Security teams have spent a decade learning what normal looks like for a person. They’ve barely started on the software that now acts like one.
That’s the core of Abnormal AI’s 2026 State of Behavioral Security Report, released November 5. The survey covered 525 security professionals at organizations with more than 1,000 employees across six countries, about 85% of them CISOs or security operations leaders. AimPoint Group fielded it in July and August. Abnormal sells behavioral security, so read it as a vendor survey with a stake in the answer. The numbers are still telling.
46% say they’re not effective at all at defining normal behavior for AI agents. Not “somewhat behind.” Not effective at all.
Mature for humans, blank for machines
The odd part is how good these teams say they are elsewhere. More than 81% rely on behavioral anomaly detection to a major or extensive degree. 72% say they’re better prepared to catch anomalous behavior from non-human identities than from people. Yet 53% don’t define normal behavior for machine identities at all.
Both can be true. Service accounts and API keys used to be predictable. A backup job runs at 2 a.m. and touches the same three systems every night, so any deviation stands out without anyone having written down a baseline. AI agents break that. An agent with access to email, a CRM and a code repository does different things every day by design, because it’s responding to whatever it was asked. The behavior that would flag a compromised service account is just Tuesday for an agent.
Budgets are moving accordingly. 43% expect AI agents to get their biggest behavioral-monitoring investment over the next two years, more than three times the 14% who named API integrations.
Slow investigations
The other number to keep is time. 90% say understanding why an anomaly fired is critical. 51% need four hours or more to investigate and fix one. Four hours is a long time when the thing being investigated can send a thousand emails or push code in a minute. Abnormal’s field CISO Mick Leach put the hard part simply: knowing what normal looks like for every employee, every service account and every AI agent.
The same week, Black Hat Europe confirmed its December 9 opening keynote: Heidy Khlaaf of the AI Now Institute on why AI agents are going into production faster than anyone can secure them. Researchers and vendors are describing the same gap from opposite ends. Khlaaf’s point is that the assurance work comes after deployment, if at all. Abnormal’s survey shows what that looks like on the ground: teams with no baseline for the agents they’re already running.
What follows
Expect three things. Identity vendors will extend non-human identity products to cover agents, with per-agent permission scopes and session logs. Behavioral analytics vendors, Abnormal included, will sell agent baselining as the next module. And the first serious agent-driven breach will be found through slow, manual investigation, because the alert that should have caught it was never written.
The fastest fix available today is the dull one. Give each agent the narrowest permissions its job needs, log everything it does, and treat any agent with standing access to email and payments as a privileged account.