AI Agents Force Enterprise Security Shift: Identity Management Becomes Critical Control Plane

Your AI Agents Are Guessing at Scale: Permissions Decide the Damage

Watch an agent work through a task, and you'll see the future of enterprise security. Watch Claude work through a long task some time. It can spend 4 minutes trying to read a CSV that turned out to be a folder, give up, write a script to list its contents, and then get there. It works. Just never the way you sketched it in your head. That is guessing at scale, and it is not a flaw. It's how LLMs work and why they're so effective. Agents reason probabilistically, choosing the next best action, observing the result, and adapting. That loop is what makes them powerful, but it is also why security models built around predictable workflows break down. AI agents are designed to improvise; that is what makes them useful. But when improvisation is paired with broad access, every wrong turn becomes a security risk. So here is the question: How do you secure a system whose next move you cannot predict? The Questions Nobody Wants to Answer Every team deploying agents runs into the same access decisions, usually without noticing: * Do you give an agent every tool that might help, or only the ones it will probably need? * Do you grant admin authority because some edge case could call for it? * Do you provision agents with broad access, or scope it down to the specific request in front of the agent right now? Are all of these connectors needed? Which need admin access? Are they needed for every session? None of these has a clean answer, because applying least privilege is hard. Doing it for every agent, and then for every session that agent runs, is orders of magnitude harder. So teams do the human thing by granting full access and moving on. Broad permissions are the path of least resistance, and agents inherit them by default. Most teams cannot answer these questions, because nobody has the inventory. Token Security finds every agent running in your environment, the identities behind it, and the access each one holds. Why the Usual Playbook Fails For two years, most AI security efforts went into shaping how models respond. Guardrails that include prompt filtering, input and output constraints, and behavior controls. While these are useful in many contexts, they are the wrong layer for the problem in front of us. Prompt filters try to constrain behavior. With natural language as the interface and an infinite number of possible prompts, there is always another way in. Filtering that works ninety-nine percent of the time still fails, because one percent of infinity is still infinity. More importantly, guardrails operate after access has already been granted. Once an agent holds credentials to a production system, the security boundary is already behind it. A filter can shape what the agent says, but cannot undo what the agent is allowed to do. Prediction fails for the same structural reason. Traditional identity and access management answers one question: what can this identity reach? That model is less useful for AI agents. Two agents with identical permissions can behave completely differently depending on what each is trying to accomplish. You cannot secure a goal-driven system by profiling its past behavior, because its next action depends on contexts it has not yet encountered. Why This Is Urgent Now The scale has already arrived. Palo Alto Networks puts the ratio of non-human identities to human identities at 109 to 1, including 79 AI agents. Agents are accelerating that curve, because anyone can spin one up in minutes, and most do so outside any security review. Think of agent risk as access multiplied by autonomy. Access sets the blast radius, while autonomy narrows the window for human intervention. Static IAM policies, written for humans who log in during business hours and get reviewed once a quarter, were never designed for agents that never sleep, don't use MFA, and are rarely retired. Identity Is the Only Control Plane That Holds Strip away the model, the prompt, and the framework, and one thing stays constant: every action an agent takes runs through an identity. It authenticates with a service account, an API key, an OAuth grant, a cloud role, or a token. All actions, from reading data to modifying infrastructure, depend on the permissions of an agent's identities. That is why identity, not prompt filtering, is the control plane for agentic AI. Identity is the layer that spans every system an agent touches, making it the only place you can enforce control consistently. Identity controls access, and intent makes that access safe. Intent Is the Missing Dimension Traditional access control asks what an identity can do. For agents, that is not enough, because purpose is what separates safe behavior from dangerous behavior. An agent resolving a failed deployment and an agent exfiltrating data may perform nearly identical low-level actions: reading logs, calling APIs, and accessing a database. From an IAM perspective, they look the same, but their intent is not the same at all. Intent-based security adds that missing context. Instead of asking "what can this agent access," you ask "what should this agent be able to access to accomplish its purpose, and nothing more." Once intent is defined, permissions can be tightly scoped, and anything outside that boundary stops being a routine anomaly and becomes a security signal worth acting on. This is also the only version of least privilege that survives contact with reality. You cannot hand-tune permissions for every agent and every session. You can, however, model each agent's intent and automatically enforce access controls against it. That is the shift that makes least privilege operational instead of aspirational. Visibility Is Table Stakes. Enforcement Is the Point. Most tools stop at visibility. An inventory of agents is necessary, but it does not change what an agent is allowed to do. Knowing you have a problem is not the same as fixing it, and users will keep granting as much access as they can to get their work done faster. The work that actually reduces risk is preventative and continuous: * Discover every agent and the identities it uses, across cloud, SaaS, endpoints, and AI platforms, including the shadow agents nobody registered. * Understand what each agent can access and what it is meant to do, so you can right-size permissions to intent. * Enforce that scope automatically, revoke access when an agent is retired, and govern the full lifecycle from creation to decommissioning, because risk does not appear at creation. It accumulates as access piles up and ownership blurs. Agents guess. That is their nature, and it is not going to change. What you can change is the blast radius of a wrong guess. You do that at the identity layer, scoped to intent, and enforce it before the action rather than explain it after. Your agents will keep improvising. The question is whether they are improvising inside boundaries you set, or boundaries you never drew. To learn how to secure AI agents at scale, demo Token Security today.

