Topic starter
06/11/2026 6:40 pm
TL;DR: Three 2026 surveys show that 35% to 60% of organisations cannot shut down a rogue AI agent, and 18% of reactive organisations cannot identify or stop one at all, according to Aizome research. The core issue is not deployment alone but the absence of operational governance that can detect behavioural drift and contain agent actions before damage is done.
Editorial analysis by NHI Mgmt Group, based on content published by Aizome: “35% of Organizations Can’t Shut Down a Rogue AI Agent. Are You One of Them?”.
By the numbers:
- 35% of organisations admit they could not shut down a rogue AI agent if one emerged.
- A separate survey from Kiteworks, drawing on 225 security leaders, puts that number at 60%.
- 18% of reactive organisations cannot identify or stop a rogue agent at all.
Key questions
Q: What should teams do immediately when an AI agent behaves unpredictably?
A: Suspend the agent's high-risk access, preserve the prompt and tool-call trail, and review the inputs that may have redirected its behaviour.
Q: Why do AI agents create new governance risk for GRC programs?
A: AI agents can request access, process data, and generate trust artefacts faster than human review cycles can keep up.
Q: How should security teams govern AI agents that can change behaviour at runtime?
A: Security teams should govern AI agents with runtime monitoring, behavioural baselines, and identity-triggered response, not just static approval workflows.
Practitioner guidance
- Establish a complete AI agent inventory Track every agent that can act in production, including those deployed outside formal IT or procurement processes.
- Define runtime containment criteria Set behavioural thresholds that trigger containment when an agent drifts, exceeds scope, or acts outside its declared purpose.
- Preserve attribution and audit trails Log identity, tool calls, decision points, and outcomes so the team can explain what the agent did after containment.
Bottom line: AI agents introduce a governance problem that extends beyond access assignment, because valid credentials do not prevent runtime drift.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Runtime governance, not deployment governance, is now the controlling discipline for AI agents. A valid identity and authorised credentials do not make an agent safe if its behaviour can drift after deployment. The important control question is whether the programme can evaluate what the agent is doing while it is doing it, then stop it before the action becomes irreversible. Security teams that still treat agent governance as a one-time approval process are already behind the operating model the board expects.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern AI agents that can change behaviour at runtime?
A: Security teams should govern AI agents with runtime monitoring, behavioural baselines, and identity-triggered response, not just static approval workflows. The goal is to detect when an agent drifts from expected purpose, reduce privileges immediately, and keep accountability tied to a named owner. In agentic environments, governance must work at machine speed rather than review cadence speed.
👉 Read our full editorial: Rogue AI agents expose a governance gap boards now expect closed