New global research for Illumio has found that 70% of organizations delegate human decisions to AI, but 49% cannot fully audit what it does. The result is that AI is emerging as a new kind of insider risk, using legitimate access to make decisions, reach sensitive data, and take actions that organizations cannot see or control.
Published in the report ‘Licensed to Act: How AI Autonomy Is Outrunning the Limits Placed on It’, the research finds that this is no longer a theoretical risk. More than three-quarters of organizations (76%) experienced at least one AI-related security issue or warning sign in the past 12 months. While much of the AI security debate has focused on how attackers might use the technology, the findings also reveal risks emerging from organizations’ own AI systems as they gain access to enterprise applications, data, and infrastructure.
More than a third of organizations (35%) say AI made a recommendation that would have created a security risk if followed, and 26% have had an AI agent or tool connect to systems without security approval. 24% say that AI accessed data it should not have reached, while the same proportion report that AI produced or triggered an unauthorised action. Unlike an external attacker that must first break into an environment, an organization’s own AI may already have the credentials and connectivity needed to reach critical systems and data.
The stakes are particularly high as AI gains authority within the security function itself. 67% of organizations use AI within cyber security operations, while 32% are comfortable letting AI run security investigations without human review. 29% are comfortable allowing AI to deploy code changes unsupervised and 26% say the same about granting or revoking access permissions.
Other key findings include:
- Organizations are accepting more risk to unlock AI value: more than half of organizations (56%) say they are willing to accept more cyber risk than they were 12 months ago. Among that group, over half permit autonomous AI actions in non-production environments and 47% permit them in production environments.
- Enforceable limits remain lower security priorities: 82% say AI agents require fundamentally different security controls than traditional software and 69% agree that limiting what AI can access matters more than predicting every threat. But the controls that define and enforce those limits remain lower priorities: only 25% name explicitly defined permitted actions as one of their two main controls and just 27% say frontier AI has made network segmentation or microsegmentation more important.
As AI moves from an adviser that recommends actions to an operator given growing authority to take them, the research points to one practical response: limit what AI can reach by using zero trust techniques, rather than trying to predict everything it might do.
The biggest AI risk may not be a system that breaks its rules. It may be one that was never given meaningful limits in the first place. AI agents are highly persistent in pursuing a goal, so trying to anticipate every action is a losing battle. Businesses must set strict limits on what they can access and do, then enforce those limits within the application and across the underlying infrastructure. That is how you contain unexpected behaviour before it causes real damage.
Raghu Nandakumara, VP of industry strategy at Illumio
Research methodology
Sapio Research conducted this study on behalf of Illumio, surveying 1,100 IT and security decision-makers across 10 markets: the US (n=200) and the UK, France, Germany/Switzerland/Austria (DACH), the Middle East (UAE and Saudi Arabia), Japan, Australia, Singapore, Brazil, and Mexico (n=100 each). Figures cited are unweighted global averages.
Resilience Forward comment
For resilience professionals, this research highlights a profound operational paradox. Defending against machine-speed cyber attacks increasingly requires autonomous AI response within security operations; yet granting AI unsupervised authority to alter access permissions or deploy code introduces a severe single point of failure. An overzealous containment action taken by an AI agent can instantly sever critical dependencies and breach impact tolerances. Since human-in-the-loop assurance cannot operate at machine speed during a live incident, resilience teams should consider how to build that assurance beforehand. Actions might include defining strict architectural blast-radius limits and pre-authorised containment guardrails that protect essential business services before an AI agent acts.
