Abnormal AI survey finds nearly half struggle to define normal AI-agent behavior

Security teams are preparing to spend more on watching AI agents, even as many struggle to describe what safe, ordinary activity should look like. In Abnormal AI’s 2026 State of Behavioral Security Report, 46% of respondents rated their organizations not at all effective at establishing and maintaining baselines for normal AI-agent behavior.

Abnormal published the findings on November 5. AimPoint Group conducted the survey on its behalf between July and August 2026, collecting responses from 525 cybersecurity professionals across six countries. All represented organizations with at least 1,000 employees. The research also included four in-depth interviews with chief information security officers, or CISOs.

About 85% of respondents held CISO-level or security operations leadership roles. These are their assessments of readiness, not an independent test of their systems. Abnormal AI sells a behavioral-analysis platform, giving the research a commercial connection to the monitoring approach it examines.

Agents disrupt a familiar security assumption

Behavioral monitoring uses patterns of activity to identify events that deserve investigation. That requires a baseline: a picture of what an identity normally does. Abnormal draws a distinction between a machine identity, which supplies credentials for access, and an AI agent, which decides what to do with that access. An agent can pursue a goal, choose steps and change its behavior when given another tool.

Short-lived agents make that harder to reconstruct. One CISO interviewed for the research described the difficulty of auditing AI activity that lasted just 30 seconds on a virtual machine. The report distinguishes durable agents, which can be tied to a user or service identity, from temporary sub-agents created for a single task and gone almost immediately.

54%Maintain AI-agent baselines

Respondents said their organizations already maintained behavioral baselines for AI agents.

46%Not at all effective

A separate effectiveness measure asked respondents how well their organizations established and maintained those baselines. These figures do not describe two opposing groups.

Investment runs ahead of answers

AI agents nevertheless led planned spending: 43% of respondents chose them as the area receiving their greatest behavioral-monitoring investment over the next two years. That was more than three times the share choosing API integrations, the next most common answer. Those integrations connect applications so they can exchange data.

One CISO at a business-to-business software organization described committing resources without knowing which solutions would work. The spending is not starting from zero: 81% of surveyed professionals said their organizations already relied on behavioral anomaly detection to a major or extensive degree. The challenge is extending that approach to less predictable actors.

An alert still needs an explanation

Respondents most often identified false positives and difficulty defining normal activity as obstacles to wider behavioral baselining. A healthcare CISO illustrated the problem with physicians who access systems several times in three months, then disappear for six. Treating their return as suspicious creates work without identifying misconduct: the unusual-looking pattern can be routine for that job.

Investigations can be slow. In the survey, 51% said fully investigating and fixing a single behavioral detection typically took four hours or more; one in ten needed at least a full day. That measure covers behavioral anomalies generally, not just AI-agent activity. It should not be read as an agent-specific response time.

For 90% of respondents, understanding why an alert fired was very or critically important to the response. Abnormal says investigators often spend time rebuilding context: which identity acted, what it usually does and whether its permissions changed. For agents, the report frames the next step as answering three distinct questions:

• Is the agent authorized to operate?
• Does it have permission to take this particular action?
• Does the action fit its assignment, goal and the person it is working for? Permission alone does not answer that question.