A study of 107 enterprises reveals significant gaps in AI agent security as organizations grant these agents system access without adequate controls. Over half (54%) have experienced security incidents or close calls involving AI agents. Despite this, only about a third of enterprises assign each agent a unique scoped identity, while most still share credentials, increasing risk. Additionally, just 30% isolate their highest-risk agents in sandboxes to limit damage if compromised. Security measures primarily rely on native provider tools from OpenAI, Google, and Microsoft rather than specialized agent security vendors. Satisfaction with these controls remains high, though spending on AI agent security is generally minimal, accounting for less than 10% of overall security budgets. Enterprises are divided on whether their AI defenses surpass attackers, with only a third confident they are ahead. A majority plan to update their security tools soon, indicating recognized vulnerabilities amid growing agent use.
Back
