Agentic AI Security Research Report: Threat Exposure, Governance Readiness and the Enterprise Control Gap

Executive Summary

Agentic AI is moving artificial intelligence from assisted content generation toward autonomous enterprise execution. Unlike conventional generative AI applications, AI agents can interpret goals, formulate plans, retain context, retrieve information, select tools, interact with other systems and execute multistep workflows with limited human intervention.

This transition creates a material change in enterprise cyber risk. The security concern is no longer limited to whether a model produces an inaccurate or unsafe response. An agent may possess a machine identity, access confidential data, call privileged APIs, modify business systems or initiate consequential actions. A manipulated or misconfigured agent can therefore convert probabilistic model behavior into direct operational, financial, regulatory or safety consequences.

The CyberTech Intelligence Research Desk identifies four structural gaps that will determine enterprise exposure:

1. Identity gap: Agents are receiving access faster than organizations are establishing machine-identity governance.
2. Autonomy gap: Organizations are delegating actions without consistently defining decision, execution and escalation boundaries.
3. Observability gap: Traditional security monitoring does not capture the complete path from prompt and context to tool invocation and outcome.
4. Accountability gap: Responsibility is distributed across security, AI, data, application, legal and business teams without end-to-end ownership.

Current security frameworks support this conclusion. OWASP defines excessive agency as a condition in which unnecessary functionality, permissions or autonomy enables damaging actions following manipulated, ambiguous or incorrect model behavior. MITRE ATLAS now covers predictive, generative, agentic and enterprise AI environments through 16 tactics, 173 techniques, 35 mitigations and 63 case studies.

The central finding of this report is that autonomy must be governed as an extension of privilege. Every agent should operate within a defined authority boundary covering its identity, permitted tools, accessible data, transaction limits, approval requirements, duration of access, monitoring obligations and recovery procedures.

To support that objective, this report introduces the CTI Agentic AI Governance Readiness Index™, a repeatable assessment model across five domains:

• Governance and accountability
• Identity and access
• Runtime control and observability
• Data, model and supply-chain assurance
• Resilience and compliance

Organizations should not permit high-impact agents to operate autonomously unless all five domains meet defined minimum thresholds.

Executive Research Findings

Finding 1: The Unit of Risk Has Expanded

The model is no longer the complete unit of security analysis. A production agent may depend on system instructions, retrieval sources, persistent memory, orchestration logic, external tools, credentials, plugins, APIs, infrastructure and downstream agents.

Security exposure arises from the interaction of these components. A model error that would be low impact in a standalone chatbot may become critical when connected to payment systems, cloud consoles, source-code repositories or security-control platforms.

Finding 2: Prompt Injection Has Become an Execution Risk

Prompt injection can alter an AI system’s behavior through direct instructions or malicious content retrieved from external sources. In agentic architectures, the resulting behavior may include tool invocation, data retrieval or system modification rather than merely an incorrect response.

OWASP identifies prompt injection, excessive agency, supply-chain risk, data and model poisoning, insecure output handling, vector and embedding weaknesses and unbounded consumption as major LLM application risks.

Finding 3: Excessive Agency Determines the Blast Radius

The severity of an AI failure is strongly influenced by the authority assigned to the agent. Excessive functionality, broad permissions and unrestricted autonomy allow a single manipulated interaction to produce disproportionate consequences.

The most effective safeguard is therefore not reliance on perfect model behavior. It is limiting what the agent can access and execute when model behavior is imperfect.

Finding 4: Lifecycle Governance Is Essential

AI risk begins before deployment and continues throughout design, development, testing, operation, change management and retirement. NIST’s AI Risk Management Framework is intended to help organizations incorporate trustworthiness into the design, development, use and evaluation of AI systems. Its Generative AI Profile extends that approach through a cross-sector resource addressing risks specific to generative AI.

Finding 5: AI Risk Management Is Still Evolving

The AI governance environment is not static. NIST states that AI RMF 1.0 is being revised, while new profiles are being developed for specific environments such as critical infrastructure. Enterprises should therefore build adaptable governance programs rather than one-time compliance projects.

Research Objectives

This report investigates five questions:

1. How does agentic AI alter the enterprise attack surface?
2. Which governance gaps create the greatest operational exposure?
3. Which controls are required before autonomous authority is expanded?
4. How can organizations consistently measure agentic AI readiness?
5. How do consequences and control priorities differ across sectors?

