New findings from Cequence Security and Enterprise Management Associates (EMA) reveal significant challenges in AI governance among enterprises.
Despite 94% of IT and security leaders expressing confidence in the appropriate scope of their AI agents, only 33% have implemented least-privilege access. The majority operate with broad standing permissions that are occasionally reviewed, indicating a governance gap as AI agents increasingly influence business operations.
Broad standing permissions
The disconnect between perceived and actual governance is manifesting in operational incidents. Of those surveyed, 65% have experienced AI agents acting beyond their intended scope, with 29% reporting significant impacts such as data breaches or financial losses. Furthermore, only 32% of organizations can swiftly detect and contain unauthorized agent actions, while 55% require several hours and manual resources to respond.
Additionally, in about 4% of cases, external entities identified the issue before internal systems did. This highlights a critical oversight in AI governance capabilities.
Customer-facing applications
The report underscores that current governance measures are lagging behind the rapid deployment of agentic AI across various sectors. A notable 46% of enterprises are expanding AI use across multiple departments, and 79% run generative and agentic AI concurrently. Moreover, 92% of organizations have seen an uptick in AI-generated traffic targeting their customer-facing applications and APIs.
A further analysis reveals that only 34% assess AI agent authorization precisely when the agent attempts an action. Most rely on outdated permissions set at the initial provisioning stage, risking prolonged access that exceeds the agent’s original task.
Challenges in AI pilot management
Mismanagement of AI agents not reaching production further complicates the issue
Mismanagement of AI agents not reaching production further complicates the issue. About 31% of AI pilots have been paused, discontinued, or abandoned, yet many retain live system access, posing ongoing risks. Alarmingly, 14% of organizations allow unrestricted connection of AI agents to external tools and data sources through the Model Context Protocol (MCP). Of those imposing restrictions, less than half actively maintain and audit their approved connections list.
Christopher M. Steffen, VP of Research at EMA, remarked: “This research shows enterprises have moved well past experimentation with agentic AI right into production and governance has not kept pace with that shift. The gap isn’t a lack of awareness; most organizations have policies in place and express real confidence in them.”
Shreyans Mehta, Co-founder and CTO at Cequence, pinpointed confidence as a major issue, noting that it leads to a lack of vigilance in monitoring and authorisation enforcement. This oversight is precisely the vulnerability Cequence aims to address by offering security teams real-time insights and immediate enforcement capabilities.
For further insights, join Christopher M. Steffen and Randolph Barr, Chief Information Security Officer at Cequence, in their upcoming webinar titled “Agents Without Guardrails.”
Nearly every enterprise believes its AI agents are properly scoped but only a third have actually made sure of it. New research from Cequence Security, the pioneer in application, API, and agentic AI protection, and Enterprise Management Associates (EMA) found that 94% of enterprise IT and security leaders are confident their AI agents do not have more access than they need, yet only 33% actually provision agents with least-privilege access.
The remaining two-thirds run on broad standing permissions that are reviewed periodically, rarely reviewed, or never reviewed at all. The full report, Agents Without Guardrails: The Agentic AI Governance Gap in the Enterprise, is available for download now.
Broad standing permissions
The gap between confidence and practice is already showing up in production, not as a theoretical risk, but as incidents enterprises are living with right now. Among the organisations surveyed:
- 65% have experienced an AI agent take an action outside its intended scope, including 29% with measurable business impact such as data exposure, financial loss, operational disruption, or reputational damage. Another 36% caught a near-miss before it caused damage.
- Only 32% can detect and contain an out-of-scope agent action within minutes through automated means; 55% need hours and manual steps to respond.
- In approximately 4% of the organisations surveyed, the first sign of trouble came from a customer or outside partner, not an internal system.
Customer-facing applications
The findings point to one clear story. Governance has not kept pace with the speed of agentic AI deployment, and that gap is showing up at every stage of the agent lifecycle, from how agents are provisioned, to how their actions are authorised, to how they are decommissioned once a pilot ends. Other key findings from the report include:
- The scale of deployment makes the gap more urgent. 46% of organisations report they are already scaling agentic AI across multiple departments and production workflows, and 79% are running generative and agentic AI simultaneously. Further, more than 92% report an increase in AI and bot-driven traffic targeting customer-facing applications and APIs.
- That governance gap extends to how access is enforced the moment an agent acts. Only 34% of organisations evaluate an AI agent's authorisation at the moment it attempts a specific action. The majority rely on periodic policy reviews or standing permissions set once at provisioning and never revisited, meaning an agent's access can quietly outlive the task it was originally granted for, and keep working long after anyone signed off on it.
- Additionally, there’s an increasing risk in how enterprises manage agents that don't make it to production. 31% of agentic AI pilots have been paused indefinitely, discontinued, or abandoned. Many were real deployments with real system access and credentials that were never cleaned up. Every abandoned pilot with live credentials is an exposure nobody is actively watching.
- 14% of organisations allow AI agents to connect to outside tools and data sources via the Model Context Protocol (MCP) without restriction. Among the majority who do limit those connections to an approved list, fewer than half (49%) have a dedicated team actively maintaining and auditing that list on a regular basis.
Well past experimentation
Christopher M. Steffen, CISSP, CISA, VP of Research at EMA, said: “This research shows enterprises have moved well past experimentation with agentic AI right into production and governance has not kept pace with that shift. The gap isn’t a lack of awareness; most organisations have policies in place and express real confidence in them. The gap is between what’s written down and what’s enforced when an agent takes an action nobody approved. That disconnect shows up most clearly in how organisations authorise agent actions and monitor them once they’re live, and it’s the reason incidents are happening at a rate the industry hasn’t fully reckoned with.”
Shreyans Mehta, Co-founder and CTO at Cequence, said: “The number that jumped out to me is the 92% being confident in their governance frameworks. Confidence like that is a trap; its exactly why organisations stop looking for problems, stop investing in monitoring, and let authorisation checks lapse until an incident forces the conversation. This is the exact blind spot Cequence is built to close, giving security teams real-time visibility into what AI agents are actually doing and enforcing authorisation at the moment an agent acts, not after the fact.”
Join Christopher M. Steffen, Vice President of Research at EMA, and Randolph Barr, Chief Information Security Officer at Cequence, for the “Agents Without Guardrails” webinar.
