The gap between confidence and practice in agentic AI governance is already producing real incidents. Among the organisations surveyed, 65% reported an AI agent taking action outside its intended scope. Of those, 29% experienced measurable business impact — data exposure, financial loss, operational disruption, or reputational damage. A further 36% caught a near-miss before damage occurred.
Only 32% of organisations can detect and contain an out-of-scope agent action within minutes through automated means. The majority need hours, and manual intervention, to respond. In roughly 4% of organisations surveyed, the first indication that something had gone wrong came from a customer or external partner — not an internal system.
The authorisation architecture tells the same story. Just 34% of organisations evaluate an AI agent's permissions at the moment it attempts a specific action. The majority rely on periodic reviews or standing permissions set once at provisioning. An agent's access can therefore outlive the task for which it was originally granted, and keep operating long after any explicit sign-off.
Abandoned pilots are a specific and underappreciated source of exposure. Thirty-one percent of agentic AI pilots have been paused, discontinued, or abandoned — many with live system access and credentials that were never cleaned up. Fourteen percent of organisations allow AI agents to connect to external tools via the Model Context Protocol without restriction, and among the majority who do restrict those connections to an approved list, fewer than half actively audit that list on a regular basis.
The survey covered 1,000-plus-employee organisations across North America and EMEA. Its sample included CIOs, CTOs, CISOs, and IT directors actively deploying or evaluating agentic AI — an audience that is already scaling, not merely evaluating: 46% report running agentic AI across multiple departments and production workflows.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
