Ethernet cables plugged into a network switch

Can you name every AI agent you run? Five lessons for CISOs from new agentic security research

Ask a security team how many AI agents are running in their organisation and most will give you a number. Ask how sure they are, and the answer gets less tidy. New research published on 20 October by ServiceNow suggests the gap between what security leaders believe and what they can prove is now one of the biggest risks in the enterprise.

The study, Deployed but ungoverned: the state of agentic security, surveyed more than 3,700 senior security and technology decision makers, at VP level and above, across 20 countries. Its headline finding is stark: 90% of organisations had an agentic AI security incident in the past year, and only 36% of those contained it in under 24 hours.

Last week we looked at how AI agents are becoming a new kind of insider. This research moves the conversation on to a practical question: what does good governance of agents actually look like?

Confidence is running ahead of control

More than half of the organisations surveyed rate their agentic security as "established". Yet when ServiceNow measured them against five areas (attack surface, accountability, security by design, visibility and audit readiness), only 13% had what it calls a defensible posture. That is roughly one in eight.

The numbers on visibility show why. 57% of security teams say they have a full, accurate record of every AI agent in production. But 29% found agents running in production over the past year that they did not know existed, and only 34% register new agents automatically.

Access tells a similar story. 76% say they keep a complete, current map of what every agent can reach, but only 19% can see more than 90% of their agents in real time.

Scale is the problem

Part of the challenge is sheer volume. According to the research, 49% of organisations now run between 100 and 999 AI agents, and 35% run more than 1,000. At that scale, a spreadsheet and a quarterly review will not keep up.

A separate report released on the same day by identity security company Oak backs this up. Based on 201 in-depth interviews with CISOs, identity leaders and practitioners, it found that 51% see incomplete visibility of identities as a problem. Service accounts and API keys are often created with no owner or end date, and one practitioner described finding about 12,000 service accounts "before we had a single AI agent."

In other words, many organisations were already struggling with machine identities. Agents add to a pile that was growing anyway.

Response still depends on people

Even when a team spots a problem, acting on it is slow. Two thirds (66%) of organisations cannot act automatically when an agent behaves unusually, so a person still has to step in before anything changes. Only around half (51%) have automated, real-time detection of unusual agent behaviour once agents are live.

Agents are also moving well beyond IT. 82% of organisations run AI agents in or touching operational technology and physical environments, and 76% have had an OT or physical security incident involving an agent in the past 12 months. For anyone responsible for factories, hospitals, transport or utilities, that is the figure to take to the board.

Ben de Bont, CISO at ServiceNow, said: "Organizations shouldn't have to choose between moving quickly and managing risk. The ones that get this right will build governance into how they deploy agents from the start, so they can realize the benefits of AI without losing visibility or control."

Five moves from the organisations getting it right

The useful part of the research is what the 13% did differently. ServiceNow sets out five structural choices:

Build a continuous inventory and map agent access. Make registration a technical step in the deployment path rather than a manual task, and keep the record and access map in one place that updates itself.
Bring security in before design. Only 44% of organisations involve security before agent development begins. Writing requirements into the project brief means permissions, logging and boundaries are set from the start rather than inherited later.
Join up visibility. Bring agent activity, identity exposure and posture into a single view, and automate detection so unusual behaviour shows up in real time.
Capture evidence as you go. Record approvals, permissions and agent actions as they happen, so an audit trail exists before anyone asks for it.
Name one accountable owner. Give one person responsibility for agentic AI governance across the organisation, with a documented scope covering the framework, review gates and response plan.

Inspired's take

The figure we keep coming back to is 29%. Nearly three in ten security teams found agents they did not know about. That points to a process problem as much as a tooling one. It suggests agents are being switched on through routes that never touch security.

That makes the second move, getting involved before the build, the one we would start with. It costs little, it does not need a new platform, and it gives every later control something to hang on. Only 32% of organisations have a mandatory automated gate that stops an agent going live until it passes a security check. As the report puts it: "A gate that isn't required isn't a gate."

A few questions worth asking this week:

Could you produce a list of every agent in production today? And would you trust it?
How does a new agent get registered? If the answer is "someone tells us", it will be missed.
What happens if an agent misbehaves at 2am? If the answer involves waiting for a person, plan for how long that takes.
Who owns this? If the answer is several people, it may in practice be nobody.

None of this means slowing AI down. The message of the research is that control has to be built in from the start, so that organisations can keep adding agents and still see them, stop them and prove what they did.

Join the conversation

How does your organisation keep track of its AI agents? We would like to hear what is working and what is not. Share your view in the comments, and join fellow security leaders at our next CISO summit to compare notes.