Mastercard rewrites fraud rules for AI agents | VentureBeat

Every time a Mastercard gets tapped, the network has less than a tenth of a second to judge how likely the purchase is to be fraudulent. It made that call across 175 billion transactions last year. Now the buyer on the other side of that judgment is starting to change, and Greg Ulrich, the company's chief AI and data officer, spelled out the consequence for the VB Transform 2026 audience in Menlo Park on July 14. "We've built a bunch of risk rules over time that were intended to stop a bot from transacting," Ulrich said. "Now we need to enable the bot to transact, so that requires a change to our risk framework and our risk rules." Ulrich joined Mastercard eleven years ago when an analytics company he worked at was acquired, and said trust struck him from day one on the job. "It's what enables a merchant that's never met you to accept payment and ensure that they're going to get paid. It's what enables you as a consumer to transact and ensure that things are going to work out in a trusted, secure way. And if something goes wrong, there's a safe and secure path for a dispute and to resolve this," he said. 175 billion transactions, scored in under 100 milliseconds He took the audience inside each of those calls. "When you tap your Mastercard to pay for a product or service, we're providing a score to that transaction," he said. "We have under 100 milliseconds to look at that and give a score from zero to 999 about how likely is that to be fraudulent or real. And we pass that on to the issuing bank." Generative AI widened what that score can see. "Because we have new technology, we can bring in more data, we can bring in more context, and now we're finding that we can identify 300, 400% more fraudulent transactions at those high-risk bands," Ulrich said, without adding friction or false positives for consumers. The company's Safety Net system has stopped more than 70 billion fraudulent transactions, he told the audience, and Mastercard is building its own transformer model on its transaction data as a foundation for new safety, security, and personalization solutions. VentureBeat's Beyond the Pilot podcast took that production fraud stack apart in detail earlier this year. A third of the services business already runs on AI The business stakes reach past fraud. About 40% of Mastercard's company is now based on services, Ulrich said, including marketing services; fraud, safety and security; and business intelligence. "A third of those are predicated on AI, and those are growing at a much faster clip than everything else," he said. One line he returned to all session went further. "What's going to enable AI to continue to scale is not the capabilities of the agents, it's how much we trust those agents to do on our behalf as a consumer, as a business, as a financial institution, or otherwise," he said. Five layers stand between agents and the network Agentic commerce changes the object being secured. "Instead of a single atomic transaction where I say go buy something, I'm effectively delegating authority, or a consumer's delegating authority, a business is delegating authority," Ulrich said. "And when that happens, it's a much more complicated transaction." Trust, in turn, has a precondition. "The only way it's going to work with trust is if we can identify what was the intent, what are the behaviors, what are the constraints that were intended in that transaction." Ulrich walked through five layers Mastercard has built against that problem. Identity comes first. "I want to make sure I can understand not just who the consumer is, but who the agent is, that I combine them together and that I have KYA or know your agent, that I'm validating that it's legitimate technology, that it's a legitimate agent," he said. "We can register it into our system." Verifiable intent settles the "wrong-Nikes" problem Verifiable intent is second, a tamper-proof cryptographic record of the original instructions that travels with the transaction. "If you've asked for Nike black Nikes in size 12, but you got them on a final sale and they're not returnable and that wasn't in your instruction, there's a way to look at that in an objective and clear way on the back end," he explained. Controls form the third layer, defining which merchants an agent can buy from, at what limit, and under what constraints. Execution runs through Mastercard Agent Pay, which carries "the tokenization, authentication, the acceptance framework embedded within it" and has launched with Microsoft, OpenAI, Google, and others, Ulrich