"There is no plan [for AI agents]…we don't know what the solutions are, but we're all gonna put resources to go after it."
—CISO, B2B Software Organization
Enterprise organizations are racing to secure the behavior of autonomous AI agents. 43% of surveyed security leaders will put their greatest behavioral-monitoring investment into AI agents over the next two years, more than 3x the next category.
And yet, nearly half of respondents say they are not at all effective at establishing and maintaining behavioral baselines for AI agents today.
Securing behavior for human and non-human identities has always been Abnormal’s foundational philosophy. With 81% of respondents already relying on behavioral anomaly detection to a major or extensive degree, we’ve asked them what stands in the way of fully operationalizing the behavioral approach, and what their teams are doing to respond to the ongoing deployment of AI agents making autonomous decisions across the org.
Drawing on insight from 525 cybersecurity leaders across 6 countries, plus 4 in-depth CISO interviews, the 2026 State of Behavioral Security provides a comprehensive picture of organizations’ struggle to define normal for increasingly unpredictable actors.
See the Data
False Positives and Defining Normal Are Top Concerns for Security Teams
With 87% of respondents having mostly or comprehensively operationalized behavioral baselining, among the most commonly cited obstacles in achieving broader coverage are:
The problems at the top are related to baselines, while logistical issues like staffing and budget are less prominent. “Too many false positives start to erode confidence,” one healthcare CISO told us.
A CISO at another healthcare organization showed what imprecision in baselining behavior looks like on the ground. Their identity population includes physicians who might access the environment several times in three months, then disappear for six.
In this scenario, a rule that treats prolonged inactivity as abnormal only generates more work, because it cannot adequately define normal behavior for a human identity that’s perfectly routine for its environment.
Imprecise Baselines Can Delay Teams’ Investigations
90% of respondents say understanding why a behavioral anomaly triggered is very or critically important to how they respond. Yet, even as AI accelerates both attack methods and detection, reaching that understanding is slow for many teams.
51% need four hours or more to fully investigate and remediate a single behavioral detection, and one in ten need at least a full day.
Those hours often go into reconstructing context the baseline of normal should have carried: who or what generated the activity, what that identity normally does, whether permissions recently changed.
"All we know is it's misbehaving," one CISO said.
The Gap Widens With Non-Human Identities
The physician example illustrates the challenge for human identities, where teams still have substantial behavioral history to draw on. With the exception of SaaS, behavioral-baseline coverage is generally lower across non-human categories. Yet confidence in detection moves the other way.
72% of respondents say their organization is better prepared to detect anomalous behavior from non-human identities than from human ones. At the same time, 53% do not establish normal for machine identities at all.
That confidence is not baseless. A service account with a defined purpose and a fixed set of permissions may be easier to read than a person, and deviations can stand out even where monitoring is incomplete. The logic holds for exactly as long as the machine actor stays predictable. But for AI agents…
Agents Remove That Assumption
A machine identity is a credential used to obtain access. An AI agent is a software actor deciding what to do with that access: pursuing a goal, selecting a route, and behaving differently the moment it is given a new tool. Authorization establishes that an agent is permitted to act. It says nothing about whether this action, in service of this goal, is what the agent should be doing.
“We know what a service account’s supposed to do and what it’s not supposed to do,” one CISO told us. “The challenge with [AI] agents is: we don’t know what we don’t know.”
The ambiguity doesn’t end there. One CISO drew a line between durable agents—the kind you can tie to a user or a service principal—and ephemeral sub-agents, created for a single task and gone almost immediately.
“How are you gonna go audit an AI activity that lasted for 30 seconds on a virtual machine?”
Another CISO pushed further: “What is to stop that agent from cloning itself? And then telling its clone to go do stuff on its behalf?” If clone inherits its parent’s authorization and permissions, both checks pass. Only its behavior would give it away, and only if the security team has tools that know to look for it.
Over half of organizations—54%—already maintain behavioral baselines for AI agents. At the same time, 46% of all respondents say they are not at all effective at establishing and maintaining baselines for AI agent behavior.
Teams are actively trying to get ahead of the problem that can be summarized in three questions:
Is this agent authorized?
Is this action permitted?
Is this behavior expected for this agent, pursuing this goal, on behalf of this user?
Every team already running agents is living with all three, answered or not.
Explore the full research findings, compare your team’s coverage against 525 peers, and read more CISO perspectives on securing AI agent behavior.
Step Inside the 2026 State of Behavioral Security
The 2026 State of Behavioral Security Report is based on a survey of 525 cybersecurity professionals at organizations with 1,000 or more employees across 6 countries, approximately 85% of whom hold CISO-level or security operations leadership roles. The survey was fielded by AimPoint Group on behalf of Abnormal AI between July and August 2026, alongside 4 in-depth CISO interviews. Obstacle figures reflect a select-up-to-three question. Figures are rounded to the nearest whole number. Results reflect respondents’ self-reported views.