News
AI Governance Lags as 84% of Organizations Report Issues, Delinea Finds
Eighty-four percent of organizations using artificial intelligence in critical business applications reported at least one AI-related issue in the past year, according to new research from identity security company Delinea.
The company’s "2026 Application Access Governance" report identified issues including incorrect financial transactions and actions that could not be traced or explained.
The findings are based on an independent survey of 1,000 senior finance and finance technology leaders in the United States and United Kingdom. The AI-specific analysis included 879 respondents whose organizations use the technology in critical business applications.
AI Adoption Outpaces Governance Controls
The report found that 35% of surveyed organizations have deployed AI agents capable of taking actions within business applications. However, only 11% of organizations using AI said their governance and security controls were keeping pace with deployment.
Delinea also found gaps in centralized visibility into agent deployment and permissions, including who owns agents and who approved their use.
Some respondents reported segregation-of-duties conflicts involving AI, while others identified agents that continued operating after the employees who deployed them had left the organization.
The research also highlighted gaps in monitoring access across business systems. Only 46% of respondents said they continuously monitor and manage cumulative access risks across applications.
Those gaps can make it difficult to identify segregation-of-duties conflicts, in which a person or agent has permissions across systems that should be kept separate.
Audit Confidence Contrasts with Unresolved Findings
Despite those issues, 95% of respondents said they were confident their access controls would withstand scrutiny in an external audit.
However, 26% reported access-related audit findings that had recurred in consecutive years, while 25% said some findings had remained unresolved for three or more years.
Only 22% of organizations had a single named owner for each application, with ownership tracked in one system of record.
Meanwhile, 60% reported an increase over the past two years in the number of critical applications operating outside the scope of access governance or Sarbanes-Oxley Act compliance.
The findings highlight the oversight challenges associated with giving AI agents authority to act within business systems, particularly when organizations cannot consistently identify who owns an agent or trace its actions.
Frank Vukovits, chief security scientist at Delinea, said organizations remain responsible for the actions AI agents take within their systems.
“When an agent can approve a transaction or change permissions, the business owns the outcome. You need to know what every agent can do, who owns it and who approved it, before an auditor asks or your financials are misstated,” Vukovits said.