said. Intelligence is the fifth layer, spanning risk rules, insight tokens that grant "consented or permissioned access to insights" for personalized recommendations, and monitoring through Recorded Future to identify threat actors in the system. The bigger prize is a procurement agent with a budget Consumer purchases are where agentic commerce started. Ulrich pointed the room past them, to business-to-business procurement as the larger opportunity. His example was a manufacturer that wants an always-on assembly line, with an agent that manages inventory levels, tracks when stock runs low, replenishes automatically, and understands the budget and the approved suppliers. "When you can start enabling that, you require those same five layers for that type of transaction," he said. Making it work across companies multiplies the parties that have to trust each other. "You need clear standards for identity, you need clear standards for intent, you need these to work across. You're gonna have a procurement agent, a supplier agent, a banking agent. They're all gonna need to communicate to enable this to happen in an autonomous way, and that's gonna require really scaled trust infrastructure." Powerful new models, same security motion Mastercard sat in the early wave of Project Glasswing with Anthropic's Mythos model, and worked with OpenAI's GPT-5.5-Cyber, he said. "What we've seen from both of those is incredibly powerful models finding new vulnerabilities in the ecosystem that were difficult to detect previously, but it's really a new tool as opposed to a new motion," Ulrich said. Inside the company, the chief security officer leads that work. A dedicated team has prioritized the most critical assets, runs them through the models routinely, tracks findings by high, medium, and low severity, and uses the same technology to handle patches. Ulrich said the approach has already been extended out, and that Mastercard is working to make the same architecture and patching available to others as well. What Mastercard would build differently after 14 months "The guardrails, the security, all this stuff has to be embedded at the front end. These can't be things that we're adding on at the back end. That's lesson one. Lesson two is you have to be operating for scale, and the other one is around observability and accountability matter as much as the intelligence," Ulrich said, counting off what building inside Mastercard taught the team. The company built what he described as an agentic factory, an operating system with the compliance, the observability, and the guardrails built in rather than bolted on per agent. Model drift, once tracked manually by dedicated teams, is now automated into that factory. Asked by an audience member about the gotchas, Ulrich did not soften the pilot-to-production trap. "If you're trying to extend that and then add guardrails in as you're extending it, once you've already built it, I think you're doomed to fail," he said. Mastercard built a series of agents last year for its 4,000 consultants, covering deep research, text to SQL, Excel, and PowerPoint, tools that by his account did not exist at the level Mastercard needed. Were the company starting today, Ulrich said, it would build them fundamentally differently. "I don't know that we anticipated when we built things fourteen months ago that we would be rethinking the fundamental architecture and the approach already." Agentic identity joins KYB and KYC The identity layer is where Ulrich expects the market to move next. Inside Agent Pay, Mastercard authenticates the consumer the way it does in traditional e-commerce and binds the agent to that person. "Outside of that framework, I think there will be open standards to identify who an agent is and bind the agent with the consumer," he said. "And then we can tie that with verifiable intent." VentureBeat's June 2026 Pulse research points at the same gap. Only 32% of the 107 qualified enterprise respondents give every agent its own scoped, managed identity, and just 12% include an agent-identity product in their consideration set. He called identity "one of the faster-growing ecosystems," noting Mastercard has been expanding there organically and inorganically for about six or seven years, with the work now spanning "agentic identity as well as the traditional KYB and KYC identity." The risk rules that keep bots off the network came out of more than two decades of applying AI to those transactions. The rewrite, for the agents Mastercard now wants to let in, is already underway on the same network that scored 175 billion of them last year.

