Nearly every enterprise believes its AI agents are properly scoped. Only a third have actually made sure of it.

Today, new research from Cequence Security, the leader in application, API, and agentic AI protection, and Enterprise Management Associates (EMA) found that 94% of enterprise IT and security leaders are confident their AI agents do not have more access than they need, yet only 33% actually provision agents with least-privilege access. The remaining two-thirds run on broad standing permissions that are reviewed periodically, rarely reviewed, or never reviewed at all.

That gap between confidence and practice is already showing up in production, not a theoretical risk, but as incidents enterprises are living with right now. Among the organizations surveyed:

• 65% have experienced an AI agent take an action outside its intended scope, including 29% with measurable business impact, including data exposure, financial loss, operational disruption, or reputational damage. Another 36% caught a near-miss before it caused damage.

• Only 32% can detect and contain an out-of-scope agent action within minutes through automated means; 55% need hours and manual steps to respond.
• In approximately 4% of organizations surveyed, the first sign of trouble came from a customer or outside partner, not an internal system.

The findings point to one clear story. Governance has not kept pace with the speed of agentic AI deployment, and that gap is showing up at every stage of the agent lifecycle, from how agents are provisioned, to how their actions are authorized, to how they are decommissioned once a pilot ends. Other key findings from the report include:

Enterprises Have Moved Past the Pilot Stage

The scale of deployment makes the gap more urgent. 46% of organizations report they are already scaling agentic AI across multiple departments and production workflows, and 79% are running generative and agentic AI simultaneously. Further, more than 92% report an increase in AI and bot-driven traffic targeting customer-facing applications and APIs.

Authorization is Checked at the Wrong Time, Or Not At All

That governance gap extends to how access is enforced in the moment an agent acts. Only 34% of organizations evaluate an AI agent’s authorization at the moment it attempts a specific action. The majority rely on periodic policy reviews or standing permissions set once at provisioning and never revisited, meaning an agent’s access can quietly outlive the task it was originally granted for, and keep working long after anyone signed off on it.

Abandoned Pilots Are Leaving Live Credentials Behind

Additionally, there’s an increasing risk in how enterprises manage agents that don’t make it to production. 31% of agentic AI pilots have been paused indefinitely, discontinued, or abandoned. Many were real deployments with real system access and credentials that were never cleaned up. Every abandoned pilot with live credentials is exposure nobody is actively watching.

External Connectivity Carries the Same Risk

14% of organizations allow AI agents to connect to outside tools and data sources via the Model Context Protocol (MCP) without restriction. Among the majority who do limit those connections to an approved list, fewer than half, just 49%, have a dedicated team actively maintaining and auditing that list on a regular basis.

Christopher M. Steffen, CISSP, CISA, VP of Research at EMA, said: “This research shows enterprises have moved well past experimentation with agentic AI right into production, and governance has not kept pace with that shift. The gap isn’t a lack of awareness; most organizations have policies in place and express real confidence in them. The gap is between what’s written down and what’s enforced when an agent takes an action nobody approved. That disconnect shows up most clearly in how organizations authorize agent actions and monitor them once they’re live, and it’s the reason incidents are happening at a rate the industry hasn’t fully reckoned with.”

Shreyans Mehta, Co-founder and CTO at Cequence, said: “The number that jumped out to me is the 92% being confident in their governance frameworks. Confidence like that is a trap; it’s exactly why organizations stop looking for problems, stop investing in monitoring, and let authorization checks lapse until an incident forces the conversation. This is the exact blind spot Cequence is built to close, giving security teams real-time visibility into what AI agents are actually doing and enforcing authorization at the moment an agent acts, not after the fact.”

Dhruva will adopt the Ryan brand across the UAE and Saudi Arabia by the end of 2026, uniting the practice with Ryan’s global identity and international platform.

Dhruva, a leading tax consultancy firm in the Middle East, and Ryan, a leading global tax services and software provider, today announced that Dhruva will transition to the Ryan brand across the United Arab Emirates (UAE) and the Kingdom of Saudi Arabia. The rebranding will be completed by the end of 2026, bringing the practice under Ryan’s global identity and reinforcing its position as part of the world’s leading global-scale specialist in business tax.

