Cybersecurity Budgets Are Growing, but 77 Percent of Companies Still Do Not Monitor Their Own AI Agents' Behavior

Boston Consulting Group published a new survey of security leaders. Eighty-three percent of respondents report rising cybersecurity budgets. According to BCG, total spending in the area increased by 12 percent in 2025, substantially more than the expected seven percent. Cloud protection, data protection and threat intelligence are the highest priorities; more than half of security leaders plan to increase spending further in these categories. Higher budgets, however, are not yet enough. Eighty-nine percent of organizations experienced an AI-enabled attack during the previous twelve months and 35 percent reported a significant financial or operational impact. The average company in the research reported three significant security breaches and 25 incidents involving sensitive data. Protection of AI itself is particularly problematic. Only 41 percent of respondents have formal governance policies for the technology. Just 23 percent have implemented monitoring or logging of agent activity. Fewer than one in five use monitoring for unsanctioned AI tools, detection of attacks through malicious instructions, or management of digital identities that do not belong to people. BCG also found an association between these controls and lower incident impact. Organizations using more specialized safeguards were less likely to report severe consequences from exploitation of AI vulnerabilities, leakage of data into tools or employees' use of unsanctioned applications. For management, the key change is the structure of the environment being protected. Security used to focus on employees, endpoints, applications and servers. An agent adds a new identity that can operate for long periods, call additional tools and access several data sources. A company therefore needs to know not only who created the agent, but also under which identity it acts, what it can access and which of its actions can later be reconstructed. BCG also describes consolidation among suppliers. In 18 of 24 security categories studied, most organizations have already reduced the number of vendors. More mature companies want to reduce complexity; less mature ones are mainly seeking cost savings. This creates pressure on smaller security vendors: a narrow technical advantage alone may not be enough if the customer prefers an integrated platform. A practical measure of security maturity is therefore not merely the size of the budget. More important is the share of agents with their own identity, a complete activity log, limited permissions and a specific human owner. A company can spend more than last year while still protecting mainly the old technology architecture. Terms to explain Shadow AI: Tools used by employees without organizational approval or registration. Prompt-injection attack: Manipulation of an input so that a model bypasses its original rules or performs an unintended action. Non-human identity: A digital account used by a program, service or agent rather than by a specific employee.

Cybersecurity Budgets Are Growing, but 77 Percent of Companies Still Do Not Monitor Their Own AI Agents' Behavior

The full article is available to users registered at Hard Skills