Survey: 78% of Enterprises Have Pulled Permissions from an AI Agent Already in Production
The Frontegg survey of 300 CISOs also found 49% discovered production agents with access they should never have had.
A survey of 300 CISOs and security leaders by Frontegg and Agen.co, fielded 24-27 September 2026 by Cint, found 78% of enterprises have revoked permissions from an AI agent already running in production. 49% discovered production agents holding access they should never have had, only 37% restrict agent access to specific tasks, and 53% run agents on shared or long-lived credentials, a group reporting a 60% incident rate versus 46% for those that do not. Only 18% verify agent identity before it acts, and 40% have seen agents operating on employees' personal credentials, leaving audit trails unable to distinguish human from agent.
The findings arrive alongside a Microsoft security blog guiding CISOs on governed agent identity and deep observability, and theCUBE Research interviews in which none of 19 organisations with production agents allowed high-risk actions without human involvement, yet only 4 of 25 had tested agent incident scenarios and 11 of 25 admitted gaps in reconstructing agent actions across systems. Together they depict an industry adopting agents faster than it is governing them. The survey was commissioned by a security vendor.