87% say their AI controls need to work better
The AI running inside large companies has stopped waiting for permission.
The AI running inside large companies has stopped waiting for permission.
Across five categories of AI, from chatbots to process automation, more than half of 3,600 business decision-makers say the systems their teams use can act within defined rules without routine review, or finish whole processes with no human approval.
87% of those same respondents say their organization needs a better way to approve, monitor and control how AI gets used.
These are managers reporting on their own teams, so the figures capture what they believe is running.
Among those that have deployed or scaled AI at speed, 46% report security, privacy, regulatory or compliance problems and 25% report loss of visibility, control or agent permissions.
Every respondent came from a company with more than $500 million in annual revenue, spread across seven sectors including financial services, healthcare, manufacturing and retail.
The problem is that most organizations are using AI to improve a business model that AI should be replacing, said Chris Howarth , CEO at Avanade.
The second figure matters most, because an agent whose permissions a team cannot account for is unmanaged access to whatever that agent touches.
But what is the way forward, blocking access doesn’t work.
Developers , automated tools and AI coding agents hold permissions that can outlast the work they were granted for; developers, contractors, service accounts, bots and AI coding agents use these systems with permissions that require ongoing oversight.
Permissions granted for a contract or assignment may remain after the work ends.
45% believe their people use AI output without checking its accuracy or suitability, 32% believe AI is being used in ways their compliance team would not approve of, and 31% report unapproved tools in use .
Strong governance, access controls and responsible use rank among the highest priorities for 45% of respondents, well ahead of the 26% who name deploying AI as quickly as possible.
87% say AI initiatives need faster authorization to stay competitive, and 91% of that same group say the approach to approving, monitoring and controlling AI needs to be more effective.
What happened
The AI running inside large companies has stopped waiting for permission.
Across five categories of AI, from chatbots to process automation, more than half of 3,600 business decision-makers say the systems their teams use can act within defined rules without routine review, or finish whole processes with no human approval.
87% of those same respondents say their organization needs a better way to approve, monitor and control how AI gets used.
What changed
These are managers reporting on their own teams, so the figures capture what they believe is running.
Among those that have deployed or scaled AI at speed, 46% report security, privacy, regulatory or compliance problems and 25% report loss of visibility, control or agent permissions.
Who is affected
Every respondent came from a company with more than $500 million in annual revenue, spread across seven sectors including financial services, healthcare, manufacturing and retail.
The problem is that most organizations are using AI to improve a business model that AI should be replacing, said Chris Howarth , CEO at Avanade.
Why it matters
The second figure matters most, because an agent whose permissions a team cannot account for is unmanaged access to whatever that agent touches.
But what is the way forward, blocking access doesn’t work.
Technical details
Developers , automated tools and AI coding agents hold permissions that can outlast the work they were granted for; developers, contractors, service accounts, bots and AI coding agents use these systems with permissions that require ongoing oversight.
Permissions granted for a contract or assignment may remain after the work ends.
Response
45% believe their people use AI output without checking its accuracy or suitability, 32% believe AI is being used in ways their compliance team would not approve of, and 31% report unapproved tools in use .
Strong governance, access controls and responsible use rank among the highest priorities for 45% of respondents, well ahead of the 26% who name deploying AI as quickly as possible.
What security teams should do
87% say AI initiatives need faster authorization to stay competitive, and 91% of that same group say the approach to approving, monitoring and controlling AI needs to be more effective.
Among companies between $500 million and $5 billion in revenue, 90% say a better approach to approval, monitoring and control is needed, against 70% of companies above $5 billion.
Attribution
Help Net Security: The AI running inside large companies has stopped waiting for permission.
Help Net Security: Developers , automated tools and AI coding agents hold permissions that can outlast the work they were granted for.
Help Net Security: Cyberhaven has introduced Agentic Data Security (ADS), to help CISOs, data security teams, insider risk teams, and AI governance leaders say yes to AI agents without losing control of their data.
Help Net Security: Rubrik has announced Rubrik-Hosted Protection for On-Premise Unstructured Data.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.