How Small Businesses Build AI Agents Without Governance Controls

Small businesses are integrating artificial intelligence into core operations at a pace that outstrips their ability to govern it, according to a report by Pax8. The research indicates that two-thirds of small and mid-sized businesses engaged with AI have already built and deployed solutions. This rapid adoption is driven by competitive pressure, with 66% of these organizations stating they will not remain competitive within three years without AI implementation.

What unauthorized AI activity is occurring?

The Pax8 report reveals that 35% of these businesses have discovered unapproved workflows, tools, or agents operating within their environments. Aviv Nahum, co-founder and CEO at Above Security, notes that this shifts the risk profile from simple software governance to a broader business-process and security issue. Employees are no longer just experimenting with chatbots; they are building agents that connect directly to finance, CRM, and other critical systems.

Why is manual review insufficient?

More than half of decision-makers are spending hours each week manually checking the work produced by AI systems. Ram Varadarajan, CEO at Acalvio, argues that this habit of proofreading catches clumsy answers but fails to reveal where an automated agent has been or what data it has touched. As models become more capable, their outputs look increasingly polished, making manual verification less effective at detecting unauthorized access or data exfiltration.

What is the security impact of AI agents?

Nahum explains that an employee building an autonomous agent with credentials and system access effectively creates a new insider without a clear owner. Security teams often do not know these agents exist, turning shadow AI into a significant operational risk. The agent performs multi-step work autonomously, accessing company data in ways that standard user monitoring might miss, because the behavior mimics legitimate automated processes rather than individual human error.

How can organizations detect these risks?

Varadarajan suggests that behavior is a better signal than output quality for security practitioners. He recommends seeding company systems with decoy files and credentials that no legitimate employee or program would have reason to open. Any contact with these traps serves as an immediate warning of unauthorized activity. Before deploying further agents, businesses should limit what the AI can reach and inquire with technology providers about what monitoring is in place while staff focus on chatbot interactions.

What to do and how to stay safe: Pax8

• Implement behavioral monitoring to detect anomalous access patterns from automated agents.
• Deploy decoy credentials and files to identify unauthorized AI interactions.
• Limit the system access and permissions granted to any new AI agent.
• Audit existing workflows to identify unapproved AI tools connected to critical data.

Step-by-step guide: How AI Risk Management Works: The Hidden Failure Points

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many SMBs have deployed AI solutions?

According to Pax8 research, two-thirds of AI-engaged small and mid-sized businesses have built solutions that are now in use.

What percentage of SMBs found unauthorized AI tools?

The report states that 35% of these organizations discovered unapproved workflows, tools, or agents in their operations.

How do businesses plan to handle AI adoption?

Aviv Nahum advises against slowing adoption or blocking experimentation, noting that businesses deploying AI broadly are getting the most value.