Agent SOC 2

A sobering new survey highlighted by CFO Dive this week reveals the chaotic reality of rapid enterprise AI deployment. According to the data, a staggering 77% of organizations have experienced unexpected financial costs or severe operational disruptions directly caused by agentic AI over the past year. While nearly nine in ten companies have accelerated their deployment of autonomous agents, only 58% have actually implemented and consistently enforced formal AI governance policies. This research exposes a massive disconnect: business units are aggressively launching digital workers to automate tasks, while IT and finance departments are left scrambling to untangle the resulting infrastructure clashes and runaway token consumption.

Key Takeaway: The rush to deploy AI agents without oversight is actively causing operational damage. IT and Finance leaders must immediately halt "shadow deployments" and enforce strict, centralized governance policies to ensure autonomous tools aren't quietly racking up massive compute costs or breaking existing legacy systems.

A sobering new industry report released today by ACTO highlights how quickly corporate AI deployments are slipping out of IT's control. Surveying leaders in the highly regulated life sciences sector, the study found that while 64% of organizations are actively establishing AI governance, nearly a quarter (23%) do not monitor or even discuss employee use of unauthorized AI agents. The data reveals that non-technical employees are increasingly building and deploying their own unvetted AI agents outside approved systems to automate their daily work, creating a massive regulatory and security blind spot. The report concludes that the biggest barrier to scaling enterprise AI is no longer technical readiness (cited by only 9%), but a profound lack of trust and decentralized oversight.

Key Takeaway: Static corporate AI policies are failing against the reality of aggressive employee adoption. Organizations must move beyond one-time approval workflows and implement active, continuous monitoring to detect and corral "shadow agents" built by employees before they autonomously interact with sensitive corporate data.

The 2026 Talent Transformation Yearbook, released today by ICIMS and Kyle & Co., reveals a stark separation in how companies are acquiring the digital workforce. The data shows that top-performing talent teams are no longer just using AI for basic resume screening; they are aggressively deploying agentic AI across multi-step hiring workflows. According to the report, 42% of high-performing organizations have deployed agentic AI at full scale to handle complex sequences like proactive candidate pipeline building, multi-calendar interview scheduling, and internal skills matching, compared to just 9% of lagging organizations. The organizations winning the talent war are treating AI not as a standalone productivity tool, but as a foundational, end-to-end recruitment engine.

Key Takeaway: Basic AI adoption is no longer a competitive advantage; it is the new baseline. HR and Operations leaders must transition from using AI as an isolated screening tool to deploying interconnected, agentic workflows that can autonomously manage the entire operational lifecycle of talent acquisition.

Six months ago, SOC 2 Type II was a box most AI vendors checked quietly, somewhere on a trust-center page nobody read until procurement asked for it. That's changed. Boost.ai announced its certification with a press release quoting CEO Jerry Haywood calling trust "the primary currency of the enterprise AI market," and citing a clean audit, zero exceptions, as something that "accelerates procurement for global banking and insurance leaders." Contextual AI, Revmo AI, and Intelo.ai have all published similar announcements in the past year, each framing the certification as validation of their security controls and, implicitly, of the agent product sitting on top of that infrastructure.

Buyers are responding in kind. A widely shared agentic AI RFP template from Kognitos sets SOC 2 Type II as the minimum security credential a vendor should hold, with ISO 27001, GDPR alignment, HIPAA, and PCI DSS listed as additional expectations depending on the industry. The template is explicit about what counts as disqualifying: a SOC 2 Type I report, which only confirms controls were designed correctly at a single point in time, or no certification at all. Type II, which confirms those controls operated correctly over a sustained observation window, is called "the production standard." For a category of software that didn't widely exist three years ago, that's a fast convergence on a single proof point, and it's worth asking why vendors and buyers both grabbed the same one.

The answer is that SOC 2 already existed, auditors already knew how to run it, and procurement teams already knew how to read the resulting report. Nobody had to invent new infrastructure to get a credential moving through the pipeline this year. That's a reasonable reason to start somewhere. It's a bad reason to stop there, and the gap between what SOC 2 was built to prove and what an autonomous agent does is wider than either side of the transaction seems to be acknowledging.

SOC 2's trust services criteria were written for a world where humans request access, humans get approved or denied, and a log entry traces back to a named person. Several of the specific controls auditors rely on assume exactly that, and agents violate the assumption in ways the framework never anticipated. Agents are frequently created without the kind of approval workflow the access-control criteria expect, often through a pasted API key, an OAuth click, or a line added to a configuration file rather than a provisioning ticket. They often lack a named human owner the way an employee account does. When an agent acts under borrowed or shared credentials, the log can show a human's name for an action the human never took. And when an employee who provisioned an agent leaves the company, there's frequently no equivalent of the offboarding process that would normally revoke that access, so the agent can keep running on credentials nobody is actively managing.