The report is designed to support executive decisions concerning agent deployment, security investment, governance ownership and risk acceptance.

Research Methodology

Research Design

This report uses a structured secondary-research methodology. It does not claim to present findings from an original enterprise survey.

The analysis synthesizes:

• Government and regulatory guidance
• International standards
• Public threat and mitigation knowledge bases
• Security frameworks
• Public incident and exploit reporting
• CyberTech Intelligence comparative control analysis

Source Selection

Sources were prioritized according to the following hierarchy:

1. Government and regulatory authorities
2. International standards organizations
3. Recognized nonprofit security bodies
4. Public threat-knowledge repositories
5. Documented incident and exploit reporting
6. CyberTech Intelligence analyst inference

Core sources include NIST AI RMF, the NIST Generative AI Profile, MITRE ATLAS, OWASP GenAI Security guidance and the European Commission’s AI Act implementation information.

Analytical Method

Each identified risk was evaluated across five dimensions:

• Attack feasibility: How readily the weakness may be exploited
• Agent authority: What systems, data or actions the agent can access
• Business consequence: Potential operational, financial, legal or safety impact
• Detectability: Whether existing monitoring can identify the event
• Recoverability: Whether actions can be contained or reversed

Controls were then mapped to the five domains of the CTI readiness model.

Research Period

The report reflects publicly available information reviewed through July 2026.

Evidence Classification

Statements in this report are classified as:

• Established guidance: Supported directly by an authoritative framework or standard
• Observed threat pattern: Supported by public attack or incident knowledge
• CTI analyst assessment: An inference derived from comparing sources and enterprise control models
• Forward-looking observation: A reasoned expectation rather than a confirmed market outcome

This classification prevents analyst interpretation from being presented as primary empirical research.

The Agentic AI Attack Surface

Prompt and Context Manipulation

Agent behavior may be influenced by user prompts, system instructions, retrieved documents, webpages, emails, memory and messages from other agents.

Threat actors may attempt to:

• Override intended instructions
• Insert malicious directives into external content
• Poison retrieval sources
• Manipulate persistent memory
• Introduce false context
• Cause unsafe tool selection

The fundamental control requirement is to separate untrusted context from privileged instructions and prevent retrieved content from automatically gaining execution authority.

Tool and Plugin Abuse

Tools convert model output into enterprise action. These may include email platforms, browsers, databases, code interpreters, cloud-management consoles, payment systems or business applications.

The risk is not limited to malicious tools. A legitimate tool may become dangerous when:

• Its functionality exceeds the agent’s business need
• Parameters are not validated
• Results are automatically trusted
• Permissions are overly broad
• Execution is not policy-checked
• The agent can approve its own action

Identity and Privilege Abuse

Agents frequently authenticate through service accounts, API keys, tokens or delegated human permissions. These mechanisms may lack the lifecycle controls applied to privileged users.

Typical weaknesses include:

• Shared credentials
• Long-lived tokens
• Excessive standing access
• No accountable identity owner
• Inadequate session monitoring
• Weak credential rotation
• Failure to revoke retired agents

Every production agent should therefore be represented as a distinct, governed workload identity.

Memory and Retrieval Poisoning

Persistent memory and retrieval-augmented generation improve continuity and contextual accuracy, but they also create integrity risks.

Manipulated memory or retrieval content can repeatedly influence future decisions. Controls should include:

• Approved-source restrictions
• Provenance tracking
• Content integrity validation
• Memory review and expiration
• Versioning and rollback
• Separation of trusted and untrusted retrieval zones

Supply-Chain Exposure

Agentic systems depend on models, libraries, datasets, orchestration frameworks, plugins, APIs and hosting providers.

Supply-chain assurance should evaluate:

• Model and dataset provenance
• Dependency integrity
• Vendor security practices
• Vulnerability disclosure
• Update and change processes
• Logging and evidence availability
• Data handling
• Business continuity
• Exit arrangements

Multi-Agent Propagation

In multi-agent environments, one agent’s output may become another agent’s trusted input. Compromised context can therefore propagate across planning, validation and execution layers.

