AI Agents Trigger Security Crisis: 65% of Enterprises Report Incidents Amid Scaling Challenges

Agent identity is solved. Containment isn't | VentureBeat

Visa's president of technology, Rajat Taneja, walked the VB Transform 2026 audience through aiming Anthropic's Mythos at Visa's own payment network. The model stitched minor weaknesses into working exploit chains, and Visa open-sourced the harness that governed the hunt. That's what it looks like when an enterprise has the engineering depth to act on what it finds. Most don't get there. Just over half, or 53%, of enterprises have already had an agentic security incident or near-miss. Sixty-five percent enforce agent permissions at runtime, yet only 18% isolate their highest-risk agents, and just 8% pair enforcement with isolation. Leaning on provider-native controls to do the heavy lifting of agentic security just exacerbates that gap. The July wave of VentureBeat Pulse Research found that 92% of enterprises naming a primary security layer default to their hyperscalers and AI platform providers. Six waves of research have been completed since January, surveying 440 qualified enterprise security respondents. The key takeaway: the containment gap between what enterprises need and what's getting done is growing wider, often unaddressed by enterprises whose agentic AI investments and futures are at risk. The satisfaction data doesn't match the incident data The research keeps showing enterprises rating the tools they know best at a higher score, even if those tools failed them or delivered mediocre results. Three findings from the raw data cut against that instinct, and each one says something about how young this market still is. The enterprises that got hit rate their tools higher than the ones that didn't Last month's survey found that 46 enterprises reported a confirmed incident or near-miss, then went on to rate their satisfaction with their security tooling. Their average satisfaction was 4.39 out of 5. 30 of the 55 enterprises who experienced no incidents rated their security tooling at 4.13. Enterprises are rewarding any tool that saves them from a breach with a trust premium. It's a sure sign of a nascent market when brand positioning, marketing, or other means of persuading enterprises get easily superseded by saving a customer from a breach. Near-misses outnumber confirmed incidents 2-to-1 in both June and July, which means enterprises are catching problems at the edge. That edge catch is being interpreted as validation of both the security strategy and the tools acquired. Evident through seven months of data is how quick enterprise security leaders are to trust a new tool that identifies an intrusion or breach and defeats it before it gains access. VentureBeat believes the rescue itself is doing the marketing. The 4.13 average among never-hit enterprises shows the other side of the same effect. Tools that have never been seen working earn less trust, not more. VentureBeat also found that of the 17 enterprises isolating their highest-risk agents, the 14 that rated their tooling average 4.00. Enterprises that do not isolate rate it 4.35. The enterprises closest to real security are the least satisfied with their tools -- that dissatisfaction is what drives them toward the kind of engineering effort Visa put in. Four of five enterprises that solved identity did not build isolation 49%, or 57 of the 116 enterprises surveyed in July, gave each agent its own scoped, managed identity. Just a month earlier, VentureBeat's June wave recorded 32% of enterprises having assigned per-agent identities. July's 17-point jump in one month is the fastest single-month move this series has recorded. Despite these gains, 63% still report credential sharing somewhere in the fleet. Only 11 of those 57 also isolate. That ratio explains why the containment gap keeps widening even as every headline control improves. Enterprises are treating identity and isolation as substitutes. They need to see the longer-term vision of each being integral to a platform-based, layered strategy. Two incidents VentureBeat has covered show why that distinction matters. A rogue AI agent at Meta passed every identity check before its March exposure was contained. And CrowdStrike CEO George Kurtz disclosed, at his RSAC 2026 keynote, a Fortune 50 agent that rewrote its own security policy using valid credentials. Giving an agent scoped credentials does not bound the blast radius when those credentials are misused. Sandboxing does. The enforce-without-isolate population has a 58% incident rate Fifty-three enterprises in July's survey enforce scoped permissions at runtime but do not isolate. 