The First Questions That Matter: Governing an AI Agent Incident

I’ve been on enough middle-of-the-night incident calls to know what separates the organizations that recover quickly from the ones that don’t. It’s rarely the size of the security budget. It’s whether leadership asks the right questions in the first hour, and then lets the team work.

The incidents those questions have to cover are changing. Your company is likely already running AI agents: software with its own goals, credentials, and tools that acts without waiting for a person. Agents read email, query databases, update records, move money, write code, and coordinate with other agents. When one is compromised or manipulated, you’re not looking at a breached server. You’re looking at your company acting at machine speed, in ways no one approved.

That is why this belongs on the executive and board agenda. An agent acts in your company’s name, and customers, regulators, and courts will hold the company responsible for what it did. “The AI did it” will not be accepted as an explanation. An AI agent incident is a governance event as much as a security one.

Your job during an active incident is not to run the technical response. That belongs to your security team. Your job is to govern: make sure accountability is clear, the business is protected, and the people doing the work have the authority and room to act. The questions in this article are built for that role. If you want to see what your CISO’s team is working through at the same time, the companion triage guide walks through it.

When an AI agent is involved in an incident, the key question shifts from "who got in?" to "what did we authorize this agent to do, and what did it actually do on our behalf?"

What Leaders Need to Understand About AI Agent Incidents

Five realities set these types of incidents apart, and each one has consequences for the business.

The agent is a trusted insider. It runs with legitimate credentials and approved access. When an attacker manipulates it, for example, by hiding instructions in a document the agent reads, its actions can look like normal business activity. Your security tools may see nothing wrong, because technically nothing unauthorized happened.

Agents act at machine speed. An agent can take hundreds of actions in the time it takes a person to open a ticket, and many run as multiple copies or launch other agents. The damage window is measured in minutes, not days.

Attackers don't need to break in. They only need to put instructions where your agent will read them: an email, a web page, a support ticket, or a shared file. This is known as prompt injection, and it turns ordinary business content into a way in.

Agents remember. Many keep memory between sessions. Malicious instructions stored there can survive a restart and resurface long after the incident seems over.

Ownership is often unclear. IT, vendors, and increasingly business users on low-code tools all build agents. In the middle of an incident, many organizations cannot quickly answer "who owns this agent?"

None of this makes incident response fundamentals obsolete. It does mean leaders need sharper questions for an environment where software acts in the company's name.

Ten Questions to Ask During an AI Agent Incident

These questions are strategic. They are designed to help you lead, communicate with stakeholders, and make the decisions only you can make, without pulling your security team away from containment.

Establish the facts

1. What do we know right now, and what is the honest assessment of what we don't know? Your security team may feel pressure to project confidence. Encourage transparency instead. AI agent incidents often carry more uncertainty than traditional ones because logs are incomplete and agent behavior can be hard to explain. Ask for a clear line between confirmed facts and working assumptions, and require that assumptions be labeled as such.

2. Have we stopped the agent, and can we stop the others if we need to? This defines the company's operational posture. A stopped agent is a security issue. An agent that is still acting, or cannot be reliably shut down, is a business crisis. Require clear, regularly updated answers and a precise definition of "contained." Then ask the harder question: if we had to turn off every AI agent in the company within the next hour, could we?

3. What did the agent do in our name, and what is the potential business impact? Do not wait for certainty to assess impact. Find out what the agent did externally: commitments to customers, transactions executed, data shared, messages sent, and decisions affecting individuals. Identify which business processes are disrupted while the agent is offline. Contain the incident and plan for its consequences at the same time.

Manage obligations and exposure

4. What are our legal, regulatory, and contractual obligations, and are we tracking the clock? Many notification frameworks run on strict timelines: 72 hours under GDPR, four business days under SEC rules once an incident is determined to be material, and even shorter windows in some contracts. These deadlines do not wait for complete information, and the SEC expects materiality to be assessed without unreasonable delay. AI agent incidents may also trigger obligations under emerging AI regulations, customer contracts, or your own public commitments. Your General Counsel and CISO must be aligned from the start.

