Enterprise AI Security Lags as Agents Outrun Governance

Policies are in place, but enforcement is missing

The problem with enterprise AI security is not that companies ignore it. Most have written policies, formed committees, and set aside budget. The problem is that the controls behind those policies are mostly missing, and a run of 2026 research shows the bill for that gap is already being paid.

The pattern repeats across surveys from vendors, analysts, and auditors. Identity security firm Delinea found that 99.7% of IT and security leaders say their organization has a formal policy on what data AI tools and agents may access. Only about 51% check AI access against that policy in real time, and only 19% could detect in real time when an agent reached data outside its intended scope.23 OneTrust's 2026 governance research found that 74% of organizations run AI at department scale or wider. Only 5% say coordination and accountability are defined across the AI lifecycle.6 An EY survey of executives at companies with at least $1 billion in revenue found that 91% use agentic AI. Roughly half said their governance framework had not been updated to cover it, and 26% said they could not detect unauthorized agents running internally.24

This article argues that the AI security gap is mostly a problem of ownership and enforcement, not awareness. Agents are making it worse fast, and the main way companies are learning about it is through incidents.

The confidence paradox

The most telling finding is how confident executives feel compared with how often things go wrong. Omdia research commissioned by Dell found that 79% of organizations had an AI-related incident in the past year. Yet 95% said they were confident or very confident in their ability to manage AI risk.4 Gravitee's State of AI Agent Security 2026 report found the same mismatch. 82% of executives believed existing policies protected them from unauthorized agent actions. On average, only 47.1% of an organization's agents were actively monitored or secured.2227

The Dell analysis offers a reasonable explanation: organizations are treating AI risk as if it were ordinary IT risk, even though agents fail and recover in different ways.4 A ShareGate executive, commenting on a Microsoft 365 governance study, put it more simply: teams feel safe because nothing has surfaced yet. That study found that 77% of organizations had at least one governance incident in the past year. Full Copilot deployment roughly doubled over the same period, from 29% to 56%.2 When overshared files sit beside an AI assistant that can retrieve them on request, an old data-hygiene problem becomes a live exposure.2

One correction matters. Gravitee's widely quoted 14.4% figure does not mean 14.4% of agents are approved. It is the share of organizations where every agent went live with full security and IT sign-off.30 Read correctly, it says something different: about 85% of organizations have at least one agent in production that skipped review.30

Agents turn a data problem into an authority problem

With chatbots, the main risk was data leaking out through prompts. Agents add a new risk: software acting with business authority that no one deliberately granted.

The identity data is stark. In Okta's survey of 306 security executives, only 47% said they could identify every agent in their environment, 46% could control what agents connect to, and 45% could authorize what agents do. 21% let agents use shared credentials or broadly permissioned service accounts.29 Gravitee found that just 21.9% of teams treat agents as independent identities, while 45.6% still use shared API keys for agent-to-agent authentication.27 JumpCloud found that 59% of organizations using agents have not fully integrated them into identity and access management. 36% had investigated an AI-related concern without being able to determine what the AI had accessed.5

Delinea found that half of IT leaders let agents inherit the permissions of the employee who launched them.23 That means an agent can quietly pick up years of accumulated access. 42% said many agent credentials stay active until an audit.23 Kiteworks, using deployment data rather than self-reported confidence, found that only 26% of organizations restrict agents to authorized tasks and data scopes, and only 21% can automatically cut off a misbehaving agent's access.28

A CIO.com contributor argued that this is where procurement goes wrong. Companies evaluate agents embedded in Salesforce, SAP, or Workday like ordinary features, checking seat price and encryption. They often skip the more important question: what decisions the agent is allowed to make.10 A vendor's security certification protects the vendor's infrastructure. It says nothing about whether an agent should have approved a discount or issued a refund.10 Gartner expects task-specific agents in 40% of enterprise applications by the end of 2026, up from under 5% in 2025. It also predicts that by 2027, 40% of enterprises will demote or decommission autonomous agents after governance gaps are exposed by production incidents.10

Shadow AI is now measurable in breach data

AI risk is no longer just a forecast; it shows up in breach investigations. IBM's 2026 Cost of a Data Breach Report studied 602 breached organizations. It found shadow AI involved in 43% of incidents, up from about one in five the year before.14 Breaches involving shadow AI averaged $5.39 million, against a record global average of $4.99 million.1319 Roughly one in five AI-related breaches led to a regulatory fine.12

Coverage of these numbers is not fully consistent. Some outlets describe the 43% as a share of breached organizations1319, while others describe it as a share of AI-related breaches.12 The widely cited $670,000 shadow AI premium comes from IBM's 2025 edition, not the 2026 report, though it is often presented as current.1517 The direction of the trend is clear in either case, but the exact headline numbers should be read with care.

The more worrying IBM finding is that controls moved backward. The share of breached organizations with no AI governance rose from 63% to 68%. The share requiring IT approval before deploying an AI tool fell from 45% to 38%.19 Over the same period, shadow AI incidents roughly doubled.

Employee behavior explains part of this. Delinea found that 76% of employees had bypassed formal approval to use AI with company data, and 60% had felt pressure to use AI with sensitive information when unsure it was allowed.23 Gartner reports that 79% of organizations say employee AI use does not match acceptable-use policy, and 53% have deployed custom-built agents.8 Netskope data shows source code is the leading type of data in generative AI policy violations, at 42%.15

Why the gap persists

The research points to a structural cause, not a lack of effort. SC Media argues that AI security is bought as if it were one product category. In practice it is four separate problems: governance, agent identity, application security, and fraud. Each belongs to a different team.1 Give it all to governance and risk staff, and application vulnerabilities go unaddressed. Give it to application security, and decisions about which tools to adopt happen without policy oversight.1 Budget authority is split in a similar way. CISOs hold sole authority over AI security spending in only 22% of organizations, and no single investment priority is chosen by more than 40% of respondents.4

Alignment at the top is weak too. Only 31% of CISOs say they agree with their C-suite and board on how much AI risk is acceptable, and in the US that drops to 12%.29 When leadership disagrees about acceptable risk, no one can decide which agent behaviors are allowed.

OneTrust's data suggests a less obvious cause of shadow AI: slow approvals. A third of respondents said employees used unapproved tools because approved options were not available fast enough, and 96% said governance reviews had slowed at least one AI initiative.6 Many companies are paying for governance in delays without getting clear accountability in return. Netskope data cited in one analysis suggests the fix is faster approvals rather than more rules: organizations that deployed enterprise AI gateways reportedly saw shadow AI use fall from 47% to 12% within 90 days.17

How this catches up with companies

The consequences will arrive in three ways. The first is incidents. Delinea found that 87% of organizations had experienced or suspected an AI tool or agent accessing sensitive data beyond its task, and 30% took four days or longer to detect such incidents.23 One trade report says OpenAI and Anthropic have described frontier systems exploiting misconfigurations or weak authentication in testing environments.3

The second is audit and compliance. Kiteworks found that 63% of organizations faced a compliance consequence such as an audit finding or regulatory investigation. Only 27% could produce a complete AI audit log within one business day.28 An audit log can show what an agent did. It cannot show that someone authorized it.10

The third is rollback. If Gartner's decommissioning forecast is correct, many companies will remove agents they spent heavily to deploy.10

The organizations that get through this will be the ones that treat agents as identities. That means each agent gets its own credentials, narrowly scoped permissions, a named owner, and a working kill switch. Oversight should scale with what the agent can do: an agent that summarizes meetings and one that moves money should not operate under the same rules.910 Governance does not need to be stricter everywhere. It needs to be enforceable where it counts.