A new EY survey of senior AI executives, reported by Dark Reading, confirms what many of us in incident response have been watching unfold in real time: organizations are deploying AI — including autonomous, agentic systems capable of taking actions without human approval — at a pace that their governance, security processes, and technical controls simply cannot match.
This is not a hypothetical risk. In the past 18 months, my team has responded to incidents where the initial access vector or the amplification mechanism was an AI system nobody in security knew existed: an unsanctioned copilot wired into a production data lake, an agent with broad API credentials and no logging, a developer's LLM integration that happily executed attacker-supplied instructions from a poisoned document. The EY data puts numbers behind that anecdote — the gap between implementation velocity and oversight maturity is now a primary enterprise risk surface.
For defenders, the takeaway is blunt: you cannot protect what you cannot see, and right now most security teams cannot see their organization's AI estate.
Technical Analysis: Why Autonomous AI Changes the Risk Equation
Traditional software executes deterministic logic written by developers. Autonomous AI systems are different in ways that break legacy control assumptions:
Non-deterministic execution paths. An agentic system decides at runtime which tools to call, which APIs to invoke, and what data to touch. Change management, code review, and static analysis — the backbone of software assurance — do not apply cleanly to a system whose behavior emerges from prompts, retrieved context, and model weights.
Privilege concentration. To be useful, autonomous agents are granted broad, persistent credentials: service accounts with read access to mailboxes, CRMs, code repositories, and SaaS platforms. A single compromised or manipulated agent inherits all of it. From an attacker's perspective, an over-privileged AI agent is a pre-built lateral movement platform.
Prompt injection as an attack vector. Whether direct (an attacker chatting with your customer-facing assistant) or indirect (malicious instructions embedded in a webpage, email, or document the agent ingests), prompt injection lets adversaries redirect agent behavior without touching your network perimeter. Indirect prompt injection is especially dangerous because the malicious content enters through legitimate data flows the agent was explicitly designed to consume.
Data egress through the model layer. Agents that summarize, retrieve, and transform data create new exfiltration channels that bypass DLP tuned for file transfers and email. Sensitive data can leave your environment embedded in an API response to an external model endpoint.
Invisibility to the SOC. Most SIEMs have no parser for agent tool-call logs. Most EDRs treat an LLM orchestration framework as just another Python process. Agent activity — which tools were invoked, what data was retrieved, what actions were taken — lives in application logs that rarely make it to the security stack. The EY findings on oversight lagging deployment translate operationally to: your SOC is blind to an entire execution layer.
Executive Takeaways
This is a governance-and-architecture problem before it is a signature-detection problem. These are the recommendations I give clients standing up AI oversight that actually works:
1. Build a real AI inventory — and hunt for the shadow estate. Survey-driven inventories fail because teams don't self-report. Discover AI usage technically: query CASB/proxy logs for traffic to model API endpoints (api.openai.com, *.anthropic.com, generativelanguage.googleapis.com, Azure OpenAI endpoints), scan for LLM framework dependencies in code repositories, review SaaS billing for AI subscriptions, and hunt for service accounts created by AI orchestration tools. Reconcile what you find against what was approved. Every unauthorized deployment is a finding, not a footnote.
2. Apply least privilege to agents the same way you do to humans. Every autonomous agent should run under its own dedicated, auditable identity — never a shared service account, never a developer's credentials. Scope API tokens to the minimum actions required, prefer short-lived credentials, and segment agent workloads from crown-jewel systems. If an agent only needs to read SharePoint, it should be technically incapable of writing to it.
3. Put a human approval gate on high-impact actions. Autonomy should be proportional to consequence. Reading, summarizing, and drafting can be autonomous. Sending external email, executing financial transactions, modifying production systems, or deleting data should require explicit human approval or a policy-engine check. The EY data suggests most organizations have skipped this tiering — fix that before an agent does something irreversible.
4. Log the agent layer and pipe it to your SIEM. Capture prompts (where privacy permits), tool invocations, retrieved data sources, and final actions from your AI orchestration frameworks. Forward these to the SIEM as a first-class log source. Build detection content for behavioral anomalies: an agent invoking tools outside its normal set, sudden spikes in data retrieval volume, tool calls to unfamiliar external endpoints, or activity from agent identities at unusual hours. You cannot detect prompt injection or agent compromise without this telemetry.
5. Add AI-specific scenarios to your IR playbooks and tabletop exercises. Your ransomware playbook does not cover an agent that exfiltrated customer records via a poisoned knowledge base. Define now: how do you revoke an agent's credentials and containment-scope its actions, how do you reconstruct its decision chain from logs, and who owns AI incidents — security, the AI platform team, or legal? Run at least one tabletop in 2026 built around indirect prompt injection leading to data egress.
6. Map governance to a framework before regulators do it for you. NIST's AI Risk Management Framework, ISO/IEC 42001, and the EU AI Act's obligations are converging on the same core requirements the EY survey finds lacking: documented accountability, risk classification of AI systems, continuous monitoring, and human oversight mechanisms. Adopting one framework now is far cheaper than retrofitting compliance after an incident or an enforcement action.
Remediation: Closing the Oversight Gap in 90 Days
Days 1–30 — Visibility: Stand up the technical AI discovery described above. Produce a single inventory of sanctioned and unsanctioned AI systems, their identities, permissions, and data access. Present the shadow AI findings to leadership with business context, not blame.
Days 31–60 — Control: Enforce dedicated agent identities with least-privilege scoping. Implement approval gates for high-impact actions. Block or proxy unsanctioned model endpoints at the egress layer while providing an approved, monitored alternative — outright blocking without an alternative just drives usage underground.
Days 61–90 — Detection and Response: Onboard agent telemetry to the SIEM, deploy initial behavioral detections, update IR playbooks, and run the first AI-incident tabletop. Establish a standing AI risk review — monthly at minimum — with security, platform, legal, and business owners at the table.
The EY survey is a warning shot, not a surprise. The organizations that treat autonomous AI as a governed, monitored, identity-bearing part of the enterprise will absorb the coming incidents. The ones that let deployment outrun oversight will be writing post-incident reports about systems they never knew they had.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.