The transition marks the next phase of the strategic joint venture announced in 2025 and reflects the continued integration of Dhruva’s regional capabilities with Ryan’s global platform, technology, and international resources. Clients across the Middle East will continue to benefit from the same trusted advisory teams, enhanced by access to Ryan’s worldwide expertise and service capabilities.

“The Middle East has been a strategic growth market for us for many years, and we have built a strong advisory practice founded on deep client relationships, technical excellence, and local market understanding,” said Dinesh Kanabar, Founder, Chairman, and CEO, Dhruva Advisors and Vice Chairman, Ryan.

“The transition to the Ryan brand marks a significant milestone in our journey and reflects the strength of our partnership. By combining our regional expertise with Ryan’s global scale, technology, and international capabilities, we are creating an even stronger platform to support clients across the region as they navigate an increasingly dynamic and evolving tax landscape.”

“The Middle East is one of the most important growth markets for tax advisory services globally, and we are investing in the region with a long-term view,” said Tom Shave, President of Ryan’s European and Asia-Pacific Operations. “Uniting under the Ryan brand strengthens how we serve clients across the UAE, Saudi Arabia, and Europe—bringing seamless access to our global expertise, technology, and international resources through one trusted platform. This transition marks an important milestone in our integration and reinforces our commitment to the region’s future.”

Ryan will continue to invest in its Middle East operations, expanding its team, capabilities, and regional presence across key markets, including Dubai, Abu Dhabi, and Riyadh. The practice provides comprehensive tax advisory services spanning corporate tax, value-added tax (VAT) and indirect tax, transfer pricing, mergers and acquisitions (M&A) tax structuring, research and development (R&D), and cross-border compliance.

“The response from our clients over the past year has been the clearest validation of this partnership,” said Nimish Goel, Leader, Middle East, Dhruva, a Ryan Affiliate. “From the outset, our teams have been integrating Ryan’s global capabilities in technology, specialized expertise, and best practices into the work we already lead in the region. Adopting the Ryan brand is the natural next step. It is the same people and the same trusted relationships, now carrying the name of the largest Firm in the world dedicated exclusively to business taxes.”

The rebranding will be implemented in phases during the second half of 2026, with signage, visual identity, and digital properties transitioning to the Ryan brand across the region.

What could follow the December deadline is an assessment cycle, not a filing cycle.

By Manish Bansal, Associate Partner, Dhruva Advisors, A Ryan Affiliate, Saudi Arabia

For most of the past five years, inter-alia, one of the major topics of tax conversation in Saudi boardrooms has been e-invoicing. Are we on the Fatoora platform? Which wave are we in? Has the ERP been configured or do we go with a third-party e-invoicing solution? Will we make the deadline?

Those were the right questions for the period we have just left. They are not necessarily the right questions for the period we are entering.

On 29 June 2026, the Zakat, Tax and Customs Authority (“ZATCA”), acting on a decision of the Minister of Finance, extended the Cancellation of Fines and Exemption of Financial Penalties initiative for a further six months, running from 1 July to 31 December 2026. It covers excise tax, value added tax, real estate transaction tax, withholding tax and corporate income tax. That much has been widely reported.

Less widely noticed is a condition set out in the accompanying guideline. If the Authority extends the initiative again past December, that further extension will not reach returns that fell due after 30 June 2026.

The Authority has not simply granted more time. It has informed the market, in advance, where the relief eventually stops. Whatever is announced in December, the clean-up window for historical positions is being drawn shut. For a tax administration, that is about as clear a statement as one can give.

What the regulator already sees

The reason this matters now, rather than in some indeterminate future, is that the Authority’s information position has changed fundamentally.

Wave 24 of the e-invoicing Integration Phase closed on 30 June 2026. Announced in September 2025, it captured every taxpayer whose VAT-subject revenues exceeded SAR 375,000 in 2022, 2023 or 2024. That figure is not arbitrary: it is the mandatory VAT registration threshold. In effect, the wave brought the entire registered population into scope.

And the direction has not stopped there. On 24 July 2026 – ZATCA published the criteria for Wave 25, halving the threshold to SAR 187,500 of VAT-subject revenue in 2022, 2023, 2024 or 2025, with integration required by 1 February 2027.

Under the Integration Phase, standard business-to-business invoices are cleared by ZATCA before they reach the buyer, and simplified business-to-consumer invoices are reported within twenty-four hours. Invoices must be issued in a prescribed structured format, carrying a cryptographic stamp and a unique identifier.

