Nine in 10 global organizations have already experienced an agentic AI security incident in the past year, and only 36% of those businesses contained it in under 24 hours, according to findings from ServiceNow.
What’s more, only 13% of businesses have a defensible security posture.
“The agentic incidents making headlines this year are a warning about what can happen when AI is deployed without the right controls,” says Ben de Bont, CISO, ServiceNow. “Organizations shouldn’t have to choose between moving quickly and managing risk. The ones that get this right will build governance into how they deploy agents from the start, so they can realize the benefits of AI without losing visibility or control.”
Key takeaways:
· While many security leaders self-assess as having established agentic security postures, only 13% have defensible programs when measured against five key domains: attack surface, accountability, security by design, visibility, and audit readiness.
· Just 44% of security teams globally design security into an agent’s development before it’s built, which means for the majority, permissions and guardrails are being implemented on an ad-hoc, after-the-fact basis.
· 49% of organizations now run between 100-999 AI agents, and 35% run more than 1,000.
· 57% of security teams have a full, accurate record of every AI agent in production and have processes to track changes.
· 29% of security teams found AI agents running in production that had never been registered or known.
· 76% of organizations say they maintain a complete, current map of every agent's access, but only 19% can see more than 90% of their agents in real time.
· Two-thirds (66%) cannot act automatically when an agent behaves anomalously, which means a human still has to intervene before anything changes.
