Picture a scene that is becoming easy to imagine. A long-standing customer rings a building-supplies wholesaler on Monday morning, mildly amused. Why, he asks, did a text message chase him about an unpaid invoice on Sunday evening? Nobody in accounts sent it. Nobody bought an AI agent, either. A feature arrived in an update to software the firm had used for years, and someone switched it on thinking it was a reminder setting. The scene is illustrative rather than reported. The question behind it is real, and it is one place an AI agent security audit can begin: with the software a business already owns.
Many governance plans look the other way. They focus on agents a company intends to build — a service bot, an internal assistant, a pilot with a budget line. The quieter question sits on the finance director’s laptop. What has that software learned to do since the firm bought it?
Capability now arrives with the update, not the purchase
At Xerocon London, Xero set out an agentic roadmap for small-business finance. Automated bank reconciliation sits among its existing tools. Document chasing is due from October and Bill Protection is in beta. Xero describes Payment Follow Ups as coming soon, and says they may analyse payment history, consolidate invoices, time reminders and switch to SMS, with human oversight.
None of this is alarming in itself. A firm chasing late payment by hand loses days it does not have. What is worth noticing is the procurement moment. It is unlikely that a finance director would sign a contract headed “autonomous system permitted to message our customers about money.” Capability of that kind arrives as a release note and a toggle.
The same shift is visible in enterprise software. Microsoft made Agent 365 generally available on 1 May. It describes the product as a control plane to observe, govern and secure agents across supported local, SaaS and cloud environments. Microsoft’s corporate vice president of AI security, David Weston, described his own setup to VentureBeat: “I have 18 agents running behind my team chat right now.” A large vendor now sells inventory, governance and control as a product. That is a fair measure of how far agent sprawl has gone.
What an AI agent security audit should actually ask
A useful AI agent security audit asks three questions of every piece of software in the business. A non-technical director can ask all three out loud.
What can it read? An agent may act with delegated user permissions, or with an identity of its own. Both models need least-privilege controls. Under a sales manager’s access, it may include a pipeline. Under a managing director’s, it may take in the mailbox holding the redundancy plan and the acquisition term sheet. An administrative decision sets that scope, and it should be explicitly approved and recorded.
What can it change? Can it edit a customer record, alter a supplier’s bank details, mark an invoice as settled, or delete something? Each is an ordinary software permission. Each becomes a different proposition when the thing holding it acts on a schedule rather than a click.
What can it send, and to whom? External actions carry the company’s name: email, SMS, payments, messages posted into a shared customer channel. A reconciliation error may remain internal; a badly timed chase to a client mid-negotiation is immediately commercial.
Two more questions finish the picture. Does it act when no human is present? Who can switch it off? The National Cyber Security Centre published guidance on agentic AI in May, co-authored with the US, Australian, Canadian and New Zealand cyber agencies. Its clearest test is: “If you cannot understand, monitor or contain an agent’s actions, it is not ready for deployment.” The advice around it is unglamorous. Bound the pilots. Apply least privilege. Use temporary credentials, monitor behaviour, and name an owner who approves access and can stop the agent.
UK data shows AI uptake is ahead of AI-risk controls
The Office for National Statistics tracked AI use among UK businesses with ten or more employees. It rose from around 12% in late 2023 to around 35% by June 2026, almost three times the earlier level. The government’s security research is blunter about what came with that growth. In the Cyber Security Breaches Survey 2025/2026, 31% of businesses were using, adopting or considering AI: 21% had adopted it, 4% were adopting, 6% were actively considering. Of those, 24% reported security practices or processes to manage AI risk.
The supplier figures matter here, because this capability arrives through vendors rather than projects. Only 15% of UK businesses review the cyber risk posed by their immediate suppliers. Six per cent look at the wider supply chain. A company that never examines what its vendors are doing is less likely to notice a new autonomous capability when one of them ships it.
A related problem sits underneath. CyberArk’s 2025 survey of 2,600 security decision-makers counted 82 machine identities for every human one. It found that 42% had privileged or sensitive access, and that 88% of organisations define privileged users as human only. Those are machine identities: API keys, service accounts, workloads, devices. They are not a count of AI agents, and nobody should read them as one. They describe the ground agents now join — an identity layer already large, already loosely governed, already outside most definitions of privilege. Separately, Gartner predicts that by 2028, a quarter of enterprise breaches will trace back to AI-agent abuse.
How to run an AI agent security audit
Take the software the company already pays for: CRM, finance, email, helpdesk, e-commerce, HR. For each one, write down what its agentic features can read, change and send. Note who enabled them. Note whether an external action can happen without a person approving it. For a small, simple estate, a first pass may take an afternoon. Larger or decentralised businesses will take longer. It pairs with the other inventory worth doing: the spreadsheets staff still rebuild by hand each month.
Then set the boundary deliberately. For many workflows, reading and drafting are lower-risk starting points, provided data access is properly scoped. Writing to systems of record needs an owner. Anything that reaches a customer needs approval until it has earned trust, and a log either way. An AI agent security audit is operational discipline rather than a technology decision. It spans IT and business operations, so it needs a named owner across both. It is also why consulting firms such as Riophany design governance, permissions, human escalation and operational ownership into automation from the start.
In the illustrative case at the top, the wholesaler could decide to keep the feature. What changes is that someone can say what the software is allowed to do. For many firms, that is the question the update now forces.
The next AI governance failure in Britain will probably not look like a rogue system chasing a strange goal. It will look more ordinary: a competent, useful piece of software doing what its latest version promises, for a company that never quite agreed to it.
What does Riophany do
Riophany looks at a business process and works out what should happen automatically, what needs AI to understand the situation and what should still be decided by a person. Then we connect those steps across the systems the business already uses.