90% of organizations in the EMEA region have experienced a security incident related to agentic AI in the last year, and only 36% of them managed to contain it in less than 24 hours. This is what a new study by ServiceNow reveals, which warns of the security risks derived from the use of agentic AI without adequate governance in companies.
The report, titled Deployed but ungoverned: the state of agentic security, collects responses from 3,766 senior security and technology managers from organizations around the world, of which 1,265 belong to the EMEA region. Their conclusions come at a time when AI agents are leaving the pilot phases behind to integrate into the systems that support the operation of hospitals, airports, factories, financial entities and other sectors. These are environments in which a single action without adequate controls can have serious consequences for society.
“The incidents involving agentic AI that have made headlines this year are a warning of what can happen when this technology is deployed without proper controls,” said Ben de Bont, Chief Information Security Officer (CISO) at ServiceNow. “Organizations should not have to choose between moving quickly and managing risks. “Those that get it right will build governance into their agent deployment early on, so they can take advantage of AI without losing visibility or control.”
Gaps in the governance of agentic AI
According to the ServiceNow report, while many security leaders believe their organizations have strong protections in place for agentic AI, only 13% of organizations globally have security programs that meet the criteria in five key areas: attack surface, accountability, security by design, visibility, and audit readiness.
Currently, most agentic AI is managed through traditional governance frameworks and systems that rely on human intervention. In EMEA, less than half of organizations have governance frameworks covering the main aspects of deploying AI agents. Furthermore, in 56% of organizations in the region, security governance begins once the design phase of AI agents is complete, indicating that, in most cases, security is addressed reactively, rather than being integrated from the early stages of development.
AI agents increase companies’ risk exposure
- 50% of EMEA organizations already use between 100 and 999 AI agents, while 34% use 1,000 agents or more.
- 58% of security teams in the region have a complete and accurate inventory of all AI agents in production and have procedures to track changes.
- 24% of security teams have detected operational AI agents that had never been registered or whose existence was unknown. These agents can lead to shadow AI situations, which are only discovered after they have been operating unsupervised.
Risks advance at the speed of machines, but the response still depends on people
- 75% of organizations in Europe, the Middle East and Africa say they maintain a complete and up-to-date map of the systems and resources each agent can access, but only 23% can monitor more than 90% of their agents in real time.
- Even organizations capable of detecting a problem often cannot stop it quickly enough. 67% of the region’s security teams cannot act automatically when an agent exhibits anomalous behavior, so human intervention is still necessary to apply corrective measures.
Reduce the gap to regain control
ServiceNow’s Autonomous Security solution helps companies move from a reactive, fragmented security model to one based on prevention and autonomous governance, capable of acting faster than AI generates new risks.
Under the Shift Zero principle, ServiceNow helps organizations keep their risk exposure as close to zero as possible at all times. This allows companies to demonstrate what their systems are doing, why they are doing it, and who or what is responsible for their actions, without slowing the pace of AI adoption that business demands.
Organizations should not have to choose between moving quickly and managing risks
This approach includes the standards and protection mechanisms necessary to safely adopt agentic AI, including a kill switch and AI Passport.
“Innovation and security must advance at the same time, not one after the other,” says Nadir Izrael, vice president of Cybersecurity and Risk at ServiceNow. «That is the
The goal of Autonomous Security and Shift Zero: integrate governance from the moment an agent is developed or deployed, rather than adding it later. “When security can operate at machine speed, it stops being a brake on AI adoption and becomes what enables it to scale safely.”