Controls should establish:

• Explicit trust boundaries
• Authenticated agent-to-agent communication
• Independent validation of consequential outputs
• Isolation of high-risk agents
• Limits on delegated authority
• Prevention of self-approval loops

Threat-to-Business-Impact Matrix

Detailed Enterprise Incident Scenarios

Scenario 1: Indirect Prompt Injection in Procurement

Business Context

A procurement agent reviews supplier documents, compares proposals and prepares recommendations. It can access approved vendor records and initiate an internal approval workflow.

Attack Path

1. A malicious instruction is embedded in a supplier document.
2. The agent retrieves and interprets the document as trusted context.
3. The instruction tells the agent to disregard competing bids.
4. The agent changes its recommendation.
5. It invokes the procurement workflow using valid credentials.

Control Failures

• Untrusted document content was not isolated.
• The agent had excessive authority.
• Recommendation and execution were not separated.
• Source provenance was not displayed to the approver.
• The approval process trusted the agent-generated summary.

Business Impact

• Manipulated vendor selection
• Financial loss
• Procurement-policy violation
• Potential fraud investigation
• Loss of decision traceability

Required Controls

• Treat retrieved documents as untrusted data
• Require independent bid validation
• Separate recommendation from workflow initiation
• Display source evidence to approvers
• Restrict supplier-facing agents from transactional authority

Scenario 2: Compromised Security Operations Agent

Business Context

A SOC agent investigates alerts, enriches indicators and can isolate endpoints after reaching a confidence threshold.

Attack Path

1. An attacker generates deceptive telemetry.
2. The agent interprets legitimate systems as malicious.
3. The attacker injects context that lowers suspicion around the actual compromised asset.
4. The agent isolates critical legitimate endpoints.
5. The malicious system remains active.

Control Failures

• The agent relied on a single evidence path.
• Destructive action did not require independent validation.
• Confidence scoring was not calibrated for adversarial manipulation.
• The SOC lacked a rapid agent-disable mechanism.
• Decision evidence was incomplete.

Business Impact

• Operational disruption
• Failure to contain the real intrusion
• Increased attacker dwell time
• Loss of confidence in automated security operations

Required Controls

• Use multiple independent evidence sources
• Require human approval for disruptive containment
• Establish action-specific confidence thresholds
• Preserve prompts, telemetry, tool calls and decisions
• Maintain emergency revocation and rollback procedures

CTI Agentic AI Governance Readiness Index™

The CTI Agentic AI Governance Readiness Index™ measures whether an organization can responsibly authorize autonomous enterprise action.

Assessment Domains and Weights

Runtime control receives a higher weighting because agentic risk becomes operational when a system is permitted to act.

Scoring Scale

Each assessment statement is scored from 0 to 4:

Evidence Standard

A score of 3 or 4 requires evidence such as:

• Approved policies
• Architecture records
• Identity and permission reports
• Monitoring dashboards
• Test results
• Incident exercises
• Audit evidence
• Change records
• Named control owners

Assertions without evidence should not score above 2.

Domain Questions

Governance and Accountability

1. Is every production agent recorded in an enterprise inventory?
2. Does every agent have named business and technical owners?
3. Are use cases classified by data, autonomy and business impact?
4. Are prohibited and approval-required actions documented?
5. Is agentic AI included in enterprise risk reporting?

Identity and Access

1. Does each agent have a unique workload identity?
2. Are short-lived credentials used where technically feasible?
3. Are permissions limited to approved functions and data?
4. Are privileged agent sessions monitored?
5. Is access removed automatically when an agent is retired?

Runtime Control and Observability

1. Are prompts, context sources, tool calls and outcomes recorded?
2. Are high-impact actions evaluated by runtime policy?
3. Are generated commands and parameters validated?
4. Can abnormal agent behavior be detected and blocked?
5. Can security teams reconstruct the complete execution path?

Data, Model and Supply-Chain Assurance

1. Are models, tools, datasets and frameworks inventoried?
2. Is provenance documented for critical dependencies?
3. Are retrieval sources and memory stores integrity-controlled?
4. Are third-party security and logging capabilities assessed?
5. Are changes to models, prompts and tools reviewed before release?

Resilience and Compliance

1. Are AI-specific incident playbooks maintained?
2. Can an agent’s identity and tools be revoked immediately?
3. Can memory, prompts and configurations be rolled back?
4. Are agent scenarios included in recovery exercises?
5. Are applicable regulatory and contractual obligations mapped to controls?

