Survey Finds Enterprise Gaps in Agentic AI Security Readiness
Summary
An Arkose Labs report based on a survey of 300 enterprise leaders finds gaps in agentic AI security readiness, including limited governance and difficulty attributing activity to AI agents. It also offers identity-focused recommendations.
Key points
- In the survey, 97% of leaders expected a material AI-agent-related security or fraud incident within 12 months; 49% expected one within six months.
- 57% of surveyed organizations reported having no formal AI-agent governance controls, while 88% expected defined or advanced frameworks within three years.
- Only 26% of respondents were very confident their organization could prove an AI agent caused a security or fraud incident.
- 87% agreed that AI agents using legitimate credentials pose a greater insider-threat risk than human employees.
- About 72% expressed concern that current defenses would not keep pace as AI-driven threats evolve.
- Organizations allocated an average of about 6% of security budgets to AI-agent risk; 10% said they did not track it separately.
- The report recommends stronger oversight of machine identities, visibility into automated workflows, and logging to reconstruct decision chains.
Article Details
- Publisher
- Arkose Labs
- Report Period
- February 2026
- Scope
- Global survey of enterprise leaders on agentic AI security, fraud, and governance readiness.
- Sample Size
- 300 enterprise leaders across Security, Fraud, Identity, and AI functions.
- Key Statistics
- 97% of respondents expected a material AI-agent-related security or fraud incident within 12 months; 49% expected one within six months.
- 57% of organizations reported having no formal AI-agent governance controls; 88% expected defined or advanced frameworks within three years.
- 26% of enterprise leaders were very confident their organization could prove an AI agent caused a security or fraud incident.
- 87% agreed that AI agents operating with legitimate credentials pose a greater insider threat risk than human employees.
- 76% reported that their C-suite was not deeply involved in AI-agent security decisions or lacked a strong understanding of the risks.
- Recommendations
- Integrate security leadership into AI deployment planning so identity controls, monitoring, and investigative capabilities are addressed early.
- Maintain visibility into non-human identities and keep automated systems within defined access boundaries.
- Monitor automated interactions across APIs and services, including which systems invoke specific credentials and unusual workflow patterns.
- Develop telemetry and logging to trace automated actions across systems and reconstruct decision chains during investigations.
Vendors
Industries
Bankingincluding financial services, banking, technology,Digital servicesmanufacturing, and digital services.Financial Servicesincluding financial services, banking, technology,Healthcaretelecommunications, retail and e-commerce, healthcare,Manufacturingmanufacturing, and digital services.Retail and e-commercetelecommunications, retail and e-commerce, healthcare,Technologyannual revenue. Respondents represent major technologyTelecommunicationstelecommunications, retail and e-commerce, healthcare,