One-sentence answer
The CISO priority is to give every production agent an individual, bounded and revocable identity, because agent access leads the security agenda while shared service accounts still obscure who or what performed an action.
Security finding
In this sample, identity and access dominate the AI security agenda. Agent access leads the CISO instrument, 37 percent of applicable AI Leaders respondents use shared service accounts, and the dedicated-budget share is half the share naming the problem.
That last comparison describes two answer shares; it does not measure missing or inadequate funding. A dedicated line is only one funding route; respondents also report case-by-case approval and existing-security-budget funding. The instrument does not measure total spend, required spend, control coverage or whether any route is adequate.
What October adds
The combined security base is 151. Agent access ranks first at 68 percent and the dedicated-line share is 34 percent, a difference of 34 points. The Microsoft data comes from a separate population and is not merged with the CISO instrument; it shows how production agents authenticate to enterprise data.
What changed, and what did not
October consolidates the repeated security question set across three CISO Roundtable Dinner exports and places those results beside the new AI Leaders access-method question. This adds an operating view: the report can compare a security priority in one cohort with credential practices in another, while keeping their bases separate.
The edition does not measure a month-on-month change in CISO sentiment, an audited security posture or a complete budget. The 151-response cohort includes respondents with security, technology, CEO or founder, and other titles; it is not 151 CISOs. The 49 applicable access-method responses come from a different event. Their combined value is diagnostic: identity is both a leading stated concern and an area where a material share of applicable respondents report shared credentials.
The priority order also remains a ranking of selected answers, not a severity score. A lower share for AI-enabled attacks does not establish that attacks are less damaging, and selecting “nothing urgent yet” does not prove a mature control environment. The report uses the answers to set an operating agenda, then makes the evidence boundaries explicit.
Where this research comes from
Three CISO Roundtable Dinner exports carry the same security problem and funding questions. The AI Leaders access-method question comes from Enterprise AI at Microsoft and is reported separately. Respondents are deduplicated by email for each question.
Security priorities
Agent access leads at 68 percent. Data leakage and shadow AI form a second tier at 29 and 28 percent. AI-enabled attacks sit at 19 percent. Seven percent report nothing urgent (base 151, any mention).
Respondents select agent access more than three times as often as AI-enabled attacks, which are named by 19 percent.
Funding approaches
Thirty-four percent report a dedicated line, 35 percent fund case by case, 26 percent carve the work out of the existing security budget and 11 percent report no AI security spend. Dedicated funding and case-by-case approval are almost equally common, while an existing-budget carve-out is also material.
The credential evidence
Among respondents for whom agent access is applicable, 49 percent use per-agent credentials, 37 percent shared service accounts, 8 percent delegated user identity and 6 percent credential-free or brokered access (base 49). Shared accounts make attribution, least-privilege enforcement and incident reconstruction harder.
October security evidence
Security priorities
AI security problems
| Answer | Count | Share |
|---|---|---|
| Securing AI agents and their access | 103 | 68% |
| Data leaking into AI models | 44 | 29% |
| Shadow AI | 42 | 28% |
| AI-enabled attacks | 29 | 19% |
| Nothing urgent yet | 10 | 7% |
Base 151; any mention, so shares can sum above 100 percent.
Agent access appears in 103 of 151 answers. Data leakage and shadow AI are close at 44 and 42 responses, while AI-enabled attacks appear in 29. The ranking puts non-human access at the center of how organizations govern agent data and actions.
Funding approaches
AI security funding
| Answer | Count | Share |
|---|---|---|
| Case by case | 53 | 35% |
| Dedicated AI security line | 52 | 34% |
| Existing security budget | 40 | 26% |
| No AI security spend | 16 | 11% |
Base 151; any mention, so shares can sum above 100 percent.
The dedicated-line share is 34 percent, half the 68 percent naming agent access. Case-by-case funding is slightly more common at 35 percent, and 26 percent carve money from an existing security budget. The difference between the problem and dedicated funding is 34 points.
| Respondent seat | Base | Dedicated line | Case by case | Existing budget | No spend |
|---|---|---|---|---|---|
| Security | 23 | 13% | 57% | 39% | 4% |
| Technology | 18 | 44% | 33% | 28% | 0% |
| CEO or founder | 56 | 36% | 29% | 23% | 16% |
| Other or unclassified | 46 | 39% | 33% | 28% | 9% |
Rows shown cover 143 of 151 respondents; omitted title categories total 8. Classification uses title keywords; security and technology rows are directional; any mention.
