Science & Tech · Cybersecurity · 2 hrs ago
Security teams plan more monitoring for AI agents
Security teams named AI agents their top planned investment in behavioral monitoring over the next two years, according to a 2026 survey by Abnormal AI.
Forty-three percent chose AI agents, more than three times the share who chose API integrations, the next most common answer.
Many organizations are still working out what normal agent behavior looks like: nearly half of respondents said they were not effective at setting and maintaining those baselines, while about two in five said they were very or extremely effective.
Monitoring coverage is lower for agents and other software identities than for user sign-ins, which 76.2% of respondents said they tracked with behavioral baselines.
Agents can carry out tasks across systems, so investigators need to know what an agent was asked to do and whose permissions it used to judge whether an action was expected.
Just over half of respondents said investigating and fixing a behavioral anomaly typically took at least four hours, and false positives and difficulty defining normal activity were common obstacles.
Organizations plan to invest in agent monitoring over the next two years, but the survey describes continuing challenges in identifying and assessing unusual activity.
AI agents were the most common planned investment in behavioral monitoring, chosen by 43% of respondents to Abnormal AI’s 2026 State of Behavioral Security Report.
More than 81% said their organizations relied on behavioral anomaly detection to a major or extensive degree.
Respondents were divided on how effectively their organizations could establish and maintain baselines for normal AI agent behavior.
About half said their organizations maintained baselines for AI agents, API integrations and service accounts.
Just over half said investigating and remediating a behavioral anomaly typically took at least four hours.
- Who
- Security professionals surveyed for Abnormal AI’s 2026 State of Behavioral Security Report.
- What
- Respondents identified AI agents as their top planned investment in behavioral monitoring.
- When
- The report was published on November 10, 2026. Respondents were asked about investments over the next two years.
- Where
- Not stated.
- Why
- Security teams use behavioral monitoring to identify activity that may warrant investigation, but establishing what is normal for AI agents can be difficult.
This story does not have two clearly opposing sides.
This story does not have a timeline yet.
- Planned investment
- 43% chose AI agents
- Anomaly detection
- More than 81% relied on it to a major or extensive degree
- User baselines
- 76.2% maintained baselines for sign-ins and authentication
- Non-human identities
- About 72% said their organizations were better prepared to detect unusual behavior from them than from people
- Investigation time
- Just over half said anomaly investigation and remediation typically took at least four hours