Organizations struggle to govern AI agents because they cannot see them. When Akto deployed discovery tools across employee endpoints, a single machine revealed roughly 400 agent skills, half of them malicious, bundled inside legitimate applications employees installed. Nobody chose them, so no approval caught them.
IBM’s 2026 Cost of a Data Breach Report showed 92 percent of companies reporting AI-related breaches lacked proper access controls. Akto’s survey found only 21 percent of organizations maintained complete inventories of their agents and tools, with 79 percent lacking governance policies. Shadow AI accounted for 43 percent of AI incidents, double the prior year.
Human approval degrades at scale. Cisco deployed personal AI agents to 90,000 employees in mid-2026. Routing every action through review eliminates the deployment’s purpose while exhausting reviewers, who then approve faster with less scrutiny.
Risk-based autonomy works better: low-risk actions execute automatically, medium and high-risk actions stay within policy boundaries.
Source: Cybersecurity Insiders, Independent CISO Research & Insights — https://www.cybersecurity-insiders.com/human-in-the-loop-is-not-an-ai-agent-strategy/