31 of those 53 have already had an agent security incident or near-miss. That is 58%, five points above the 53% sample average. The enterprises living inside the containment gap are getting hit more often than the enterprises outside it. Amy Chang, Cisco's head of AI threat intelligence and security research, presented findings on the Transform agentic security panel showing that when Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through up to 88.3% of the time. Single-turn red-teaming missed it. An adaptive attacker who defeats the guardrails lands inside whatever architecture sits behind them, and for 53 of the enterprises in this data, that architecture enforces but does not contain. VentureBeat's Q1 Pulse Research tracked the same structural weakness earlier this year. Unauthorized tool or data access ranked as the most feared failure mode in every Q1 survey, growing from 42% in January to 50% in March. The April-May survey found only 4% of enterprises comfortable relying on model guardrails alone. Enterprises predicted they needed external controls, choosing to build enforcement over containment. Enterprises built enforcement 35 points ahead of forecast. Isolation barely moved The April-May survey asked 109 enterprises how they expected agent behavior to be controlled by the end of 2026, and 30% predicted runtime enforcement, 14% sandboxed execution, and 32% model-level guardrails. By July, 65% had built enforcement, more than double the prediction, while isolation reached 18%, roughly the rate they said it would. Enterprises built what was easy at twice the forecast and built what was hard at roughly the forecast. The April question asked for the primary control mechanism, single-select, while July's posture question allowed multiple selections, so the comparison is directional rather than exact. Provider lock-in accelerated across all three quarters Provider-native platforms already led usage in April-May, named by seven in ten enterprises describing their tooling. By June, 82% called one their primary agent security layer, and by July that share reached 92%, with OpenAI's guardrails leading at 44%, Microsoft Azure at 42%, Anthropic's managed-agent controls at 37%, and Google Cloud at 31%. Cloudflare at 11% and Cisco at 9% lead the dedicated specialists fighting over what remains. The identity tools most relevant to the credential-sharing gap are the smallest of all, with Microsoft Entra Agent ID at 7%, while Okta for AI Agents, non-human identity platforms, and runtime sandboxing tooling each sit at 3%. CrowdStrike CTO Elia Zaitsev told VentureBeat at RSAC 2026 that observing agent actions is a solvable problem but inferring intent is not. The provider bundle proves his point, solving observation while leaving containment unbuilt. 74% plan to replace tools they just rated a career-high satisfaction score Satisfaction scores continue rising as enterprises gain more experience using tools and techniques to stop agentic AI-based attacks. Rising to 4.29 out of 5 in July from 4.2 in June, satisfaction is the highest reading in the series. Despite the high satisfaction levels, 74% plan to replace their tools within 12 months, up from 59% in June. Only 26% intend not to change. VentureBeat believes early adopters are impatient to gain greater insights, and know what they don't know about agentic security and resilience. Closing that knowledge gap is forcing churn into a market this young, and the raw answers resolve the paradox: 92% of enterprises naming a primary layer name a provider-native one. The 4.29 measures how easy it is to turn on a provider's guardrails. It does not measure how effective those guardrails are at preventing the incidents 53% of the same respondents already had. The organizations closest to the threat are the least confident about it In June, defenders led attackers 35% to 21%, but by July the split was 30-30, a dead heat. Among enterprises that have been hit, 39% now say attackers are ahead, against 20% of those that have not. Getting hit nearly doubles the pessimism but does not change the shopping. Just 10% of enterprises include any agent-identity product in their consideration set. Runtime sandboxing draws 6%, and those numbers hold regardless of incident history. VentureBeat covered the same blind spot in the June data. The label changed from agent security gap to containment gap, but the shopping did not. Methodology The posture question was answered by 93 of the 116 qualified July respondents, and the skippers are not hidden isolators. Twenty-three of the 25 who selected no posture option are organizations still evaluating agents, unsure of their status, or with no deployment plans, groups for which a security posture largely does not yet exist, so the 18% isolation figure reads on the enterprises actually running or piloting agents. April-May, June, and July are separate, independently fielded waves rather than a single tracked series, so month-over-month comparisons in this piece are directional rather than a measured trend. Base sizes for the cross-cuts differ by instrument. The identity question covers all 116 respondents, isolation covers the 93 who described a posture, and the satisfaction inversion of 4.39 versus 4.13 is computed on the 76 respondents who rated their tooling. The bottom line VentureBeat's cross-survey analysis of 573 enterprise respondents concluded in July that enterprises deployed AI agents ahead of the controls needed to manage them, and they did it knowingly. Three waves of security-specific data now show where the knowing stops. Enterprises continue giving agents scoped identities and treating that as containment, but that assumption is false, and the incident data keeps proving it. In fact, 46 of 57 enterprises that solved identity did not build isolation. The enforce-without-isolate population's 58% incident rate is the clearest evidence that identity alone isn't enough. The containment gap will not close through satisfaction with what is easy. Whether enterprises build isolation and governed identity deliberately, or whether a confirmed incident that propagates does it for them, is the question the next wave will answer.

