Enterprises will spend 2027 buying security for agents that are already running. The surveys show what they skipped at deployment. The four questions apply at any size. What changes is who owns the answers.
On October 28, a16z published a survey of 100 chief information security officers at companies with more than 1,000 employees. Asked to recall their top five priorities for 2026, they named exposure management and SIEM. Asked for 2027, all seven of the most selected initiatives involve AI. Internal AI agent security gained 28 points. Exposure and vulnerability management lost 21.
The easy read is that security budgets chase the newest threat. The better read is in the same survey: 92% of these companies report production use of employee generative AI tools, 83% run coding assistants or agents, and 55% have agent-to-application integrations live. The enterprise is paying to secure agents because the agents are already working. The 2027 security list is a bill for questions that were not asked at deployment.
The same four questions apply at 60 employees and 6,000. Below about 1,000 there is no security function to receive the bill, so it arrives through SaaS renewals, cyber insurance and customer questionnaires instead, and lands on the CEO. That changes who answers, not what. This piece is about the four questions the enterprise is now paying to answer, and why an operator at any size can settle them for a few leadership hours if they are settled before the agent runs.
Source: a16z, The New Security Agenda, Oct 28, 2026. 100 CISOs at companies with more than 1,000 employees. Union of the top ten initiatives in either year. 2026 priorities are recalled; 2027 priorities are stated in the same survey. Redrawn from the published data.
The mechanism is simple and almost nobody designs for it. An agent on an employee's laptop runs in that employee's session, under that employee's credentials. A copilot inside a SaaS product acts on behalf of the signed-in user through delegated tokens. Security Risk Advisors put it plainly in May: from the operating system's view, the agent is the user sitting at the keyboard, and there is no field in the endpoint tooling that says an action came from an AI. BeyondTrust's lab ran a computer-use agent through Microsoft Defender and CrowdStrike and recorded no alerts.
In a 1,000-person company the first agents are usually built by engineers with scoped service accounts. In a 200-person company the first agent is usually built by the CEO, the CFO or the head of operations, from a personal login, on a Sunday. Those people have access to everything. So does the agent.
The enterprises surveyed by a16z know this: 46% name agents exceeding their permissions or being compromised as a top worry. The joint guidance published by CISA, the NSA and their Five Eyes partners on May 1 says each agent needs its own verifiable identity and should never be granted broad or unrestricted access. The vendor surveys, which should be read as vendor surveys, point the same way: 1Password found 41% of organizations with agents holding access beyond what anyone approved, and Okta found only 47% of CISOs who could identify all the agents in their environment.
The cost of skipping this step has a date. On April 25, 2026, a coding agent working a staging task for PocketOS hit a credential mismatch, made one API call to its hosting provider using a fully permissioned token, and deleted the production database and every backup in nine seconds. The most recent recoverable copy was three months old. The provider's fix was a delayed-delete feature. The founder's fix should have been a token that could not reach production.
The second question is how much the agent may do on its own. The enterprise answer, across every 2026 survey, is a ladder. PwC asked 3,934 business and technology leaders: 22% would authorize fully autonomous action, 38% partial autonomy, 36% human-led with AI support. The a16z CISOs are on the same ladder: 36% are comfortable with autonomous action on low-risk tasks today, 60% expect to be within a year, and 7% expect to allow it in most cases.
Sources: PwC 2027 Global Digital Trust Insights, 3,934 business and technology leaders, published Oct 1, 2026 (segments sum to 96%; the remainder did not answer). a16z CISO survey, Oct 28, 2026, N=100.
The useful detail is where the rung sits. The a16z respondents draw the line between gathering information and changing a production system. An agent can pull the logs; a person approves the change. Microsoft shipped exactly that as a product feature in September: a per-tool toggle in Copilot Studio that requires human approval before an agent sends an email, closes a ticket or processes a payment.
That line is not a security setting. It is an operating design decision, and it applies to every function an agent touches. Accounts payable: the agent codes and matches invoices, a person releases the payment run. Pricing: the agent proposes, a person publishes. Scheduling: the agent drafts the week, a manager posts it. Customer service: the agent answers, a person issues the refund above a threshold. McKinsey's October guidance says the same thing in its own vocabulary: autonomy, access, oversight and escalation belong in the design of the work, with ownership established before launch, not after the pilot.
