AI Agent Security: The Hidden Gap Between 14% and 89%

Last Verified: 13 August 2026

Two statistics have circulated widely this year, usually in isolation.

The first: 14.4%, the share of organisations reporting full security and IT approval for agents going live, from Gravitee’s survey of more than 900 executives and technical practitioners.

The second: 89%, the year-over-year increase in attacks by AI-enabled adversaries, from CrowdStrike’s 2026 Global Threat Report.

Cited separately, each is a talking point. Paired correctly, they describe a compounding structural problem that neither number shows alone.

Paired incorrectly — which is how they usually appear — they produce a number that sounds alarming and means very little.

This article does the pairing properly, and shows its working so you can check it.

Key Takeaways

• Only 14.4% of organisations report that all their AI agents reach production with full security and IT sign-off. Most coverage misreads this as 14.4% of agents, which is a different and less useful claim.
• AI-enabled adversary operations grew 89% year over year, per CrowdStrike’s 2026 Global Threat Report. That figure describes 2025 activity, not 2026.
• Governance coverage is a stock. Adversary capability is a flow. A stock cannot catch a compounding flow, which is the structural problem this article models.
• At 89% annual growth, adversary capability doubles roughly every 13 months. Security review throughput at most organisations does not.
• Access scope beat model sophistication, industry, and maturity as the strongest predictor of incidents: 76% incident rate for over-privileged AI versus 17% for least-privilege deployments.

---

Quick Navigation

---

What the 14.4% Figure Actually Measures

Start with a correction, because almost every secondary source gets this wrong.

Gravitee’s finding is that only 14.4% of respondents report all their AI agents going live with full security and IT approval. The unit is organisations with universal sign-off, not agents that received sign-off.

Those are different claims. “14.4% of agents are approved” implies 85.6% of agents ship unreviewed. The actual finding implies that 85.6% of organisations have at least one agent that skipped review. Real per-agent coverage sits somewhere above 14.4% and below 100%, and nobody has published it.

That distinction matters for anyone building a risk model on top of it, which is what we are about to do.

The survey’s other findings fill in the picture:

• 80.9% of technical teams have moved past planning into active testing or production
• 47.1% of agents are actively monitored or secured
• 24.4% of organisations have full visibility into which agents communicate with each other
• 25.5% of deployed agents can create and task other agents
• 88% reported confirmed or suspected agent security incidents in the past year, rising to 92.7% in healthcare

The monitoring number is the more usable one. Roughly 53% of agents run without consistent oversight or logging. That is a per-agent measure, and it is the input this model uses.

---

What the 89% Figure Actually Measures

The same care applies here. CrowdStrike’s 2026 Global Threat Report, published February 2026, found an 89% increase in operations by AI-enabled adversaries.

That measures 2025 activity against 2024. It is not a 2026 figure, despite being widely quoted as “attacks rose 89% in 2026.” The report is named for its publication year, not its data year.

CrowdStrike’s accompanying findings matter for calibration:

• Average eCrime breakout time fell to 29 minutes, with the fastest observed at 27 seconds
• 82% of detections in 2025 involved no malware at all
• More than 90 organisations had legitimate GenAI tools exploited to generate malicious commands
• ChatGPT was mentioned in criminal forums 550% more than any other model

One nuance the headline hides: researchers noted attackers mostly use AI to optimize existing methods rather than invent novel attack vectors. Better phishing, faster reconnaissance, quicker credential dumping.

That is not reassuring. It means the growth is in throughput, and throughput is exactly what compounds.

---

Why AI Agent Security Fails as a Stock-Versus-Flow Problem

Here is the conceptual core, and the reason pairing these numbers is worth doing.

Governance coverage is a stock. It is a level — a percentage of your estate that has passed review at a point in time. Stocks change when you add to them.

Adversary capability is a flow. It is a rate of change — 89% growth per year. Flows compound.

A fixed stock cannot keep pace with a compounding flow. For governance to hold its relative position against adversary capability, review coverage must grow at the same rate the threat does.