[6]

Trustworthy AI starts with surviving production failures

Evaluating AI agents in production tends to focus only on positive results. Did the agent complete the task? Was the output accurate? Did the demo go well? The answers to those questions matter, but they miss the case that determines whether an enterprise can actually trust agents with real work: what happens in the 30% of instances where something goes wrong? In financial services, for example, an autonomous agent that mishandles a money-movement workflow doesn't turn into an innocuous support ticket. It creates legal liability that can extend across an entire business. In healthcare, unchecked data access calls can compromise patient safety and lead to HIPAA violations. Highly regulated industries can't treat failure as a minor inconvenience. And when the stakes are categorically higher than in most other sectors, it changes what "production-ready" means. The problem? Most popular agent frameworks were built by teams focused on connecting large language models to reasoning loops and evaluation. While valuable, it's not the same discipline as distributed systems engineering. Few of these frameworks were built by people who spend their careers thinking about recovery, consistency and fault isolation. Many give little thought to what happens when an agent fails mid-flight, and that gap can be very expensive once agents are handling real-world transactions. Replaying From Scratch Doesn't Work When a sales agent moves through a 10-step workflow and fails at step nine, the naive recovery approach is to start the entire flow over from step one. That sounds harmless until you account for what each step actually costs. Every restart means re-running every LLM call that already succeeded, burning through token spend for work that was already done correctly. At scale, that inefficiency turns a single bug into a real financial problem. It also produces a worse experience for the people and systems downstream. In a regulated workflow, it's sloppy work that becomes a compliance and audit problem waiting to surface. The fix is durable execution: checkpointing that captures progress at each meaningful step, so recovery means resuming from step nine, not replaying the whole sequence. This has become standard practice in distributed systems, and agent orchestration needs to follow suit. When you're evaluating agent frameworks, here's the question you should ask: if an agent fails partway through a long-running task, does the system resume from where it left off, or does it start over? The answer will tell you the difference between frameworks built for production and those built for demos. There's an Access Problem Nobody Talks About Security in agentic systems presents its own version of this challenge, and it starts with a question that sounds basic but that most organizations can't seem to answer: can you prove exactly who or what did what, and when? That question is harder to answer as agents act on behalf of other agents, which act on behalf of humans. Each layer of delegation adds ambiguity about accountability. And when you add MCP servers into the mix, the exposure compounds. MCP gives language models access to company records, patient data and internal systems. The vast majority of MCP servers in production today connect to some kind of database, and the common mistake is granting broad access to that entire data store rather than narrowly scoping what each server can see. That distinction matters when something goes wrong. If a system with broad access suffers a breach or a supply chain compromise, the attacker gains access to the entire environment. Scoped access, where an MCP server or agent can only reach the specific data it needs for the task at hand, is one of the most overlooked design decisions in agentic architecture right now. It's also a relatively cheap problem to fix before deployment, yet one of the most expensive to fix after a breach. Identity adds another layer. Many organizations still use traditional authentication protocols that were made for human users logging into applications, not for autonomous systems that act at machine speed and scale. Without verifiable identities for each agent and each component, malicious code can impersonate a legitimate part of the system and operate undetected. What's needed here is what's known as cryptographic attestation: a tamper-proof record of everything that happened in the system tied to the specific identity that did it. That record lets you replay the system's state after the fact and determine with certainty that a specific piece of code accessed a specific system at a specific moment. Why? Because that identity was managed and enforced in real time. It's the difference between a policy that says a component "should" be trusted and a system that can prove what it actually did. Design to Limit the Blast Radius, Not Just Patch the Damage There's also a problem with how most organizations think about vulnerabilities. The industry's attention is almost entirely on patching known CVEs, and that's necessary. But at the same time, it misses something important: a vulnerability only becomes a known CVE after a breach has already occurred. Patch management is inherently reactive and does nothing while a system is actively compromised, by which point malicious code is already trying to move laterally through the network. This is why runtime enforcement deserves far more attention. The goal isn't just prevention; it's containment. If a system is compromised, can you detect that a component is behaving abnormally and immediately restrict its access, even before you've identified or patched the underlying flaw? Limiting the blast radius in real time, rather than relying solely on detection after the fact, is what separates a contained incident from a full-scale breach. Zero trust principles should be applied specifically to AI workloads, not just inherited from traditional cloud-native security protocols. That means strict authentication and authorization for every agent and MCP server, clear policies on what each component is allowed to access, and controls that stop compromised components from sending data outside the organization. You Need to Prove Safety, Not Just Function This isn't pessimism toward AI agents; it's about engineering maturity. Every distributed system that has matured into something enterprises trust with critical workloads, from databases to cloud infrastructure, went through this same evolution. They go from optimizing for common cases to designing explicitly for the rare, expensive failure. Agentic AI is now at that point. The organizations that get it right will be able to sit down with an auditor or a regulator and demonstrate, with evidence, exactly how their systems behave when something breaks: - Durable recovery that doesn't waste a single completed step. - Access that's scoped to the task, not the whole database. - Identity that can be cryptographically verified, not just assumed. - Containment that activates in real time, not after the fact. These are the bars that enterprises serious about deploying AI agents at scale need to meet. We list the best business cloud storage to manage your data. This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

[7]

Fortune

The godfather of Israeli cybersecurity: The Hugging Face incident exposes the wrong AI security debate | Fortune

The proliferation of AI agents at companies across the world introduces a new level of risk and vastly magnifies insider threats. Companies must now control how agents interact with users, other agents, data, and applications. Controlling these interactions is becoming the number one security challenge enterprises face. What makes this different from previous shifts in enterprise security is speed and autonomy. A human insider threat unfolds over days or weeks, and there are patterns to detect. An agent can execute thousands of autonomous actions in the time it takes a security team to notice something is wrong. That's not a marginal difference; it's a different category of risk, and most organizations are still building their defenses for the old category. Hugging Face clearly demonstrated that an AI agent, when tasked with a specific goal, can navigate around the barriers intended to restrict it. Now that the breach has happened, it's no longer a matter of if guardrails need to be put in place, but when. Yet, rather than focus on what occurred and a path forward, the industry is choosing to focus on other variables that muddy the waters. The bottom line is this: this risk cannot be left only for model providers to solve. I do not expect model companies, whether frontier models or open-source models, to provide cyber protection for the models they build. Cybersecurity has always been a specialized discipline. It needs to be addressed by companies with expertise, and the AI era will require security architecture built for visibility, governance, and real-time control, not adapted from tools designed for a different problem. This isn't about distrust of model builders. It's a basic principle of how security has always worked. The team that builds a product is rarely the team best positioned to secure it, because those are two different disciplines with two different mandates. That was true of enterprise software 20 years ago, and it's true of AI systems now. It's not about the US vs. China AI race The instinct to frame this as open-source versus closed, or one country's models against another's, misses the mark and distracts from what actually took place. This has nothing to do with nationalism. This isn't about Chinese open-source models or American closed-source models. National borders do not confine the challenges created by AI, but perhaps exacerbate the technical, political, social, and economic obstacles that we must all face. In fact, cybersecurity is the least of anyone's worries. The challenges underpinning this go well beyond any single industry, and treating them as a contest between nations doesn't get us any closer to solving them. Defining borders and creating uncontrolled competition between countries isn't helpful in facing and solving the issues presented by frontier AI. Framing this as a contest between nations also misdirects attention and resources. Every hour spent debating where a model was built is an hour not spent building the controls that can stop this kind of incident from happening, regardless of its origin. The attack surface doesn't care about a model's passport. A case for global collaboration We need to band together in order to address the broader AI risks at hand. This means global collaboration around AI safety and security, across model companies, security experts, governments, and enterprises, with the right expertise brought to the table. This is how we protect innovation without slowing it down. The Open Secure AI Alliance spearheaded by Nvidia is a step in the right direction, but it's just the beginning. There's more to be done. Global coalitions and international forums like the World Economic Forum (WEF) offer a literal stage for diverse-minded experts to solve the complex governance, security, and policy challenges created by AI. Each of these groups holds a piece of the AI safety puzzle that the others don't. Model companies understand the systems they've built better than anyone outside their walls. Security companies understand how attackers think and how enterprises actually get breached, because that has been our job for decades. Governments can unify and set standards that give the whole ecosystem a baseline to work from. None of these groups can do the others' jobs, and pretending otherwise is how gaps like the one we just saw open wider. Every enterprise now has AI agents operating with some degree of autonomy. That number is only going to grow. The question worth asking isn't which lab built the model or which country it came from. It's whether anyone is watching closely enough to catch what these agents are primed to do next. The opinions expressed in Fortune.com commentary pieces are solely the views of their authors and do not necessarily reflect the opinions and beliefs of Fortune.

