AI Agents Are Already Inside Your Systems, but Who’s Controlling Them?

Why It Matters

AI agents now act as autonomous actors across critical systems, turning a governance gap into a tangible operational and regulatory risk for enterprises, especially in fast‑moving Southeast Asian markets.

Key Takeaways

• 71% enterprises use AI agents in core systems
• Only 16% enforce effective AI governance
• 92% lack full visibility into AI identities
• 47% CISOs observed unauthorized AI agent actions
• Southeast Asian firms face cross‑border compliance challenges

Pulse Analysis

The enterprise AI landscape has moved far beyond experimental chatbots. Companies are wiring autonomous agents into finance platforms, customer databases, payment rails and development pipelines to accelerate productivity. Gravitee’s report reveals a startling mismatch: while 71% of large firms have granted agents direct system access, a mere 16% have put robust governance frameworks in place. This architectural blind spot creates a hidden attack surface, where machines can chain actions at machine speed, bypassing traditional human‑centric identity controls. The result is a growing operational power risk that eclipses classic concerns about model bias or data leakage.

In Southeast Asia, the problem is amplified by a patchwork of legacy applications, cloud services and offshore development teams. Companies often span multiple jurisdictions—Singapore headquarters, Vietnamese engineering, Philippine support and Indonesian merchant networks—each with distinct compliance regimes. When an AI agent is loosely scoped, it can instantly traverse CRM, data warehouses and payment workflows, triggering cross‑border regulatory alarms. Moreover, 92% of surveyed organisations admit they cannot fully see AI‑generated identities, and 95% doubt they could contain a misuse event, leaving security teams scrambling for real‑time insight.

The emerging divide will separate firms that treat AI agents as first‑class identities—complete with dedicated authentication, authorization, monitoring and lifecycle management—from those that view them as convenient add‑ons. Early adopters may move slower initially, but they will gain agility later, while the latter risk costly breaches and operational downtime. Enterprises should invest in AI‑specific IAM solutions, enforce granular policy controls, and implement continuous audit trails to regain visibility. By doing so, they not only mitigate risk but also turn disciplined AI agent governance into a competitive advantage in the region’s fast‑paced digital economy.