Almost no security organisation doubles its review throughput annually. Headcount does not grow that way, and neither do review queues.

This is why “we’re improving our AI agent security posture” can be true and irrelevant at the same time. Improving linearly against something compounding means falling behind while the absolute numbers move in the right direction.

---

The Agent Exposure Gap: An AI Agent Security Model

The model takes three published inputs and produces four derived metrics. Every input is sourced; nothing is invented.

Input 1 — Governance coverage (stock). 47.1% of agents actively monitored or secured. Complement: 52.9% unmonitored surface.

Input 2 — Adversary growth (flow). 89% year-over-year growth in AI-enabled adversary operations.

Input 3 — Control effectiveness (lever). Incident rate of 76% for over-privileged AI versus 17% under least privilege, from Teleport’s survey of 205 CISOs, security architects and platform leaders.

The derived metrics follow.

Metric	Value	Derivation
Organisational exposure ratio	5.9 : 1	85.6 ÷ 14.4
Adversary doubling time	~13 months	ln(2) ÷ ln(1.89)
Coverage runway to universal sign-off	~3.3 years	3 doublings from 14.4%
Blended incident expectation	~48%	(0.471 × 0.17) + (0.529 × 0.76)

---

Running the AI Agent Security Numbers

Take each in turn.

The 5.9 : 1 exposure ratio. For every organisation with universal security sign-off on its agents, roughly six have at least one agent in production that skipped review. That is the cleanest single expression of the governance gap.

The 13-month doubling time. Sustained 89% annual growth doubles capability every 1.09 years. If your security review capacity is flat, your relative coverage halves in just over a year — even with zero new agent deployments.

The 3.3-year coverage runway. Moving from 14.4% universal sign-off to full coverage takes roughly three doublings. If an organisation doubled its review throughput every year — an aggressive assumption almost nobody meets — it would still take until 2029 to close the gap. Adversary capability doubles slightly faster over the same period.

The 48% blended incident expectation. Weighting monitored and unmonitored agent populations by their respective incident rates yields an expected portfolio incident rate near 48%.

That last figure is where the model gets interesting, because the observed rate is 88%.

---

Where This AI Agent Security Model Breaks Down

A model that only confirms its own inputs is not worth publishing. Here is where this one fails, stated plainly.

The model under-predicts by roughly 40 percentage points. It expects 48% and the field reports 88%. Three explanations are plausible, and they are not mutually exclusive.

First, the 88% figure covers confirmed or suspected incidents. Suspicion inflates counts in ways confirmed data does not.

Second, monitoring is not the same as least privilege. The model treats monitored agents as if they enjoy least-privilege protection, which overstates their safety. An agent can be fully logged and still wildly over-permissioned — and 70% of organisations grant AI systems more access than a human in the same role.

Third, the two surveys measure different populations at different times and were never designed to be combined.

Other limitations worth stating. All three inputs are vendor-published research, and each vendor sells a product in the category it measured. The 89% growth rate may not persist; extrapolating it three years is a projection, not a forecast. And organizational counts do not translate cleanly into agent counts.

The model is a lens for thinking about direction and magnitude. It is not an actuarial instrument, and anyone presenting it as one is overselling it.

---

What AI Agent Security Incidents Look Like in Practice

Abstractions get argued with. Mechanisms get fixed. Here is what the growth figure looks like operationally.

CrowdStrike documented Russia-nexus FANCY BEAR deploying LLM-enabled malware to automate reconnaissance and document collection. The eCrime actor PUNK SPIDER used AI-generated scripts to accelerate credential dumping and erase forensic evidence. DPRK-nexus FAMOUS CHOLLIMA built entire fake companies — AI-generated websites, GitHub accounts, email infrastructure — to support insider-threat operations.

None of that is a novel attack class. All of it is existing tradecraft running faster and cheaper.

Two patterns deserve specific attention from anyone running agents.

