CISOs’ biggest question as we head into 2027 is how to better secure AI agents. That point was driven home in a recent survey of 100 CISOs It found that internal AI agent security has seen the largest percentage point increase (28%) year-over-year in becoming a top five priority for CISOs. The reason is simple: enterprises need to secure the AI their employees and customers are increasingly using
Our team at Agen.co by Frontegg recently published our own report – The State of Autonomous Agent Governance – based on a survey of 300 CISOs and CSOs to better understand how security leaders are governing AI agents.
Following the highly publicized agent breakouts at OpenAI and other major AI labs this summer, more than four in five of those security leaders tightened policy, added tooling, or opened a review. Our report found that 83% of these security leaders oversee environments where AI agents are now connected to internal systems or data, and 70% have 11 or more agents connected. 84% are seeing more than a thousand agent actions a week, with one in five seeing more than ten thousand.
Security teams can see agents, but they can’t stop actions
Despite this skyrocketing use, CISOs told us that they are confident (75%) that they know how many agents are connected to their systems. I believe them. I’ve met a lot of these people, and they are not careless.
However, this data point is coupled with half of them admitting their security teams have found an agent running in production this year with access it never should have had. A quarter found more than one. In addition, more than half of their organizations had an incident involving an agent in the past twelve months, and six in ten learned about it only after the fact, from a log, an employee, a customer, or an audit.
The problem here is that even if they’re aware of an agent in use, most security teams are unable to respond in real-time to agent actions. In fact, 42% of security leaders admitted they cannot block a specific harmful action before it runs. They can kill the agent, revoke its credentials, or find the action in the logs, but only after it has already happened.
Incident rates for security leaders confident they knew what agents were doing inside their walls were also no lower than anyone else’s. Of course both things can be true in security. You can be excellent at checking the door and have no idea what’s going on inside the building. Perimeter security and identity-native runtime enforcement are not the same thing.
Meanwhile, 53% of CISOs say their companies still run agents on shared or long-lived API keys. Another 40% run them on an employee’s personal credentials. This means the agent logs in as a person, and the logs show that person doing whatever the agent did. Startlingly, only 18% are checking an agent’s identity before each action. Most of the rest check once, at registration or at the start of a session, and let it go.
Identity teams can’t write agentic rules fast enough
Every one of the tens of thousands of agent actions a week is a decision: allow it, stop it, ask someone, hide the sensitive fields. If someone has to write the rule before each decision, the rulebook will break before the first time a developer connects something nobody planned for. Only 43% say they can keep policies current by hand comfortably. Everyone else says the burden is growing, they’re falling behind, or it isn’t humanly possible at their scale.
When asked what would cut the effort most, the top answer, ahead of better rules, fewer tools, or more people, was an agent or AI system that sets and updates agent policies on its own. Adding more headcount to the identity security team came last. The same rang true in Andreessen Horowitz’s survey, with 87% of CISOs saying their budgets are increasing in 2027, but less than half saying they are increasing headcount.
Security leaders want autonomous governance solutions, as long as they draw the lines
If not more people, then what? We asked security leaders how much they would trust an AI system to make agent access decisions in real time, within limits they set, without a human reviewing each one. 23% would trust it fully, and 60% would trust it within tight limits. Just 1% wouldn’t trust it at all.
That’s probably the right answer. If a CISO told me they’d hand every access decision to an agent and its underlying model tomorrow, I’d worry a little. What they’re saying is more careful and more useful: I’ll let the system decide within the bounds I draw, and I want to see why it decided what it did.
Anything calling itself autonomous governance has to be fast enough to sit in the path of an action without slowing it down. For instance, the PaperCut attacker in September used hundreds of agents to break into eleven organizations in 26 seconds.
It also has to be specific to the company, because what’s normal for a bank’s agents could be a red flag at a hospital. And it has to stay bound by people, because someone has to remain accountable even when they’re no longer in the loop for each call.
You also don’t get to autonomous agent governance overnight. It happens one rung at a time. Each level learns from the decisions the one below it made. It’s slow and unglamorous, and it’s the only way I know to produce a system a CISO would actually trust with the keys.
However, it’s needed, as most security leaders aren’t telling their organizations to slow down with AI agent use. Two-thirds want their organizations to keep adopting agents, and plan to spend more on controls to govern and secure them. Agents are already working without anyone in the loop. Sooner or later, governance will need to move autonomously, too.
Sagi Rodin is the co-founder and CEO of Agen.co byFrontegg, the $70M-backed Identity and Access Management (IAM) company, which has provided cybersecurity infrastructure to enterprises including Siemens, Cisco, and Datadog since 2019. The company’s latest innovation is Agen.co, an identity-native agentic governance platform built for AI agents, not people. Agen.co gives every agent its own identity, governs what it can do at the moment of the action rather than at the login, and keeps a named human accountable for each one. Before Frontegg, Sagi was director of cloud security at Check Point Software Technologies, and he has also held multiple CTO roles. He holds a BSc in computer software engineering from Technion-Israel Institute of Technology.