[8]

AI agent governance is ready. Cost isn't. | VentureBeat

Across 107 enterprises, agentic orchestration is not a choice of a single platform. The typical enterprise runs three orchestration platforms at once, and selects them for flexibility across models rather than affinity to any single one. Microsoft leads primary usage while Anthropic leads forward consideration by a wide margin. The AI control plane enterprises expect is deliberately hybrid, meaning it includes use of the leading AI providers, but also provider-independent technologies -- and the risk they fear most from provider-resident control is not lock-in but the provider's own security and permissioning limits. One in five enterprises still has no real-time way to stop a runaway agent before the bill arrives. This wave of VentureBeat Pulse Research examines enterprise agent orchestration: which platforms enterprises run on, what drives the choice, what they optimize for, how they expect agent control to be structured, and -- most revealingly -- how orchestrated their deployed "agents" actually are and how tightly they control the cost of running them. The central finding is that orchestration has become plural. Eighty-five percent of enterprises run two or more orchestration platforms and 64% run three or more, with a mean of 3.1 platforms per organization. Microsoft AI Foundry / Copilot Studio appears in 70% of stacks and OpenAI's Agents SDK in 68%, with Anthropic's Claude Platform in 47%. Asked to name a single primary platform, respondents who gave one unambiguous answer put Microsoft first (41%) and Anthropic second (28%). Nobody in this sample is running one orchestration layer and calling it a strategy. The selection logic follows from that plurality. Flexibility across models and tools is the leading purchase driver at 29%, nearly three times the share naming model gravity -- native alignment with a state-of-the-art base model -- at 10%. Enterprises are not choosing the orchestration environment that comes with their favorite model; they are choosing the one that does not commit them to any model. Security and permissions (17%), production reliability (15%), and control over agent execution (15%) fill out a buying logic focused on governance and optionality rather than developer convenience. A clear majority (53%) expect a hybrid control plane by the end of 2026 -- provider-native plus external orchestration -- and the risk they most associate with provider-resident control is security and permissioning limitations (37%), ahead of vendor lock-in (23%) and limited visibility (22%). Investment has moved accordingly: agent monitoring and debugging leads the spend at 31%, with security and permissions enforcement at 30%, while workflow tooling draws 19%. Enterprises are spending to see and govern agents, not merely to build them. Most companies admit that a majority of their "agents" are really just chatbots. A plurality of 47% of respondents say that between 26 and 50% of their agents are genuinely orchestrated, with 37% at a quarter or below and 16% past the halfway mark. But fiscal control remains the soft spot: 21% of enterprises track agent spend only through post-hoc logs, with no real-time way to halt a runaway execution loop. Methodology VentureBeat fielded this survey as part of its ongoing Pulse Research series, with this instrument focused on enterprise agent orchestration. Responses are filtered to organizations with 100 or more employees (n=107), drawn from a single July 2026 wave; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. All figures in this report come from the July fielding only. Where questions were multiple-select, shares can sum to more than 100%. This wave draws a notably large-enterprise, technology-heavy sample, and that shapes every finding in it. By organization size, more than half sit at 10,000 employees or above: 50,000+ (26%) and 10,000-49,999 (25%) lead, followed by 2,500-9,999 and 500-2,499 (19% each) and 100-499 (11%). Technology/Software accounts for 53% of respondents, with Government/Public Sector (16%) and Manufacturing/Industrial (10%) next. By role the sample is hands-on and technical: software and ML engineers (22%), product and program managers (21%), directors of data/AI/analytics (17%), and VPs of data/AI/analytics (12%). On purchasing, 90% are recommenders, influencers, or final decision-makers for AI solutions (63% recommender/influencer, 27% final decision-maker). A note on the primary-platform question. Forty-six of 107 respondents registered more than one selection on a question intended to capture a single primary platform. Because those responses cannot be resolved to one answer, primary-platform shares are reported on the 61 respondents who gave a single unambiguous answer, and are labeled as such wherever they appear. Platform footprint figures -- which platforms an enterprise uses at all -- use the full n=107 base and are unaffected. The ambiguity is worth noting on its own terms: on a question asking for one platform, more than four in 10 respondents could not or would not narrow to one, which is consistent with the multi-platform pattern documented in Finding 1. At 107 respondents the sample is robust enough to read directionally with reasonable confidence, though it remains self-selected and is not a probability sample. Because each subgroup here only includes about 50 to 60 respondents, splits between them are less precise than the full-sample findings. Finding 1: Orchestration is a portfolio, not a platform The typical enterprise runs three orchestration platforms at once We asked which agent orchestration platforms enterprises use, and which one they treat as primary. The first answer is that almost nobody has just one. The defining feature of this layer is plurality. Only 15% of enterprises run fewer than two orchestration platforms; the median organization runs three, and one in six runs five or more. Read that way, the platform "shares" below describe overlapping deployments rather than a divided market -- Microsoft and OpenAI each appear in roughly seven of ten stacks precisely because most stacks have room for several. Asked to name one primary platform, the 61 respondents who gave a single unambiguous answer put Microsoft AI Foundry / Copilot Studio first at 41%, Anthropic's Claude Platform second at 28%, LangChain / LangGraph at 10%, and OpenAI's Agents SDK at 7%, with Google, Amazon, Salesforce, and custom in-house builds at 3% each. Microsoft's lead on primary usage alongside OpenAI's near-equal footprint on any usage is the signature of an enterprise-weighted sample: the Microsoft platform arrives through an existing enterprise agreement and becomes the default seat of record, while other platforms are added around it for specific work. A