Illumio survey finds 70% delegate once-human decisions to AI, but only 49% can audit every agent action

Organizations are giving AI authority that recently belonged to people, without matching it with full oversight. In research published October 21, Illumio said 70% of surveyed organizations delegate decisions or actions that required human approval a year earlier. Only 49% said they could see and audit every action an AI agent takes.

Sapio Research conducted the study for Illumio, a breach-containment vendor, surveying 1,100 IT and security decision-makers across 10 markets. The figures are unweighted global averages: the U.S. supplied 200 respondents, while each of the other nine markets supplied 100. The findings describe respondents’ accounts of AI use and security, rather than measurements from an independent audit of their systems.

An agent can act with the access it already has

The technical distinction is between an assistant that offers advice and an agent that carries out work. An agent can call other systems, change configurations and complete tasks through multiple steps. Unlike an outside attacker that must first break in, an organization’s own AI may already hold the credentials and connections needed to reach sensitive data.

That makes the boundary around its access important. Instructions built into an AI system depend on the system following them. An externally enforced allow-list instead specifies the systems, data and actions the agent may use. The distinction is between asking an agent to stay within limits and enforcing those limits outside the agent itself.

The survey found a mismatch between that principle and organizations’ priorities. While 69% agreed that limiting AI’s access matters more than predicting every threat, just 25% named explicitly defined permitted actions among their two main AI controls. Separately, 62% said they had deployed AI tools before putting appropriate safeguards in place.

The biggest AI risk may not be a system that breaks its rules. It may be one that was never given meaningful limits in the first place.

Raghu Nandakumara, VP of Industry Strategy at Illumio

Warning signs are not all completed breaches

Overall, 76% reported at least one AI-related security issue or warning sign during the previous 12 months. That category includes recommendations that could have caused trouble, not just actions that happened: 35% said AI made a recommendation that would have created a security risk if followed.

Other responses concerned actions already taken. Some 26% said an AI agent or tool connected to systems without security approval. Another 24% said AI accessed data it should not have reached, and the same proportion reported AI producing or triggering an unauthorized action. These are separate reported categories, not a count of distinct breaches.

Confidence in visibility also depended on the question. Help Net Security reported that 84% claimed visibility into how AI accesses data and systems—a much broader measure than tracing every agent action. Meanwhile, 56% said they were willing to accept more cyber risk than a year earlier. Within that group, 47% permitted autonomous AI actions in production environments.

Security teams are delegating, too

The authority extends into security work itself. Illumio said 67% of organizations use AI in cybersecurity operations. Asked about unsupervised work, 32% were comfortable letting AI run security investigations, 29% with deploying code changes, and 26% with granting or revoking access permissions. Those figures measure willingness, not confirmation that each activity is already happening.

For teams already running agents, Nandakumara recommended a targeted start rather than waiting for a complete inventory. His advice to Help Net Security was to:

• Start with an agent that can reach data the organization cannot afford to lose.
• Write down the three or four things it needs to do, then restrict its actions, systems and data accordingly.
• Name the business leader who owns the outcome, while security owns access limits and the ability to stop the agent.