The Pulse
JumpCloud Finds 92% of Firms Report AI-Related Incidents
A JumpCloud survey of 250 U.S. and U.K. IT decision-makers found that 92% of organizations reported an AI-related incident or exposure in the past year. The report also found that 59% of organizations using AI agents had not fully integrate
AI.info Team · Written with AI ·
Most firms report an AI incident; many cannot trace access
92% of organizations surveyed by JumpCloud said they had experienced at least one AI-related incident or exposure in the past 12 months. More than a third said they investigated an AI-related concern but could not establish what the AI had accessed. The findings come from a new survey of 250 IT decision-makers in the United States and United Kingdom, published October 7.
The report points to a gap between what organizations permit AI systems to access and what they can later verify. 72% of respondents reported a moderate-to-large gap between allowed access and provable activity; just 4% said they had no meaningful gap. Those are respondents’ reports, not an independent count of security incidents or a measurement of every AI action inside their companies.
Agents often sit outside employee identity policies
More than half of the surveyed organizations use or test agents capable of changing systems, permissions, records or workflows. Among organizations using agents, only 41% said they had fully integrated them into the identity and access management policies applied to human users. The remaining 59% manage agents only partly through those policies or rely on separate tools and rules.
That separation can complicate basic questions after an agent acts: which identity authorized it, what information it reached, and whether its permissions matched the task. The report says 63% of agent environments also use higher-risk authentication methods, including shared service accounts or long-lived API keys. Such credentials can make it harder to tie an action to a specific agent.
Nearly half allow high-risk actions before review
JumpCloud’s accompanying report says 46% of organizations allow high-risk agent actions to occur automatically, with review based on logs afterward; 18% require human approval before those actions are completed. It also found that 49% of respondents described AI permissions as broad, difficult to review or inconsistent, while only 14% said they review permissions continuously or automatically.
These results suggest that oversight often comes after execution rather than before it. That leaves organizations relying on records to reconstruct decisions even as many respondents say they cannot reliably prove what an AI system accessed. One in three organizations also said AI can reach identity and access management systems, which govern access to other company resources.
Survey covers 250 U.S. and U.K. organizations
JumpCloud fielded the survey from July 8 to July 20, 2026, among IT decision-makers at organizations with 200 to 2,500 employees. The sample was split evenly between the United States and United Kingdom, and between organizations primarily using Google Workspace and Microsoft 365. All respondents were using or testing embedded AI assistants, agents that can take action, or both; the report gives a margin of error of plus or minus 6.1 percentage points at a 95% confidence level.
The findings therefore describe a defined group of organizations already engaging with workplace AI, rather than all businesses. JumpCloud sells identity and access management products, and the company’s proposed response is its Agentic IAM Lifecycle framework, which calls for discovering agents, registering them with an accountable human owner, managing their permissions and reviewing activity continuously. The survey does not establish that the framework would prevent the incidents respondents reported.
JumpCloud calls for clearer ownership and access
“AI agents are quickly becoming another class of identity in the enterprise,” said Joel Rennich, JumpCloud’s senior vice president of advanced technologies and innovation. He said agents can access sensitive systems and trigger workflows, while many organizations do not govern them with the same rigor as human users.
The central test in the report is practical: when an auditor, customer or security team asks what an agent accessed and who authorized it, can the organization produce evidence? In JumpCloud’s survey, 36% of respondents said they had looked into an AI-related concern without learning what the AI had accessed.