note on reading these shares: As described in the methodology section, the respondents are self-selected, this wave skews heavily toward large technology organizations, and the primary-platform figures rest on a 61-respondent subset. The numbers measure where this cohort has placed its orchestration bets today, within a self-selected audience of AI-active technical practitioners. A sample built this way can diverge substantially from spend-weighted market measures, and each VB Pulse survey draws its own sample with its own company-size and industry mix, so vendor figures should not be compared across our surveys, either. Respondents rate the platforms they run at 4.17 out of 5 for overall satisfaction, 3.91 for ease of implementation, and 3.63 for value for money -- with value for money the weakest of the three by a clear margin. That ordering is itself a finding: enterprises are broadly happy with what these platforms do and distinctly less happy with what they cost, which is the same nerve the fiscal-control finding touches at the end of this report. Satisfaction sits alongside a two-thirds intent to change platforms within the year; this remains a layer enterprises work with rather than settle on. Finding 2: Flexibility, not model gravity, drives selection Enterprises buy the orchestration layer that doesn't commit them We asked what most influenced the orchestration platform choice, and optionality leads by a distance. Flexibility across models and tools (29%) is the selection-side explanation for the multi-platform reality in Finding 1: enterprises are choosing orchestration environments on the strength of what they leave open rather than what they lock in. Model gravity -- picking the orchestration layer that comes with a preferred frontier model -- draws just 10%, less than a third of the flexibility share, which places the pull of any single base model well down the list of what actually decides this purchase. The next tier reinforces the governance emphasis. Security and permissions (17%), production reliability (15%), and control over agent execution (15%) together account for 47% of responses: nearly half of enterprises pick their orchestration platform on whether they can constrain and depend on what it runs. Ease of development draws 8% and total cost of ownership 4%, an inversion of how these platforms are usually discussed in engineering circles. Performance sits last at 2% -- at this stage of adoption the binding constraints are optionality and control, not raw speed. Finding 3: The job is reliable multi-step execution Enterprises judge orchestration by whether it completes the work We asked what enterprises optimize for -- their primary success metric for orchestration. Reliability and multi-step workflow management lead, with developer productivity closer behind than in the buying criteria. Task completion reliability (30%) and multi-step workflow management (27%) together account for 57% of responses: orchestration succeeds, in the enterprise view, when it reliably carries a task through multiple steps to completion. Developer productivity takes a substantial 23% -- notably higher than ease of development's 8% as a purchase driver in Finding 2, which suggests enterprises do not expect to buy developer velocity so much as to earn it once the platform is in place. End-user experience is a minor concern at 7%, consistent with orchestration being an internal execution problem rather than a UX one. This reliability-first standard is the yardstick against which the portfolio-maturity finding later in this report should be read: enterprises define success as dependable multi-step execution, and a little over a third of them still say a quarter or fewer of their deployed agents do multi-step work at all. Finding 4: Two-thirds plan to move -- and Anthropic leads the consideration set The installed base and the pipeline point to different vendors We asked whether enterprises plan to adopt a new, additional, or replacement orchestration platform in the next 12 months, and which platforms they are considering. Two-thirds of enterprises (67%) intend to adopt a new, additional, or replacement orchestration platform within the year, but the clock runs longer than the intent suggests: the largest cohort sits at 6-12 months (28%) and only 15% expect to move within a quarter. This is deliberate re-platforming on a planning horizon, not urgent churn. The consideration set is where this finding earns its headline. Among the 72 enterprises in motion, Anthropic leads at 43% -- well ahead of Google (31%), custom in-house builds (31%), OpenAI (25%), LangChain / LangGraph (17%), and Microsoft (17%). Set that against Finding 1, where Microsoft leads primary usage and appears in 70% of stacks: the installed base and the forward pipeline point at different vendors. Anthropic draws roughly two and a half times Microsoft's forward consideration despite trailing it on current primary usage, and custom in-house control planes draw as much interest as any external platform besides Anthropic. A further 18% of movers are evaluating with no shortlist at all. Read alongside the flexibility-first selection logic in Finding 2, the shape of the next twelve months is legible: enterprises expect to add rather than replace, they are shopping for platforms that preserve model choice, and a substantial minority intend to solve the problem themselves rather than buy it. Finding 5: Investment flows to watching and governing agents Monitoring and permissions lead the spend; workflow tooling trails We asked which orchestration-related investment will grow most next year. Observability and governance take the top two places. Monitoring and debugging (31%) and security and permissions enforcement (30%) are effectively tied at the top and together account for 61% of planned growth. The money is going to seeing what agents do and constraining what they are allowed to do -- the two capabilities that matter once agents are running in production rather than being built toward it. Workflow tooling (19%) and scaling infrastructure (18%) trail, and almost no one is standing still: just 3% report a flat budget. The emphasis is consistent with the buying logic in Finding 2, where security and permissions was the second-ranked selection factor, and with the control-plane architecture in Finding 6. Enterprises that have decided to run agents across three platforms have a visibility and permissioning problem by construction, and they are funding it directly. Finding 6: The control plane will be hybrid -- and security is why Enterprises split control, and fear the provider's permissioning more than lock-in We asked where enterprises expect the primary control plane for agents to live by the end of 2026, and what worries them most if