EMA research

Cequence Security and EMA surveyed 202 enterprise IT and security leaders and found that 94% are confident their AI agents aren’t over-provisioned, yet only 33% enforce least-privilege access. Sixty-five percent have already experienced an out-of-scope agent action, with 29% reporting measurable business impact. The research defines a runtime authorization gap that point-in-time compliance frameworks aren’t built to close.