The inability to establish baselines is complicating the task of securing these autonomous tools, a new report found.