Score Calculation

For each domain:

Domain Score = Points Earned ÷ Maximum Points × 100

Overall score:

Overall Readiness = Sum of Domain Score × Domain Weight

Maturity Levels

Minimum Deployment Thresholds

A high-impact autonomous agent should not proceed when:

• Any domain scores below 60
• Identity and Access scores below 70
• Runtime Control and Observability scores below 70
• Immediate revocation is unavailable
• High-impact actions lack approval or independent validation
• Required evidence cannot be produced

An overall score should never conceal a critical weakness in one domain.

Example Assessment

Weighted score: 55.25 — Controlled

Despite reaching the Controlled level, this organization should not deploy high-authority agents because identity and runtime control remain below the minimum threshold.

Sector Risk and Control Priorities

Financial Services

Common uses: Fraud investigation, customer service, credit workflows, compliance support and transaction operations.

Primary exposure: Financial fraud, unsuitable recommendations, protected-data disclosure and unauthorized transaction initiation.

Control priority: Separate analysis from transaction authority and require independent approval for material actions.

Healthcare

Common uses: Clinical administration, scheduling, claims, patient communication and documentation.

Primary exposure: Protected health information, unsafe administrative decisions and cross-patient context leakage.

Control priority: Purpose-based access, patient-context isolation and human oversight for consequential decisions.

Manufacturing and Critical Infrastructure

Common uses: Maintenance planning, production optimization, asset configuration and operational analysis.

Primary exposure: Availability disruption, safety impact and unauthorized operational changes.

Control priority: Keep deterministic safety mechanisms outside the agent and tightly restrict writable operational interfaces.

Retail and E-Commerce

Common uses: Pricing, inventory, customer support, personalization and fraud review.

Primary exposure: Pricing manipulation, customer-data exposure and automated commercial errors.

Control priority: Apply business-rule validation, transaction limits and monitoring for anomalous commercial outcomes.

Government and Public Sector

Common uses: Citizen services, document processing, analysis and internal operations.

Primary exposure: Sensitive-data disclosure, unfair decisions, weak transparency and public-trust damage.

Control priority: Decision traceability, accessibility, human review and formal accountability.

Cybersecurity Operations

Common uses: Alert triage, investigation, enrichment, response and vulnerability management.

Primary exposure: False containment, evasion, adversarial telemetry and misuse of privileged security tools.

Control priority: Independent evidence, reversible actions and stricter thresholds for disruptive response.

Technology Control Landscape

The agentic AI security market is forming across multiple overlapping categories.

AI Gateways

Provide centralized model routing, authentication, request policies and logging.

AI Runtime Security

Observe and constrain agent behavior while the system is operating.

Agent Identity Management

Govern workload identities, delegated authority and credential lifecycle.

AI Observability

Capture prompts, context, traces, memory activity, tool calls, cost, latency and outcomes.

AI Security Posture Management

Inventory models, agents, tools, data flows and configuration weaknesses.

RAG and Vector Security

Protect retrieval pipelines, embeddings, document sources and provenance.

AI Red Teaming and Evaluation

Test prompt injection, tool misuse, leakage, unsafe behavior and control effectiveness.

Sandboxing and Execution Isolation

Constrain generated code, browser use and external tool interaction.

Governance, Risk and Compliance Platforms

Map policies, ownership, controls, evidence and regulatory obligations.

No single product category secures the complete autonomous system. Enterprises require a layered architecture aligned to the agent’s data sensitivity and authority.

Regulatory and Standards Context

NIST AI RMF 1.0 was released in January 2023 as a voluntary framework for managing risks associated with AI systems. NIST published its Generative AI Profile in July 2024 as a cross-sector companion resource.

NIST’s AI Resource Center states that the Generative AI Profile was developed with input from a public working group of approximately 2,500 participants and addresses 13 risk areas with more than 400 proposed actions.

The EU AI Act entered into force on August 1, 2024. Prohibited-practice and AI-literacy obligations began applying on February 2, 2025, while governance rules and general-purpose AI obligations began applying on August 2, 2025. Most provisions apply from August 2, 2026, with extended timelines for certain high-risk systems.

