Solution 6 of 6
Find the AI and agents already running, decide what each can reach, and keep the evidence that it holds.
The problem
IBM’s 2026 study found that about one in five organizations reported an AI-related breach. Of those, 92% lacked proper AI access controls. Only 40% of all organizations said they use access controls on AI models and data.
An AI assistant or agent acts through the access it is given: data stores, tools, accounts and other systems. If nobody decided that access on purpose, it was set by whoever connected the tool first. The weakness is then in who can reach what, not in the model.
Fewer than half of organizations actively secure non-human identities, and AI agents are one of them.
AI-related breaches, IBM 2026
Each figure is a share of the group above it, as stated by IBM.
Common mistakes
The models do get attacked. IBM found model inversion and prompt injection to be the costliest AI attacks. But most organizations in its 2026 data with an AI-related breach lacked access controls on AI. Who and what can reach the model, its data and its tools is where much of the gap sat.
An agent chooses its own actions and uses tools and credentials to carry them out. OWASP names this in its 2025 LLM list as Excessive Agency. Its Top 10 for Agentic Applications, released in December 2025, adds Identity and Privilege Abuse, Tool Misuse and Rogue Agents. Treat each agent as an identity with limits.
NIST published FIPS 203, 204 and 205 in August 2024. It urged administrators to start integrating them immediately and said full integration will take time. Replacing cryptography is slow, so the early step is to know where you use it.
Regional view
IBM’s 2026 study put the average breach in the Middle East at $8 million. Of malicious breaches in the region, 26% were AI-enabled, and 55% of regional organizations with a security operations center had deployed agents in it. The study sample included organizations in the UAE and Saudi Arabia, but IBM gives no separate UAE figure.
Average loss per breach by attack type, 2026. IBM. The global average for all breaches is shown for comparison.
Standards we work from
Using a standard as a common language is not certification or endorsement.
How it works
| System | Data it sees | What it can do | Approved by |
|---|---|---|---|
| Support chatbot | Customer chats | Read, reply | Support lead |
| Code assistant | Source code | Read, suggest | CTO |
| Invoice agent | Finance ledger | Write | Nobody |
| Meeting notes tool | Calls, documents | Read, store | Nobody |
| Report builder agent | Finance ledger | Write | CFO |
We find where AI is already in use, including tools staff adopted on their own. For each one we record what data it sees, what it can call or change, and who approved that. We do the same for the agents you plan to run.
| System | May read | May change | Needs a person |
|---|---|---|---|
| Support chatbot | Chats, help articles | Nothing | Refunds |
| Code assistant | Repositories | Branches only | Merges |
| Invoice agent | Ledger | Draft entries | Every posting |
| Report builder agent | Ledger | Nothing | Not needed |
| Meeting notes tool | Own calls only | Nothing | Sharing |
We set what each system may reach and what needs a human decision. We test it against known attack types: the OWASP LLM and agentic lists, and MITRE ATLAS. The same method applies to new platforms and to cryptography that will need replacing.
Each item has an owner, a date and a record an auditor can open.
We check that the rules hold in practice and can be shown. That means test results, logs and a named owner for each decision. We map the evidence to the frameworks you use, so a regulator, auditor or customer can follow it.
Where this starts
Choose a question4 questions · select any
What you hold
| Attack type | System | Finding | Exposure |
|---|---|---|---|
| Prompt injection | Support chatbot | Reads hidden page text | High |
| Excessive agency | Invoice agent | Can post without approval | High |
| Sensitive data disclosure | Notes tool | Stores calls in shared space | Medium |
| Insecure plugin | Code assistant | Runs unreviewed script | Medium |
| Training data leak | Report builder | None found | Low |
Every system in use or planned, with owner, data, reach and who approved it.
Who uses itCISO, CIO, AI and data leads
What each system may access or change, and which actions need a person to decide.
Who uses itSecurity architects, IT owners
Findings against the OWASP LLM and agentic lists and MITRE ATLAS, ranked by exposure.
Who uses itSecurity engineering, AppSec
Records that map to NIST AI RMF or ISO/IEC 42001, where you use them.
Who uses itRisk, compliance, audit
Where new platforms or post-quantum cryptography change your architecture, and in what order.
Who uses itCIO, CISO, board
A different way to look
The policy is in place. Nothing shows what the systems can reach.
| System | Owner | Can write to | Approval |
|---|---|---|---|
| Invoice agent | CFO | Finance ledger | Enforced |
| Report builder agent | CFO | Finance ledger | Enforced |
| Support chatbot | Support lead | Nothing | n/a |
| Code assistant | CTO | Branches | Merge review |
What leadership hears
We have an AI policy.→
Eleven AI systems. Two can write to finance data. Both need approval.
Where our specialists come in
Your problem decides which of these we use. You do not have to pick.
Adapt and transform
Read first
Article
The model is one layer of the risk. Data, tools, identities, supply chain and outputs are where much of the enterprise exposure sits.
Cybrilliant AI Security SME
Read →Research / Report
A review of what the main AI security frameworks, risk lists and government guidance cover, where they overlap, and what an enterprise still has to work out for itself.
Cybrilliant AI Security SME
Read →Expert Briefing
How AI agents change the attack path, which controls still hold when a model can act, and what to settle before autonomy goes live.
Cybrilliant Agentic AI Security SME
Read →Technical Explainer
Autonomy moves the risk from what a model says to what it is allowed to do.
Cybrilliant Agentic AI Security SME
Read →Architecture Guide
Agents act with real credentials. Each one needs an accountable owner, a bounded authority and an end date.
Cybrilliant Agentic AI Security SME
Read →Decision Framework
A way to decide, for each AI system, which controls must stop an attack, which must spot it and which must contain it.
Cybrilliant AI Security SME
Read →Questions
AI tools that staff use without IT or security approval. We start by finding them, not banning them.
Neither is required by us. NIST AI RMF 1.0 is voluntary. ISO/IEC 42001 sets requirements for an AI management system. We use them as a common language where they help your customers, auditors or board.
That is a question for your legal counsel; we do not give legal advice. The European Commission publishes the timeline, which was revised by the AI Omnibus. We map technical controls to the obligations your counsel confirms.
We check what it can reach, then try known attack types against it, such as prompt injection and misuse of its tools, using the OWASP lists and MITRE ATLAS. The result is findings tied to a specific system and a specific fix.
No. We start with what is already running and rank it by what it can reach. Low-reach tools can continue. High-reach ones get an owner and an approval step first.
