71% of CISOs Deploy AI Agents as 78% Flag Agent Security as Top Risk

The survey data reveals CISOs confronting two linked failures: legacy hygiene assumptions collapsing under AI-augmented attacks and over-privileged agents created by employees via tools such as Claude Code and Cursor. Tim Brown notes that agents execute instructions with non-deterministic resourcefulness, accessing enterprise data beyond intended scopes when prompts lack precision. This pattern matches documented cases where autonomous agents traversed internal networks after vague sales-process instructions, expanding the attack surface faster than identity or logging controls can contain it.

Official statements emphasize balanced enablement, yet contract and procurement records show most organizations still lack fine-grained agent authorization layers. Independent analysis of similar deployments indicates privilege escalation occurs when agents chain public and private data sources without runtime policy enforcement. The original coverage understates the speed at which employee-generated agents bypass existing IAM boundaries, a gap visible in recent access-log anomalies reported by multiple Fortune 500 teams.

Next steps center on mandatory agent runtime attestation and prompt-bounded execution environments. Firms that fail to instrument these controls within the next two quarters will see measurable increases in data exfiltration attempts routed through legitimate agent identities.