Agentic AI security readiness is lagging enterprise adoption

At a glance

What this is: This is a research-led assessment of agentic AI security that finds adoption is outpacing visibility, governance, and runtime controls.

Why it matters: It matters because AI agents are now part of identity and access scope, and IAM teams need to govern their inventories, permissions, and execution paths before autonomous behaviour becomes a routine control failure.

By the numbers:

• 69% of enterprises are already piloting or running early production agent deployments.
• Only 21% of organizations maintain a fully up-to-date inventory of agents, MCP servers, tools, and connections.
• 79% of organizations have no formal governance policy for AI agents or MCP connections.
• 60% of organizations have not conducted an AI or agentic risk assessment in the last 12 months.

👉 Read Akto's analysis of the state of agentic AI security in 2025

Context

Agentic AI security is the discipline of governing software systems that can choose actions, call tools, and move data inside enterprise environments. The primary problem in this article is not model quality. It is that agentic AI has entered production faster than identity, access, and monitoring controls can keep up.

For IAM, IGA, PAM, and NHI teams, the central question is whether an agent should be treated as an identity with inventory, permission boundaries, and audit expectations. Once an agent can invoke APIs, trigger workflows, or interact with other agents, standard user-centric assumptions stop holding.

That is why agentic AI has to be evaluated as part of the broader identity model, not as a sidecar to application security. The article's findings are typical of a market where deployment pressure is high and governance maturity is still low.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: What breaks when organizations do not inventory AI agents and MCP connections?

A: Security teams lose the ability to answer what exists, what it can reach, and who owns it. Without that baseline, policy, monitoring, and incident response all become incomplete. The result is blind spots where agents can act, connect, and expand their effective scope without clear governance.

Q: Who is accountable when an AI agent takes an unsafe action?

A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.

Technical breakdown

Why agent inventories are the first control plane issue

Agents are not just model endpoints. They are runtime identity surfaces composed of the agent itself, the tools it can call, the data it can touch, and the connections it can use. Without an inventory, security teams cannot build a trust graph or answer who can act on behalf of whom. In agentic environments, discovery is not a nice-to-have. It is the prerequisite for authorization, logging, and ownership.

Practical implication: establish a live inventory of agents, tools, MCP connections, and delegated accounts before expanding production use.

How autonomous execution changes identity governance

Traditional IAM assumes access is granted to a principal and then reviewed later. Agentic AI changes the sequence because action selection happens at runtime, often across multiple tools and systems. That means the control problem is not only entitlement management but also decision containment, where the system can chain actions faster than human review cycles can observe them. Governance must therefore cover action boundaries, not just credential issuance.

Practical implication: map which actions agents can initiate independently and separate those actions from read-only or low-risk tool access.

Why MCP and tool trust create new exposure paths

Model Context Protocol gives agents a standardized way to connect to tools and data sources, but standardization does not equal safety. Each connector, plugin, or integration expands the trust boundary and can become an execution path for prompt injection, unsafe calls, or data leakage. The security issue is less about the protocol itself than about how permissions, validation, and monitoring are enforced around it.

Practical implication: treat every agent tool connection as an identity boundary that needs approval, logging, and periodic review.

Threat narrative

Attacker objective: The objective is to turn legitimate agent access into uncontrolled enterprise action that produces data exposure, workflow abuse, or privilege expansion.

1. Entry occurs when an enterprise deploys an AI agent with access to business tools, APIs, or MCP-connected services without full visibility into its identity surface.
2. Escalation happens when the agent can chain tool calls, interact with other agents, or inherit broader permissions than the original use case required.
3. Impact follows when autonomous actions modify data, leak information, trigger workflows, or bypass intended approval paths faster than human teams can intervene.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent inventories are now an identity control, not a discovery exercise. When 79% of organizations lack a fully up-to-date inventory of agents, MCP servers, tools, and connections, the issue is not operational tidiness. It is that identity governance cannot begin without knowing what non-human actors exist and what they are allowed to do. In agentic environments, inventory is the first control plane, and without it every downstream policy is partial at best.

