Study Finds Gaps in Oversight of AI Security Actions

A study by Illumio says organizations are handing decisions once made by people to AI, including decisions involving user permissions and sensitive data. Its findings point to gaps between the limits organizations believe they have set for AI agents and what those agents can actually do.

According to the study, 70% of organizations delegate previously human-made decisions to AI, while 49% say they can see and audit an AI agent’s actions. It also found that 56% are willing to accept greater cyber risks than 12 months ago; 47% of that group permit AI actions in production environments.

Illumio reported that 76% of organizations experienced at least one AI-related security issue in the past year. In addition, 35% said following AI recommendations would create a security risk, 26% reported AI tools connecting to other systems without approval, and 24% said AI sought data it should not access. Another 24% reported an unauthorized action triggered or produced by AI.

Although 67% use AI cybersecurity tools, the study says 32% allow AI to conduct investigations without human oversight and 29% permit unsupervised code changes. Raghu Nandakumara, Illumio’s VP of Industry Strategy, said businesses should set and enforce limits on what AI agents can access and do. These findings are claims reported by Illumio’s study.