) matches the global average Q3.