In Germany, Austria and Switzerland, 61 per cent of surveyed organisations say they are more willing than a year ago to accept higher cyber risks in pursuit of AI’s benefits. That is a statement of intent, not proof that organisations are already behaving more recklessly. The findings nevertheless point to a widening gap: AI is gaining decision-making authority, while few organisations explicitly define what it is allowed to do.

AI systems are moving beyond data analysis and recommendations. They are being connected to business applications, data and infrastructure—and increasingly given authority to make decisions or trigger actions that once required human approval. The security question is therefore becoming more specific: which actions may an AI agent take, which resources may it access, and who can intervene when it behaves incorrectly?

A survey commissioned by Illumio and conducted by Sapio Research offers a snapshot of the trend in the DACH region. Sixty-three per cent of respondents say they have delegated decisions to AI that required human approval a year ago. Sixty-one per cent say they can track every action carried out by an AI agent. The same proportion say they are now more willing than 12 months ago to accept higher cyber risks in order to benefit from AI. The global figure for increased risk tolerance is 56 per cent.

The five-point gap between the DACH and global figures is not, by itself, evidence of a distinct regional trend. The DACH sample comprises 100 respondents, and the published methodology does not provide uncertainty estimates for the regional results. The more revealing finding is the tension within the DACH responses: organisations report both increased delegation and high visibility into agents’ actions. Neither measure shows whether those actions are effectively constrained.

Incidents, warning signs and different meanings of risk

Seventy-nine per cent of DACH respondents say they experienced at least one AI-related security incident or warning signal in the past 12 months. That combined figure should not be read as a 79 per cent incident rate: the release does not specify how many responses refer to confirmed incidents and how many to warning signs. Thirty-nine per cent report an incident or one that was narrowly avoided.

Other findings give a more detailed picture of the reported issues. Thirty per cent say an AI system accessed data it was not authorised to use. Twenty-nine per cent report that an AI recommendation would have created a security risk if implemented. Twenty-five per cent say AI proposed or triggered an unauthorised action, while 18 per cent discovered that an AI agent or tool had connected to systems without prior security approval.

These are self-reported findings, not the results of an independent technical assessment. They do not show how severe each case was or whether the organisations fully investigated its cause. They do, however, highlight that risk does not come only from attackers using AI. An organisation’s own agents can also become a security concern through excessive permissions, flawed decisions or poorly controlled connections.

AI in security operations needs boundaries

Seventy-two per cent of surveyed DACH organisations already use AI in cyber security processes. Thirty per cent consider it acceptable for AI to investigate security incidents without human review. Thirty-eight per cent would consider allowing AI to make code changes without supervision—nine percentage points above the global figure. Twenty-eight per cent would allow AI to grant or revoke access rights autonomously.

Automation can shorten response times. But an incorrect code change or access decision can also create new attack paths or weaken existing safeguards. Organisations should therefore distinguish between analysis and execution: an agent may investigate an incident and prepare a change, while implementation requires approval. Any actions that can be taken without approval should be defined in advance.

The survey suggests that many organisations recognise the need for specific controls. Seventy-three per cent of DACH respondents say AI agents need different security controls from conventional software, compared with 82 per cent globally. Seventy-one per cent consider limiting AI access more important than predicting every possible threat. Yet only 19 per cent name explicitly defined permitted actions among their most important security measures; the global figure is 25 per cent.

That is the central gap: respondents support limiting AI, but few identify concrete action rules as a priority. Logging what an agent did does not close that gap. As Alex Goller, Principal Solutions Architect at Illumio, puts it: “Visibility is not control.”

Permissions must be enforced where actions happen

In practice, AI agents should be treated as distinct identities with narrowly scoped permissions. Access should be limited to what each task requires. Organisations should define which tools and actions are permitted, require additional approval for consequential or difficult-to-reverse changes, and ensure that logs record which agent acted and with what permissions. They also need procedures for revoking access immediately and reversing changes.

Network segmentation can further limit the systems a compromised or misdirected agent can reach. Thirty per cent of DACH respondents say the spread of advanced AI has increased the importance of network segmentation and microsegmentation. The survey does not show that segmentation alone would have prevented the reported incidents. It can help contain the potential impact, but it does not replace identity, permission and application-level controls.

The study surveyed 1,100 IT and security decision-makers across ten markets, including 100 respondents from Germany, Austria and Switzerland. Because Illumio commissioned the research, its findings should be read as a commercially commissioned survey. They provide a picture of reported attitudes and experiences, not a technical audit of AI security across DACH organisations.

The key question is not whether organisations trust AI in general. It is whether they can define and enforce their agents’ permissions so that a mistake does not spread across the environment. Visibility helps teams understand what an agent has done. Security depends on whether its access and actions are effectively limited.