01
Why the risk has moved from what AI says to what it does
A KPMG and Cequence report
Delegating Outcomes, Not Authority
Agentic AI Runtime Security, Governance, and Control
Organisations are starting to hand AI agents whole business outcomes: resolve this billing complaint, reconcile these accounts, restore this service. The agent chooses the path. Identity and static permissions confirm who is acting, but they can't decide whether the next action should proceed.
This report sets out how to govern each consequential action before it executes, for the agents you deploy and for the agents that act for your customers.
Get the full report
Complete the form for instant access.
Agents are already acting on your channels
65%
of IT and security leaders surveyed had seen an AI agent act outside its intended scope.
2026 survey of 202 IT and security leaders in North America and EMEA, conducted by Enterprise Management Associates for Cequence
1 in 7
AI agent visits went beyond reading and shopping to book, buy, sign in, or manage an account.
Cequence field data, 281,627 AI agent visits, October 2026
414K
visits to one marketplace claimed to be a widely used consumer AI agent. Every one was credential stuffing.
Cequence field data, October 2026
Inside the report
Written for CISOs, chief risk officers, and the leaders responsible for AI governance.
Get the report02
Seven recurring ways authorised agents produce unauthorised outcomes
03
A three-stage governance model and a runtime engine that decides each consequential action before it executes
04
Where to enforce controls for the agents you deploy and the agents that arrive for your customers
05
A 90-day adoption roadmap and results from a controlled study of persona-based governance