Apono Survey Finds Agentic AI Security Readiness Lags Perceived Risk
Summary
Apono’s survey of 250 cybersecurity professionals found only 21% felt prepared for agentic AI attacks, while 98% reported security-related deployment delays or added reviews. Just 2% had experienced or observed incidents involving AI agents.
Key points
- Apono commissioned Global Surveyz to survey 250 cybersecurity professionals in December 2025 at organizations with at least 250 employees across North America, Europe, the Middle East and Africa.
- Only 2% reported experiencing or observing an incident involving AI agents or autonomous workflows; all respondents believed attacks targeting agentic workflows would cause greater damage than traditional cyber tactics.
- Agentic AI attacks ranked among perceived existential threats for 48% of respondents, but only 21% said their organizations were prepared to manage them.
- Agentic AI adoption remained limited: 57% reported use in specific workflows and 42% were testing or prototyping. Security or data concerns caused added reviews, slowdowns or reduced scope for 98%.
- Some 99% expected agentic-workflow attacks to be harder to detect and contain than traditional attacks; only 1.5% were very confident in their current tools and knowledge.
- CIOs and CTOs were the strongest adoption advocates for 45% of respondents, while 77% assigned primary AI cybersecurity accountability to CISOs or security leadership.
- The report emphasizes stronger identity governance, control of privileged access and visibility into permissions before expanding autonomous systems.
Article Details
- Publisher
- Apono
- Scope
- Global survey of agentic AI adoption, perceived cybersecurity risks, preparedness, governance, and investment plans at organizations with at least 250 employees. Responses were collected in December 2025 by Global Surveyz.
- Sample Size
- 250 senior cybersecurity professionals recruited through a global B2B research panel.
- Key Statistics
- Only 2% of respondents reported experiencing or observing an incident involving AI agents or autonomous workflows within the preceding six months; 98% reported never doing so. Nevertheless, 100% believed attacks targeting agentic workflows would cause greater damage than traditional cyberattacks.
- 57% reported limited agentic AI use in specific workflows, while 42% remained in testing or prototype phases.
- Security or data concerns caused deployment slowdowns or additional review steps for 77% of respondents and significant delays or reduced project scope for 21%.
- 48% selected agentic AI or autonomous workflow attacks among threats capable of causing existential damage, while only 21% selected them among threats their organization was prepared to manage. Both questions allowed multiple answers.
- 77% identified CISO or security leadership as primarily accountable for AI-related cybersecurity risks, while 45% identified CIO or CTO leadership as the strongest internal advocate for agentic AI deployment.
- Recommendations
- Address identity governance and overprivileged access before expanding autonomous AI deployments.
- Establish visibility into which human and non-human identities can access sensitive resources and what permissions they hold.
- Define agent autonomy limits, guardrails, and required security controls before expanding agents' responsibilities.