The Agent Enterprise Is Here. Is Security Ready? | Lightspeed Cyber 60 & CISO Survey

Our research found that hijacked agents acting inside enterprise networks have emerged as the #1 security threat, 79% of CISOs report an AI-related incident this year, and confidence in internal defenses has plummeted to 55%. In response, almost all security teams are dedicating significant budgets to AI tools to close the gap.

Enterprise software is also undergoing its fastest architectural shift in decades. This is a fundamental change in how software is both built and operated: every company surveyed now deploys AI-generated code, while 88% already allow AI to execute actions without human approval. AI agents, running in production at 77% of surveyed organizations, are now taking autonomous actions, calling APIs, and executing workflows directly inside core environments. As autonomous systems scale across the enterprise, security is being tested like never before. 

Today, Lightspeed is excited to unveil the fourth edition of the Cyber 60, presented by Fortune, recognizing the fastest-growing venture-backed cybersecurity startups in the market today. Discover the 2026-27 Cyber 60 list and CISO Survey.

Alongside the list, we’re publishing our annual CISO Survey, conducted in partnership with Wakefield Research among 200 CISOs at companies generating $500M+ in annual revenue.

As AI revolutionizes how we build and deploy software, cybersecurity cannot afford to take a back seat. The data reveals an urgent inflection point for security leaders, founders, and enterprises alike.

Key Findings From the Front Lines

• Agents are officially in production: 77% of surveyed organizations already run AI agents in production, and 98% are piloting, using, or exploring them.

• The visibility and credential gap: Among companies using or exploring agents, only 20% maintain a complete inventory of active agents. Alarmingly, 26% use or would use human credentials to authenticate agents, while only 34% use dedicated per-agent identities with scoped permissions.

• Hijacked agents top threat rankings: Compromised or hijacked internal agents (51%) are tied with AI-generated phishing and deepfakes (51%) as the #1 AI-related threat vector keeping CISOs up at night.

• Incidents are escalating: 79% of CISOs report a confirmed or suspected AI-related incident in the past 12 months (up from 75%), with 99% detecting active AI-driven attack attempts.

• Security is losing its seat at the table: Despite mounting threats, security drives AI governance at just 21% of enterprises (down sharply from 33% last year), while 21% state security is not formally involved at all. Tellingly, enterprises where security leads AI governance report significantly fewer incidents.

• Autonomous response is already live: 88% of organizations allow AI to execute security response actions without prior human approval, though 71% keep autonomy confined to narrow, low-risk actions.

• Workloads and confidence pressures: 87% of CISOs state that AI-generated code has increased their AppSec workload. Meanwhile, confidence that internal teams have the skills to handle AI-specific risk dropped from 71% to 55%, prompting 85% to plan hiring or reskilling within the next 12 months.

What Comes Next

CISOs are not standing still. 85% expect security budgets to expand this year, and 82% now allocate more than 5% of their total security budget directly to AI initiatives.

Topping evaluation lists for the year ahead are agent identity, authorization, and access governance (55%), AI risk scoring and behavioral analytics (49%), and runtime guardrails for production agents (48%).

Securing the autonomous enterprise also requires a unified framework. We explore six high-priority opportunity areas for builders and founders in cybersecurity.

Download and share the full report

We’ve created a PDF version of the Cyber 60 and CISO Survey that you can download to share with colleagues, customers, and anyone you think will find value in this research.

As always, we are grateful to Fortune for their continued partnership in ensuring rigorous, objective research and for presenting this work to the broader security community.

The Lightspeed Team

The content herein does not constitute an offer to sell or a solicitation of an offer to buy any securities or investment advisory services. 

Certain information contained herein is based on information from various sources prepared by third parties. While such sources are believed by Lightspeed to be reliable, neither Lightspeed nor its affiliates assume any responsibility for the accuracy or completeness of such information, and such information has not been independently verified by Lightspeed. Unless otherwise indicated, the inclusion of any third-party firm and/or company names, brands and/or logos are for representational purposes and does not imply any affiliation with these firms or companies and also does not imply their endorsement to the views expressed by the authors.

For additional disclosures, please see https://lsvp.com/legal/.