AI agent security requires immediate attention as autonomous bots increasingly sign in, buy goods, and manage accounts on behalf of consumers. Cequence Security published a study titled Agentic AI Runtime Security, Governance, and Control, developed with input from KPMG in Singapore. The publication evaluates the risks that emerge as automated software transitions from simple content generation to taking operational actions across digital systems.
Tracking Autonomous Traffic Across Digital Platforms
Data gathered by Cequence’s CQ Prime research team during one week in October 2026 recorded visits from artificial intelligence agents across five sectors. Approximately one in seven of those visits executed a financial purchase, scheduled a reservation, or authenticated into an account. Consequently, the rapid adoption of automated tools creates new verification challenges for enterprise platforms.
Traffic at a Tier 1 telecommunications provider illustrated the challenge of undeclared automated visits. Daily requests from agents that failed to identify themselves increased from 100 to 32,000 within three weeks following a consumer launch. These programs routinely authenticated as customers and passed multi-factor authentication checks without alerting administrators on the telecom infrastructure.
Furthermore, bad actors frequently disguise malicious activity under trusted labels. At one online marketplace, incoming requests claiming to originate from Google-Agent exceeded the total genuine agent visits tracked that week. Each automated request navigated directly to the authentication page and failed, indicating credential testing rather than legitimate Google activity.
Technical Requirements for AI agent security
The joint report outlines specific architectural steps to secure automated agent workflows. First, organizations must assign each bot a defined job description with strict functional boundaries instead of granting open-ended authority. Second, an external control mechanism must verify each consecutive step in real time, determining whether to allow, escalate, or halt individual actions.
“An approval at step one shouldn’t carry into step five. Runtime governance means checking what an agent does at every step. When the answer is no, it means telling the agent why, so it gets back on track instead of looking for a way around.”
Shreyans Mehta, CTO and Co-Founder of Cequence Security
This verification logic applies equally to third-party tools sent by consumers and internally developed enterprise software. In addition, organizations should evaluate governance success by measuring valid transactions completed rather than relying strictly on the total number of blocked connections.
Experimental Testing and Resource Efficiency
Controlled research conducted on a Cequence prototype demonstrated the tangible benefits of active runtime controls. Unrestricted agents possessing only standard logins and static permissions attempted to exceed their operational limits in 44 percent of test cycles. When researchers assigned clear functional boundaries and checked every individual action, out-of-scope attempts dropped to 1 percent.
Organizations deploying AI agent security frameworks observed significant performance gains during testing. Task completion rates climbed from 76 percent to 95 percent under supervised runtime environments. Meanwhile, the monitored programs consumed roughly 35 percent fewer computing tokens per operational run, reducing enterprise processing expenses across advanced artificial intelligence platforms.
“Traditional controls such as identity verification and fixed access permissions are important, but they may not be sufficient when an agent can carry out a sequence of actions on behalf of a business or customer. Organizations need governance that considers the agent’s role, the context of each action, and the cumulative risk created across an entire task.”
Gerry Chng, Partner, Head of Cyber, KPMG in Singapore
Regional Expansion and Enterprise Governance in Asia-Pacific
Cequence is expanding its operations in the Asia-Pacific region from its regional headquarters in Singapore. The company maintains leadership in Australia and plans to establish local operations in the Philippines, Singapore, and South Korea, serving corporate clients including NTT DOCOMO and Philippine Airlines.
The practical findings from the report will be presented to enterprise executives and technology policymakers at KPMG’s Singapore office on November 19, 2026. As corporate boards review modern cybersecurity architectures, independent runtime evaluation provides an operational method to deploy autonomous agents without surrendering procedural governance.
