Securing AI Agents Necessitates Autonomous Governance: What CISOs Are Saying - Cybersecurity Insiders

A recent survey by Andreessen Horowitz of 100 CISOs reveals that internal AI agent security has seen the largest percentage point increase (28%) year-over-year in becoming a top five priority for security leaders. This surge comes as enterprises grapple with securing AI systems that employees and customers are increasingly adopting.

Agen.co by Frontegg's report, "The State of Autonomous Agent Governance," surveyed 300 CISOs and CSOs to understand how security leaders are governing AI agents. Following high-profile agent breakouts at OpenAI and other major AI labs this summer, 83% of these security leaders tightened policies, added tools, or opened reviews.

Growing Agent Usage, Limited Control

The report found that 83% of security leaders oversee environments where AI agents are connected to internal systems or data, with 70% having 11 or more agents connected. 84% are seeing more than a thousand agent actions a week, with one in five witnessing over ten thousand.

Despite this visibility, security teams face significant limitations. While 75% of CISOs are confident they know how many agents are connected, half admit their teams have found agents running in production with unauthorized access this year. More than half of organizations experienced an agent-related incident in the past twelve months, with 60% learning about it only after the fact.

Even if they're aware of an agent in use, most security teams are unable to respond in real-time to agent actions. In fact, 42% of security leaders admitted they cannot block a specific harmful action before it runs.

Credential and Policy Challenges

The security landscape is further complicated by credential management practices. 53% of CISOs report their companies still run agents on shared or long-lived API keys, while 40% use employees' personal credentials. Startlingly, only 18% check an agent's identity before each action.

The volume of decisions required to manage these agents is overwhelming. With tens of thousands of agent actions weekly, each requiring an allow/deny decision, manual policy creation becomes unsustainable. Only 43% of security leaders say they can comfortably keep policies current by hand, with others reporting the burden is growing or becoming unmanageable at scale.

The Case for Autonomous Governance

When asked what would reduce the most effort, security leaders prioritized an autonomous system that sets and updates agent policies over better rules, fewer tools, or more people. This aligns with Andreessen Horowitz's findings, where 87% of CISOs expect budget increases in 2027, but less than half plan to increase headcount.

Security leaders expressed openness to autonomous governance solutions: 23% would fully trust an AI system to make agent access decisions in real time, while 60% would trust it within tight limits. Just 1% wouldn't trust it at all. This cautious approach reflects the need for systems that can operate autonomously while remaining accountable to human oversight.

Moving Forward

Effective autonomous governance must be company-specific, as normal behavior for one organization might be suspicious in another. It must also maintain human accountability, even as individual decisions become automated. Implementation happens incrementally, with each level learning from decisions made at lower levels.

Despite these challenges, security leaders aren't slowing AI agent adoption. Two-thirds want their organizations to continue adopting agents while planning to spend more on governance and security controls. As agents increasingly operate without human oversight, governance systems will need to evolve autonomously to keep pace.