Agentic security doesn't need a whole new definition - you just need to reframe what you already know

AI agents need their own identities, controls and accountability Though attack vectors and threat environments have changed since the advent of the internet, one thing has remained a constant - humans use software, and software has predefined parameters. That distinction is exactly why social engineering remains so effective. Cybercriminals exploit predictable weaknesses in human behavior, granting them accesss to accounts and other sensitive information. For the first time ever, that long-standing assumption is being turned on its head. In today's increasingly autonomous world, AI agents can take action on behalf of humans, creating an entirely new class of attack vectors that target machine autonomy rather than human weaknesses. The boundary between software and user is getting really, really blurry The purpose of an agent isn't just to retrieve information or wait for a human's approval - its responsibilities can include interpreting objectives, developing plans, choosing tools, accessing data autonomously and taking actions. In short, agentic AI bridges both software and user. This doesn't make everything we know about software and SaaS security obsolete, but it does mean that many of the assumptions underpinning today's controls are no longer sufficient. Humans will continue to use conventional software, but alongside agentic workflows, leaving organizations responsible for security both types of environment. Thankfully, the fundamentals remain - least privilege, strong authentication and separation of duties will all be central to the next wave of cybersecurity. What will change, though, is how those principles will be applied to agents, which don't behave as software or human users. AI agents need identities of their own The first requirement is to stop treating agents like features hidden inside applications, or software in their own right. An enterprise agent should actually have a first-class identity just like any other human colleague. This means AI agents should have unique identities, named owners (line managers), clearly defined purposes and specific permissions. But they should also have their own lifecycles akin to software, such as creation dates, review points and expiry dates. "Expiry dates or periodic recertification are important because agents can otherwise become long-lived access paths that are harder to govern than human users," Zendesk Chief Security Officer Vinay Patel explained to me in an exclusive interview. At the end of the day, these are the sorts of controls that already exist for human users because organizations already understand the risks of unmanaged access, due to role changes or company departures, for example. Without treating AI agents as users in their own right, companies risk accumulating abandoned agents, stored credentials and even data access paths whose original business purposes may have disappeared - an unthinkable consequence for humans, so one that should be treated just as severely for AI agents. Human-in-the-loop automation is the future Importantly, AI agents don't just occupy one space. They can act autonomously, be commissioned on a task-by-task basis by a human user, or operate somewhere between the two. Patel told me that an "audit trail should preserve both identities: the human who initiated or authorized the action and the agent that executed it." For fully autonomous agents, a log tying them back to their "owner, purpose, and approved policy" is still just as important. But of course, it all boils down to flawless visibility and effective management. "Companies need inventory and discovery across the places agents can be created or embedded, including SaaS platforms, internal automation tools, development environments, and third-party integrations," Patel added. Organizations must monitor not only which agents are deployed, but whether their permissions and behavior remain aligned with their original business purposes. Recent NIST research raises many of the same priorities, including verifiable records of agent actions, intent, data sources and generated output. But while NIST is developing guidance around agent adoption, visibility, control and accountability, agents are already being deployed, and often without the necessary safeguards. Traditional IAM falls short A separate Cloud Security Alliance paper concluded, "traditional identity and access management (IAM) protocols, designed for static applications and human users, can't keep up." The researchers argue that credentials and permissions should be task-specific, short-lived and easily revokable, unlike human identities which are generally set for the duration of their employment contracts. The CSA also recommends applying zero-trust principles by treating agent compromise as a credible possibility. By enforcing least privilege, isolating systems and continuously verifying access, organizations can limit the potential consequences of an attack or misconfiguration as they adapt to this new security environment. Accountability starts before deployment Patel says that, "accountability should not collapse onto a single party by default." It's as much the responsibility of adopters as it is lawmakers, and even end users. Key to understanding vulnerabilities and potential risks is identifying where the failure occurred: "user's instruction, the agent owner's governance, the developer's design, the platform provider's controls, or the enterprise's deployment model." Above all else, Zendesk's Chief Security Officer argues that "accountability must be defined before deployment, not reconstructed after an incident." In the short term, this work could slow AI adoption as companies address controls that might've been overlooked during early, informal experimentation. The danger arises when a successful pilot actual progresses into production without pausing to define ownership, permissions and other policies. Before scaling agent deployments, organizations should pause other ensure the right foundations are in place. Governance becomes much harder to retrofit once an agent has actually been embedded. Preparing for the autonomous workforce The question is no longer how, or even whether, AI agents will become part of the enterprise - it's about how employers can establish the necessary controls before they're more common than human workers. The most valuable security investments today focus on visibility, control, accountability and governance, not forgetting over investments tech admins are making across data foundations and interoperability. But thankfully, none of this requires a business to abandon the security principles it's spent decades developing. All it requires is for leaders to extend and reframe these for the agentic world. The future enterprise will combine the human-software environment we already know with a new end-to-end agentic layer - neither one of these will replace the other. Companies preparing for this new hybrid will see the greatest returns. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Hush Security says the AI security problem has shifted from protecting models to governing identities as autonomous agents spread

