Small and midsize businesses are developing their own AI tools and autonomous agents, raising concerns about how those systems are secured and monitored, according to the Q3 2026 Pax8 SMB AI Pulse Report. The report surveyed 1,150 business technology decision-makers in the United States, United Kingdom, Germany, and Sweden.
The findings show how far businesses have moved beyond experimenting with chatbots and other off-the-shelf tools. Among SMBs using or experimenting with AI, 67% have developed their own AI solutions that are now in regular use. Just 13% rely exclusively on commercially available tools.
Among businesses building AI, 52% are developing automated workflows that connect AI to other business systems, while 46% are building or testing agents capable of carrying out multi-step tasks autonomously.
As SMBs develop their own AI systems, they assume responsibility for securing them. The report suggests that formal oversight and approval processes have not kept pace. More than a third (35%) of AI-engaged SMBs reported discovering unauthorized AI tools, workflows, or agents running within their organizations in the previous six months.
Shadow AI Complicates Security Oversight
AI agents can introduce security risks beyond those associated with unauthorized chatbots because they may have access to sensitive company data and the ability to take actions autonomously.
“An employee experimenting with a chatbot is one level of risk,” said Aviv Nahum, Co-Founder and CEO of Above Security. “An employee building an agent that has credentials, accesses company data, connects to finance or CRM systems, and performs multi-step work autonomously is something very different. At that point, the organization has effectively created a new insider, often without a clear owner or a security team even knowing it exists.”
Yet many businesses lack formal processes for approving the AI systems their employees build. According to the Pax8 report, the share of businesses with documented review and approval procedures ranges from 23% in the UK to 45% in Sweden.
The findings from Sweden illustrate the complexity of AI oversight. The country has the highest rate of formal AI review in the survey, but also the highest rate of shadow AI discovery, at 55%. The higher discovery rate could reflect better detection of unauthorized AI, but the survey does not establish why Swedish businesses reported both more formal oversight and more shadow AI.
Part of the problem may be that existing AI policies focus on which tools employees can use rather than what they can build. Those rules may do little to address an internally developed agent operating across multiple business systems.
AI Development Brings Unexpected Costs
AI spending can also be difficult to predict. According to the Pax8 report, 49% of businesses that purchased AI in the previous year received at least one bill or usage charge that was higher than expected. Usage-based pricing can make costs difficult to forecast as businesses deploy more internally developed tools.
In the UK, unexpected charges were more common among established AI builders: 52% reported higher-than-expected bills, compared with 17% of businesses relying exclusively on off-the-shelf products.
AI adoption also brings additional demands on employees' time. Although 69% of AI-engaged SMBs say the technology has freed up time, 55% of decision-makers spend at least three hours a week reviewing, editing, or fact-checking AI-generated work. That review doesn't necessarily reveal what an autonomous agent is doing behind the scenes.
“Many small businesses now spend hours each week having employees proofread artificial intelligence, a habit that catches clumsy answers but reveals little about where an automated agent has been or what it has touched,” said Ram Varadarajan, CEO of Acalvio. “And the more capable the models become, the more polished their outputs look.”
Security Concerns Shape AI Adoption
Despite the widespread adoption of AI, security concerns are influencing how businesses deploy the technology. The Pax8 report found that security is the biggest barrier to expanding AI use, cited by 32% of respondents. Seven in ten said security concerns had prompted them to change their approach, slow adoption, or seek outside help.
Those concerns are also shaping purchasing decisions. Nearly two-thirds (64%) of SMBs have formal or informal rules or preferences about which AI providers or models they can use. Seventy percent also said they would pay at least 6% more for AI services offering greater control over how their data is stored and used.
Securing Internally Developed AI Agents
Improving oversight begins with identifying which AI systems are operating within an organization and who is responsible for them. Businesses also need to understand what company data those systems can access. Formal approval processes should cover these internally built systems, not just the commercial AI tools employees use.
Businesses should also limit agents' permissions to the data and systems they need to perform their assigned tasks. Access restrictions should be accompanied by monitoring that tracks agent activity after deployment, including which resources agents access and where they send data. Such monitoring can reveal problems that reviewing AI-generated output would miss.
Varadarajan also recommends deception-based detection, which uses decoy files and credentials to identify potentially unauthorized access to business systems.
“Security practitioners who know the problem know that behavior is the better signal, and our best approach is to seed a company's systems with decoy files and credentials that no legitimate employee or program would have reason to open, so that any contact with them is an immediate warning,” he said.
As AI agents take on more complex tasks and gain access to critical business systems, securing them will require more than checking their output. Businesses must also be able to monitor their activity and control what they are authorized to do.
