Illumio report: 70% of organizations delegate security decisions to AI, but oversight lags

AI’s growing role in security decisions

A new report by Illumio, a cybersecurity firm, reveals that 70% of organizations now delegate security decisions to AI that were previously handled by humans. This shift reflects a broader trend of automating critical functions to improve efficiency, but it also introduces new risks.

According to the report, only 49% of organizations can audit AI actions, creating what Illumio describes as a "control gap." This gap raises concerns about accountability, particularly in high-stakes environments like financial services or healthcare, where missteps can have severe consequences.

Risks and lack of oversight

The report highlights a willingness among organizations to accept greater cyber risks: 56% are now tolerating more risk than they did 12 months ago. This shift coincides with AI’s expanding role in security operations, where speed is often prioritized over thorough oversight.

Nearly half (47%) of organizations allow AI to take actions in production environments, but 35% admit that following AI recommendations could result in security vulnerabilities. Additionally, 32% let AI conduct investigations without human oversight, and 29% permit it to deploy code changes unsupervised.

Security incidents tied to AI

The consequences of this reliance on AI are already visible. Seventy-six percent of organizations reported experiencing one or more security issues due to AI in the past year. These issues include unauthorized data access (reported by 24%), AI connecting to systems without approval (26%), and AI triggering unauthorized actions (24%).

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This report underscores a growing tension between automation and control in cybersecurity. Founders and operators, particularly in sectors like fintech, healthcare, and cloud services, are increasingly relying on AI to scale decision-making. However, the lack of auditability and the rise in unauthorized AI actions reveal a critical gap: speed is being prioritized over safety. For startups building AI-driven security tools, this is a signal to embed transparency and human oversight into their products from day one. For investors, it suggests a need to scrutinize portfolio companies’ AI governance practices, as unchecked autonomy could lead to regulatory or reputational risks down the line.

Key takeaways

• Founders adopting AI for security must prioritize auditability to avoid compliance risks, especially in regulated industries.
• The 76% incident rate indicates AI-driven security tools require rigorous testing and human oversight to prevent breaches.
• Organizations accepting higher cyber risks may face long-term vulnerabilities, impacting investor confidence and customer trust.

Related on Lazyfounder

• More ai news