Tracking AI agent near-misses to measure whether security controls are working

Security programs usually record only incidents that caused harm, yet attempts blocked by controls reveal both an agent's willingness to cross boundaries and whether those boundaries hold. NIST, NSA and CISA's October incident response practices define control near-misses and ask organizations to track and report them. UK AI minister Kanishka Narayan said the government will assess strengthening its Cyber Security and Resilience Bill to cover reporting of serious incidents and near misses, though no amendment text exists yet. Because real agent incidents are rare, near-misses offer a more frequent and useful metric for showing which agents push against their scope and which control layers catch them. The article proposes a simple register with a few mandatory fields per blocked attempt, including the agent, timestamp, attempted action, boundary hit, and the control that caught it.