Enterprises Need Unified Cost and Security Controls to Scale AI Agents Responsibly
In the digital age, organizations are increasingly investing in artificial intelligence, yet there remains a notable disparity in how they manage these expenditures alongside the security of AI agents. A recent report highlights that enterprises often approach financial accountability for AI independently from considerations of operational safety—creating a governance gap that has significant implications for both financial health and data security.
This disjointed oversight is manifested in a range of challenges organizations face when integrating AI into their operational frameworks. Despite existing cost policies aimed at regulating AI expenditures, the lack of real-time visibility into the various models, agents, and workloads used in AI deployment complicates enforcement. A concerning statistic from harnesses’ 2026 State of AI in FinOps report indicates that approximately 72% of organizations reported unexpected spikes in their AI-related costs over the past year. When prompted about next month’s AI expenses, engineering leaders frequently respond with vague estimates or an admission that they will find out only after the fact.
An illustrative example of this predicament can be drawn from Amazon’s recent experience, as highlighted by the Financial Times. A specific task involving the AI model Claude exceeded its allocated budget by an astounding $1.8 million—representing an 860% overage. This incident underscores the peril of autonomous agents operating without sufficient oversight, as costs can spiral out of control before organizations recognize they have incurred them.
Historically, similar challenges have arisen with cloud computing, where finance and engineering departments often reconcile costs long after they are incurred. However, the unique dynamics of AI mean that inefficiencies or poorly managed workflows can lead to significant financial overruns almost instantaneously. The speed at which autonomous agents consume resources, coupled with a lack of robust cost governance, necessitates a reevaluation of cost policies at both the developer and AI agent levels. In some instances, enterprises may need to implement hard cost thresholds that suspend an agent’s activity once certain financial limits are reached.
But cost visibility is only half of the governance conundrum. The second, equally critical dimension is ensuring organizations have transparency regarding the actions and behaviors of their AI systems. Harness’ State of AI-Native Application Security report suggests that many security teams struggle to identify all large language models operating within their environments. Without visibility into these agents, organizations become vulnerable to unauthorized access and unintended actions that could compromise data integrity.
The rapid proliferation of AI across enterprise landscapes has outpaced the implementation of governance frameworks capable of managing them. Industry analysts at Gartner project that task-specific AI agents will continue to become woven into enterprise applications, with identity and access management for these agents emerging as one of the most pressing security concerns. The challenge lies in granting AI agents the same level of system access as human employees, but without the corresponding governance protocols in place.
Furthermore, the increasing adoption of open standards, like the Model Context Protocol, has facilitated the integration of AI agents but lacks built-in security measures. This vulnerability has not gone unnoticed by malicious actors. Recently, approximately 7,600 fraudulent GitHub repositories, over 800 of which were disguised as legitimate AI tools, have been discovered. These repositories were strategically designed to be surfaced by coding assistants, amplifying the risk that developers could unwittingly incorporate malware into production environments.
The implications of these developments are profound, expanding the threat landscape from developers utilizing AI tools to the tools themselves. Securing AI systems necessitates a comprehensive approach that includes rigorous visibility into the actions taken by AI agents, the systems they interact with, and the data they leverage.
However, the current landscape reveals a stark gap: only about one-third of developers involve security teams prior to commencing AI projects, and barely half do so before deployment. The underlying issue does not stem from a lack of awareness; rather, it lies in the rapid pace of AI development, which frequently outstrips traditional security review processes.
In this context, organizations cannot afford to treat cost and security as isolated components. Understanding the financial implications of AI usage without a grasp on system behaviors exposes organizations to significant risk. Conversely, confirming the security of an AI system without insights into cost metrics can obscure its true business value.
Conversations with enterprise customers indicate that many organizations are still in nascent stages of crafting robust AI governance and security frameworks. While they are taking steps to implement appropriate tools and policies, the increasing reliance on AI agents raises concerns about how effectively they can manage risks associated with scaling operations—particularly in sectors governed by stringent regulations.
To tackle these intricate governance challenges, organizations must cultivate operational visibility. This means establishing a comprehensive understanding of every AI model interaction, agent action, and tool application, alongside the associated costs and outcomes. FinOps teams require real-time transparency that goes beyond mere monthly reports, while security teams need insight into all AI agents functioning within the enterprise, including those not officially authorized.
Ultimately, organizations looking to successfully scale AI initiatives will not necessarily be those with the highest expenditure. Instead, those that prioritize building visibility and control into both cost management and risk mitigation from the outset stand to emerge as frontrunners in the AI landscape. If organizations fail to develop these capabilities effectively, the rapid expansion of AI adoption could hinder their ability to govern, justifying expenditures, and scaling the technology effectively.