IBM’s ATOM system now handles approximately 95% of daily threat investigations autonomously. It enriches alerts, scores risk, and drives response without a human reviewer in the loop. Investigation time is down 37%. The system processes the equivalent of 850 analyst hours every month.
That is an impressive result. It is also a live demonstration of the problem the World Economic Forum spent an entire white paper warning about.
In May 2026, the WEF published Empowering Defenders: AI for Cybersecurity in collaboration with KPMG. It draws on case studies from IBM, Google, Allianz, Santander, Aramco and others to show that AI adoption in cyber defence has moved from theory into operational reality. Its central warning is consistent across every section: autonomous AI action without a confirmed human authorisation requirement creates an accountability gap that adversaries and regulators will both exploit.
The paper maps this across a four-level autonomy spectrum. At the top end - “Execute (independent)” - AI agents act without real-time human involvement, with governance provided by supervisor AI agents or post-hoc audits. A record of what already happened is not a control. It is evidence for the inquiry that follows.
The WEF identifies three specific failure modes. Agents can be hijacked to execute destructive actions. Unintended behaviours driven by hallucinations or misconfigured objectives can cascade across multi-agent environments at machine speed. And agents can be deployed and act without proper approval, with no clear accountability for outcomes. The paper calls for new technical guardrails tailored to these realities. It does not specify what they look like.
The case studies fill that gap inadvertently. Standard Chartered auto-resolves cases within defined thresholds under a “strict human-in-the-loop model” - but that model is entirely self-built, undocumented as a standard, and not transferable. Aramco has over 50 patented AI solutions autonomously triggering containment actions across its infrastructure. PETRONAS achieved a 30–40% reduction in incident response times through AI agents that triage and correlate without human review. Every one of these organisations engineered a bespoke answer to the same question: how do you let an AI act at machine speed while keeping a named human accountable for the outcome?
GoFirm is that answer, built as infrastructure rather than a one-off internal project. Before a consequential action executes - isolating a system, triggering containment, approving an automated high-stakes decision - GoFirm routes a confirmation request to the named human authority on their registered device, through a channel entirely separate from the agent environment. The authority reviews the exact action parameters and confirms with their biometric. An agent that has been hijacked, hallucinated, or misconfigured cannot produce that confirmation. The action does not proceed.
Every authorisation is signed, timestamped, and written to an append-only audit trail. When DORA, NIS2, or a board inquiry asks who authorised the action and when, the record already exists - created at the moment of execution, not reconstructed afterwards.
The WEF notes that 92% of technology executives view AI agent management as a non-negotiable skill within five years. The organisations that get there safely will be the ones that built the authorisation boundary before they needed it, not the ones explaining to regulators why they didn’t.
GoFirm is The Authority Platform. Stop unauthorised action. Every time.
In association with Osinto.ai, the collective intelligence platform for Security, Resilience & Defence. Osinto’s AI-enabled open-source network and governed collaborative operational environment help mitigate the growing security, resilience and governance obligation in minutes, not months.
References
1. IBM case study, in WEF / KPMG, Empowering Defenders: AI for Cybersecurity, May 2026
2. Ibid., Foreword and Introduction
3. Ibid., Section 3.2
4. Ibid., Section 3.3
5. Standard Chartered case study, ibid.
6. Aramco case study, ibid.
7. PETRONAS case study, ibid.
8. KPMG, Global Tech Report 2026, cited ibid.