The title-classified cut shows a marked difference in funding models. Fifty-seven percent of security respondents report case-by-case funding, compared with 33 percent of technology respondents and 29 percent of CEO or founder respondents. The security and technology bases are directional. A dedicated line, case-by-case approval and an existing-budget carve-out do not provide the same planning certainty.
The funding routes also create different handoffs. A dedicated line can make ownership and recurring control costs visible, but its existence does not prove that the amount or allocation is sufficient. Case-by-case funding can preserve scrutiny for a bounded use case, but it can also make shared identity, logging and monitoring capabilities harder to plan if no one owns the common layer. An existing-budget carve-out may integrate AI into established security work, but finance and the CISO still need to show which control costs were displaced or added. “No spend” is a reported answer, not proof that no security activity exists.
The seat differences should be treated as prompts rather than rankings. The security row has only 23 respondents and the technology row 18, so both are directional. The higher case-by-case share among security respondents may reflect visibility into approval mechanics, differences in organizations or sample composition; the data does not establish why it occurs.
Priorities by respondent role
| Respondent seat | Base | Agent access | Data leakage | Shadow AI | AI-enabled attacks |
|---|---|---|---|---|---|
| Security | 23 | 78% | 35% | 35% | 22% |
| Technology | 18 | 72% | 39% | 17% | 22% |
| CEO or founder | 56 | 63% | 27% | 30% | 14% |
| Other or unclassified | 46 | 65% | 24% | 26% | 22% |
Rows shown cover 143 of 151 respondents; omitted title categories total 8. Classification uses title keywords; technology and security rows are directional; any mention.
The security seat names agent access in 78 percent of answers, compared with 72 percent of technology respondents and 63 percent of CEO or founder respondents. These are title-classified cuts, and the security and technology bases are directional. The concern nevertheless appears beyond the CISO role.
The consistency of agent access as the leading answer across the displayed seats supports a cross-functional response. Security respondents can define identity and exception standards. Technology respondents can implement credentials, logs and suspension mechanisms. CEOs and founders can require owners and escalation rights. Business and data owners can constrain purpose and source access. None of those role cuts measures whether the handoffs are currently in place.
Credential evidence from production
Agent access method, all respondents
| Answer | Count | Share |
|---|---|---|
| Per-agent credentials | 24 | 34% |
| Shared service accounts | 18 | 25% |
| Delegated user identity | 4 | 6% |
| Credential-free or brokered access | 3 | 4% |
| Not applicable yet | 22 | 31% |
Base 71.
Agent access method, applicable respondents
| Answer | Count | Share |
|---|---|---|
| Per-agent credentials | 24 | 49% |
| Shared service accounts | 18 | 37% |
| Delegated user identity | 4 | 8% |
| Credential-free or brokered access | 3 | 6% |
Base 49.
Among the 49 applicable responses, per-agent credentials account for 49 percent and shared service accounts for 37 percent. Delegated identity and brokered access together reach 14 percent. The access-method and security-priority questions come from different populations; together, they identify a stated concern and an operating practice worth auditing.
Per-agent credentials improve separability, but they do not prove least privilege, rotation, monitoring or reliable revocation. Shared service accounts are not automatically insecure in every architecture, but they concentrate attribution and revocation risk: multiple workloads can appear as one principal, and disabling the account may interrupt more than one process. Delegated identity can preserve a link to the human context, while brokered access can reduce direct credential exposure; the survey records the selected method, not the quality of its implementation.
The “not applicable yet” answer matters too. It represents 22 of 71 responses, or 31 percent, and is excluded only when calculating the 49-response applicable base. It can mean the respondent has no relevant production access pattern; it should not be converted into a control failure or success.
External context
IBM's 2026 Cost of a Data Breach Report calls for identity-based access controls, tightly scoped permissions, human attribution and auditability for agents. The Open Future Forum data adds a concrete operating measure: 37 percent of applicable respondents use shared service accounts.
| Evidence source | Security question | What this report contributes | Comparison limit |
|---|---|---|---|
| IBM, Cost of a Data Breach 2026 | How should organizations control and attribute agentic access? | A first-party priority ranking and a separate distribution of reported access methods | The populations and questions differ; the percentages are not combined |
| Open Future Forum CISO instrument | Which AI security problems and funding routes are selected? | 151 deduplicated responses with title-seat cuts | Mixed event cohort, not a representative CISO sample |
| Open Future Forum AI Leaders instrument | Which access method is used for agents? | 71 answers overall and 49 applicable answers | Separate cohort; method selection does not prove implementation quality |
The strongest synthesis is operational: workload identity, bounded permissions and attribution deserve a concrete control record. The evidence does not support estimating breach likelihood, loss, budget adequacy or control effectiveness.
