Notifications
Clear all
Topic starter
22/07/2026 4:36 pm
TL;DR: Security and data concerns have already slowed agentic AI deployments, with 98% of 250 senior security leaders saying so in Apono’s 2026 survey, while only 21% feel prepared to handle attacks involving agentic AI or autonomous workflows. The data shows security readiness, not ambition, is now the binding constraint on production rollout.
NHIMG editorial — based on content published by Apono: New Apono report reveals 98% of cybersecurity leaders are slowing agentic AI adoption due to insufficient security controls
By the numbers:
- 98% of respondents say security and data concerns have already slowed deployments, added review steps, or reduced the scope of agentic AI and autonomous system projects.
- Only 21% say their organization feels prepared to manage attacks involving agentic AI or autonomous workflows.
- 77% report moderate slowdowns or added scrutiny, while 21% cite significant delays or reduced project scope.
Questions worth separating out
Q: How should security teams govern agentic AI as it moves into production?
A: Security teams should govern agentic AI as a class of non-human identity, not as a generic application feature.
Q: Why do AI agents increase non-human identity risk?
A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission.
Q: What do teams get wrong about least privilege for AI agents?
A: They often stop at permission scope and ignore behavioural scope.
Practitioner guidance
- Define agent-scoped privilege boundaries Assign each agent the narrowest actionable scope needed for the task, with separate controls for tool use, data access, and delegation.
- Require pre-production approval gates for autonomous actions Block production deployment until agent actions are constrained by human approval for sensitive operations such as data export, privilege changes, and external tool invocation.
- Instrument complete agent audit trails Capture every tool call, data retrieval, privilege change, and downstream action so security teams can reconstruct what the agent actually did, not just what it was asked to do.
What's in the full report
Apono's full report covers the survey detail this post intentionally leaves for the source:
- The full breakdown of responses from 250 senior cybersecurity professionals across North America, Europe, the Middle East and Africa.
- The study’s split between moderate slowdowns and significant delays for agentic AI projects.
- The report’s discussion of accountability pressure on CISOs, security teams, and technical leaders.
- Apono’s own framing of why identity governance and privileged access controls are becoming prerequisites for adoption.
👉 Read Apono's 2026 report on agentic AI cyber risk and adoption slowdowns →
Agentic AI security readiness: why CISOs are pressing the brakes?
Explore further
24/07/2026 4:12 pm
Agentic AI creates an assumption collapse, not just a control gap. Identity governance was designed for actors whose purpose is knowable before execution begins. That assumption fails when an agent can choose tools, sequence actions, and adjust timing at runtime. The implication is that access review cadence alone cannot govern a system whose privilege path is created inside the session.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: Who should be accountable when an AI agent causes a security incident?
A: Accountability should sit with the human owner, platform team, or business function that granted and operated the agent. The identity may act independently, but governance cannot detach responsibility from the delegation chain. Programs should define ownership, escalation, and remediation paths before deployment so responsibility is clear when the agent's behaviour changes.
👉 Read our full editorial: Agentic AI adoption is slowing as security controls lag
