Enterprise AI Adoption is Outpacing Security Controls

Key Takeaways:

• In Neo's October 2026 survey of 50 CISOs and CIOs, 86% have AI in production and one in five run more than 500 agents.
• Discovery is the capability their tools perform best, but only 55% can prevent sensitive data from leaving through AI.
• Closing the gap means enforcing policy where the agent acts, with a record of who acted.

AI is in production at most enterprises, and the controls around it were built for the pilot phase. In Neo's October 2026 survey, performed by Hedosophia, of 50 chief information security officers (CISOs) and chief information officers (CIOs) at US organizations with 500 or more employees, 86% said AI is in production beyond the Big 3 general-purpose chatbots (Claude, ChatGPT, and Gemini). That AI usage varied with 86% using third party agentic apps, 78% using custom agents, and 66% using AI for coding assistance. Figure 1 below shows the various usage.

While about half of respondents indicated that they’re using between one and 50 AI agents, 20% have more than 500 agents in production today.

Despite wide adoption, security controls have gaps

When asked how their current AI security tooling performs, gaps with agent governance emerged. Discovery of shadow AI apps, models, and agents was the capability most often rated as working well, at 60%, followed by preventing sensitive data from leaving through AI at 55%. From there the numbers fall quickly, as only 23% said their tools can stop a misbehaving agent mid-action, and 11% said they can detect drift from an agent's approved behavior.

Why the AI security gap can't wait

The shape of breaches changed in 2026. In IBM's Cost of a Data Breach report for 2026, covering 602 breached organizations, 92% of those with an AI-related incident lacked proper AI access controls. Incidents involving shadow AI more than doubled to 43%, and the mean time to identify and contain a breach rose to 247 days. Most of the organizations in the study had no AI governance policy at all, and the ones that did still had no control at the point where AI touched data.

The distance between policy and practice has widened as well. In EY's September 2026 survey of senior AI decision-makers at large US public companies, 26% of respondents admitted that their organization cannot detect unauthorized AI agents operating internally. This lack of visibility was especially concerning considering 36% had suffered an AI incident or failure with a material negative impact on their organization, from data loss and financial harm to brand damage and operational disruption.

The cost of the gap is also being priced. In August 2026, Reuters reported that cyber insurers are reviewing and adapting policy language because agents can cause losses without triggering a traditional security event. The Center for Strategic and International Studies, citing The Information, adds that state insurance commissioners have approved more than 80% of carrier requests to exclude AI-related damages. The same analysis notes that carriers can't see how an insured's AI systems are governed or whether the claimed controls exist. An organization with a policy and no enforcement record has little to show an underwriter.

ISACA's Cybersecurity Recommendations for Securing AI Agents states, “Organizations should establish clear governance and ownership, apply strong identity and least-privilege controls, isolate execution environments, protect sensitive data and memory, enforce policies before actions occur, monitor agent behavior continuously, and maintain resilience mechanisms.”

How Neo controls AI across your company

Most organizations in our survey can find their AI but far fewer can stop it. Neo is built not only for discovering agents operating in an environment but also for knowing what each agent can do, whether humans or agents originate any action, and enforcing policy when the agent acts. Each decision leaves a record that will satisfy an auditor or an underwriter.

Neo gives security teams four capabilities that work together:

• Discover: Continuously inventory agents, plugins, MCP servers, extensions, models, and enterprise software across all endpoints, including shadow AI that never went through procurement. Inventory is where governance starts, not where it ends.
• Assess: Map each agent’s capabilities, permissions, configurations, identities, and attack paths, so risk is judged in the context of the actor. An agent holding a production database credential and a write-capable MCP server carries a different risk than a read-only coding assistant, even when both are approved.
• Attribute: Resolve the human, agent, application, endpoint, and intent behind every tool call, file access, API request, and data movement. Sometimes an approved agent uses approved credentials to take an unapproved action. Attribution is what makes that visible and ties it to an accountable owner.
• Enforce: Allow, block, redirect, or require verified human approval at the point where software acts, inside the agent’s tool calls rather than at the network edge. Every decision is preserved as evidence.

What this changes for security teams

• Stopping an agent mid-action: Only 23% of respondents can do this today. With enforcement at the tool call, a risky action is blocked or held for approval before it runs, not flagged after the damage is done.
• Keeping sensitive data in: Policy applies to what the agent does, so data protection follows the actor. It doesn’t depend on traffic passing through a proxy or DLP checkpoint.
• Proving control exists: Each enforcement decision is recorded with who acted, through which agent, and why it was allowed or stopped. Security, audit, and insurance carriers get evidence that controls exist and work, not just a written policy.

Get a demo and see the gap between discovery and control measured on your own endpoints.

FAQs

What does an AI governance policy need to say about agents?

Most AI policies written before agents cover data handling and acceptable use, and stop there. An agent policy also has to name the actions an agent may take on its own and the ones that need a person's approval. It has to say which credentials an agent may hold, who is accountable for each agent, and how it is stopped. A policy that doesn't answer those questions can be followed to the letter while an agent deletes a database.

Why can't existing security tools stop a misbehaving AI agent?

Most security tools were built to inspect traffic, files, or processes, and an agent's decisions happen inside an application those tools weren't designed to see. A proxy sees requests that pass through it, a data loss prevention tool sees content leaving the network, and an endpoint detection tool looks for malicious software. An approved agent using approved credentials to take an unapproved action looks normal to all of them. A control that can tell the difference has to sit inside the agent's own tool calls.

What should a CISO ask before approving an AI agent for production?

A short set of questions covers most of the risk. Ask what the agent can reach, including credentials, files, and connected systems, and which of its actions require a person's approval and where that approval is enforced. Ask how its actions are attributed to the human and the agent behind them, and how the team would stop it mid-task and whether that has been tested. An agent that can't be described in those terms is one the organization can see but not govern.