"From Agentic Risk to Human Wins" Report Finds AI Agents and Employees Are Now a Single, Interconnected Layer of Defense, But Only 19% of Organizations Have Adopted the 'Gold Standard' Approach
Tampa Bay, FL (May 20, 2026) – KnowBe4, the global leader in digital workforce security,securing both AI agents and humans, today announced the launch of its new research report,"From Agentic Risk to Human Wins: Building a Culture of Security in the Era of Agentic AI." The report reveals that the integration of AI agents into the workforce has completely rewritten the cybersecurity equation, making trust, culture, and human-AI partnership the new critical focus.
With agentic AI now widely embedded in day-to-day work, 58% of cybersecurity leaders report that AI agents are already taking actions within organizational workflows. However, a lack of governance is leaving organizations exposed, the report shows that a staggering 52% of organizations report their use of AI is unapproved or ungoverned. This means risk is increasingly emerging through everyday work behaviors, not isolated incidents.
Key Findings from the Report:
-
86% of employees say deepfake content is so realistic that it is harder to know what to trust.
-
64% of employees say it’s possible that they could be tricked by AI-enabled attacks.
-
Almost six in ten cybersecurity leaders (58%) report that mistakes during everyday work have had the greatest impact on their organization’s cybersecurity in the past 12 months.
-
42% of cybersecurity leaders identify AI-enabled attacks as a key driver of future human-related cybersecurity risks.
-
Over a third of employees reported that they commonly source their own agentic AI tools where options are unavailable or restrictive, leaving organizations vulnerable to cyberattacks.
The report shows that organizations making progress are those who prioritize cybersecurity as an culture over a mere function, seamlessly incorporating secure behaviors into daily work. These organizations are creating environments where employees feel safe reporting mistakes, with 89% of employees agreeing. Yet, only 19% of cybersecurity leaders report their organizations have an integrated and culture-embedded approach in place to manage human-related cybersecurity risk.
“Cybersecurity is entering a new phase where every organization must think about both human behavior and AI behavior,” said Perry Carpenter, chief deception strategist, KnowBe4. “The companies leading this shift are creating cultures where trust is reinforced through everyday actions, where employees feel safe speaking up, and where AI agents are treated as part of the workforce that also needs guidance, guardrails, and accountability.”
Our "From Agentic Risk to Human Wins: Building a Culture of Security in the Era of Agentic AI" report concludes that achieving "Wins" requires organizations to design systems that guide behavior, build supportive cultures, and shift from tracking failures to reinforcing positive actions, and extending a security-first mindset across both AI agents and humans. Download the report.
Methodology
This research is based on a global survey conducted by Vanson Bourne, polling 4,000 professionals: 800 security decision makers and 3,200 employees, across the Americas, EMEA,and APJ regions, representing organizations with 250 or more employees.