Governing the agent workforce: New data on the next frontier of AI risk

In the fast-paced world of agentic AI, building agents and defending ROI is yesterday’s news. Today, the more pressing challenge is managing and governing the exploding workforce of agents to mitigate growing enterprise risk.

The problem intensifies as AI agents move from advisory to more active roles. According to a survey of 200 IT and AI decision makers conducted by Foundry and Rubrik, most agents are allowed to act with full (26%) or limited (35%) autonomy.

With access to enterprise systems and authority to execute end-to-end tasks, governance, guardrails, and compliance have become key obstacles to AI agent implementation. This was cited by 42% of survey respondents, along with AI agent management, at 18%. Almost one quarter of respondents (24%) cited security and governance as the biggest barrier to their ability to scale agents, even over technical complexities (17%) and lack of proven ROI (14%).

Rubrik

The reality is traditional security, monitoring, and governance solutions are architected to manage human identities, not agentic AI. “We spent decades mastering how to manage humans and we’ve gotten pretty good at that,” says Michael Ortega, Director of AI Marketing at Rubrik. “We don’t yet have that same rigor for agents.”

For example, there is no scenario where a company would hire 1,000 new employees without onboarding or managerial oversight. Nor would they give them access to highly sensitive data right off the bat. “[AI agents] are our new employees, but that’s exactly how we are treating them,” Ortega cautions.

A new governance paradigm

Traditional security and governance guardrails don’t translate well to an agent workforce that moves at machine speed to evaluate and execute thousands of decision points in seconds. AI agents are also probabilistic, which lets them make complex decisions, but also act in unpredictable ways. As a result, a rogue agent can do 10x the damage of a human in one-tenth the time.

Currently, most organizations use logs and manual review or legacy observability platforms to keep tabs on agents. But they lack the holistic visibility and context needed to effectively track agent identity, actions, and downstream impact. There are also a variety of methods employed to govern agents, many paper-based, with limited ability to control agent behavior at run-time.      

Without a new paradigm for controls and visibility, AI agents become a vector for significant enterprise risks while undermining business value. Nearly half of survey respondents have had to deal with an agent or chatbot conveying false or incorrect information. Another 38% confirm agents have exfiltrated data or caused a sensitive data leak.

But it’s not because AI agents are inherently malicious – it’s because they lack the common sense of their human counterparts. “We can’t put a human in the loop for everything because that would slow things down,” Ortega explains. “We have to enable our teams to have autonomous workflows without having a human check everything.”

A new breed of solutions is emerging to manage the autonomous workforce. As an example, Rubrik tackles this head-on by leveraging AI to govern AI. Rather than relying on static rules and legacy pattern matching, Rubrik Agent Cloud evaluates real-time behavior anchored in deep data and identity context. Armed with this context, the platform assesses agent intent to block or permit actions before execution. By unifying monitoring, control, and remediation into a single pane of glass, Rubrik delivers holistic visibility across the entire agent estate. For the inevitable moment an AI agent strays, Rubrik’s Rewind initiates granular rollbacks to restore the environment to a known good state, eliminating downtime and data loss.    

AI is forcing IT and security leaders to reimagine governance, and platforms that safely unleash the agent workforce are essential for success. See all the insights from the survey on agentic governance and risk.