36% Now, 60% Next Year, 7% for Most Actions: How Far CISOs Will Let Agents Act Alone

Thirty-six percent of CISOs are comfortable today with AI agents taking autonomous low-risk actions. Sixty percent expect to be comfortable within twelve months. Only 7% expect agents to act autonomously in most cases.

Those three numbers come from The New Security Agenda, an Andreessen Horowitz survey by Zhang and Colby of 100 CISOs at companies with more than 1,000 employees, asking about their 2027 plans. Read separately, each number is a sentiment reading. Read together, they describe a structure. Our reading is that security buyers are drawing a ladder, with a rung for each kind of action.

A disclosure before going further. a16z has invested in Armadin and Neo, two companies the article promotes. The survey numbers are still useful. The framing around them should be read knowing who wrote it.

The ladder has three rungs

The answers fall into tiers. Our reading of those tiers:

Rung one: low-risk actions, today. Just over a third of the sample is already there. The a16z article draws the line in one sentence: “Gathering logs is different from changing a production system.” Our examples: collecting evidence, enriching an alert, querying a log store. In our reading, these are actions where a wrong call costs time but leaves uptime intact.

Rung two: the same rung, wider adoption, next year. The jump from 36% to 60% is the story most people will quote. It measures more organizations reaching the first rung and says nothing about climbing higher. The survey’s question is about low-risk actions in both cases.

Rung three: autonomy in most cases. Seven percent. That is the share of CISOs who expect agents to act alone across the bulk of their work. For us, the distance between 60% and 7% is the most telling result in the report, even though the two numbers answer different questions. Our reading is that comfort with autonomy does not generalize. On these numbers, approval for log gathering does not carry over to production changes.

A governance program can be measured against this ladder. If your agents act alone across most of their work, you sit with the 7% of this sample who expect that. That may be the right call. It should be a deliberate one, with the controls to match.

Why so few expect the top rung

Two concerns in the survey sit beside it. Forty-six percent of CISOs worry about agents exceeding their permissions or being compromised. Forty-seven percent worry about employees leaking data into AI tools. The first is the one that bears on autonomy.

The a16z authors explain why it is hard to see: “Agents run on employee devices with the user’s own permissions, so to the tools built for the last decade of endpoint security, an agent reading a file or calling an API looks exactly like the employee doing it.”

If an agent inherits a user’s permissions and the tooling sees the user, then every autonomous action is attributed to a human who did not take it. A CISO cannot grant autonomy to an actor the logs cannot name. In our reading, the thin top rung is first a visibility problem. Trust comes after. On the detection side, see Shadow AI Moved Inside the Perimeter and Your Detection Playbook Did Not Follow. On permissions, see Your Agent Permission Model Works 40% of the Time.

Security is the brake, and budgets are expected to grow

The survey reports that 63% of responses describe security slowing at least some AI adoption. That figure counts responses, not respondents, so it should not be read as “63% of CISOs.” It still describes a function that sees itself as the brake.

The spending data shows where CISOs plan to put money. Eighty-seven percent expect cybersecurity spending to increase. The survey reports 4% expecting headcount cuts, while describing the rest of the headcount answers only in rough halves. Within twelve months, 45% plan to buy or upgrade internal AI agent security, and 38% plan to buy or upgrade AI usage and governance tooling.

Agent security is the larger of the two AI purchase lines the survey reports. In our reading, agent security is what makes the actions of an agent visible and bounded. Visibility is what lets a CISO move an action class from “needs approval” to “runs alone.” The ladder climbs only as fast as the controls underneath it are built.

We read the gap between the headline adoption number and the top-rung number this way. Moving from 36% to 60% on low-risk actions needs modest controls, such as read-only scopes, rate limits and a log of what the agent touched. In our view, moving anyone to the top rung needs the agent to be a distinct identity with its own permissions, its own audit trail, and a way to stop it mid-action. Only 7% of this sample expect to get there.

A ladder per action instead of a dial per agent

The practical lesson is about granularity. One way to govern autonomy is at the level of the agent: this agent is supervised, that one is trusted. The survey’s own framing, low-risk actions and the line between gathering logs and changing production, is by action class instead. The same agent can gather logs alone and still need a human to approve a firewall change.

A ladder per action risk has three properties that a per-agent setting lacks.

It degrades safely. When a new action type appears, it lands on the bottom rung by default and has to earn promotion.

It produces evidence. Promotion from one rung to the next can require a record: how many times the agent proposed this action, how often a human overrode it, what the override reasons were.

It matches how incidents happen. Damage comes from a specific action against a specific system. Governing at the action level puts the control where the damage occurs.

Finding problems faster also does not mean fixing them faster, as our essay on the remediation deficit argues. The autonomy ladder is the same question asked of agents: which fixes are they allowed to apply on their own?

Do this now

Take the a16z numbers as an external benchmark and score your own program against them.

List every action your agents can take. Group them by consequence: read, enrich, notify, change configuration, change production. If you cannot produce the list, you are not yet on rung one in any governed sense.
Assign each action a rung. Default everything to “human approves.” Promote only the actions where a wrong call costs time rather than availability, which is the low-risk class where the survey’s 36% sit today.
Give agents their own identity. The top rung stays thin while an agent reading a file looks like the employee reading it. Separate credentials and separate logs come before any autonomy above the first rung.
Define the promotion rule. Write down what evidence moves an action up one rung. Override rate, sample size, reviewer. Without the rule, promotions happen by habit.
Tie the budget line to the ladder. If agent security is on your twelve-month plan, as it is for 45% of the surveyed CISOs, scope the purchase by which rung it unlocks.

The survey tells you where peers stand. The ladder tells you where each of your agent’s actions stands. The second answer is the one an auditor will ask for.

This analysis synthesizes The New Security Agenda (Andreessen Horowitz, October 2026).

Victorino Group helps security and platform teams build per-action autonomy ladders for AI agents, with the identity and audit controls each rung requires. Let’s talk.