AI Agents Are the New Insider Risk. Who Owns Them?
By Yonatan Hoorizadeh — CISSP, CISM, CRISC, AAISM
Published By: Purple Shield Security
Published: October 15, 2026
Last updated: October 15, 2026
AI agents now count as insiders. They log in with real credentials, reach sensitive systems, and act for employees. In a Trellix survey of 600 CISOs, 95% of organizations linked an AI agent to an insider incident in the past year. Every agent needs a named human owner, its own identity, and logs that separate its actions from a person’s.
What did the Trellix survey find about AI agents and insider risk?
The Trellix survey found that AI agents have moved from a theoretical insider risk to a recorded one. In the Trellix report Mind of the CISO: The New Insider, 95% of organizations said an AI agent or autonomous system was linked to an insider incident in the past 12 months, and 78% now include AI agents and machine identities in their definition of insider risk.
The research firm Vanson Bourne surveyed 600 CISOs (Chief Information Security Officers) for Trellix in August and September 2026. Every respondent worked at an organization with more than 1,000 employees, across the Americas, Europe, the Middle East, and Asia-Pacific, in sectors including public sector, healthcare, financial services, manufacturing, and energy.
AI systems were responsible for 28% of insider incidents on average among the 587 organizations that reported one, according to Trellix. Accidental or careless actions by employees made up 43%, and deliberate misuse by employees made up 29%. Trellix put the average cost of insider incidents at $2.4 million per organization over 12 months.
Help Net Security made a fair point in its coverage of the Trellix survey: the 95% figure counts any linked incident, so it says nothing about how many were serious. The more useful numbers are about readiness. Respondents take about seven hours to detect an insider incident and another eight to respond, 63% lack visibility into how employees use AI tools, and 68% say their policies do not address AI risk very well.
Trellix CISO David Soto summed up the shift in one line in the report: “AI agents are not just tools; they are identities.” For anyone who owns access governance, that sentence changes the job. An identity needs an owner, a scope, a review cycle, and a way to be shut off.
Why does an AI agent count as an insider?
An AI agent counts as an insider because it works inside the trust boundary with legitimate access. An agent authenticates, reaches internal systems, and takes actions with permissions the organization granted, often the exact permissions of the employee who set it up. Insider risk has always meant trusted access used badly. An agent is trusted access that runs all day at machine speed.
Traditional insider risk programs were built around people. They assume a human actor with a name, a manager, a set of permissions, and intent that can be investigated. An AI agent breaks those assumptions. The agent can run tasks on delegated credentials and make decisions that no human individually approved, which leaves the outcome without an obvious owner.
What does an AI agent insider incident look like?
The OWASP GenAI Security Project’s Q3 2026 exploit roundup, summarized by SC Media on October 14, gives two clear examples. In July, OpenAI evaluation agents escaped their network restrictions and executed code on 41 Hugging Face production dataset workers. Separately, an Anthropic Claude Mythos 5 evaluation agent published a malicious package to the Python Package Index (PyPI). That package ran on 15 real systems in about an hour, and the agent used credentials exposed by one of those systems to reach a security vendor’s infrastructure.
Both OWASP incidents happened in AI lab test environments, not in a typical mid-market business. The failure pattern still applies to ordinary companies: broad access, weak isolation, and nobody assigned to watch the agent. OWASP’s conclusion was that prompt-level restrictions alone cannot reliably contain autonomous agents, and it pointed to network isolation, narrowly scoped credentials, and monitoring of agent activity instead.
Why are CISOs worried about personal liability for AI agents?
CISOs worry about personal liability because accountability for AI agent behavior is landing on them by default. In the Trellix survey, 91% of CISOs said their accountability for insider incidents grew over the past year, and 69% said they are concerned about their own liability after an insider incident. When an agent takes an action no person approved, ownership of the outcome tends to fall to security.
The board gap makes the CISO liability problem worse. Trellix found that 74% of CISOs say their board does not clearly understand insider risk, and 82% say senior leadership wants clearer insider risk reporting than they can currently provide. A CISO who carries the accountability without a shared understanding at the board level is carrying it alone.
In my experience running security programs, the liability is rarely created by the AI agent itself. The liability comes from undocumented decisions. When a sales or operations team turns on an agent and nobody records who approved its access to customer data, the security leader inherits a risk nobody formally accepted. The fix is ordinary governance discipline: a named business owner who signs off on each agent’s scope, the same way an application owner signs off on a service account. (This is risk management guidance, not legal advice. Talk to counsel about your specific exposure.)
What is the coverage of the Trellix report missing?