AI infrastructure is now a target, not just a tool. More than 90 organisations had legitimate GenAI tools exploited to generate malicious commands. AI supply-chain compromise ranked as the second most common MITRE ATLAS technique for initial access. LLMjacking — stealing corporate credentials to access frontier-model APIs — and cost harvesting, where attackers deliberately inflate a victim’s AI bill, are both established techniques.

Speed has collapsed the response window. A 29-minute average breakout time means the gap between initial access and lateral movement is shorter than most escalation procedures. The fastest observed was 27 seconds. Any AI agent security control that depends on a human noticing something and responding within the hour is already too slow for the median case.

The 82% malware-free detection rate closes the loop. Attackers are logging in with valid credentials rather than breaking in with tooling. That is precisely the surface an over-permissioned agent expands.

---

The One AI Agent Security Control That Moves the Needle

Strip away the modeling and one finding does most of the work.

Teleport’s research found that access scope — not model sophistication, not industry, not organizational maturity, not stated confidence — was the strongest predictor of security outcomes. Over-privileged AI deployments reported a 76% incident rate. Least-privilege deployments reported 17%.

That is a 4.5x difference driven by a single architectural decision.

The supporting detail explains the mechanism. 67% of organisations still rely on static credentials, which correlate with higher incident rates. Only 3% have automated controls governing AI behavior at machine speed. And 43% report that AI makes autonomous infrastructure changes at least monthly, while 7% do not know how often it happens.

For readers mapping this against the wider exposure surface, our breakdown of the five hidden layers of the AI attack surface covers where these permissions actually get exercised. The distinction between systems that act and systems that merely generate is set out in agentic AI versus generative AI, and it is the distinction that makes access scope decisive.

---

Why Executive Confidence Makes AI Agent Security Worse

The most uncomfortable data point in either survey is not a gap in controls. It is a gap in perception.

82% of executives report confidence that existing policies protect against unauthorized agent actions. Meanwhile 14.4% of organisations have universal sign-off, 47.1% of agents are monitored, and 88% have already had an incident.

Teleport found something sharper still: organisations most confident in their AI deployments experienced more than double the incident rate of less confident peers.

Confidence is inversely correlated with safety here. The plausible mechanism is that confidence reduces scrutiny, and reduced scrutiny is precisely what lets agents ship without review.

The related finding — 81% of security leaders feel pressure to deploy agents quickly even when security is not fully in place — completes the picture. Executives believe policy is protective. Security leaders know it is not and ship anyway.

Policy documentation and runtime enforcement are not the same thing, and this is the measurable cost of confusing them. Structured human-in-the-loop checkpoints remain the practical answer where automated enforcement has not caught up.

---

Applying the AI Agent Security Model to Your Deployment

You can run this on your own estate in an afternoon. Four numbers.

Count your agents. Not approved agents — all of them, including those a team stood up without telling anyone. The discovery step is where most organisations find the problem.

Calculate your monitored share. What percentage has logging, an audit trail, and a named owner? That is your governance stock.

Calculate your least-privilege share. What percentage operates with the minimum permissions required for its task? If an agent can read files and make outbound HTTP requests when its job is summarizing tickets, it counts as over-privileged.

Blend the two. Apply 17% to your least-privilege population and 76% to the rest. That is your expected incident rate. Compare it to what you have actually seen. A gap in either direction tells you something: too low means you are not detecting incidents, too high means your permission scoping is worse than your inventory suggests.

Then ask the question that matters more than any of these figures: can you terminate a misbehaving agent mid-action? Research indicates 60% of organisations cannot, and 33% lack audit trails entirely.

Detection without intervention capability is documentation of problems you cannot stop.

---

Primary sources:

• Gravitee — State of AI Agent Security 2026
• CrowdStrike — 2026 Global Threat Report
• Teleport — 2026 State of AI in Enterprise Infrastructure Security
• OWASP — Top 10 for LLM Applications

---

Frequently Asked Questions

---

Keep reading

Here are the latest posts from the blog.