that control sits inside a model-provider platform. Hybrid control is the dominant expectation by a wide margin (53%). Taken together, the hybrid, custom in-house, and externally-abstracted options -- every architecture that keeps control at least partly outside the provider -- sum to 78% of enterprises, against 14% willing to hand control to a provider-managed service outright. The reason enterprises give is worth separating from the one usually assumed. Security and permissioning limitations lead the risk question at 37%, well ahead of vendor lock-in at 23%, with limited visibility and observability close behind at 22%. Combining the security and visibility answers, 59% of enterprises name a control-and-oversight concern rather than a commercial one. The worry is less that a provider platform will be hard to leave than that it will not let them see or constrain what their agents are doing while they are on it -- the same concern funding the monitoring and permissions spend in Finding 5. Only 2% say provider-resident control is not a concern at all. Finding 7: The chatbot trap is loosening, not broken "Bridging the gap" is now the modal answer on portfolio maturity We asked enterprises to assess their portfolios honestly: What share of their deployed "agents" are true multi-step orchestrated workflows versus simple single-prompt chatbot wrappers. The center of gravity has moved into the middle band. Just under half of enterprises (47%) now put between a quarter and half of their portfolio in genuinely orchestrated, stateful workflows, and 16% are past the halfway mark. The bottom two bands -- a quarter or fewer genuinely orchestrated -- account for 37%, and outright pure-chatbot portfolios have nearly vanished at 3%. Against the reliability-first success standard in Finding 3, this is a portfolio that has started to do the work the orchestration layer exists for, without most of it being there yet. Maturity tracks platform count. Enterprises reporting a quarter or less genuine orchestration run 2.8 platforms on average; those in the 26-50% band run 3.5. The organizations furthest into real multi-step work are the ones running the most orchestration platforms at once, which is the practical case for the flexibility-first selection logic in Finding 2 -- multi-step portfolios appear to accumulate platforms rather than converge on one. One split that might be expected does not appear. Organization size makes no difference to portfolio maturity in this wave: 38% of enterprises at 10,000+ employees report a quarter or less genuine orchestration, against 37% of smaller ones, and the shares past the halfway mark are equally close (16% and 15%). Whatever separates the mature portfolios from the immature ones here, it is not headcount. Finding 8: Fiscal control is still reactive for one in five A fifth of enterprises learn about a runaway agent from the logs Finally, we asked how enterprises enforce fiscal control over agent token consumption -- the risk that an autonomous loop exhausts a budget before anyone intervenes. The approaches split four ways, fairly evenly. One in five enterprises (21%) has no real-time, programmatic way to stop an agent before a budget-breaking bill arrives -- they learn of it from the logs afterward. Another 30% lean entirely on the native caps and throttles built into their primary platform, a control only as good as the provider's tooling and one that sits awkwardly beside the hybrid, keep-control-outside posture of Finding 6. Roughly half of enterprises -- those building custom gateways (25%) or exploiting cross-model routing to arbitrage cost (24%) -- are treating token burn as an engineering problem to be controlled deterministically, and the routing group is doing so in a way that only works because they run several platforms at once. Unlike previous waves, no size split appears here: 18% of enterprises at 10,000+ employees exercise only reactive control against 23% of smaller ones, a difference well within sample noise. The gap in fiscal control in this wave is not between large and small enterprises but between those that have built a cost-control plane and those still relying on whatever their provider ships. Read against the satisfaction scores in Finding 1 -- where value for money was the weakest of three ratings at 3.63 -- the picture is of a cohort that is unhappy about what agents cost and, in half of cases, not yet instrumented to do much about it. The bottom line: Plural by design, governed by intention, metered by hope Organizations with 100 or more employees describe an orchestration strategy built around optionality rather than commitment. They run three platforms on average, choose them for flexibility across models rather than affinity to any one, and judge them on whether they carry multi-step work reliably to completion. Microsoft anchors the installed base and appears in seven of ten stacks; Anthropic leads forward consideration by a wide margin among the two-thirds planning a change; and a substantial minority intend to build their own control plane rather than buy one. Today's footprint describes where these enterprises are, and clearly does not describe where they intend to stay. The governance posture is deliberate and consistent. A hybrid control plane is the majority expectation, 78% intend to keep control at least partly outside the provider, and the reason is not commercial but operational -- security and permissioning limits (37%) and limited visibility (22%) outrank vendor lock-in (23%) as the fear attached to provider-resident control. The budget follows the fear: monitoring and debugging and security and permissions enforcement together take 61% of planned investment growth, ahead of the tooling used to build agents in the first place. Where the strategy thins out is cost. Portfolio maturity has moved into the middle -- 47% now report between a quarter and half of their agents genuinely orchestrated, and pure-chatbot portfolios have nearly disappeared -- but 21% still cannot stop a runaway agent in real time, another 30% depend on whatever caps their provider ships, and value for money is the lowest-rated attribute of the platforms they run. Enterprises have worked out how they want agents governed well before they have worked out how to meter them. At 107 respondents in a single July wave, skewed toward large technology organizations, this reads as a clear directional signal rather than a precise measurement. The questions for subsequent waves are whether the middle band of portfolio maturity keeps climbing, whether the forward consideration for Anthropic and for in-house control planes converts into deployment, and whether fiscal control catches up to a cost that enterprises already say they are not getting their money's worth on.