Less than a year after emerging from stealth to tackle non-human identity security, Israeli cybersecurity startup Hush Security believes the enterprise AI security conversation has fundamentally changed. The company, which earlier this week announced a $30 million Series A round led by returning investors Battery Ventures and YL Ventures with Akamai Technologies joining as a strategic investor, argues that organizations are rapidly moving beyond experimenting with generative AI assistants and into deploying autonomous software agents that require an entirely different security model. While the funding will help expand engineering, U.S. sales and enterprise integrations, Hush is framing the announcement primarily as evidence that identity -- not models -- is becoming the critical control plane for enterprise AI. "The discussion has moved incredibly fast," CEO and co-founder Micha Rave told VentureBeat in a video call interview following the funding news. When Hush launched last year, the company's focus was securing non-human identities -- API keys, service accounts, machine credentials and other identities used by software rather than people. Since then, Rave says, customers have increasingly asked a different question: how do they safely allow AI agents to operate inside production systems? This is a pertinent and urgent question ever since Hugging Face revealed in mid-July it was hacked by an autonomous AI agent, later identified as an OpenAI test agent running internally that escaped its secure sandbox, powered in part by an unreleased model. According to Gartner figures cited by the company, the average Fortune 500 organization could be running more than 150,000 AI agents by 2028, compared with fewer than 15 only a year earlier. Hush also points to Omdia research suggesting that 96% of organizations are relying on governance models that were never designed for autonomous AI agents. From machine identities to autonomous software The company's original thesis was that enterprises had accumulated thousands of long-lived machine credentials that were difficult to rotate, audit and secure. Rather than relying on static secrets, Hush developed an identity-based system that brokers short-lived, policy-driven access for machines. Rave says AI agents amplify that same problem. "Software now acts autonomously, on its own initiative, inside your most sensitive systems," he said. "AI agents need strict identity, not just API keys." Unlike traditional automation, AI agents frequently act across multiple enterprise systems, invoke external services, make decisions independently and often execute actions using the permissions of the human who launched them. In practice, organizations often grant an agent broad OAuth permissions or administrator credentials simply to enable it to complete tasks. That creates what Hush describes as an identity problem rather than simply an AI problem. During the interview, Rave said virtually every security leader he speaks with faces the same dilemma: either slow AI adoption until appropriate controls exist or allow employees to connect new agents directly into corporate systems despite limited governance. "The answer," he said, "is that they let everything in. You cannot stop innovation in the name of security." Identity becomes the control point Rather than treating AI agents as another application requiring credentials, Hush is extending its existing non-human identity platform into what it calls an "Identity Gateway" for AI agents. The platform sits between agents and enterprise resources, allowing organizations to discover agents, assign each one its own identity, associate it with a responsible human owner, broker task-specific permissions at runtime and maintain centralized audit logs. Instead of allowing an agent to inherit all of a user's privileges indefinitely, Hush attempts to enforce what it calls "least agency" -- granting only the permissions necessary for the specific task being executed. The company says every action can be logged, attributed and revoked from a single control plane, while administrators retain the ability to terminate an agent's access immediately if necessary. This represents a broader shift in enterprise identity management. Human identities have long been governed through identity providers, single sign-on and privileged access management systems. Machine identities have increasingly received similar attention as organizations modernized cloud infrastructure. Hush argues autonomous AI agents now represent a third identity category requiring dedicated governance. Hush has not publicly posted its pricing for the Identity Gateway solution. Governing every kind of enterprise agent Hush says enterprises are no longer dealing with a single category of AI software. During the interview, Rave described three broad classes emerging inside organizations: * Desktop coding assistants and productivity agents such as Claude, Cursor and VS Code integrations. * Enterprise AI platform agents running on services such as Microsoft Foundry, Salesforce Agentforce or AWS AgentCore. * Custom agents organizations build internally for business processes or customer-facing applications. Each introduces different governance challenges, but all ultimately require controlled access to enterprise systems. The problem, according to Hush, is that many agents currently authenticate using inherited human credentials or long-lived API keys, making it difficult to determine whether an action originated from a person or from an autonomous system acting on that person's behalf. "If I see something in the Salesforce logs," Rave said during the interview, "did the user do that, or was it the agent the user was using?" That attribution challenge becomes increasingly significant as organizations begin deploying multiple autonomous systems capable of initiating actions without direct human approval. Existing identity tools weren't designed for AI agents Rather than replacing identity providers or secrets managers, Hush positions itself as filling a gap between them. Traditional IAM platforms authenticate employees. Secrets managers store credentials. Neither, the company argues, governs the runtime behavior of autonomous software acting on behalf of humans across multiple systems. Hush says its platform continuously discovers known and shadow agents across enterprise environments, assigns ownership, brokers just-in-time credentials and records every interaction in a centralized audit trail. According to its product documentation, organizations do not need to modify their existing agents because the platform operates by brokering access requests rather than changing application logic. That identity-first approach is attracting customers already deploying enterprise AI initiatives. IT infrastructure services provider Kyndryl says it has deployed Hush internally and has begun offering the platform to enterprise customers. "Our collaboration with Hush is rooted in a shared security philosophy: identity is the ultimate control point for the modern agentic workforce," said Adeel Saeed, senior vice president and CTO for Global Cyber Resiliency at Kyndryl, in a prepared statement. Akamai's participation in the funding round similarly reflects what the company sees as an architectural rather than incremental shift. "AI agents are driving the next transformation, and identity is the piece most companies haven't solved yet," said Ramanath Iyer, Akamai's chief strategist. Security priorities are moving beyond the model itself The broader AI security market has spent the past two years focused largely on prompt injection, model vulnerabilities, jailbreaks and LLM safety. Those remain active research areas, but enterprise deployments increasingly face operational questions around what autonomous systems are permitted to access and how those actions can be governed. Hush argues that identity is becoming the enforcement layer for answering those questions. Rather than asking whether an AI model can safely generate code or summarize documents, enterprises increasingly need to determine which systems an agent may access, whose authority it exercises, how permissions are delegated, and how every action can be traced back to an accountable owner. Whether Hush's identity-centric approach becomes the dominant model remains to be seen. But as enterprises move from experimenting with AI assistants to deploying thousands of autonomous software agents, the company is betting that the next major security challenge won't be securing the models themselves -- it will be securely managing the identities of the software acting on their behalf.

