Illumio Inc. survey finds gaps in auditing AI agent actions
6th article in the last 90 days, one of 36 articles referencing Illumio. Previous coverage: Illumio releases John Kindervag’s “Cyber Resilience at Machine Speed” book (Oct 2026).
Companies mentioned
Best suited for
- Seniority
- Director
- Job function
- Cybersecurity / Information Security
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Decision stage
- How to start
- Adoption curve
- Early Majority
- Technology maturity
- Accelerated Attention
- Industry
- Information Technology / Cybersecurity / Application, Cloud & AI Security / AI Security & LLM/Model Security
Our classification, not the publisher's statement. Best suited for, not only for.
Illumio Inc., a breach containment company, published global research indicating that AI is emerging as a new form of insider risk. Because AI systems operate using legitimate access, they can make decisions, reach sensitive data, and take actions that organizations cannot always see or control. The findings come from a survey of 1,100 IT and security decision-makers conducted by Sapio Research.
Seventy percent of surveyed organizations now delegate decisions and actions that required human approval a year ago, yet only 49% can see and audit every action an AI agent takes. The findings point to an emerging control gap between the authority organizations give AI and their ability to audit and constrain its actions.
More than three-quarters of organizations (76%) reported at least one AI-related security issue or warning sign in the past 12 months. The findings highlight risks from organizations' own AI as it gains access to enterprise applications, data, and infrastructure, not only from attackers. Unlike an external attacker, an organization's own AI may already hold the credentials and connectivity needed to reach critical systems and data.
Thirty-five percent said AI made a recommendation that would have created a security risk if followed, and 26% reported an AI agent or tool connecting to systems without security approval. Twenty-four percent said AI accessed data it should not have reached, and the same share reported an unauthorized action produced or triggered by AI.
AI is also gaining authority within the security function itself. Sixty-seven percent of organizations use AI in cybersecurity operations, and 32% are comfortable letting AI run security investigations without human review. Twenty-nine percent accept unsupervised AI code deployment, and 26% accept AI granting or revoking access permissions.
“The biggest AI risk may not be a system that breaks its rules. It may be one that was never given meaningful limits in the first place,” said Raghu Nandakumara, VP of Industry Strategy at Illumio. The research points to limiting what AI can reach through Zero Trust as the practical response, rather than trying to predict every action it might take.
Press release, provided by Globe Newswire on behalf of Illumio. Read the original.