Application access governance is struggling to keep up with AI in the systems that run company finances. That is the main finding of a new report from Delinea Fastpath, which says 84% of organisations using AI tools or agents in critical business applications reported at least one AI-related issue in the past 12 months. The issues included incorrect financial transactions and actions that could not be traced or explained.
The report, 2026 Application Access Governance Report: Secure Now or Pay Later, was published by Delinea on 27 October 2026.
Who the application access governance report surveyed
Unlike many AI security surveys aimed at security chiefs, this one looked at finance. It draws on an independent survey of 1,000 senior finance and finance technology leaders across the US and UK. Of those, 879 use AI tools or agents in critical business applications, such as the systems used for financial transactions and reporting.
The report says the vast majority of organisations use AI tools or agents in these applications, and 35% have deployed agents that actually perform actions rather than just give suggestions.
Audit confidence versus audit history
A large part of the report compares how confident organisations feel with what their audits actually show.
- 95% of respondents are confident their access controls would withstand external audit scrutiny
- 26% report access findings that came back in consecutive years
- 25% report findings that have stayed open for three years or more
In other words, most organisations believe they would pass an audit, while about a quarter keep seeing the same problems or leave them unresolved for years.
Gaps in oversight and ownership
The report points to three structural weaknesses in application access governance.
Cross-application risk. Only 46% continuously monitor and manage cumulative access risk across applications. Without that, segregation of duties (SoD) conflicts that span more than one system can stay hidden. SoD rules make sure one person, or one agent, cannot both start and approve a sensitive action, such as creating a vendor and paying it.
Fragmented ownership. A majority say each access governance activity is mostly or fully automated. Yet only 22% have a single named owner for each application, tracked in one system of record.
Shrinking scope. Over the past two years, 60% report more critical applications operating outside access governance or Sarbanes-Oxley Act (SOX) scope, even as most also say they brought more applications inside it.
AI agents in finance systems
According to the report, most organisations using AI lack full, centrally tracked visibility into how agents are deployed, what they can access, what permissions they hold, who owns them and who approved them.
In the past 12 months, a sizable share reported AI-related SoD conflicts. Some also found agents that kept operating after the person who deployed them had left the organisation. Only 11% of organisations using AI say their governance and security controls are keeping pace with AI deployment.
Frank Vukovits, Chief Security Scientist at Delinea, said AI agents are taking action in the applications that run company finances, and that when an agent can approve a transaction or change permissions, the business owns the outcome.
Delinea’s recommendation is to centralise and automate access controls across critical business applications and AI agents. Its Fastpath product handles SoD analysis, user access reviews, access requests and change monitoring.
As a writer, I feel the gap between 95% audit confidence and only 11% saying controls keep pace with AI is the story here. An agent left running after its owner leaves is the kind of problem that an annual audit may not catch. I would also note that Delinea sells access governance tools, and the release does not give exact figures for every finding, such as the share reporting AI-related SoD conflicts.
FAQ
What did the Delinea Fastpath application access governance report find?
84% of organisations using AI tools or agents in critical business applications reported at least one AI-related issue in the past 12 months, including incorrect financial transactions and untraceable actions.
Who took part in the survey?
1,000 senior finance and finance technology leaders in the US and UK, of whom 879 use AI tools or agents in critical business applications.
How many organisations say governance is keeping pace with AI?
Only 11% of organisations using AI say their governance and security controls are keeping pace with AI deployment.