Surveys find most security teams cannot baseline normal AI agent behavior, creating a monitoring and governance gap
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 10/11/2026 12:18; os links antigos trazem para cá.
Industry research shows that organizations deploying autonomous AI agents cannot reliably define what normal agent behavior looks like. This undermines anomaly detection, access governance and incident response for these non-human identities (cybersecuritydive.com). The Abnormal AI 2026 State of Behavioral Security Report surveyed 525 security professionals and put numbers on the problem (helpnetsecurity.com, published 2026-11-10). 46% said their organizations are not at all effective at establishing baselines for normal AI agent behavior, while about two in five rated themselves very or extremely effective. AI agents are also the top planned behavioral-monitoring investment, chosen by 43% of respondents over the next two years (helpnetsecurity.com). This is a governance and visibility gap, not an active threat. Neither source reports a vulnerability, CVE, indicators of compromise, exploitation, threat actor or affected vendor product, and no vendor advisory or patch is involved. The Abnormal AI survey is vendor-commissioned, and the earlier Cybersecurity Dive piece (2026-11-06) does not name the report it covers, so the two may describe the same research, but this is not confirmed.
Detalhes técnicos
- Without a behavioral baseline, teams struggle to tell legitimate agent actions from compromised, manipulated or misconfigured ones (cybersecuritydive.com).
- Over 81% of respondents rely on behavioral anomaly detection to a major or extensive degree. About 72% said they detect unusual non-human identity behavior better than human behavior (helpnetsecurity.com).
- Baseline coverage is about half each for AI agents, API integrations and service accounts, versus 76.2% for user sign-ins (helpnetsecurity.com).
- Just over half of respondents said investigations from anomaly detection to remediation take at least four hours. False positives and difficulty defining normal activity are the main obstacles (helpnetsecurity.com).
Remediação
- Inventory AI agents as first-class non-human identities (cybersecuritydive.com).
- Log their tool calls, API usage and data access (cybersecuritydive.com).
- Scope their credentials to least privilege with short-lived tokens (cybersecuritydive.com).
- Build activity baselines before relying on anomaly detection (cybersecuritydive.com).
Linha do tempo
-
Abnormal AI survey: most security teams cannot yet baseline normal AI agent behavior
ler a análise desta fonte ocultar
A Abnormal AI 2026 State of Behavioral Security Report, based on a survey of 525 security professionals, finds that AI agents are the top planned investment for behavioral monitoring, chosen by 43% of respondents over the next two years. Nearly half of respondents (46%) said their organizations are not at all effective at establishing baselines for normal AI agent behavior, while about two in five rated themselves very or extremely effective (businesswire.com via finance.yahoo.com). Over 81% rely on behavioral anomaly detection to a major or extensive degree, and about 72% said they detect unusual non-human identity behavior better than human behavior. Baseline coverage is lower for AI agents, API integrations and service accounts, at roughly half each, compared with 76.2% for user sign-ins. Just over half of respondents said investigations from anomaly detection to remediation take at least four hours, and false positives and difficulty defining normal activity are the main obstacles. This is a vendor-commissioned survey with no reported exploitation, vulnerability or threat actor, so the risk is operational rather than an active threat.
-
cybersecuritydive.com ↗ · pub. 06/11/2026 12:36 · coletado 06/11 14:00 primeiro registro só resumo do feed
Report: enterprises lack behavioral baselines for autonomous AI agents, hampering monitoring and governance
ler a análise desta fonte ocultar
A new industry report covered by Cybersecurity Dive finds that organizations deploying autonomous AI agents cannot reliably define what normal agent behavior looks like, which undermines anomaly detection, access governance and incident response for these non-human identities. Without a behavioral baseline, security teams struggle to distinguish legitimate agent actions from compromised, manipulated or misconfigured ones. The article reports a governance and visibility gap rather than a specific vulnerability, intrusion or threat actor campaign; it names no CVE, no indicators of compromise and no affected vendor product. Operational urgency is therefore limited, but the gap is a forward-looking risk as agentic deployments scale. No vendor advisory or patch is involved.
Remediation
Defenders should inventory AI agents as first-class non-human identities, log their tool calls, API usage and data access, scope their credentials to least privilege with short-lived tokens, and build activity baselines before anomaly detection can be meaningful.