New research compares audit confidence with access control outcomes and finds inconsistent oversight of AI agents
SAN FRANCISCO, Oct. 27, 2026 (GLOBE NEWSWIRE) -- Delinea, the identity security platform that continuously controls what AI agents, humans and machines can do and for how long, today published new research from Delinea Fastpath examining how organizations govern application access in the AI era. According to the report, 2026 Application Access Governance Report: Secure Now or Pay Later, 84% of organizations using AI tools or agents in critical business applications reported at least one AI-related issue in the past 12 months, including incorrect financial transactions and actions that could not be traced or explained.
The report also compares confidence in access controls against audit history. While 95% of respondents are confident their access controls would withstand external audit scrutiny, 26% report access findings that recurred in consecutive years and 25% report findings that have stayed open for 3 or more years. The findings of the report draw on an independent survey of 1,000 senior finance and finance technology leaders across the US and UK, 879 of whom use AI tools or agents in critical business applications.
"AI agents are taking action in the applications that run your finances, and governance hasn't kept pace," said Frank Vukovits, Chief Security Scientist at Delinea. "When an agent can approve a transaction or change permissions, the business owns the outcome. You need to know what every agent can do, who owns it and who approved it, before an auditor asks or your financials are misstated."
Key findings from the report include:
- Cross-application risk lacks continuous oversight: Only 46% continuously monitor and manage cumulative access risk across applications, which can hide segregation of duties (SoD) conflicts that span systems.
- Ownership is fragmented: A majority report that each access governance activity is mostly or fully automated, yet only 22% have a single named owner for each application tracked in one system of record.
- Governance scope is not keeping pace: Over the past two years, 60% report more critical applications operating outside access governance or Sarbanes-Oxley Act (SOX) scope, even as most also report bringing more applications inside it.
AI agent oversight is lagging in critical business applications
The vast majority of organizations use AI tools or agents in critical business applications, and 35% have deployed agents that perform actions. Most organizations using AI lack full, centrally tracked visibility into deployment, access, permissions, ownership and approval. In the past 12 months, a sizable share reported AI-related SoD conflicts, and agents that kept operating after the person who deployed them left the organization. Only 11% of organizations using AI say governance and security controls are keeping pace with AI deployment.
Stronger control calls for centralizing and automating access controls across critical business applications and AI agents. Delinea Fastpath helps teams answer three questions: who has access, what are they doing with it and where are they vulnerable. Its access control, access review, access provisioning and change tracking capabilities automate SoD analysis, user access reviews, access requests and change monitoring.
To read the full findings and benchmark your program, download the report here: https://delinea.com/resources/application-access-governance-report-2026
About Delinea Fastpath
Delinea Fastpath is a leader in application access governance, helping organizations automate governance of human and agentic access across business applications to maintain continuous audit readiness. By automating key IT General Controls, including Segregation of Duties (SoD) risk analysis, Fastpath helps organizations reduce risk, simplify compliance, and strengthen oversight of sensitive applications and data. Organizations can govern access across 100+ cloud and on-premises applications, with more than 30 out-of-the-box native direct connections that enable fine-grained risk analysis down to the lowest securable object.
About Delinea
Delinea is an identity security platform governing what AI agents, humans and machines can do, and for how long. Just-in-time authorization extends privileged access management from access to action, cutting standing privilege across on-premise, multi-cloud and ephemeral infrastructure. Its platform scores identity risk and keeps access decisions auditable. Over 9,000 organizations, including two-thirds of the Fortune 100, rely on Delinea. Learn more at delinea.com.
Media Contact Justin Ordman Senior Director, Marketing Communications PR@delinea.com
