Enterprises have pushed agentic AI into production faster than they have learned to govern it, and the cleanup is where the risk now lives. Nearly a third of agentic AI pilots were paused or scrapped over the past year, yet many were never actually switched off. The agents still hold the credentials and production access they were handed on day one. That finding comes from Cequence Security, whose survey of 202 enterprise technology and security leaders was conducted by the analyst firm Enterprise Management Associates (EMA).
- Two-thirds of enterprises, 65%, have already seen an agent act outside its intended scope, and 29% took measurable organizational damage.
- Confidence is running ahead of control: 94% believe their agents hold no more access than they need, while only 33% actually provision them with least privilege.
- Some 47% cannot reliably inventory the agents already running in production, and 46% cannot produce a 30-day audit trail for a single agent.
- The report’s fix is unglamorous: authorize agents at runtime, automate detection before scaling, and make agent decommissioning a security job.
The Agentic AI Pilots That Never Logged Out
Roughly a third of the agentic AI pilots these companies ran were paused indefinitely or formally killed, often over security concerns, then left provisioned with the credentials and production access they started with. A shutdown ticket closed the project; nobody closed the account.
Across the 202 organizations, 65% had already watched an agent act outside its intended scope, and 29% booked measurable organizational impact from it.
These deployments are well past the sandbox. Some 46% are scaling agents across multiple departments, most run generative and agentic systems side by side, and another 36% had caught a near-miss before any harm landed.
Confidence Runs Ahead of Enforcement
Confidence and enforcement pull apart in the numbers. While 94% were at least somewhat confident their agents were not over-permissioned, only 33% actually provisioned them with least privilege. Just 34% checked whether an agent was authorized at the moment it tried to act, and the rest lean on standing permissions reviewed periodically, rarely, or never. AI governance here lives on paper and stops before enforcement. Agentic AI is outrunning the access model it inherited, and confidence has filled the gap. “Most organizations have policies in place and express real confidence in them,” said Christopher M. Steffen, who leads research at EMA and wrote the report. “The gap is between what’s written down and what’s enforced.”
The data on visibility are worse. Some 47% lacked a reliable agent inventory despite running dozens in production. Another 46% could not readily produce the 30-day audit trail a compliance review or an incident responder would ask for. Detection was no better: only 32% could contain an out-of-scope action within minutes through automation, while 55% needed hours of manual work. Seven organizations said they usually learn an agent went off-script only when a customer or partner tells them. Underneath the AI framing sits an ordinary identity security problem, where agents are non-human identities with standing access and no one offboarding them.
Decommission Agents the Way You Offboard Staff
The order matters, and it starts with cybersecurity hygiene on what you already deployed rather than new controls on what comes next.
Revoke the credentials of every retired agent pilot this week – Nearly a third of pilots were paused or killed, yet many kept the production access your identity security team can pull now.
Check authorization when the agent acts, not at onboarding – Only 34% evaluate authorization at execution time; the rest trust standing permissions no one revisits, leaving teams to re-evaluate trust for these agents.
Inventory your agents and automate detection before you scale – Just 32% can contain an out-of-scope action in minutes, 55% need hours, and 47% cannot even list the agents in production.
Until those retired pilots are logged out for good, every enterprise scaling agentic AI is trusting a fleet of agents it can neither see nor switch off.
Join our LinkedIn group Information Security Community!
