WCRC Intelligence
Boards are deploying AI faster than they can secure it
Two surveys published in early October point to the same governance gap. AI agents are already in production across most large organisations, while the controls built to manage them lag far behind.
At a glance: PwC's 2027 Global Digital Trust Insights Survey of 3,934 executives, published on 1 October 2026, found that 50% of security leaders rank attacks on AI systems among the threats they are least prepared for. SailPoint's Horizons of Identity Security report, published on 6 October and based on 340 leaders, found that 79% of organisations run AI agents in production but only 2% use identity security built for agents. For boards, AI risk is now an operational question, not a future one.
The adoption side: agents are already at work
SailPoint, an identity security company, surveyed 340 senior leaders in identity, IT, cybersecurity and risk worldwide for the fifth edition of its Horizons of Identity Security report. Its headline finding is that 79% of organisations already run AI agents in production. AI agents now make up 22% of the non-human accounts in their systems.
This is vendor research from a company that sells identity security, with a modest sample. Its findings should be read as directional. They are still useful because they describe a specific control gap that larger surveys tend to treat in general terms.
The control side: a 40-to-1 gap
Against the 79% running agents, SailPoint found just 2% have deployed identity security tools built specifically for AI agents, a gap the company puts at 40 to 1. Some 85% still rely on identity tools not designed for agentic identities.
Confidence runs ahead of capability. SailPoint reports that 87% of respondents rate their human identity and access management as capable or better, but only 43% report mature processes for agent access. Some 80% describe their tooling gap as moderate or smaller, yet only 15% can provision non-human access in real time. And while 57% are confident they can meet regulatory requirements, only 43% feel ready to produce verifiable evidence in an AI-related audit.
"You cannot bridge this gap by asking human-speed tools to work faster," said Wendy Wu, Chief Marketing Officer at SailPoint.
| Finding | Figure | Source |
|---|---|---|
| Organisations running AI agents in production | 79% | SailPoint (340 leaders) |
| Using identity security built for AI agents | 2% | SailPoint |
| Mature processes for agent access | 43% | SailPoint |
| Ready to evidence controls in an AI-related audit | 43% | SailPoint |
| Security leaders least prepared for attacks on AI systems | 50% | PwC (3,934 executives) |
| Expect cyber budgets to rise | 84% | PwC |
| Cyber risk a standing board agenda item (strongly agree) | 47% | PwC |
| Would authorise fully autonomous AI agents for cyber defence | 22% | PwC |
The threat side: what leaders feel least ready for
PwC's 2027 Global Digital Trust Insights Survey is far larger, covering 3,934 business and technology executives in 71 countries and territories. It finds that 50% of security leaders name attacks targeting AI systems among the threats they are least prepared to address. That puts AI-system attacks ahead of cloud-related threats (40%), third-party breaches (34%) and ransomware (33%).
Asked which AI-enabled attacks they are least prepared for, respondents cited compromise by autonomous botnets (53%), adversarial attacks (52%) and data poisoning (52%).
Money is moving. PwC reports that 84% of security and finance leaders expect cyber budgets to rise, up from 78% a year earlier, and 58% of security leaders rank AI among their top cyber budget priorities. "AI is changing both sides of the cyber equation," said Avinash Rajeev, Global Cyber, Data and Tech Risk Leader at PwC US.
The board side: oversight still catching up
PwC's governance findings are the most direct message for directors. Only 47% strongly agree that cyber risk is a standing item on the board agenda. Companies have implemented an average of three of seven key data-risk measures, and only 5% have implemented all seven, down from 7% last year. A third of CEOs and security and risk leaders say they have dedicated AI roles, such as a chief AI officer or AI board. Just 39% have a fully formalised, integrated continuity plan that addresses cyber risk.
Leaders are also cautious about handing AI the controls in their own defences. Only 22% would authorise fully autonomous AI agents for cyber defence. The main barriers they cite are the reliability and maturity of the technology, and accountability and explainability.
WCRC analysis: read together, the two surveys show an inconsistency in how organisations treat AI autonomy. They are reluctant to let AI agents act alone in security, yet most are already letting agents act in business systems with identity controls designed for people. That is the gap boards should close first.
A governance read for boards
WCRC analysis: the evidence supports four board-level questions.
- How many AI agents do we run, and who owns each one? If management cannot answer, the identity gap SailPoint describes is likely present.
- What can each agent access? Agents with human-style permissions inherit human-style risk at machine speed.
- Could we evidence our AI controls to a regulator tomorrow? SailPoint's finding that only 43% feel ready suggests most could not.
- Is AI risk on the standing agenda, or raised only after incidents? PwC's data suggests fewer than half of boards treat cyber risk as standing business.
What it means for leaders
- Inventory agents as identities. Every AI agent should have a named owner, defined permissions and a record of its access, just as an employee does.
- Fund agent-specific controls. With cyber budgets rising at 84% of companies, make sure part of the increase targets AI agents, not only traditional threats.
- Prepare audit evidence now. Only 43% of SailPoint's respondents feel ready to evidence controls in an AI-related audit. Build logs and documentation before you are asked for them.
- Put AI risk on the standing board agenda. Quarterly review of AI deployments and incidents should be routine.
- Treat vendor surveys with care. Use them to spot specific gaps, then validate against your own systems before acting.
Quick answers
Q: How many organisations run AI agents in production? A: SailPoint's Horizons of Identity Security report (October 2026), a survey of 340 identity, IT, security and risk leaders, found that 79% run AI agents in production, while only 2% use identity security built for agents.
Q: Are companies prepared for attacks on AI systems? A: PwC's 2027 Global Digital Trust Insights Survey found that 50% of security leaders rank attacks targeting AI systems among the threats they are least prepared to address.
Q: Are cyber budgets increasing? A: Yes. PwC reports that 84% of security and finance leaders expect cyber budgets to increase, up from 78% the previous year.
Filed under