Gartner Predicts Agentic AI Incident Costs Will Quadruple by 2027
SecurityWeek reports that agentic AI adoption expands attack surfaces faster than traditional controls can manage, driving up incident costs.
Key points
- Gartner forecasts incident costs from agentic AI will increase fourfold through 2027.
- SonarSource notes that frontier LLMs producing the best code also generate the most severe vulnerabilities.
- Organizations often lack clarity on their AI adoption maturity, leading to insufficient security governance.
Gartner predicts that the financial costs of security incidents driven by agentic artificial intelligence will increase fourfold through 2027, according to a report by SecurityWeek. This forecast highlights the growing tension between the productivity gains offered by AI tools and the expanding security risks they introduce to software development environments.
The proliferation of large language models for software development is expanding the attack surface too rapidly for traditional security controls to keep pace. This acceleration is driven by both sanctioned enterprise tools and shadow AI applications brought in by employees without organizational oversight. The resulting security implications are creating significant challenges for security operations center teams and developers alike.
The Cost of AI Maturity
SonarSource indicates that the most capable frontier large language models, such as Claude and Gemini, present a distinct security paradox. These models write the most functional and high-quality code but simultaneously produce the most severe security vulnerabilities. This dynamic creates a sharp double-edged sword for organizations seeking to leverage AI for improved developer productivity while maintaining robust application security standards.
Governance is widely considered the primary method for controlling risks associated with AI-driven software development. Effective governance helps maintain control over what AI agents can and cannot do within an organization’s infrastructure. Improved observability of AI tool usage and code commits is essential for limiting risk levels while still reaping the benefits of increased productivity.
However, governance efforts often fall short when organizations lack a clear understanding of their current position on the AI adoption scale. Many companies are working in the dark regarding their security controls because they do not fully grasp their capabilities, risks, or required developer skill levels. Without this clarity, implementing effective security best practices becomes nearly impossible.
Who Is Affected
Security and technology professionals across all sectors are affected by the rapid proliferation of agentic AI in software development. The report notes that the fallout from these security implications could be far more serious than typical software vulnerabilities. Developers and SOC teams are currently facing a prolonged period of heightened risk as they attempt to integrate these powerful tools into their workflows.
Organizations that have not established a clear governance plan addressing the new reality of software development are particularly vulnerable. They may not understand what security measures are needed at their specific stage of AI adoption. This lack of maturity in AI security practices leaves them exposed to incidents that could significantly impact their bottom line and operational integrity.
What should you do?
Organizations should assess their current stage of AI adoption to determine appropriate security controls. Understanding the specific capabilities and risks of their AI projects is crucial for implementing effective governance. Developers need to be trained on the security implications of using large language models in their coding processes.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Gartner
- Evaluate your organization's current AI adoption maturity to identify gaps in security governance and control.
- Implement improved observability for AI tool usage and code commits to monitor for unauthorized or risky behaviors.
- Train developers on the security risks associated with frontier LLMs and the potential for severe vulnerabilities in generated code.
- Review and update governance plans to specifically address the capabilities and constraints of agentic AI tools in development.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are agentic AI tools considered a security risk?
Agentic AI tools expand the attack surface faster than traditional controls can manage, and frontier models can produce severe vulnerabilities alongside functional code.
What does Gartner predict about AI incident costs?
Gartner predicts that the costs of incidents driven by agentic AI will increase fourfold through 2027.
How can organizations better manage AI security risks?
Organizations need to understand their stage of AI adoption maturity and implement governance plans that address specific capabilities, risks, and developer skill requirements.