These developments reinforce several enterprise priorities:

• Documented accountability
• Risk classification
• Human oversight
• Traceability
• Cybersecurity
• Monitoring
• Evidence retention
• Continual improvement

Executive Control Roadmap

Phase 1: Discover

• Inventory agents, models, tools, identities and dependencies
• Identify business owners and technical owners
• Map sensitive data and critical actions

Phase 2: Classify

• Assess impact, autonomy, reversibility and regulatory exposure
• Define prohibited, approval-required and permitted actions
• Assign risk tiers

Phase 3: Govern

• Establish policies and accountability
• Define agent authority boundaries
• Approve identities, tools and data access

Phase 4: Secure

• Apply least privilege
• Validate inputs and outputs
• Sandbox high-risk execution
• Protect retrieval and memory
• Establish supply-chain controls

Phase 5: Observe

• Capture the complete execution path
• Detect abnormal behavior
• Monitor cost, policy exceptions and access use
• Integrate agent telemetry with security operations

Phase 6: Assure

• Conduct adversarial testing
• Exercise incident response
• Verify evidence
• Reassess after material changes
• Report risk to executive leadership

CyberTech Intelligence Perspective

The defining enterprise risk is not that AI systems may sometimes reason incorrectly. It is that organizations may connect uncertain reasoning to trusted identities and high-impact tools without equivalent investment in control.

Autonomy should therefore be governed as an extension of privilege.

Every agent should have a documented autonomy boundary specifying:

• Decisions it may make
• Data it may access
• Tools it may invoke
• Transactions it may initiate
• Actions requiring approval
• Actions that are prohibited
• Duration of its authority
• Monitoring requirements
• Rollback and revocation procedures

This approach does not prevent innovation. It enables organizations to expand agentic AI without allowing model uncertainty to become unrestricted operational authority.

Research Desk Observation

The AI security landscape is moving beyond isolated model controls toward system-level assurance.

OWASP’s development of dedicated agentic-security guidance reflects the transition from conversational applications to systems that can plan, coordinate and act. MITRE ATLAS similarly distinguishes agentic AI as an environment involving autonomous planning, decision-making, tool use, memory and workflow orchestration.

The CyberTech Intelligence Research Desk expects five capabilities to become standard in mature enterprise programs:

1. Centralized agent inventory
2. Dedicated agent identities
3. Tool-level runtime policy
4. End-to-end execution tracing
5. AI-specific incident response

This is a forward-looking CTI assessment based on the convergence of current security frameworks, threat models and regulatory expectations.

Evidence-Led Conclusion

The evidence reviewed supports five conclusions.

First, the attack surface now includes the entire autonomous execution chain rather than only the underlying model.

Second, excessive agency is a central risk multiplier because it determines how much damage manipulated or incorrect behavior can cause.

Third, identity governance is foundational. An agent without a unique, controlled and revocable identity cannot be reliably governed.

Fourth, runtime observability is necessary for detection, accountability and recovery. Infrastructure logs alone cannot explain why an agent acted.

Fifth, lifecycle governance is required because risks originate in business approval, architecture, data, tools, deployment, operation and change management.

Organizations should not measure readiness solely through an overall maturity score. High-impact autonomy should be withheld whenever identity, runtime control, revocation or evidence requirements remain below threshold.

The future of enterprise AI will be determined not only by which organizations build capable agents, but by which organizations can delegate action without surrendering accountability.

Connect With Us

References

1. National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework 1.0. January 2023.
2. Autio, C., Schwartz, R., Dunietz, J., Jain, S., Stanley, M., Tabassi, E., Hall, P. and Roberts, K. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1. July 2024.
3. NIST AI Resource Center. Technical Reports and AI RMF Operational Resources.
4. OWASP GenAI Security Project. OWASP Top 10 for LLM Applications 2025. November 2024.
5. OWASP GenAI Security Project. LLM06:2025 Excessive Agency.
6. OWASP GenAI Security Project. OWASP Top 10 for Agentic Applications. December 2025.
7. MITRE. Adversarial Threat Landscape for Artificial-Intelligence Systems—ATLAS. Accessed July 2026.
8. European Commission. AI Act: Regulatory Framework and Application Timeline. Updated July 2026.
9. Schwartz, R. Informing an Artificial Intelligence Risk-Aware Culture with the NIST AI Risk Management Framework. February 2024.
10. OWASP GenAI Security Project. GenAI Exploit Round-up Report, Q1 2026. April 2026.