Zero trust and breach containment in an agentic world - Zscaler CEO Jay Chaudhry on the new stakes of threat defense

As AI security drama hijacks enterprise news cycles with unsettling regularity, I keep coming back to my conversation with Zscaler. Billed as an "AI security platform built on zero trust," Zscaler is the perfect foil for everything that is preoccupies me with AI security: * Will AI ultimately help defenders as much as attackers? (Even with the concerning Hugging Face attack from an OpenAI agent run amok, Hugging Face's defense included a Chinese AI model). * Why do companies struggle to contain breaches, before they turn into massive credential exposures? Zscaler data findings - "a critical gap between innovation and security" My foil? Good sport Jay Chaudhry, CEO, Founder and Chairman of Zscaler. Some data points: Zscaler began the year with its 2026 threat report, which cited an 83 percent year-over-year rise in AI usage, "creating a critical security gap between innovation and security." Timed with its Zenith Las Vegas user event in June, Zscaler released fresh data, Zscaler Research Finds Cybercrime Economics Are Shifting as AI Trades Mass Volume for Lethal Precision. "Lethal" might be a touch dramatic, but there is no question that AI-powered attacks enable greater sophistication, at greater scale. Two stats that jumped out: * Quality Over Quantity: Phishing volume fell 20% for the second year in a row as attackers recalibrate to high-fidelity, AI-accelerated lures. * Reconnaissance Exposed: Deception telemetry recorded 89.9 million hostile interactions from 1.37 million unique attacker IPs in six months, revealing large-scale scanning and credential validation before compromise. When I asked Chaudhry for the pulse of Zscaler customer, that's where he started: The problem they're trying to solve are threefold: one, they want better cyber protection. They're all nervous about cyber. Mythos is making them nervous. AI is overall making them nervous. There is no business agility without security I didn't expect the CEO of a security vendor to emphasize business agility, but that's where Chaudhry went next. But as Chaudhry points out, agility without security is basically fragile agility - or agility with too much risk exposure. Number two, [enterprises] want business agility. That means they want to be able to do things in a more agile fashion, and want to be more competitive. Examples would be: 'Can I open a new office in Kuala Lumpur in three days rather than wait for three months, because some routers, firewalls, boxes need to be shipped and things slow down?' 'Can I really open a mobile retail store in one day, and be up and running?' Another example of business agility would be: I am acquiring a company. When you acquire, you integrate you the two companies together. There's a people side of it, then there's applications rationalization, then the network and security takes a long time. How can we make things faster, rather than waiting for a transitional services agreement for 18 months? What customers don't need is complexity: The third bucket is: help me reduce my cost and complexity. Network and security are really requiring lots of investments that become complicated. The solutions they started deploying twenty years ago; they have been bolted-on. Bolted-on complexity lacks resilience. That all resonates - but I'd argue that security is either broken, flawed, or - at best - not keeping stride with attacker advances. Chaudhry says to get out in front, we must first understand how we got here: Since 1997, when I started my first cybersecurity company, I saw the number of attacks grow every year. I saw the budget for IT security grow every year. Then I asked myself, the attacks are growing; breaches are growing. This investment in cybersecurity isn't working. We got a firewall, then we got a next-gen firewall - we keep on deploying it. The results aren't very good... . Fundamentally, the core of cybersecurity has been: my data center is my castle, and then a firewall is a moat; it's a door; it's a gate. You can't get in unless I check you, and then I allow you to get in. Once you're inside, you're trusted. On "zero trust" and threat containment - we need a different approach Zscaler is intent on changing this. Chaudhry: I thought that a different approach was needed. So we literally turned security on its head. Cybersecurity comes across geeky and complicated, but it doesn't need to be. As a repeat victim of identity theft, I have axes to grind with corporate security. My biggest beef? Containment. I told Chaudhry: I'm so sick of reading about breaches where five million records were affected. Can I once read about a breach where only ten customers were affected, or only 1,000 pieces of data? Why the hell can't anyone contain their breaches? This is ridiculous. As Chaudhry explains, our systems were designed for lateral connectivity - a circumstance ripe for malware exploitation. A network is like a highway; it connects every office to every office. I go and sit in a branch office; I connect to the network, and the job of the network is to allow me