SecurityHQ, a global cybersecurity company pioneering Security Performance Engineering, has released new research conducted in collaboration with Datadog, an AI-powered observability and security platform for cloud applications. The findings highlight a significant gap between how enterprises assign accountability for AI agents and their ability to trace and verify the actions those agents perform.
The report, “The Accountability Gap: The State of AI Agent Security and Governance 2026,” surveyed 204 cybersecurity leaders from midsize and large organizations. While 76% of respondents reported having formally established accountability for AI-driven operational or security decisions, 45% acknowledged experiencing incidents involving AI agents or automation in which responsibility was unclear.
As AI agents become more deeply integrated into enterprise infrastructure, these governance challenges are expected to intensify. According to the research, 51% of respondents indicated that AI agents already operate extensively throughout their organizations. Additionally, 93% anticipate that AI agents will access enterprise systems more frequently than human users within the next five years.
“Most security teams can see that agents are working. Far fewer can explain what an agent did, in what sequence, and under whose authority. Those are the questions that matter when something goes wrong,” said Feras Tappuni, CEO of SecurityHQ. “Defining accountability in a policy document is the easy part. It has to hold up in the hour after an incident, when the facts are incomplete, the business needs answers, and someone has to decide what to isolate and who has the authority to act.”
The study also identifies substantial limitations in AI agent observability and incident investigation capabilities. Only 49% of respondents reported being able to fully reconstruct every action performed by an AI agent during the preceding 30 days.
When responding to a critical incident, just 17% indicated they could reconstruct an agent’s activities within minutes. Another 51% would require hours, while 23% would need days. The remaining 9% either anticipated longer investigation periods or were uncertain how quickly they could establish a complete record of agent activity.
“Enterprises are adding a new class of actor to their infrastructure, and most observability was designed around people and the services they run,” added Tappuni. “Agents need the same level of instrumentation. When teams can see what an agent touched and when, in real time, questions about accountability become answerable.”
The challenge extends beyond authorized AI deployments. Nearly half of surveyed cybersecurity leaders (49%) suspect that individuals within their organizations may already be operating unapproved AI agents. Among this group, 51% reported that such activity potentially extends across multiple teams, complicating efforts to maintain centralized visibility and governance.
“The fundamentals are identity, permissions, logging, and being able to follow an agent across systems that were not designed to be read together,” said Aaron Hambleton, Senior Vice President of Product & Services at SecurityHQ. “That operational context is what allows security teams to reconstruct what happened to make smart and defensible decisions quickly. Without it, the first hours of an incident can be wasted assembling the timeline.”
The findings further emphasize the continued importance of human oversight in AI-driven decision-making. An overwhelming 99% of respondents identified at least one category of AI agent activity that should require mandatory human review. Financial approvals emerged as the leading area, cited by 61% of participants.
The research underscores the need for enterprises to strengthen AI agent governance through improved observability, identity management, access controls, and comprehensive activity logging. As autonomous agents assume broader operational responsibilities, organizations must be able to establish clear accountability and reconstruct agent behavior to support timely and defensible security decisions.
The full report is available at: https://www.securityhq.com/the-accountability-gap/
____________
About SecurityHQ
SecurityHQ is a global cybersecurity company that helps organizations engineer, measure, and continuously improve the performance of their security operations. Founded in 2003, the company delivers flexible and technology-agnostic solutions through its Security Performance Engineering approach. Built around each customer’s environment, the approach brings together managed detection and response, threat and adversary intelligence, exposure management, and advisory services. With 400+ analysts and engineers across six global SecOps Centers, SecurityHQ provides 24/7 human-led detection, response, and continuous improvement. Its work is focused on reducing noise, improving decision-making, and strengthening security performance over time.
Join our LinkedIn group Information Security Community!