Most companies without a security function run one of two settings. No gate anywhere, until the first incident. Or a gate on everything, which is why the agent is still a demo nine months in. Both are the same mistake: nobody decided which actions are reversible.
In the enterprise, the problem is too much gate. 63% of the a16z responses describe security slowing at least some AI adoption, through reviews, approval requirements and restrictions on particular uses. Merge's survey of 1,500 employees at mid-sized companies (a vendor survey) found 28% skip asking permission because IT approval is too slow. The work goes underground. IBM's 2026 breach study, run by Ponemon, found shadow AI in 43% of incidents, up from 20% a year earlier.
Even at the enterprise, the structure lags the deployment: Deloitte's survey of 3,235 senior leaders found 21% with a mature governance model for agentic AI, and only 25% had moved 40% or more of their pilots into production.
Below the enterprise, the problem is no gate at all. RSM's Q1 2026 survey of more than 500 middle market executives found 35% with a formal AI governance framework and 44% with defined roles for AI decisions. Grant Thornton asked roughly 1,000 US leaders whether they could pass an AI governance audit in 90 days: 78% were not fully confident. Among the 100 private equity respondents, 9% were, the lowest of any sector, and 7% had a tested response plan for an AI failure.
There is a third pattern worth naming, because it is the one sponsors will meet in a board deck. KPMG tracked 314 executives at $1B+ companies across two quarters: confidence in their AI governance rose from 57% to 73%, while the share actually building controls into their agents fell from 43% to 30%. Confidence went up as the work went down.
A value creation plan that funds an "AI efficiency" line without that page is funding a liability nobody has sized.
The third question is what is running. The a16z authors describe the problem well: software approved as an ordinary application gains agentic capabilities with its next update, employees add extensions and integrations, and an agent's permissions grow as it takes on more work.
Below the enterprise, this is the whole story. The US Chamber surveyed 3,732 small businesses this summer: 66% use AI, 24% already use agentic AI, 34% plan to, and 64% of users rely mainly on tools built by someone else. A company that has never bought an "AI tool" is running agents through its CRM, its accounting package and its email client, each switched on by a vendor release and each acting under an employee's login. Merge found 62% of employees connecting AI directly to their email and 47% authenticating with personal accounts rather than anything IT provisioned.
No survey measures whether each agent has a named owner. The closest bookends are Okta's finding that 20% of enterprises manage agents ad hoc, by whichever team built them, and Forrester's prescription that there should be no unowned autonomy. Of every question in this piece, the inventory is the one a leadership team can least often answer in the room. Not because the number is large, but because nobody owns the list.
Source: RSM Middle Market Cybersecurity Special Report, Q1 2026 (The Harris Poll), more than 500 US middle market executives at $30M to $10B revenue. "Other or not stated" is the residual.
The fourth question is who closes the loop. Agents are good at producing findings, drafts, exceptions and recommendations. They are indifferent to whether anyone acts on them.
Security is the function with the cleanest data. HackerOne's platform shows validated, unresolved vulnerabilities up 131% in two years; in its summer survey of 111 security leaders at $100M+ companies, nearly 70% said findings now arrive faster than teams can resolve them. Bain's September report describes AI scanning lifting alert volume as much as eightfold, and leading companies moving 20% to 25% of their security staff into remediation to keep up. A fintech CISO told a16z the tools find vulnerabilities faster but do not patch faster.
Engineering shows the same shape. DX measured 500+ companies through the third quarter: pull requests per developer up 75.5% over four quarters, while teams with mostly AI-written code wait 105% longer for a first review. LinearB's dataset of 8.1 million pull requests found 84% of human-written changes merged within 30 days against 33% of AI-generated ones.
Sources: DX, State of AI Impact in Engineering, Q3 2026, 500+ companies (throughput over four quarters; first-review wait at teams with 80%+ AI-authored code versus 20% to 40%). HackerOne 2026 Security Research Report, platform data Jul 2025 to Jun 2026. Both are platform measurements, not opinion surveys.
The operator version is familiar. An agent flags 400 invoice exceptions a month that used to be 40. An agent drafts 60 customer replies a day that someone must read. Without an owner and a cadence, the backlog grows until the agent gets switched off, and the pilot is recorded as a failure of the tool.