to go left and right, find applications, and use them, which is wonderful - but now malware has learned that it wants to exploit the same design feature. It gets your laptop infected; it's on the network; it finds your mission-critical application by moving laterally, and it encrypts them and asks for money. A zero trust architecture like Zscaler's is specifically designed to address this: The best security is to eliminate lateral movement. Lateral movement means: don't put it on the network. A switchboard eliminates lateral movement. You go from A to B, and B only. Suppose your machine got infected. The malware may be able to reach one application you are logged on. That's it. No left, no right. So we must eliminate lateral movement. That's what we do with zero trust architecture. With Ai agents, the stakes are that much higher: Today, a user is the weakest link.Tomorrow, agents will be the weakest link. In fact, they're far more dangerous if they got hijacked or hacked. They're more dangerous because they can act in milliseconds. The numbers will keep on growing, and they need no coffee break, no weekend, no vacation, no sleep time. Ugh - so how do you secure against that? Well, they are somewhat like digital workers, like people, just like I described to you: how can we have a policy that says: this user can only go here, this user can talk only to this application. Applying zero trust to agentic workflows - how Zscaler's acquisition of Symmetry fits in That's why Zscaler extended their Zscaler Zero Trust Exchange Platform to secure AI agents as well. How will this apply zero trust to agentic workflows? Chaudhry: A certain group of agents can talk to certain group of applications or a certain group of agents - that's the cool new technology we are building, which is critical. The CIOs I talk to say: 'We've got a bunch of agents, but we aren't comfortable rolling them out because we don't know the security controls and the like. Agents still need containment. Therefore, a zero trust architecture is still relevant. But how is defending against AI agents different? The zero trust architecture we built lines up pretty well - with two differences. Number one, we had to build a few new pieces. We had to build MCP gateways, which we didn't have before. Now, as agents communicate, the prompts and responses need to be inspected. Is this prompt trying to do prompt injection? So we had to figure out the intent - what's the intent of this prompt? And then we had to figure out how to get the identity of the agent. Identity generally comes from the party that builds agents. When Microsoft allows you to build agents, it also gives you identity. We use the identity to do what needs to be done. So, most of the pieces were in place. Then there is the issue of agent proliferation: The biggest piece we had to worry about was scale. For every user, there could be 5,000 agents. The amount of traffic could be growing quite a bit. How do you scale for that? When I started the company, I wanted to build the most scalable service out there, so we were already very scalable, and we had to think about how to scale even more.. If I'm securing 60 million enterprise users today, this may be over a billion agents in not too distant future. How does Zscaler's acquisition of Symmetry factor in? It's about graph-based data lineage, giving access to the right people: It's we call a data lineage graph. Tomorrow, this graph will help us create policies to enforce in our zero trust engine to say: I want these agents to talk to these applications.' Otherwise, how do you know who talks to who? Symmetry gives us a map and graph of who is talking to who. My take - who has the AI edge, attackers or defenders? I asked Chaudhry about a surprising post from security expert Bruce Schneier; Schneier argued that AI-driven security might ultimately benefit defenders more than attackers. Chaudhry says he "fully agrees" with Schneier on this, albeit with an asterisk: We have seen the use of AI to find needles in haystacks - to find things we couldn't find before. But Chaudhry flags the problem of organizational inertia: We've got the technology, but I have a big concern. Hackers have no inertia; larger corporations have more inertia. The adoption of technology takes too long. CIOs and CSOs need to be more pro-active in doing things, just like software development. Contrary to the agentic-security-hype doom loop, the tools to defend are there - if organizations show the resolve. However, if they don't overcome that inertia and fund their security modernization, I don't like their chances. I'm amongst those who believe that the OpenAI agent's hack of Hugging Face *** was as much an overblown publicity stunt than a cause for alarm. Still, defending against that attack took some sophistication (Hugging Face ended up utilizing a Chinese model to defend against OpenAI agent's breach). Can the white hats out there can keep pace with aggressive/amoral attackers, who can utilize systems without guardrails? Let's see organizations put inertia in the rearview mirror - and get their zero trust defenses in place. Then we'll find out...

