Sometime in late 2024, enterprise AI crossed a line. Engineering teams began wiring language models to tools: file systems, APIs, email inboxes, databases. These weren’t chatbots, they were agents; systems that act, plan, delegate, and remember, often without waiting for human input between steps.
That transition happened faster than most security organizations could track. And it created a threat surface that existing tools were not built to address.
According to NeuralTrust’s State of Agentic AI Security 2026 report, 48% of all AI agents running in enterprise production environments operate without meaningful security controls. Not 48% of companies lacking a policy, 48% of the actual agents themselves, handling real tasks, touching real data, calling real APIs right now.
Key findings from 2026 research:
- 88% of enterprises with deployed agents have experienced at least one security incident (Shattered.0.io, 2026)
- 34% of deployed enterprise agents affected by prompt injection attacks (Shattered.io, 2026)
- $4.7M average cost of an AI agent-related data breach (IBM, 2025)
Between December 2025 and April 2026, AI agent fleets doubled across enterprise environments. Monitoring coverage stayed flat at around 52%. As deployment accelerated, the security gap widened.
The Problem Isn’t The Code – It’s The Runtime
The dominant approach to agentic security carries a structural flaw: it applies application security thinking to systems that don’t behave like applications. Application security works on the assumption that the code you review, test, and deploy is the code that runs. Fix the code, fix the risk. The application does what the code says, deterministically, every time.
“You can review the code. You can red-team the system prompt. You can audit the tool permissions. And your agent can still be exploited at runtime by a malicious document it retrieves from a SharePoint folder.” – Victor Garcia, CTO, NeuralTrust.
Pre-deployment controls matter. Code review and red-teaming before going live are still necessary: attack techniques evolve independently of whether your agents change, so recurring red-team schedules are valuable.
But none of those controls help when an agent processes adversarial content it retrieves from a document mid-task, or when a user crafts an input that shifts its goal, or when a sub-agent inherits permissions its parent should never have delegated. Those threats exist at runtime, and most enterprise security programs are not built to catch them.
The Threat Categories That Matter
For security teams, the relevant attack surface is now fundamentally different from traditional threat models. The whitepaper identifies ten categories that matter most for production deployments. Four are foundational:
Prompt injection and its variants. Adversarial content embedded in documents, emails, or API responses that attempts to redirect an agent’s behavior. This affects 34% of deployed enterprise agents today. Indirect injection (where the malicious payload arrives not from the user but from something the agent retrieves) is particularly difficult to catch with static analysis.
Tool and permission abuse. A compromised agent is a compromised insider. When an agent has tool access to your email system, file storage, or customer database, an attacker who can manipulate its behavior has everything that agent can reach. The attack surface doesn’t live in the code, it lives in the credentials.
Memory and context poisoning. Agents that persist memory across sessions create a new attack vector: an attacker who can influence the memory store affects every future session. Once poisoned, the corruption is durable and may be invisible to standard monitoring.
Multi-agent trust propagation. In orchestrated systems where agents communicate and delegate, a single injection point can cascade across an entire agent network. A compromised sub-agent that inherits elevated permissions can act with authority no individual attacker would have received directly.
The Shadow Agent Problem
One dimension that receives less attention: most enterprises have significantly more agents running in production than their security teams know about.
A product manager spots a productivity opportunity, asks an engineer to build something over a weekend, and three weeks later that prototype is handling real user requests. The security review never happened because it was “just a prototype.” The prototype never stopped being a prototype in anyone’s mind, even as it ran in production.
“A compromised chatbot gives an attacker information. A compromised agent gives an attacker the ability to act, at scale, as a trusted insider.” – Joan Vendrell, CEO, NeuralTrust
Deloitte’s 2026 State of AI in the Enterprise found that nearly 80% of organizations still lack mature governance for AI agents, even as agent adoption accelerates across the business. According to Gartner’s 2026 AI Adoption in the Enterprise survey, 38% of large organizations now operate fleets of more than 100 agents, and most security teams have no reliable way to enumerate that fleet, let alone monitor it consistently.
You cannot secure what you cannot see. The first priority of any agentic security program is visibility, not policy enforcement.
A Framework Built For Behavioral Systems
Securing agentic AI at runtime requires a fundamentally different approach — one built on behavioral observation, semantic-level enforcement, and real-time response rather than static analysis and perimeter controls.
NeuralTrust’s whitepaper, Agentic AI Security at Runtime: The Enterprise Playbook for Securing AI Agents in Production, organizes a practical response around four pillars: Observe, Enforce, Detect, and Respond. Together, these cover not just what to monitor but how to act on it, in a way that doesn’t require a 12-month transformation program to implement.
The playbook also addresses the specific realities of how enterprises actually build agents today: using open-source frameworks like LangChain, CrewAI, AutoGen, and Semantic Kernel that were designed for speed and flexibility, not security governance.
Framework-specific guidance throughout the document translates the four-pillar model into the systems teams are already running.
The organizations that build this capability now will be ahead. Not just in security posture, but in the speed at which they can safely expand their agentic programs. Security built at the agent layer is not a brake on AI adoption. It is what lets you run.
Download the Whitepaper for free
Join our LinkedIn group Information Security Community!