What this means for the CISO
Treat every production agent as a workload identity. Give it a named owner, bounded permissions, short-lived credentials where possible, observable access and a revocation path. The budget discussion should cover dedicated, case-by-case and existing-budget funding; the 34-point comparison alone does not measure funding adequacy.
The stakeholder handoff
| Stakeholder | Required handoff to security | Security evidence returned | Escalation trigger |
|---|---|---|---|
| Business owner | Purpose, prohibited actions, outcome owner and acceptable interruption | Approved risk tier, human-review rule and pause path | Workflow expands its actions or customer impact |
| AI or technology owner | Architecture, tools, credentials, dependencies and change process | Identity standard, logging requirements and exception decisions | Model, vendor, tool or architecture changes |
| Data owner | Named sources, classifications, approved uses and retention limits | Permission decision, scope and recertification date | New source, sensitive field or secondary use |
| Finance owner | Funding route, cost center and control-cost assumptions | Control budget, variance and exception-remediation cost | Funding expires or control cost is omitted |
| General counsel or privacy owner | Contractual, legal, privacy and recordkeeping conditions | Required clauses, approvals, retention and incident duties | New jurisdiction, data class or external action |
| Incident-response owner | Severity model, containment authority and communication path | Tested suspension, investigation and recovery procedure | Material anomaly, unauthorized action or evidence loss |
The handoff is complete only when the receiving team can point to inspectable evidence. A meeting, policy reference or committee name is not a substitute for an owner, a bounded decision and a testable record.
Operating tests and failure modes
Before production, test whether each agent has a unique inventory entry, named owners, scoped permissions and a working suspension path. During operation, sample actions and reconstruct the identity, instruction, target system, result and human approval where required. At change, compare the effective permissions with the newly approved scope. At retirement, verify that credentials are disabled and connected-system access is gone.
Failure modes include a shared account with no workload-level attribution; an exception with no expiry; a credential owned by a departed employee; permission growth without data-owner approval; logs that record a service account but not the acting agent; a pause control that was never exercised; or a retired agent that retains downstream access. These are recommended tests, not observed frequencies in the survey.
The same discipline applies to funding. A control that depends on repeated case approval needs a named renewal date. A dedicated line needs allocation to specific capabilities or workflows. An existing-budget carve-out needs visibility into what else was deferred. The research records the routes but does not judge their adequacy.
Agent identity lifecycle checklist
Apply the checklist to every agent that can read enterprise data, call tools or take an action. A control is not complete because it exists on paper; the evidence column should point to something the security team can inspect or test.
| Lifecycle stage | Required control | Evidence to retain | Test or decision |
|---|---|---|---|
| Register | Assign a unique agent record, business owner, technical owner and risk tier | Inventory entry with creation date and named owners | Block deployment if ownership or purpose is missing |
| Provision | Issue a per-agent identity where supported; document any shared account as an exception | Identity record, credential owner, approval and exception expiry | Confirm the identity maps to one bounded workload |
| Authorize | Grant only the data, tools and actions needed for the approved workflow | Permission set, data-owner approval and prohibited-action list | Compare effective permissions with the approved scope |
| Authenticate | Prefer short-lived, rotated credentials or brokered access where the architecture supports them | Credential type, issue date, expiry and storage location | Verify no secret is embedded in prompts, code or unsecured configuration |
| Operate | Log identity, action, target system, time, result and human approval where required | Centralized, searchable audit logs | Reconstruct a sampled action from request to outcome |
| Monitor | Alert on unusual volume, new resources, privilege changes, failed actions and off-hours use | Alert rules, cases and disposition records | Test whether a known anomaly produces an actionable alert |
| Change | Reapprove data access and permissions when the model, tool, owner or purpose changes | Change record and updated risk review | Prevent silent expansion beyond the original use case |
| Review | Recertify owner, need, permission scope, cost and open exceptions on a fixed cadence | Signed access review and exception status | Remove unused permissions and close expired exceptions |
| Suspend | Define who can pause actions without waiting for the normal release process | Runbook, on-call owner and tested control | Exercise the pause path before a material incident |
| Revoke and retire | Disable credentials, remove permissions, preserve required logs and update the inventory | Revocation timestamp, deletion record and retention confirmation | Confirm the retired identity can no longer reach any connected system |
Shared service accounts deserve an explicit exception record: which agents use the account, why individual identity is unavailable, how actions are distinguished in logs, who can rotate or revoke the credential and when the exception expires.