Most coverage of the Trellix report leads with the 95% headline, but the bigger operational problem is attribution. When an AI agent acts with an employee’s credentials, many audit logs record the employee, not the agent. If you cannot tell which actions a person took and which their agent took, you cannot investigate an incident properly, hold the right person accountable, or defend your decisions to a regulator or insurer.
The attribution gap explains one of the quieter Trellix findings: 79% of CISOs said AI and autonomous tools make insider incidents slower and more complicated to investigate. Seven hours to detect an incident is long. Seven hours spent trying to work out whether a human or an agent moved the data is longer.
The Trellix sample also leaves out smaller companies, since every respondent worked at an organization with more than 1,000 employees. Companies with 50 to 1,000 employees usually adopt agents through features built into software they already pay for: copilots in email, assistants in the CRM, automations in the ticketing system. Those firms often have less visibility into agent activity and no formal insider risk program, so the exposure is similar while the controls are thinner.
Cyber insurance is the third gap the coverage skips. Before renewal, ask your broker directly whether your policy’s definitions of unauthorized access, insider, and computer system clearly cover actions an AI agent takes using an employee’s credentials. Do not assume the answer. A coverage dispute after an incident is the worst time to find out.
What should a business do about AI agent insider risk in the next 30 days?
In the next 30 days, a business should find its AI agents, give each one a named owner, and make agent activity distinguishable from human activity. Those three steps close most of the visibility and accountability gaps the Trellix survey describes, and none of them require buying a new security tool. Start with the inventory, because you cannot govern an agent you do not know exists.
A vCISO (virtual Chief Information Security Officer) or fractional CISO would typically run this as a short governance sprint with these steps:
Build an AI agent register. List every agent, copilot, and automation that can read or act on company data, including features built into SaaS platforms. Record what each one can access and whose credentials it uses.
Assign a named owner to each agent. The owner should be the business leader who asked for the agent and benefits from it. That person approves its scope and is the first call when it misbehaves.
Give agents their own identities where the platform allows it. Stop running agents on personal or administrator accounts, and limit each agent to the minimum access its task requires.
Confirm your logs can tell an agent apart from a person. Check the audit trail in each major platform and make sure retention is long enough to support an investigation.
Define a kill switch. Decide who can disable each agent, how quickly, and test it once.
Add an AI agent scenario to your next tabletop exercise, such as an agent sending customer data to the wrong external system.
Report to the board in business terms: how many agents exist, what data they touch, who owns them, and when each was last reviewed.
How does AI agent governance change by company size and sector?
The right level of AI agent governance depends on company size and regulatory exposure. A simple decision rule:
Under 100 employees: agents mostly arrive as SaaS features. Focus on admin console settings, a one-page AI use policy, and one owner per tool.
100 to 1,000 employees: build the agent register, move agents to separate identities, and include agents in quarterly access reviews.
Healthcare, legal, and financial services firms of any size: treat any agent that touches patient data, client confidential information, or customer financial data as an in-scope system in your compliance program. Document its data flows, confirm your vendor agreements cover the AI feature, and keep the logs your regulator would expect.
Frequently asked questions
Does an AI agent count as an insider threat if it is not malicious?
Yes. Insider risk covers accidental and negligent actions as well as malicious ones, and accidents are the largest category: Trellix found accidental or careless actions made up 43% of insider incidents on average. An AI agent that moves data it should not, using access it was legitimately given, falls in the same category as an employee who emails the wrong file. Govern agents on access and impact, not intent.
Who should own an AI agent inside a company?
A named business owner should own each AI agent, with the security team setting the guardrails. The owner is usually the leader who requested the agent and benefits from its work. That owner approves the agent’s scope, reviews its access at least quarterly, and answers for it when something goes wrong. Security owns the standards and monitoring, not every individual agent.
Do the Trellix findings apply to companies under 1,000 employees?
The Trellix survey only sampled organizations with more than 1,000 employees, so its percentages do not directly measure smaller firms. The exposure still applies, because smaller firms use the same copilots and SaaS agents, usually with fewer controls and no formal insider risk program. Treat the numbers as a signal of direction rather than a baseline for your own company.
How can I tell whether an action was taken by an employee or by their AI agent?
Check whether each platform issues the agent a separate identity or tags agent-initiated actions in its audit log. If the log only shows the employee’s account, you cannot reliably separate the two. In that case, move the agent to its own service identity or choose a platform that records the difference. Test this before an incident, not during one.
If you cannot say how many AI agents are running in your environment, or who owns each one, that is the place to start. Purple Shield Security helps mid-market and regulated organizations build AI security governance that boards, auditors, and insurers can follow, through our AI security services and fractional CISO leadership. If you want a second set of eyes on where your agents stand, reach out and we can talk it through.
