Cequence Security has published a report developed with input from KPMG in Singapore on governing and securing agentic AI as agents move from generating content to taking consequential actions. The report, Agentic AI Runtime Security, Governance, and Control, will be presented to business, technology and policy leaders at a joint event at KPMG's Singapore office on 19 November.
Cequence's CQ Prime research team tracked more than a quarter of a million AI agent visits across five industries in one week of October 2026. About one in seven booked, bought, signed in or managed an account for the customer. At a Tier 1 telecommunications carrier, traffic from agents that did not identify themselves grew from about 100 requests a day to as many as 32,000 within three weeks of a major consumer AI agent's launch, and the agents signed in as the customer and passed multi-factor authentication.
A trusted name proves nothing. At one online marketplace, more visits claimed to be Google-Agent than all the genuine agent visits Cequence tracked that week. Every one went straight to the sign-in page and failed, which Cequence reads as attackers testing stolen passwords in bulk under a legitimate agent's name. Google was not involved.
The report recommends giving each agent a specific job turned into hard limits, checking every action in real time with a control outside the agent, and measuring success by work completed rather than actions blocked. In a controlled study using a research prototype, agents with only logins and fixed permissions tried to act outside their job in 44% of runs. With a defined job and every action checked, those attempts fell to 1%, task completion rose from 76% to 95%, and agents used about 35% fewer tokens per run.
Shreyans Mehta, CTO and co-founder of Cequence, who co-authored the report, said: "An approval at step one shouldn't carry into step five." Gerry Chng, Partner and Head of Cyber at KPMG in Singapore, said: "Traditional controls such as identity verification and fixed access permissions are important, but they may not be sufficient when an agent can carry out a sequence of actions on behalf of a business or customer."
Cequence has its regional headquarters in Singapore and says it is growing in Asia-Pacific, with plans for local teams in the Philippines, Singapore and South Korea. Its customers in the region include NTT DOCOMO and Philippine Airlines.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