[9]

Enterprise AI needs a new model for behavioral intelligence

Enterprise internet security vendors and experts have spent many years trying to understand human behavior. As a result, there is now a wide variety of very effective tools and processes that help distinguish legitimate user activity from behavior that may indicate a compromised account or malicious activity. Behavioral analytics has come a very long way. The underlying principle is that behavior is often a stronger indicator of compromise than the use of credentials alone. In this context, behavioral analytics establishes a strong baseline for individual users over time, including the systems they access, typical login patterns, data usage, administrative actions, API activity and various other interactions. Any significant deviations can trigger investigation. A security disconnect But as we all know, things are changing very fast. The rapid move from GenAI assistants to autonomous AI agents has introduced a new kind of enterprise actor, one that combines non-human identity with autonomy, dynamic decision-making and the ability to execute multi-step actions across systems. Existing security models were not designed with this combination of characteristics in mind. Clearly, AI agents are now of particular concern thanks to their ability to execute tasks autonomously, access multiple applications, retrieve information, make decisions within defined parameters and complete multi-step workflows. To say the adoption of AI agents across the enterprise space is dramatic is to put it very mildly. Gartner predicts that by the end of 2026, 40% of enterprise applications will incorporate task-specific AI agents, compared with fewer than 5% in 2025. In order to work, many of these agents will be given identities, permissions, credentials and access to sensitive business systems. It stands to reason that security issues will follow. Unlike human users, however, most organizations have little understanding of what constitutes expected or abnormal behavior for autonomous identities. That helps explain why Gartner's 2026 Hype Cycle views Agentic AI Security as an emerging discipline, and why governance and behavioral monitoring capabilities are still in their early stages of development. It also creates a potentially serious disconnect organizations have mature behavioral intelligence for people but comparatively little for AI agents, despite both increasingly operating as trusted identities within enterprise environments. Agents of change But is the difference between human and AI behavior really that important? In the pre-AI era, human behavioral analytics relied on relatively stable patterns. Most users worked predictable hours, accessed a consistent set of applications, connected from familiar locations and performed activities aligned with their role. After all, humans are creatures of habit, including in the workplace environment where the vast majority would never do anything malicious. AI agents are fundamentally different because, unlike employees, they may legitimately operate continuously rather than during business hours. Activity at 3 am is not inherently suspicious, but a human employee being online at that time might raise a red flag, particularly if it occurs outside normal activity patterns. Agents can also interact with dozens of services and APIs within seconds as part of a single workflow, while high activity volumes should be expected rather than seen as exceptional. Yes, many agents act on behalf of users, but they also make independent decisions about how best to complete a task within defined parameters. This creates an additional layer of abstraction between the user request and the actions ultimately performed. Permissions are also likely to become more nuanced as organizations expand the range of what agents are allowed to do. An agent designed to perform a relatively simple task, such as retrieving information, may later gain the authority to trigger much more complex and consequential business processes. That's fine, but what if the associated security processes don't develop at the same rate? Bringing all these issues together, the challenge is not just to ask whether behavior looks unusual in human terms, but also to understand whether it is unusual for that specific agent. As a result, organizations must also establish behavioral baselines for AI agents in the same way they have done for human users, while recognizing that the characteristics of those baselines will be fundamentally different and subject to change at any point. Monitoring should also consider whether the sequence of actions taken remains consistent with the agent's intended objective, because individually legitimate actions can, when combined, produce unintended or harmful outcomes. What should organizations monitor? Having established that monitoring AI agents is a specific requirement, organizations then need to put processes in place to ensure their behavior remains within whatever guardrails they have established, and that begins with visibility. This means clearly understanding which AI agents exist, what identities they have, which systems they can access and the purpose they are intended to fulfill. Behavioral baselines can then be restricted to the applications an agent typically accesses, the APIs it calls, the data it retrieves or modifies, the business processes it supports and the level of privilege it normally exercises. But, for every agent, context is critical. Within reason, asking a finance agent to access accounting systems is normal, whereas the same agent interacting with software development or HR software platforms may pose a different level of risk. As with human users, the objective is not simply to identify isolated events but to recognize meaningful deviations from an agent's established operating pattern. The point is that monitoring should complement existing security controls, such as identity management and governance as well as policy enforcement, among other options. The processes and technologies should provide an additional layer of understanding of how authorized AI identities operate within the enterprise. Without these controls in place, we can expect to see many more headlines about 'rogue agents' and the potentially dire consequences of losing control over their behavior. We list the best online cybersecurity courses. This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