The vendor-review criteria run into a related problem that's specific to how agents are built today. Model Context Protocol servers function as a kind of unvetted vendor relationship, arriving without a purchase order, a vendor-risk review, or in some cases even an identifiable company behind them. One identity-security vendor's own registry found that roughly three in ten MCP server names it tracks can't be matched to any real company. Segregation-of-duties controls get stretched too: when one agent reviews another agent's proposed change, the review is nominal in a way a human reviewer's sign-off isn't, and the actual decision can happen inside a prompt that sits entirely outside whatever system the audit is examining.

None of this means SOC 2's criteria are wrong. They were written at a time when "who did this and were they authorized" had an obvious answer. Agentic systems broke that assumption faster than the audit framework updated to catch it, and a SOC 2 report, even a clean one, generally doesn't say anything about whether the organization has closed that specific gap.

Security researchers covering this space independently are converging on the same word: accountability. One widely cited technical analysis calls the absence of a clear human requester behind a privileged agent action "a major accountability gap," and it's not a hypothetical. Auditors expect to trace a privileged action back to an accountable individual. When the log instead shows a generic tool name, a CI/CD runner, or a shared service account, there's often no way to establish who initiated the action or who approved it, which is precisely the kind of gap the Cloud Security Alliance's 68% figure describes at scale rather than as an edge case.

The volume problem compounds the attribution problem. The same analysis points out that the central challenge with agentic systems isn't proving a control exists; it's proving that control operated correctly at the frequency agents generate activity, which can be orders of magnitude higher than human-driven systems ever produced. Ephemeral infrastructure, auto-scaled instances that spin up and disappear within a workflow run, often isn't instrumented consistently enough to leave the kind of continuous log chain an auditor needs. And where a human-centered audit can rely on an interview or a documented policy to establish intent, an agent-centered one increasingly needs "why" evidence: a traceable rationale for a given output, not just the output itself, something almost no current SOC 2 engagement is scoped to collect.

This is the same structural issue "The Continuous Audit" raised from the compliance side back in September: periodic review, whether that's a quarterly audit cycle or an annual SOC 2 renewal, can't keep pace with a system generating decisions continuously. A SOC 2 report is, by definition, a look backward at a defined observation window. Agent activity doesn't pause between windows.

The most direct way to see the gap is to compare what SOC 2 tests against what an AI-specific standard like ISO 42001 tests. SOC 2 confirms that an organization's security and operational controls, access management, encryption, monitoring, incident response, operated as described over the audit period. It says nothing about whether training data was collected lawfully and without skewed sampling, whether the vendor keeps an inventory of its AI systems with a risk classification attached to each one, whether an impact assessment was performed before a new agent capability went into production, or whether AI governance accountability reaches someone at the executive level rather than sitting with a single engineering team. ISO 42001, the AI-specific management-system standard published in late 2023, covers exactly that territory: an explicit AI policy, lifecycle controls spanning design through deployment and monitoring, and handling of AI-specific nonconformities. Its certification ecosystem is still young, and one compliance vendor predicts third-party ISO 42001 certification becomes a dominant buyer expectation within 18 to 24 months, though that's a forecast, not yet a market reality.

Contextual AI's own SOC 2 announcement is a useful, unintentionally honest illustration of the limits here. The company describes encryption standards, access controls, infrastructure resilience, and an active bug bounty program in real detail, and it's careful to call the certification "not the end of our security journey." What it doesn't do, and what no SOC 2 Type II announcement in this space currently does, is say anything about the accuracy of the agent's outputs, the behavior of the underlying model, or how a customer would know whether a specific autonomous decision the agent made was the right one. That's not a knock on Contextual AI specifically. It's the honest boundary of what the credential was built to certify, and it's a boundary buyers reading these announcements are mostly not seeing stated plainly.

Give procurement teams some credit here: the better RFP templates circulating this year are explicit that SOC 2 is a floor, not proof of AI-specific safety. The Kognitos template flags the distinction directly, warning buyers that "SOC 2 is not SOX," meaning a clean SOC 2 report doesn't demonstrate SOX-relevant financial controls either, a reminder that the certification's scope is narrower than its reputation. The pattern echoes something "The Vendor Consolidation Wave" already identified: in a crowded, fast-moving vendor category, buyers gravitate toward whatever proof point is legible and comparable across vendors, even when that proof point covers less of the actual risk than it appears to. SOC 2 Type II is legible. Comparing one vendor's model evaluation methodology against another's is not, so it gets skipped in favor of the credential that's easy to put in a comparison table.

