AI Autonomy Report Cover
Rising levels of AI autonomy are creating an operational control gap across global businesses, according to research published by breach containment firm Illumio. A study of 1,100 IT and security leaders revealed that 70% of organizations now delegate tasks that required human approval 12 months ago. However, only 49% of these enterprises can fully view and audit every action performed by an automated agent.
Evaluating AI Autonomy in Enterprise Operations
The study, titled Licensed to Act, found that corporate systems face internal exposure as autonomous software gains direct access to digital assets. Specifically, 76% of surveyed organizations experienced at least one security incident or warning sign tied to artificial intelligence over the past year. Furthermore, internal software tools frequently hold pre-existing access rights to critical databases across corporate networks.
Data risks have already emerged within daily workflows. About 35% of respondents noted that an automated system provided advice that would have caused a security exposure if adopted. In addition, 26% observed an agent connecting to systems without formal authorization, alongside reports of systems reaching unauthorized data and automated executions occurring without proper approval.
Expanding Authority in Security Operations
Corporate teams are extending significant operational trust to automated tools within cybersecurity departments, deploying them directly into critical security workflows. Moreover, 32% permit software to manage threat investigations without human review, while also permitting unsupervised code deployment. Another 26% permit automated software to modify administrative access privileges.
“The biggest AI risk may not be a system that breaks its rules. It may be one that was never given meaningful limits in the first place. AI agents are highly persistent in pursuing a goal, so trying to anticipate every action is a losing battle. Businesses must set strict limits on what they can access and do, then enforce those limits within the application and across the underlying infrastructure. That is how you contain unexpected behavior before it causes real damage.”
Raghu Nandakumara, VP of Industry Strategy at Illumio
Shifting Risk Tolerance Across Industries
Enterprise leadership appears increasingly willing to accept operational threats to deploy new software quickly. Roughly 56% of surveyed professionals reported a higher tolerance for digital risk compared to the previous year. Among those willing to take risks, over half approve autonomous executions in testing environments, and 47% run them in live production networks within the wider economy.
Although respondents stated that autonomous agents require defensive controls distinct from standard applications, implementation remains slow. Only 25% prioritize clear limits on permitted actions, while 27% report that advanced software increased the priority of microsegmentation.
Research Methodology and Regional Scope
Conducted by Sapio Research across ten global markets, the survey gathered data from 1,100 professionals in the United States, Saudi Arabia, the United Arab Emirates, the United Kingdom, France, Germany, Japan, Australia, Singapore, and Mexico. As companies expand artificial intelligence adoption, experts recommend establishing strict Zero Trust boundaries rather than attempting to anticipate every possible computational action.