The large surveys say the fix is organizational. McKinsey finds EBIT impact from AI stuck at 37% of companies for a second year, with high performers at 6%; three quarters of those high performers redesigned the workflow, against one quarter of everyone else. BCG surveyed 11,749 employees: 42% of daily AI users save at least a day a week, and 66% have been given no guidance on what to do with it. The hours are real. The structure to spend them is missing.
A sponsor reading an AI line in a value creation plan should know what happened in the function most able to automate. The a16z CISOs expect spending up (87%); roughly half expect headcount to rise, half expect it flat, and 4% expect to cut. PwC's larger sample agrees: 84% expect cyber budgets to rise. IANS and Artico, who benchmark what was actually spent, are more sober: average security budgets grew 5% in 2026 and 45% of organizations saw no increase at all. But 69% of their CISOs do not expect AI to reduce headcount, and 81% expect it to create new roles.
Agents did not replace the security team. They gave the security team something new to govern.
RSM adds the middle market warning. Among middle market companies raising AI spend, 41% are taking the money from cybersecurity. Governance work is growing in the one segment that is cutting the budget for it.
The questions do not change. The owner does. At $1B+ revenue, KPMG finds 49% of companies with defined use cases where an agent may not act on its own, and a CISO to enforce them. At $30M to $10B, RSM finds a dedicated CISO at 30% of companies. Under 250 employees, the US Chamber finds 64% of AI users relying on tools built by someone else, which means the vendor made the scope decision and nobody in the building reviewed it.
| Company size | Who owns the four answers | What the data shows | Source |
|---|---|---|---|
| $1B+ revenue | A CISO and a security function | 49% have defined no-autonomy use cases | KPMG Q3 2026, N=314 |
| $30M to $10B | A CISO at 30%; another executive at 24%; IT with no leader at 20% | 35% have a formal AI governance framework | RSM Q1 2026, 500+ executives |
| Under 250 employees | Usually the vendor, by default | 24% run agents; 64% rely on third-party tools | US Chamber, N=3,732 |
The arithmetic below the enterprise is different.
30% of middle market companies have a dedicated CISO. 20% leave security to IT with no named leader. 43% outsource the SOC and 41% outsource risk and compliance. Nine in ten use AI. One in four small businesses already runs agents, mostly through third-party tools. The party most likely to notice an unapproved agent in a PE-backed company at $40M of revenue is a managed service provider, not an employee.
Sponsors are not blind to this. Protiviti and NC State's 2027 risk survey ranks AI implementation risk second for private equity respondents, and 42% say better governance and accountability for AI deployments is a priority. The same report notes sponsors rate their ability to protect and respond lower than other sectors do, because the portfolio company runs the controls. Alvarez & Marsal found 73% of North American sponsors expecting AI to raise portfolio value within 12 months and 8% describing their own firm as leading in AI.
The mandate runs ahead of the readiness. That gap is where the four questions belong.
Four questions, in order. Each depends on the one before it.
The cost is small and the comparison is lopsided. Answering the four questions for one agent takes a leadership team three to four hours: an hour to scope and re-credential it, an hour to write the reversible list, half an hour for the inventory line, and a standing 30 minutes a week for the queue. A company with a dozen agents is looking at about 40 hours in month one and a few hours a week after that. The alternatives are the enterprise route, where a16z's CISOs report 44% defaulting to a platform purchase before they have an inventory, or the PocketOS route, where the price was three months of data and 30 hours of downtime on a token that took seconds to scope. The rules of thumb will fail where the company has no system of record to protect in the first place, or where the agents are spreadsheet macros by another name. Everywhere else, 40 hours against one irreversible action is not a close call.
In a Composition Diagnostic these show up in the first 14 days as a page in the operating structure, next to the spend authority matrix and the meeting cadence. The enterprise is about to spend a year of security budget on the same four answers.
Last week we sized a customer float from a filing. The agent float is harder to see, because it runs under names that already have access.
For a sponsor or a CEO, the question is narrower than whether to buy an AI security platform. Which agents are acting in your company today, under whose credentials, and who would know if one of them did something it should not?
Which agents are running, under whose credentials, and who owns each one show up in the first 14 days. Book 30 minutes with a principal to walk the four questions against your business.
Almost every initial AI deployment targets the visible layer of work when the actual leverage sits in the invisible layer underneath.
Every AI vendor pitch in the middle market understates the same line item. The model works. Then the project hits integration, and timeline and cost double.
