Enterprise AI Security Starts with AI Agents
This survey report explores the rise of AI agents in enterprises, as well as the reality of autonomous AI risks. Commissioned by Zenity, the report reveals that autonomous systems are already operating at scale. They often exceed intended permissions and act outside defined boundaries as part of routine operations.
The findings show that AI agent adoption is widespread and decentralized. Most organizations use multiple platforms and deploy agents across IT, security, engineering, and customer-facing functions. At the same time, shadow AI agents are emerging early in adoption cycles, creating visibility and accountability gaps. Nearly half of organizations report experiencing an AI agent-related security incident. Detection and response timelines often extend into hours or days.
The report highlights a growing disconnect between adoption and control. Many organizations lack real-time inventories, consistent runtime authorization, and comprehensive traceability, making it difficult to govern autonomous behavior. In the absence of a defined AI agent security strategy, organizations often default to existing compliance frameworks.
This research underscores a critical shift: autonomous behavior is increasingly shaping enterprise risk. Organizations must evolve governance and security models to address the dynamic, interconnected nature of AI agents.
Key Takeaways:
- Large portions of the workforce already use AI agents daily. An impressive 43% of organizations report that more than half of employees use AI agents regularly. However, organizations rarely centralize adoption. Only 5% use a single agentic platform, while 44% use two to three platforms and 43% use four or more.
- Unsanctioned AI agents appear early in adoption, with 54% of organizations reporting 1–100 unsanctioned AI agents, even when overall agent counts remain relatively modest. Ownership is often unclear as well. Only 15% report that 76–100% of agents have defined ownership, while the most common ownership range is 26–50% (34%).
- Scope violations are routine rather than exceptional, with 53% of organizations reporting that AI agents exceed intended permissions occasionally or sometimes. Further, 47% of organizations report a security incident involving an AI agent. Another 58% indicate detection and response take five hours or longer, extending exposure windows.
- Existing regulatory frameworks heavily influence AI agent governance, yet only 13% of organizations report feeling highly prepared for upcoming AI-related regulations.
Download this Resource
Best For:
- Security Architects
- AI/ML Engineers and Practitioners
- Risk and Compliance Leaders
- IT and Security Operations Teams
About the Sponsor
+(2)%20(1).png)
Zenity is the leader in securing, governing, and enabling AI Agents everywhere. The company provides adaptive security to enable the AI movement, allowing for innovation to thrive in a governed, safe, and scalable environment. Zenity provides a comprehensive security and governance platform for enterprises to embrace AI Agents by securing them from build-time to runtime. The platform consists of business-logic driven AI Security Posture Management (AISPM), AI Observability, and AI Detection & Response (AIDR) capabilities.
