Cequence Security and KPMG Collaborate on Joint Report Examining how Organisations can Govern and Secure Agentic AI

New Cequence data in the report shows AI agents already signing in, booking and buying on behalf of customers, often without identifying themselves

SINGAPORE, Nov. 11, 2026 /PRNewswire/ -- Cequence Security, the leader in application, API, and agentic AI protection, today published Agentic AI Runtime Security, Governance, and Control, a report on governing AI agents as they act. This report has been developed with input from KPMG in Singapore, examining how organisations can govern and secure Agentic AI as agents move from generating content to autonomously taking consequential actions. The findings of the report will be presented to senior business, technology, and policy leaders at a joint event hosted at KPMG's office in Singapore on 19 November. Read the executive brief or download the full report.

AI is shifting from answering questions to taking action, with agents now issuing refunds, updating records, and moving money. The report sets out how to govern those actions as they happen, for agents deployed by organizations.

What Cequence's analysis and data show

• Agents already act for customers: In one week of October 2026, Cequence's CQ Prime research team tracked more than a quarter million AI agent visits across five industries. About one in seven booked, bought, signed in or managed an account for the customer.
• Many never say they are agents: At a Tier 1 telecommunications carrier, traffic from agents that didn't identify themselves as agents grew from about 100 requests a day to as many as 32,000 within three weeks of a major consumer AI agent's launch. They signed in as the customer and passed multi-factor authentication.
• A trusted name proves nothing: At one online marketplace, more visits claimed to be Google-Agent than all the genuine agent visits Cequence tracked that week. Every visit went straight to the sign-in page and failed, a sign of attackers testing stolen passwords in bulk under a legitimate agent's name. Google was not involved.

What Cequence recommends

• Give each agent a specific job, not open-ended authority: Each agent should work from a plain-language job description turned into hard limits, so it can't decide on its own to do more.
• Check every action in real time: A separate control outside the agent should approve, escalate, or block each action in real time, since harmless-looking steps can add up to something the agent isn't allowed to do. When it blocks an action, it should point the agent to the allowed route so the work still gets done.
• Measure success by work completed, not actions blocked: Good governance and security let agents get more legitimate work done without the organisation losing control.

In a controlled study using a Cequence research prototype, agents with only logins and fixed permissions tried to act outside their job in 44% of runs. When each agent was given a defined job and every action was checked against it, those attempts fell to 1%; task completion rose from 76% to 95%, and agents used about 35% fewer tokens per run.

"Organisations across Asia-Pacific are moving from experimenting with AI to deploying them to achieve real business outcomes. Traditional controls such as identity verification and fixed access permissions are important, but they may not be sufficient when an agent can carry out a sequence of actions on behalf of a business or customer. Organisations need governance that considers the agent's role, the context of each action, and the cumulative risk created across an entire task. KPMG's contribution to this report brings together our experience in governance, risk, regulation and cyber security to help organisations put appropriate oversight around AI agents while enabling legitimate work to continue," said Gerry Chng, Partner, Head of Cyber, KPMG in Singapore.

"An approval at step one shouldn't carry into step five," said Shreyans Mehta, CTO and co-founder of Cequence Security, who co-authored the report. "Runtime governance means checking what an agent does at every step. When the answer is no, it means telling the agent why, so it gets back on track instead of looking for a way around. It has to work the same way for an agent your customer sends as for one you built yourself."

Expanding in Asia-Pacific

Cequence's presence is growing in Asia-Pacific, where it has established its regional headquarters in Singapore. The company has a regional team, including senior leadership in Australia, with plans to build local teams in the Philippines, Singapore, and South Korea over the coming months. In the region, its customers include NTT DOCOMO in Japan and Philippine Airlines.

"AI agents are already acting for customers across the region, and boards want to know they can trust them," said Ameya Talwalkar, CEO and co-founder of Cequence Security. "KPMG has a deep understanding of how boards and regulators think about risk, and Cequence sees what agents actually do on our customers' applications and APIs every day. Together, we can show organisations how to give agents real work without losing control. Singapore is setting the pace on governing AI agents, which makes it the natural home for our Asia-Pacific business."

About Cequence Security

Cequence protects the applications and data that power the agentic enterprise. More than a decade of bot defense and API security experience has established Cequence as the leader of safe and secure agentic AI adoption. The Cequence platform delivers deep insight into user, entity, and agent behavior, enabling organizations to secure, govern, and control agentic AI workflows while protecting against bad actors and rogue agents. Cequence delivers value in minutes rather than days or weeks with a highly scalable, no-code approach. Trusted by the largest and most demanding private and public sector organizations, Cequence protects more than 10 billion daily API interactions and 4 billion user accounts. To learn more, visit: https://www.cequence.ai.

SOURCE Cequence Security