New Research from Abnormal AI Finds Nearly Half of Security Teams Say They Can’t Tell What Normal Behavior Looks Like for AI Agents
Security teams say they are prioritizing behavioral monitoring to catch unexpected activity from their AI agents, but
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
Abnormal AI, the AI-native behavior security company, today released its 2026 State of Behavioral Security Report, revealing that 46% of security professionals say they are not at all effective at establishing what normal behavior looks like for AI agents, even as 43% say agents will receive their greatest behavioral-monitoring investment over the next 24 months, more than three times that of API integrations (14%).
Behavioral security uses AI to learn what’s normal for each identity, account, and system, then flags activity that deviates, rather than relying on known threat signatures. Without a clear picture of normal behavior, a compromised or misbehaving agent can look like any other. More than 81% of respondents now rely on behavioral anomaly detection to a major or extensive degree, but that maturity hasn’t yet extended to AI agents or machine identities.
“Behavioral security is no longer a debate. Organizations are already deploying it, and our research shows that adoption was the easy part,” said Mick Leach, Field CISO at Abnormal AI. “The hard part is knowing what normal looks like for every employee, every service account, and every AI agent. As companies hand more work to autonomous agents, the question shifts from ‘is this unusual?’ to ‘is this unusual for this agent?’ Teams that can’t answer that second question are missing the earliest warning sign.”
The data shows how many teams are still operating without a clear picture of normal. While 72% of respondents say they are better prepared to detect anomalous behavior from non-human identities than from human ones, 53% do not define normal behavior for machine identities at all. And even when anomalies are caught, response is slow: 90% say knowing why an anomaly triggered is critical, but 51% need four hours or more to investigate and remediate one.
“The organizations that get ahead on AI agents won’t be the ones with the most alerts. They’ll be the ones that know what normal looks like for every identity and can act the moment it changes,” said Leach.
Download the full 2026 State of Behavioral Security Report to learn more.
Methodology: Abnormal AI’s 2026 State of Behavioral Security Report is based on a survey of 525 cybersecurity professionals at organizations with 1,000+ employees across six countries, approximately 85% of whom hold CISO-level or security operations leadership roles. The survey was fielded by AimPoint Group on behalf of Abnormal AI between July and August 2026. Results reflect respondents’ self-reported views.
About Abnormal AI
Abnormal AI stops cybercrime with behavioral AI, protecting more than 5,000 organizations, including 30% of the Fortune 500. The Abnormal Behavioral Security Platform uses proprietary AI models to understand normal activity across enterprise identities and detect anomalous behavior associated with sophisticated cyber threats. Learn more at abnormal.ai.
View source version on businesswire.com: https://www.businesswire.com/news/home/20261105792265/en/
Media gallery