NTT DATA AIVista and Snowflake: Identity alone won't secure enterprise AI agents

Presented by NTT DATA AIVista VentureBeat's June research found that 69% of enterprises are still running AI agents that share credentials, a practice associated with higher rates of security incidents and near-incidents. But at VB Transform 2026, Mukesh Karki, CTO of NTT DATA AIVista, and Mayank Upadhyay, chief security and trust officer at Snowflake, argued that fixing identity is only the first step. Enterprises also need action-level authorization and tamper-resistant audit trails built into every agent interaction if they're going to deploy autonomous systems safely at scale. "These organizations need to be able to prove to their auditors in a very tamper-resistant fashion that those records showing what they did actually prove what they're doing," Karki said. "And the provability is essentially your license to operate in a regulatory environment." Why shared credentials cause agentic AI security incidents The problem, Upadhyay says, is many assumptions were carried over from an earlier generation of software. "In the traditional software world, a human being clicks somewhere and the software does something very deterministic, and you know which API it's going to call," he said. "But in the agentic world, the software has a brain of its own, and it's constantly rewiring itself. If you give this software more permission than it needs for a particular goal, agents are exploratory by nature, so they're going to try lots of different things, and you'll have unintended side effects." Embedding a single static API key compounds the exposure, he added. "It's a really bad pattern if you have one API key, you shove it into the agent, and it's talking as anybody to a particular SaaS service, because then you're giving this agent the union of everybody's needs," he said, noting that the second failure mode is forensic, since "things may go wrong, and you wouldn't be able to attribute it to the right agent." Scoped credentials are only the starting point in regulated industries Karki, whose clients are mostly in insurance, healthcare, and finance, treats scoped credentials as table stakes. "In a regulatory setting, an agent that's not broadly scoped with shared scope credentials is not going to run, period," Karki said. "Having a scope credential is just a starting point. There are actually two layered constraints. One is the jurisdiction in which the agent operates, and then it's the jurisdiction or the rules of that organization." For instance, a claims adjustment agent in Washington State operates on different regulations than one in California, he adds, and every claim is different. "Those scoped credentials are not enough, because it has to be action-based and rules-based at the time it's taking action," he added. Where the employee analogy for AI agents breaks down The employee analogy, Karki argued, only goes so far. Agents still need to learn an organization's unique context, much as a new employee does. But unlike people, enterprises can't realistically build trust with thousands of agents over time. "A star employee in one organization might not be the best employee when they move to a different organization, not because they became worse, but because they don't have the context of this new place, and the same is true with agents," Karki said. "If every employee has 100 agents, you can't say you're going to onboard these agents and do a background check on them." Upadhyay said the employee analogy should place agents one rung lower in the organizational hierarchy. "Treat them like interns," he suggested. "They have good intent, but they don't always know what they're doing, and you have to keep your eye on them while you gradually build trust." On the Snowflake platform, administrators can impose platform-wide guardrails such as read-only operations, while developers further narrow an agent's permissions when they launch each session. A three-layer approach to AI agent governance There's no question where governance belongs, Karki says. "Governance has to happen at every agent action, and it has to sit outside the agent," he explained. "That's the only way you'll be able to prove later that the agent took an action it was allowed to take." Upadhyay broke governance into three layers: The agent layer covers identity, tool permissions, and MCP governance. The model layer addresses indirect prompt injection and enables models to run inside the customer's VPC so prompts remain invisible to the model provider. The data layer covers least-privilege access, zero-copy architecture, and role-based access control. For agents to work properly, governance is required across all three. What enterprises should audit first For enterprises auditing the governance of existing AI agents, Upadhyay recommends starting in two places. The first is auditing permissions for static secrets, the largest fixable attack vector. Next is addressing shadow AI through an MCP gateway, so developers no longer have to run bootlegged open-source MCP servers under their desks and administrators have visibility into who's talking to which MCP server. There's a tradeoff between constraint and capability, and that can be addressed at the task level, with confidence scoring used to withhold autonomous execution on high-risk actions, and sandboxing as a middle path. But Karki cautions enterprises already scaling their agentic systems. "A lot of this can't be retrofitted after you have an agentic system running, and it's even harder to retrofit if you have to prove to your auditors why exactly the agent behaved the way it did," he explained. "Provability has to be built ground up when you're designing the system." Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they're always clearly marked. For more information, contact [email protected].