5. Who is communicating externally, and how are we describing AI's role? Inconsistent or unauthorized statements can do serious reputational harm, and AI incidents draw extra attention. Route all external statements through a single approved channel with legal review. Describe the agent, what it did, and how you are responding, clearly and accurately. Do not blame the technology. Taking responsibility lands better with customers and regulators.

6. Does our cyber insurance cover this, and have we notified our carrier? Most policies have specific notification requirements, and missing them can jeopardize coverage. AI adds complexity, as some carriers are revising how policies treat AI-related losses. Your risk management team or CFO should contact the carrier as soon as a significant incident is declared and should know the policy's AI provisions. Document the timeline, decisions, and actions throughout.

Enable the response

7. What decisions require my authority, and what can the response team execute without escalating to me? Executives must not become bottlenecks. Define decision authority early: spending limits, public commitments, regulatory disclosures, and board notifications. For AI incidents, designate in advance who can shut down AI-driven processes without CEO approval, because that call may need to be made in minutes. Delegate everything below your threshold to the incident commander, with clear authority to act.

8. Do we have the expertise this incident requires, internally, from our vendors, and from outside? Many incident response teams and vendors are still building expertise in AI agent incidents. Confirm that the people involved understand prompt injection, agent permissions, and AI supply chain risk. Make sure your agent platform vendor and model provider are engaged and that their obligations are clear. If expertise is missing, bringing in specialists usually costs less than a prolonged response.

9. What are we telling our employees, and when? Internal communication is an underestimated risk. Employees may need to stop using certain agents, watch for suspicious content, or verify actions taken on their behalf. If a business team built or deployed the agent, encourage open reporting. Organizations that focus on learning rather than blame recover faster.

Commit to learning

10. After this is resolved, what is the accountability process, and how will we govern our agents differently? The post-incident review decides whether the organization improves or repeats its mistakes. Commit to a structured after-action process before the incident closes, and make sure it covers governance as well as technology. Confirm you have a complete AI agent inventory, that every agent has a named business owner, and that permissions and levels of autonomy are appropriate. Identify where human oversight was missing. Incidents that do not produce organizational learning produce repeat incidents.

The CEO and board's role in an AI agent incident is to govern, not manage. Ask the critical questions, ensure accountability, and empower your security team to do its job.

Questions Are a Leadership Discipline

The questions leaders ask before an incident matter as much as the ones they ask during and after. With AI agents, this is especially true, because many of the answers you will need in a crisis, including ownership, access, control, and logging, are decided when an agent is deployed.

If the CEO and board have not thought through what they need to know when an agent acts against the company's interests, they will ask ineffective questions, or none at all, and governance will suffer. Raise these with management now, well before the next incident:

• Do we have a complete inventory of our AI agents, including those business teams built on low-code platforms, and does each one have a named business owner?
• Could we turn off every AI agent in the company within an hour, and has that been tested?
• Who is authorized to shut down an AI-driven process without escalating to the CEO?
• What can our agents do in our name, and are their permissions and levels of autonomy appropriate to the risk?
• Would we be able to reconstruct what an agent did, and do our vendors keep the logs long enough?
• How does our cyber insurance treat AI-related losses?
• Have we run a tabletop exercise on an AI agent scenario with executives in the room, such as prompt injection through a customer email, a compromised tool in the AI supply chain, or an over privileged agent deleting production data?

Tabletop exercises should test more than the technology. They should test whether your incident commander can give clear, concise answers, and whether your executives can act on ambiguous information without demanding certainty that does not yet exist.

Security resilience is built over months of preparation, not during a crisis. The organizations that keep their operations, reputation, and stakeholder trust after an AI agent incident are the ones that are prepared in advance. Agents are already acting on your company's behalf. Begin that preparation now and make it part of how the business is governed. Your agents act in your company's name. The board's job is to make sure someone can answer for what they do, before, during, and after an incident.

Learn more about how you can stay ahead of AI agent incidents within your organization. Connect with the Zenity team today.