The governance assumption that access can be reviewed after it is granted is breaking. Access review processes were designed for principals whose entitlements persist long enough to be examined on a schedule. That assumption fails when agents select actions at runtime and can chain multiple tool calls inside a short execution window. The implication is not merely that review cycles need to speed up. It is that review-based governance is being asked to police behaviour that may already be complete before the review starts.

Runtime execution containment: the new named concept for agentic security is the gap between permitted access and bounded action. The article's strongest signal is that organizations are focusing on agent permissioning while the harder problem is controlling what an agent can actually do once a tool call begins. This is where prompt-level thinking fails and identity-level thinking starts. Practitioners should frame agent security around action containment, not just authorization at login.

Agentic AI security is converging with NHI governance, but the market still treats it as a separate problem. The same control logic that governs service accounts, secrets, and workload identity now has to extend to software actors that can make choices at runtime. That convergence does not eliminate the need for specialist controls. It raises the bar for IGA, PAM, and monitoring teams to define ownership, scope, and auditability across machine and autonomous identities.

Policy without telemetry will not hold up in agentic environments. The article shows that 79% of organizations have no formal governance policy for AI agents or MCP connections, while only 41% have runtime guardrails in place. That mismatch means the category is maturing into a compliance and operational risk before most teams have a control baseline. Practitioners should treat agentic AI governance as an operating model problem, not a documentation task.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• For a broader control model, see OWASP Agentic AI Top 10 for the runtime risks that map most directly to agent tool misuse and scope drift.

What this signals

Runtime governance will become the differentiator, not model sophistication. As agentic deployments move from pilots into operational workflows, the security question shifts from whether an agent is intelligent enough to whether its actions are bounded enough to survive audit and incident review. Teams that continue to frame the problem as prompt security will miss the identity layer where the actual control loss occurs.

With 80% of organisations already reporting agents acting beyond intended scope, the next programme gap is not theoretical. Security leaders should expect inventory, ownership, and execution controls to become board-level questions, especially where agents touch customer data, financial workflows, or privileged internal systems.

The practical signal for practitioners is simple: if you cannot tie an agent to a named owner, a live inventory record, and an auditable tool trail, then the deployment is operating outside a defensible governance model. That is the point at which NHI controls, zero trust assumptions, and agent monitoring have to converge.

For practitioners

• Build a live agent inventory Track every agent, MCP server, tool, and delegated connection in a continuously updated register so security teams can see what exists and who owns it.
• Define action boundaries for each agent Classify which tool calls are read-only, which can modify data, and which require approval before execution so permissions reflect actual runtime risk.
• Add runtime guardrails around tool execution Block unsafe calls, log every tool invocation, and enforce policy at the moment of action rather than relying on post-event review.
• Extend access reviews to agent behaviour Review not just assigned permissions but also observed actions, inherited connections, and unexpected cross-system interactions across the agent lifecycle.
• Separate low-risk pilots from production autonomy Use constrained sandboxes for early agent deployments until inventory, policy, and monitoring are mature enough to support broader access.

Key takeaways

• Agentic AI is already in production, but most organizations still lack the inventory and governance needed to secure it.
• The strongest risk signal is not model output quality, but uncontrolled agent action across tools, data, and delegated connections.
• Identity teams need to treat AI agents as governed non-human identities with runtime boundaries, ownership, and auditability.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
• Agent Inventory: A governed record of every AI agent in use, including who created it, who can invoke it, what data it can reach, and what actions it can trigger. Without a current inventory, security teams cannot judge whether agent access still matches the business purpose.

What's in the full report

Akto's full blog covers the operational detail this post intentionally leaves for the source:

• Breakdowns of agent inventory, monitoring, and governance maturity by survey segment.
• The reported threat categories practitioners ranked highest for 2026 planning.
• Examples of runtime guardrails and control patterns discussed for agentic deployments.
• The full benchmark findings from 100+ verified security and AI leaders.

👉 Akto's full post covers the survey findings, control gaps, and CISO priorities in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.