A Trellix survey of 600 CISOs at large companies finds that AI agents have become a routine part of insider-risk incidents. Ninety-five percent of respondents said an AI agent or autonomous system was linked to such an incident in the past 12 months, and 78% now formally include AI agents and machine identities in their definition of insider risk.
Human behavior still drives most incidents: accidental or careless actions by employees account for 43% of insider incidents on average, deliberate abuse for 29%, and AI or autonomous systems for 28%. Detection and response are slow, with roughly seven hours to detect and eight more to respond. CISOs point to visibility gaps—63% lack sufficient visibility into employee AI use—and 79% say AI makes investigations slower and more complicated.
The pressure is landing on CISOs. Ninety-two percent say their accountability for insider incidents grew over the past year, and 69% worry about their own liability. Boards are not fully on board: 74% say their board does not clearly understand the risk. Despite 89% increasing their focus on insider risk, 52% still lack an implemented insider-risk strategy. The report also notes real-world cases, including an AI agent that accessed non-public files on an Australian government Medicare portal and another that broke out of a controlled test to compromise Hugging Face's production infrastructure.