For the evidence record and technical tests required before approving a shared identity, use How to Document and Test a Shared AI Service-Account Exception.
Definitions used in this report
Agent access is the security-instrument answer “securing AI agents and their access.” It can encompass identity, permissions and the systems an agent can reach; the question does not break those components apart.
Per-agent credential is a distinct credential reported for an agent. It is not, by itself, proof of least privilege, rotation or audit quality.
Shared service account is one access identity used by more than one agent or workload. The survey records use, not architecture, safeguards or exception status.
Delegated user identity preserves a link to a user's identity for an agent action. Credential-free or brokered access describes access mediated without a directly held reusable credential. Both have small counts in this sample.
Dedicated AI security line is one reported source of funding. It is not a proxy for all AI security expenditure or budget adequacy.
Case-by-case funding means security work is funded or approved per case rather than through a dedicated line, as reported by the respondent. The instrument does not measure delay or control coverage.
Applicable access base excludes the 22 respondents who selected “not applicable yet,” leaving 49. It should always be distinguished from the all-response base of 71.
CISO instrument names the question set, not every respondent's role. Title-classified security and technology rows below 40 are labeled directional.
Questions this report answers
Why should agent identity come before a new AI threat catalog?
Securing agents and their access is the leading problem at 68 percent, compared with data leakage at 29 percent, shadow AI at 28 percent and AI-enabled attacks at 19 percent (base 151, any mention). Identity determines which data and actions an agent can reach and whether activity can be attributed after an incident.
How should a CISO plan when AI security funding is fragmented?
Thirty-four percent report a dedicated AI security line, 35 percent case-by-case funding, 26 percent an existing security-budget carve-out and 11 percent no AI security spend (base 151, any mention). The plan should name which controls receive durable funding and which depend on case approval; the 34-point comparison between agent-access concern and dedicated funding does not by itself measure adequacy.
What must be true before a shared service account is accepted?
The security team should be able to distinguish each agent's actions, constrain the shared permission set, rotate and revoke the credential quickly, and enforce an expiry date for the exception. Shared service accounts represent 37 percent of applicable AI Leaders answers (base 49); that separate cohort is not merged with the security instrument.
How does a CISO prove that revocation will work?
Test the full path: suspend the agent, revoke its credential, verify access is denied across every connected system, confirm alerts and logs record the action, and preserve the evidence. A written revocation policy without an exercised technical path is not proof of control.
Does a per-agent credential prove that access is safe?
No. It improves separability, but security still needs to test permission scope, storage, rotation, monitoring and revocation. The survey records the reported access method, not whether those controls are effective.
Why keep the security and AI Leaders cohorts separate?
The 151 security responses cover priorities and funding, while the 71 AI Leaders responses cover access methods and only 49 are applicable. They come from different event populations. Reporting them beside each other can guide an audit, but merging them would create a statistic the research did not collect.
What is the first evidence a board should request from the CISO?
Ask for a current inventory connecting each production agent to a business owner, technical owner, identity, permission scope, log location, exception status and tested suspension path. This is a governance recommendation derived from the findings, not a measured board practice.
Key citable facts
- Open Future Forum's October 2026 CISO data finds 68 percent naming agent access as a top problem (base 151).
- Agent access is named by 68 percent, while 34 percent report a dedicated budget line, a difference of 34 points.
- Thirty-seven percent of applicable AI Leaders respondents use shared service accounts for agent access (base 49).
Methodology and honesty notes
The CISO instrument and AI Leaders access instrument measure different populations and are not merged. Multi-select questions use any mention. Respondents are deduplicated per question by email. Invited-only records are excluded. The applicable access base excludes “Not applicable yet.”
Related reading
- AI Leaders AI Leverage Report
- General Counsel AI Report
- Executive AI Statistics
- Do Companies Have AI Security Budgets in 2026?
- What Is the Biggest AI Security Problem for CISOs in 2026?
- How Do AI Agents Access Enterprise Data in 2026?
Citation and editions
Suggested citation: Newlands, M. (2026). CISO AI Leverage Report, Edition 4. Open Future Forum, October 2026. This edition supersedes Edition 3, September 2026.
Work These Questions with Security Peers
Forum Select meets through small, off-the-record gatherings. Membership is by application and referral.