CSA research note: AI agent governance gap, NIST standards timeline and CISO priorities

In two minutes

• The note argues that no enforceable, agent-specific security controls exist today, and that the first substantive NIST deliverables are not expected before late 2026 at the earliest (p. 3).
• NIST's CAISI issued a Request for Information on January 8, 2026, and NIST announced its AI Agent Standards Initiative on February 17, 2026. The note calls the RFI a signal, not a source of standards (pp. 5-6).
• It says NIST AI RMF 1.0, ISO/IEC 42001:2023 and the EU AI Act were built before autonomous, tool-calling agents and do not map cleanly to them (p. 4).
• The identity gap is described as the most acute. Survey data cited says most organizations lack visibility into AI agent identities and few govern agent access to core business systems (p. 6).
• Audit trails are a second gap. SIEM, DLP and behavioral analytics may capture the final API call but miss the chain of agent decisions behind it (p. 7).
• The regulatory vacuum is not a reason to wait. Sector regulators have existing authorities, and the EU AI Act's August 2026 high-risk deadline comes before agent-specific guidance (p. 7).
• Recommendations are tiered: inventory, least privilege and monitoring now; OWASP Agentic Top 10, the NCCoE identity concept paper and agent-specific IR in the short term; standards engagement and compliance prep over the longer term (pp. 8-9).
• The note carries a disclaimer that it is AI-assisted and has not had official CSA review (p. 2).

Key numbers

• 92%: of 235 large-enterprise CISOs and CIOs lack full visibility into their AI agent identities (p. 3 and p. 6).
• 95%: of those respondents doubt they could detect or contain a compromised agent (p. 3).
• 71% and 16%: share reporting AI systems have access to core business platforms, and share that govern that access effectively (p. 6).
• 38% and 17%: organizations monitoring AI traffic end-to-end, and those continuously monitoring agent-to-agent interactions (p. 7).
• 64%: of companies with revenue above $1 billion reported losses over $1 million tied to AI system failures in 2025 (p. 7).
• 40%: Gartner projection of enterprise applications embedding task-specific AI agents by end of 2026, up from under 5% in 2025 (p. 4).
• About 8,000: MCP servers reported exposed on the public internet without authentication (p. 4).
• Q4 2026: target for NIST's AI Agent Interoperability Profile (p. 5 and p. 9).

What to do with it

• Build an AI agent inventory covering identity, delegated permissions, connected tools and data, human owner and business process, including agents business units set up on their own (p. 8).
• Apply least privilege to agent credentials now, using time-bound, just-in-time access in place of standing access to production systems (p. 8).
• Extend SIEM and UEBA to capture tool call sequences, external API requests and data access patterns for agents (p. 8).
• Map agent deployments against the OWASP Agentic Top 10 and use it as a baseline threat model (p. 8).
• Write agent-specific incident response procedures: revoke credentials, isolate the agent from its tools, reconstruct its actions, check notification duties (p. 9).
• Track NIST deliverables and plan for sector regulators to cover AI agents within 12 to 18 months, per the note's reading (p. 9).

Read the full document if

• you need a dated summary of NIST's CAISI RFI and AI Agent Standards Initiative and what they imply for planning.
• you must make the case for acting on agent governance before standards exist.
• you want a short, tiered action list for agentic AI covering identity, logging and incident response.

What it relies on

The note does not report original research. It rests on cited third-party sources: NIST and CAISI documents, a CSA survey blog, a Cybersecurity Insiders CISO report (235 respondents), an EY/AIUC-1 survey reported by Help Net Security, Gartner, Cisco/Splunk and OWASP (pp. 11-12). Some cited sources are blog posts and Medium articles, including those for the EU AI Act analysis and the MCP exposure figures. The note says it was generated with AI assistance and has not had official CSA review (p. 2). CSA promotes its own AI Controls Matrix, CBRA, MAESTRO and STAR program as aligned resources (p. 10).

Our read

Useful as a compact timeline of NIST's agent work and a ready checklist for a first agentic AI governance push. Most statistics come from secondary surveys and blogs, and the note says CSA has not formally reviewed it. Check the cited sources before putting the figures in a board paper.