The Authority is therefore no longer reliant on what appears in a filed return. It holds the underlying transactional record, in structured form, close to real time, across the whole economy.

This is the shift most finance functions have not yet absorbed. For years, the Saudi assessment process began with an information request. In an environment of structured, near-live data, it begins instead with an anomaly the system has already identified. The taxpayer’s first substantive contact with the process is not a request for documents. It is a proposition to be answered.

Key exposure areas to be mindful of

In our experience, the following key areas could be more visible and exposed to assessment risk in the Kingdom once transactional data can be cross matched against declarations.

The first is permanent establishment risk arising from project delivery. Groups routinely deploy technical staff, secondees and subcontracted specialists into Saudi projects while treating the arrangement as an offshore supply.  Given that most KSA government portals are inter-linked, careful monitoring of in-Kingdom presence is critical, in particular, employees of non-resident companies undertaking fly-in/fly-out assignments in the Kingdom.  It is worth noting that the current tax law has no de minimis threshold for the creation of a permanent establishment.  Accordingly, even a single day of presence in the Kingdom could potentially give rise to a permanent establishment, although in practice, the ZATCA may apply a more facts-based approach when assessing whether a permanent establishment exists.

Second is related-party pricing, and here a change that took effect two years ago is still under-appreciated. Following amendments to the Transfer Pricing By-Laws, the transfer pricing provisions apply to zakat payers as well as taxpayers for financial years beginning on or after 1 January 2024, and Advance Pricing Agreements became available to both. For a Saudi family group with decades of intercompany arrangements built for operational convenience rather than for documentation, this is a material change in obligation, and one that many such groups have not yet worked through.

Lastly, needless to state that VAT audits are likely to get much more sophisticated with real time data and the data analytics and AI tools available.

What the amnesty covers, and what it does not

Many companies are counting on this window. It is worth being precise about what it covers.

The initiative covers late registration, late payment and late filing fines, penalties on the amendment or correction of a VAT return, and other financial fines imposed under Article 45 of the VAT Law, including field detection and e-invoicing violations. To benefit, a taxpayer must register where registration is required, submit the outstanding returns, and either pay the amounts due or obtain ZATCA’s approval for an instalment plan.

Two limits deserve emphasis. The initiative does not extend to penalties relating to tax evasion violations. And it operates on fines for returns falling due up to 30 June 2026.

There is also a point that no guideline states because it does not need to. The initiative waives penalties. It does not validate a technical position. A voluntary disclosure that corrects an arithmetic omission is a straightforward matter. A voluntary disclosure that reveals a contestable tax treatment is a different exercise entirely, because it puts a position on the record that will be read. The analysis must come before the filing, not after it.

Fewer than four months

For most groups, what remains to be done before 31 December is a short list. It is also, notably, not a systems exercise. The e-invoicing platforms are already built and connected. The work now is reviewing the positions those systems have been reporting all along.

Reconcile first. Take VAT/ Tax/ Zakat returns, customs declarations, withholding tax filings and audited financial statements for the open years and reconcile them against one another before ZATCA’s systems do it. Where the numbers do not tie, understand why, and document the reason contemporaneously rather than reconstructing it under assessment.

Then sort. Separate the genuine errors, which the current window is designed to resolve, from the judgement positions, which need to be assessed on their merits and defended with evidence that pre-dates the query.

Finally, treat documentation as a deliverable with a deadline. Substantiation assembled after an assessment notice arrives carries markedly less weight than substantiation prepared when the transaction occurred.

A regulator that publishes wave criteria six months ahead, that notifies taxpayers directly, that issues guidance with worked examples, and that tells the market in advance where relief will end, is behaving like the administration of a mature investment destination. That predictability is an asset for serious businesses, and it is what long-term capital looks for.

But predictability runs in both directions. The Kingdom has been clear about what it expects and when. The businesses that will move through the coming assessment cycle with least disruption are those that use the next few months to answer the questions before they are asked.

Disclaimer: This article is intended for general information only and does not constitute tax, legal, accounting or other professional advice. It reflects the tax rules in force as of the publication date, and the described regulatory landscape continues to develop. Readers should obtain professional advice appropriate to their own facts and circumstances before acting on any matter discussed.