A new IRONSCALES report found that 77% of organizations have experienced agentic AI-related security incidents in the past year.
That figure comes from organizations that reported finding that an AI agent or tool acted on instructions or content that turned out to be malicious, misleading, or unauthorized in the past 12 months, with 57% reporting a confirmed case.
“For years, the goal of a phishing email was to fool a person. Today, it only has to fool the agent sitting between that person and their inbox,” said Eyal Benishti, CEO, IRONSCALES. “Organizations have handed AI agents the key to their email, files, and even payment systems, and attackers are using the oldest tricks in the book to turn those agents against them.”
Agentic AI adoption expands access to enterprise systems
The survey features responses from 501 U.S. IT and cybersecurity professionals at organizations with 1,000 to 10,000 employees.
It found that AI agents capable of acting on employees’ behalf are now used by 96% of organizations, with four in five giving those agents access to internal systems.
Further, 49% let agents into email inboxes or messaging platforms, and 30% grant access to finance, billing, or payment systems.
Malicious emails and phishing drive AI agent incidents
Attackers have noticed this shift in permissions. The most common types of AI-agent-related incidents were an AI tool summarizing or acting on a malicious email or message (42%) and an attacker using an AI tool during a phishing or social engineering attempt (41%).
“Last year’s data showed what happens when organizations take a warning seriously: they invested, and deepfake losses became less severe,” said Benishti. “Agentic AI demands the same urgency, and it can’t come at the expense of the progress already made against deepfakes. That starts with bringing security into the room when agents are approved and protecting the inbox for agents as well as humans.”
Additional key findings include:
- AI agents are now in use in the majority of surveyed enterprises: Only 19% limit agents to the public web with no internal access. Common systems agents can reach ticketing and helpdesk tools (67%), cloud storage (56%), email and messaging (49%), internal file repositories (49%), and security tools and logs (47%).
- Security teams have little say over agentic AI: While IT is the primary approver of AI agents, plugins, and connectors for organizations (78%), security holds that role at just 6%. Among organizations that experienced an AI-agent-related incident, 39% say an employee gave an AI tool access that security would not have approved.
- We are so back with the “preparedness paradox”: 93% say their incident response plan covers AI agents, 93% say training covers safe AI use, and 84% are confident they could identify an AI-driven incident. Yet, only 52% have formal policies, controls, and incident response processes all in place. The same gap appeared last year around deepfakes.
- Deepfake defense investment is paying off: The share of organizations actively investing in deepfake defense rose from 37% in 2025 to 48% in 2026. Among organizations that lost money to deepfake-related incidents, the estimated average loss fell by about 20%, from roughly $280,000 to roughly $225,000, and seven-figure losses were nearly cut in half (from 6% to 3%). Incidents remain widespread at 84%, and the share calling deepfake defense a “top priority” slipped from 71% to 60% as agentic AI competes for attention.
Why this matters for MSPs and MSSPs
For managed service providers (MSPs) and managed security service providers (MSSPs), the findings point to a growing security challenge as customers grant AI agents access to business-critical systems without necessarily applying the same oversight they apply to human users.
The gap between adoption and governance also creates an opportunity for providers to expand their security advisory services. MSPs and MSSPs can help customers inventory deployed agents, evaluate permissions, establish approval processes, and incorporate AI-specific threats into incident response planning.
For providers deploying AI agents within their own service delivery operations, the findings reinforce the need to evaluate how agents handle untrusted content and what actions they are authorized to perform.
As agentic AI adoption expands, securing the identities, permissions, and workflows behind those tools could become an increasingly important component of managed security services.