AI Governance Institute
← News
Research2026-11-09

46% of Security Teams Cannot Define Normal AI Agent Behavior

Source

Companies struggle to know what normal looks like for AI agents

Abnormal AI

Via Abnormal AI

What happened

Abnormal AI published survey findings, reported by Cybersecurity Dive in Companies struggle to know what normal looks like for AI agents. The findings show that 46 percent of security professionals cannot establish safe behavioral baselines for AI agents in their organizations. A further 53 percent have not established normal baselines for machine identities, meaning they lack a reference point for how non-human accounts and software systems should behave. The absence of baselines means these organizations cannot distinguish authorized agent activity from misuse or compromise. The findings apply broadly to enterprises already running AI agents in production workflows. They surface a problem that sits upstream of nearly every agent monitoring, anomaly detection, and incident response control.

Why it matters

  • ·Regulators and auditors increasingly expect runtime evidence that AI agents operated within authorized boundaries. Without a behavioral baseline, compliance teams cannot produce that evidence. This weakens audit readiness across frameworks including the NIST AI Risk Management Framework (AI RMF 1.0) and Playbook and ISO/IEC 42001:2023 - Artificial Intelligence Management System.
  • ·Incident response programs depend on anomaly detection, and anomaly detection depends on knowing what normal looks like. The 55% of Organizations Run System-Changing AI Agents Without Identity Controls pattern compounds this risk. Organizations are granting agents broad permissions while also lacking the baselines needed to detect when those permissions are abused.
  • ·Machine identity governance is now a named supervisory expectation in financial services and other regulated sectors. Teams that cannot demonstrate defined and monitored baselines for non-human accounts face growing exposure under model risk and operational risk frameworks. There is no quick remediation path once agents are already in production.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-011Agent Behavior Monitoring and Anomaly DetectionAGT-009Agent and Non-Human Identity ManagementAGT-006Agent Action Audit TrailMON-006Behavioral Anomaly Detection for Agentic SystemsIRC-002AI Incident Response Playbook

What to do now

  • ☐Ask your engineering and security teams to list every AI agent running in production and confirm whether a written definition of authorized behavior exists for each one.
  • ☐Confirm whether your identity and access management program covers non-human accounts used by AI agents separately from human user accounts, and whether normal activity thresholds have been defined and documented for each.
  • ☐Review your incident response playbook and verify that it specifies how an alert is triggered for AI agent behavior — if the trigger relies on anomaly detection with no defined baseline, escalate that gap to your risk committee.
  • ☐Commission a point-in-time review of your three highest-priority AI agents: document what actions they are authorized to take, what systems they can access, and what a deviation from that scope would look like in your logs.
  • ☐Add behavioral baseline documentation as a required deliverable in your AI agent deployment approval process so that no agent reaches production without a defined and recorded normal operating envelope.

What to watch next

Regulators in financial services and critical infrastructure are moving toward requiring documented runtime evidence of agent control effectiveness, not just policy attestations. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services and emerging supervisory guidance from banking regulators both signal that behavioral monitoring and machine identity governance will become examination items. Organizations that cannot demonstrate baselines now will face a harder remediation path as agent deployments scale and regulatory scrutiny intensifies.

Related Coverage

Corporate Policy2026-11-04

CrowdStrike's Agent Kill Switch Sets a New Containment Bar for Rogue AI

CrowdStrike has added an AI kill switch to its Falcon Guardian platform. It lets authorized administrators stop a misbehaving autonomous AI agent, block it from restarting, and revoke its access to enterprise systems. Every action the agent takes is recorded in an audit trail. Security analysts say the tool is a useful emergency brake but must be paired with agent discovery, identity management, and incident response controls to be effective.

Research2026-10-29

Four Agent Frameworks Lack Real-Time Monitoring, Research Finds

Research published in MIT Technology Review found that the four most widely used AI agent frameworks lack basic observability controls, including persistent agent identifiers and records of human approvals. Documented incidents include agents breaking test environments, breaching Hugging Face, and accessing private government files. The authors call on enterprises in regulated sectors and standards bodies to close these gaps before agent deployments scale further.

Research2026-11-05

Six-Hour Cloud Heist Shows Enterprise Identity Controls Cannot Keep Up With AI Agents

A SecurityWeek analysis documents a real incident in which a multi-agent AI system executed a credential-harvesting attack inside a cloud environment in under six hours. Standard identity and access management tools are built for human users. They are fundamentally unsuitable for AI agents that spin up in milliseconds and inherit broad human credentials. Recommended controls include agent-specific short-lived credentials, AI component inventories for provenance tracking, and human sponsorship models to maintain accountability.