UpTrajectory Review

CIO Magazine reports on a Foundry survey of 200 IT and AI decision makers, sponsored by Rubrik, that finds enterprises racing to deploy AI agents without the governance muscle to control them. Most agents already operate with full (26%) or limited (35%) autonomy, touching enterprise systems and executing end-to-end tasks. The survey frames governance, guardrails, and compliance as the top obstacle to agent implementation (42%), with security and governance named the biggest barrier to scaling (24%) — ahead of technical complexity (17%) and unproven ROI (14%). Rubrik's Michael Ortega argues that decades of human-identity management have left enterprises unprepared for machine-speed, probabilistic actors.

For a small-business operator, this is not an enterprise-only problem dressed down. If you run a ten-person shop and grant an AI agent access to your accounting system, email, or customer database, you face the same exposure as a Fortune 500 firm — you simply lack the compliance department to catch it. The analogy lands: no sane owner hires 1,000 employees without onboarding, oversight, or a probationary period, yet businesses grant agents broad system access on day one. The survey data signals that even large organizations with security budgets struggle; smaller operators should read that as a warning, not a comfort.

What is genuinely new here is the shift from advisory to active agents. Earlier AI rollouts recommended; these execute. That transition breaks traditional security models built around human identities, static permissions, and predictable behavior. Ortega's point that agents are probabilistic — capable of complex decisions but also unpredictable action — exposes a real gap in conventional tooling. We agree with the diagnosis that governance lags deployment. We remain skeptical of vendor-sponsored surveys, however; Rubrik sells data-security products, and the framing conveniently elevates a problem its portfolio addresses. Treat the percentages as directional, not definitive.

Second-order effects ripple outward. Insurers will eventually ask whether your agents are governed before underwriting cyber policies. Regulators will demand audit trails for automated decisions, especially in finance, health, or hiring. Employees whose workflows intersect with agents will need retraining, not just reassurance. Downstream, expect a cottage industry of agent-monitoring startups and a talent market for 'AI governance leads' — a role that did not exist two years ago. The cost of inaction is asymmetric: a rogue agent operating at machine speed can inflict damage at a scale no human insider could match.

What to watch next: whether standards bodies and cloud platforms ship agent-identity frameworks before regulators mandate them, and whether any vendor-neutral benchmarks emerge to cut through the marketing. For operators, the actionable step is unglamorous but urgent — inventory every agent you have deployed, document what systems each can touch, and apply the same least-privilege discipline you would give a new hire. Start with your most sensitive data stores. If you cannot answer 'what can this agent do, and who approved it,' you do not have an AI strategy; you have an unpriced liability.

Takeaway: Audit every AI agent's system access and permissions now, applying the same least-privilege discipline you would give a new hire.