That's a rational response to an impossible evaluation problem, not a failure of judgment by procurement teams. But it means the certification is doing social work, signaling seriousness, reducing perceived risk, speeding up a sales cycle, that exceeds the technical work it's certified to do. The Cloud Security Alliance's broader survey data makes the stakes of that gap concrete: 85% of surveyed organizations already run agents in production, 79% believe agents create access pathways that are difficult to monitor, and only 22% say access-control frameworks are applied very consistently to agents at all. A SOC 2 Type II badge sitting on top of those numbers doesn't close the gap. It just makes the gap harder to see from the buyer's side of the table.

There's a sharper version of this problem underneath the credential question, and it connects directly to the governance failure Gartner's Shiva Varma described this spring. Varma's prediction, 40% of enterprises demoting or decommissioning autonomous agents by 2027, isn't framed as an argument against governance. It's an argument against treating governance as binary: locked down or fully trusted, with nothing in between. Varma's recommended fix is proportional governance, classifying agents across four autonomy levels, Observe, Advise, Act with Approval, and Act Autonomously, with each level carrying its own trust boundary and its own control set.

SOC 2 Type II, applied to an agent platform, is a binary credential in exactly the sense Varma is warning about. A vendor either holds the certification or doesn't. The report doesn't distinguish between an agent that only observes and flags anomalies and one that executes autonomous financial transactions, even though those two agents present wildly different risk profiles and arguably deserve entirely different audit scopes. A buyer comparing two vendors' SOC 2 reports is, in effect, applying the same uniform governance standard Gartner says is already causing enterprises to fail internally, just one layer up the stack, at the procurement decision instead of the deployment decision. The industry is at risk of repeating its own governance mistake and calling the repetition due diligence.

None of this argues for abandoning SOC 2 as a procurement signal. A vendor with a clean Type II report has demonstrably invested in security operations, and that's worth something real. The argument is that it's the wrong question to stop at, and "The Continuous Audit" already described what the right question looks like: not "are you audited," but "can your platform produce the kind of continuous, agent-level observability that makes an audit meaningful between renewal cycles." That means asking a vendor whether individual agent actions are attributable to a specific identity rather than a shared service account, whether logs persist at the granularity an incident investigation would need, whether the vendor can show how a given autonomous decision was classified under something resembling Gartner's four autonomy levels, and whether any of that evidence is available continuously rather than reconstructed after the fact for the next audit window.

Buyers asking only "do you have SOC 2 Type II" are going to get a growing number of yes answers over the next year, because the certification is now cheap enough, reputationally, that most serious vendors will get there. That convergence is exactly why the credential will stop differentiating vendors almost as quickly as it started mattering. The organizations that reduce their exposure most will be the ones that keep asking the harder, AI-specific question underneath it, the one SOC 2 was never built to answer.

SOC 2 Type II is becoming the price of entry for agent vendors, not because it proves an agent is safe, but because it's the credential procurement teams already know how to read, and in a market where 68% of organizations can't tell an agent's actions from a human's, something that looks like proof is in high demand. The audit's own criteria weren't built for agents that get created without approval, act under borrowed credentials, or generate activity at a volume no annual review cycle can keep pace with, and the gap between what the report certifies and what buyers assume it certifies is where the real exposure sits.

Gartner's warning against uniform, binary AI governance applies just as directly to how the market is treating this certification as it does to how enterprises govern their own deployed agents. A pass or fail credential, applied the same way to an agent that only observes and one that acts autonomously on financial transactions, is the same mistake at a different layer of the stack. The fix isn't a better certification. It's refusing to let any single-point-in-time or even sustained-period credential substitute for the continuous, agent-level observability this series has argued for since September, and asking vendors to prove they can provide it before the next renewal cycle comes due.

Evaluating a vendor's SOC 2 report is table stakes. Knowing what it doesn't tell you is where real risk reduction starts. The Complete Agentic AI Readiness Assessment includes a vendor-evaluation framework built specifically for agentic AI procurement, covering what to ask beyond standard security certifications and how to score a vendor's continuous observability claims against your own audit requirements. Get your copy on Amazon or learn more at yourdigitalworkforce.com. For organizations building out agent vendor due diligence, our AI Blueprint consulting helps design RFP evaluation criteria, map vendor claims against your governance framework, and build the procurement playbook that catches the gap between a clean audit report and a truly accountable agent.