SecurityHQ Research Finds an Accountability Gap in How Enterprises Govern AI Agents
45% of Cybersecurity Leaders Report AI-Related Incidents with Unclear Accountability; meanwhile, only 17% could rapidly
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
LONDON, Oct. 15, 2026 (GLOBE NEWSWIRE) — SecurityHQ, the global cybersecurity company pioneering Security Performance Engineering for stronger operational performance and resilience, today published new research, in collaboration with Datadog, the leading AI-powered observability and security platform for cloud applications, identifying a massive disconnect between how enterprises define accountability for AI agents and their ability to establish an agent’s recorded actions.
“The Accountability Gap: The State of AI Agent Security and Governance 2026” surveyed 204 cybersecurity leaders at midsize and large organizations. Of the respondents, 76% said their organization has formally defined accountability for AI-driven operational or security decisions. At the same time, 45% have already experienced an incident involving AI agents or automation where accountability was unclear.
The challenge is becoming more urgent as agents gain greater access across enterprise environments. 51% of respondents said AI agents already operate broadly across their organizations, and 93% expect agents to access enterprise systems more frequently than humans within five years.
“Most security teams can see that agents are working. Far fewer can explain what an agent did, in what sequence, and under whose authority. Those are the questions that matter when something goes wrong,” said Feras Tappuni, CEO of SecurityHQ. “Defining accountability in a policy document is the easy part. It has to hold up in the hour after an incident, when the facts are incomplete, the business needs answers, and someone has to decide what to isolate and who has the authority to act.”
The findings show that many organizations still lack the visibility to answer those questions quickly. Only 49% said they could fully reconstruct every action an AI agent performed over the previous 30 days. Following a critical incident, 17% could reconstruct that activity within minutes. 51% would need hours, 23% would need days, and 9% would need longer or were unsure.
“Enterprises are adding a new class of actor to their infrastructure, and most observability was designed around people and the services they run,” added Tappuni. “Agents need the same level of instrumentation. When teams can see what an agent touched and when, in real time, questions about accountability become answerable.”
That visibility becomes more complicated when agents operate outside approved processes. Nearly half of respondents (49%) believe someone inside their organization may already be running an unapproved AI agent. Among those respondents, 51% said the activity spans multiple teams.
“The fundamentals are identity, permissions, logging, and being able to follow an agent across systems that were not designed to be read together,” said Aaron Hambleton, Senior Vice President of Product & Services at SecurityHQ. “That operational context is what allows security teams to reconstruct what happened to make smart and defensible decisions quickly. Without it, the first hours of an incident can be wasted assembling the timeline.”
The research also found a clear expectation that human judgment will remain part of consequential decisions involving AI agents. 99% of respondents identified at least one category in which human review should remain mandatory, led by financial approvals at 61%.
The full report is available at: https://www.securityhq.com/the-accountability-gap/
About SecurityHQ
SecurityHQ is a global cybersecurity company that helps organizations engineer, measure, and continuously improve the performance of their security operations. Founded in 2003, the company delivers flexible and technology-agnostic solutions through its Security Performance Engineering approach. Built around each customer’s environment, the approach brings together managed detection and response, threat and adversary intelligence, exposure management, and advisory services. With 400+ analysts and engineers across six global SecOps Centers, SecurityHQ provides 24/7 human-led detection, response, and continuous improvement. Its work is focused on reducing noise, improving decision-making, and strengthening security performance over time.
Contact Neil Davies neil@broadsheetcomms.com
Media gallery
