Securing Agentic AI: Why data governance is the new perimeter

Global, May 18, 2026

What CIOs are reporting: AI ambition is outpacing governance

The recently released Logicalis Global CIO Report captures the gap: AI investment and expectations are rising, while governance is struggling to keep pace.

• Investment is accelerating: 94% report higher AI spend, yet more than half say adoption is moving too fast.
• Visibility is limited: only 37% say they have full oversight of AI tools used across the organisation.
• Risk is rising: 57% say employees are putting data security at risk through AI use.

Agentic AI raises the stakes. When AI can retrieve information, invoke tools, and make changes in production systems, even small governance gaps become material risk.

In our latest collaboration with IDC, IDC projects more than 1 billion AI agents by 2029, executing roughly 217 billion actions a day. At that scale, manual approvals and after-the-fact reviews won't keep up, so governance needs to be embedded from day one.

Here's what IDC recommend:

Make governance the control plane for agents

Agent governance is policy enforcement where AI runs identity, data access, and orchestration. IDC flags it as a top scaling concern because agents can act on systems and data, not just generate content.

Govern "data in use," not only "data at rest." Beyond classification and retention, control retrieval, tool use, and change authority, anchored in enterprise identity, least privilege, and audit trails.

Reduce shadow AI by making the secure path the easiest path

Shadow AI already exists unsanctioned tools and quick automations using corporate data without consistent controls. Don't only block it-provide approved patterns with enterprise identity, logging, and DLP/data loss protections so teams stay on the governed path.

Build your data architecture that enforces governance by default

Architecture is where governance becomes real. Don't bolt controls on later-design the platform so policy is enforced by default across data and systems, even when platforms are fragmented.

IDC's guidance is simple: use single-agent solutions for clear, bounded tasks; shift to multi-agent systems as workflows become interdependent. Standardise guardrails so teams can scale quickly without reinventing controls.

The key takeaways from IDC: three governance moves to scale agentic AI

1. Set clear agent permissions (control plane): decide what agents can retrieve, what tools they can call, and what they can change-based on risk and compliance.
2. Make governed AI the default (reduce shadow AI): offer approved models and connectors with enterprise identity, logging, and DLP so teams don't need to go off platform.
3. Standardise the patterns (scale guardrails): use repeatable reference architectures for single- and multi-agent work so controls stay consistent and auditable.

Conclusion: Secure AI starts with data governance

Bottom line: you can scale agentic AI fast and stay in control-if governance sets the rules for what agents can see, do, and change. Make the governed option the default and standardise patterns so each rollout gets easier. If IDC is right, 1 billion agents and 217 billion actions a day by 2029-automated guardrails are the only way to keep up.

To get the full paper visit: https://bit.ly/4uiTfLO

Further reading

Logicalis Global CIO Report 2026

CIOs leading the charge into an AI powered future

Securing AI becomes top priority as CIOs rank AI alongside malware, ransomware and phishing as major cyber risk