New research from ServiceNow shows that nearly 90% of organizations in the UK experienced an “agentic AI security incident” last year, based on the findings of 3,700+ global security leaders.
This comes as the ITSM company calls on enterprises to take control of their AI security processes, warning that AI incidents are an active threat, not a future possibility.
What the Research Says
According to ServiceNow’s new report on the state of agentic security, 88% of UK organizations have already experienced an agentic AI security incident in the past year, and only 44% of those businesses contained it in under 24 hours.
Not only that, but only 13% of organizations globally have defensible programmes when measured against five key domains: attack surface, accountability, security by design, visibility, and audit readiness.
The report also provides insight into the state of the UK’s agentic adoption, claiming that over half of UK organizations now run between 100 and 999 AI agents, and 38% run more than 1,000. Alarmingly, a quarter of security teams found AI agents running in production that had never been registered or known.
“What stands out from this research is just how quickly businesses have started using AI agents, and how security is struggling to keep up,” Damian Stirrett, Group VP and General Manager UK & Ireland at ServiceNow, told NowBen.
“When 88% of UK organizations have already experienced an agentic AI security incident, that’s a pretty clear sign that we’re not talking about a future risk anymore. This is happening now, and businesses are having to deal with it.
“The challenge isn’t that organizations shouldn’t be using AI agents. Far from it. But if you don’t know exactly what agents you’ve got running, what they’re accessing or who’s responsible for them, you’re leaving yourself exposed.”
Why Now Is The Time to Be Security-Ready
The 88% figure highlights the threat activity in UK organizations, but it isn’t limited to just that region. Some of the highest-profile AI agent incidents have taken place in the last 18 months, including the OpenAI and Hugging Face situation, as well as ServiceNow’s own breach on its AI Platform.
This is why ServiceNow stresses the importance of moving from reactive, fragmented security to enable prevention-first, autonomously governed security. This way, companies can operate faster than AI creates risk.
The company’s Autonomous Security offering, announced earlier this year, works to do this for ServiceNow customers through the Shift Zero imperative – a cybersecurity strategy that replaces fragmented, reactive security with continuous, autonomous prevention at machine speed. This includes the rules and guardrails to safely adopt agentic AI, including a kill switch and AI Passport.
Final Thoughts
As AI security threats become more and more common, the pressure to protect instances only becomes greater.
We will likely hear more about ServiceNow’s efforts to simplify and scale AI security at this week’s World Forum event in London; we’ll report on everything you need to know.