[10]

Fast Company

Do you know what your AI is doing right now?

The Fast Company Impact Council is an invitation-only membership community of top leaders and experts who pay dues for access to peer learning, thought leadership, and more. Here's the uncomfortable math of enterprise AI in 2026. A recent survey of major enterprises showed that 85% had AI agent pilots underway. Only 5% had moved those agents into production. That 80-point gap is the defining story of this phase of AI adoption, and it has almost nothing to do with model capability. Today's AI is the worst it will ever be. It will only improve. Capability is not holding companies back. What holds them back is a few simple questions that turn out to be nearly unanswerable: What AI do we have deployed, what is it doing, and are we comfortable with everything it is doing? Most organizations cannot answer that. Research this year found that only 48% of deployed AI agents are actively monitored or secured, while 82% of executives believe their existing policies protect them from unauthorized agent actions -- they have no visibility. That gap between confidence and visibility is where stalled deployments, canceled projects, and incidents live. WHY THE QUESTION IS HARD TO ANSWER The AI landscape is fragmented by design, and it will stay that way. Different vendors are building different tools for different jobs: customer support, software engineering, general knowledge work, and dozens of specialized functions. Each tool has its own capabilities, connectors, and update cadence. What one assistant supports today, another will not. What is true this month is out of date next month. Many companies have responded with a tool-by-tool approach to AI governance: A review team evaluates each AI product, signs off on a configuration, and approves it for use. However, by the time this process is complete, the tool has released new features. The underlying model has evolved. And employees have already adopted several more AI tools no one has reviewed. Gartner predicts the average Fortune 500 company will be using at least 150,000 AI agents by 2028, up from fewer than 15 in 2025. No review committee can keep pace with that. By the time you understand today's AI landscape, it's already changed. SAME CREDENTIALS, DIFFERENT TRUST There is another problem hiding within the first, which explains why so many pilots never scale. Consider a salesperson with write access to the CRM. Organizations grant that access because they trust the person. That salesperson could technically delete records or overwrite data in bulk, but everyone understands those permissions will be used responsibly. Now give an AI agent that same person's credentials to act on their behalf. The permissions are identical. The comfort is not. And no volume of instructions fixes it, because an instruction to an AI system is a request, not a control. You can tell an agent, in exhaustive detail, everything it must never do, but asking is not enforcing. The same credentials that are safe in human hands become an open question in an agent's hands. Most enterprises have no way to tell the two apart. GOVERN THE FIXED POINT The organizations that successfully put AI into production have made a subtle but important shift. Instead of trying to govern every AI tool, they're governing what those tools can access and connect to. Every assistant, agent, and copilot eventually must connect to enterprise systems to do meaningful work, whether that's a CRM, data warehouse, ticketing platform, or codebase. That consistent connection point is key to organizations regaining control. This approach allows them to distinguish between humans and agents using the same credentials. They can define what each is allowed to do. And they can approve an agent to undertake specific tasks, for example, reading records but not deleting them, or drafting content but not sending it. They can log every interaction and enforce clear, consistent guardrails. That's the idea behind the emerging AI gateway: a single control point that remains effective no matter which AI tools come next. This allows organizations to avoid choosing between agility and safety. When policy lives at the resource level rather than in each tool, a new AI product is a configuration decision, not a re-architecture. Teams adopt what works this month, and swap it next month. The answer to "what is our AI doing right now" stays in the same place. Using the best models and the cleanest data are becoming table stakes. The real differentiator for AI success is having a consistent point of control in an environment that's constantly changing, along with the confidence that comes with it to move AI into production. Blake Brannon is chief innovation officer of OneTrust.

[11]

Finding big money for AI and a smaller world for security at Black Hat USA 2026

Las Vegas was hotter than hell last week, but not as hot as the market for artificial intelligence-enabled security at Black Hat USA 2026. A bandwagon of million-dollar booths for overfunded agentic security startups arose like mirages from the desert. Fortunately, there was also real value to be found amidst the AI hallucinations. AI supply chain challenges were the topics du jour for chief information security officers and researchers comparing each other's level of preparedness for agentic AI disruptions such as the on-off introduction of Anthropic PBC Mythos-class escape exploits, and the recent OpenAI/Hugging Face attack, and even Meta Platforms Inc. saying it did one too, just to not get left out. "I think this incident was a really good example of exploiting the nondeterministic capabilities we already know about AI, where there's just a lot more code and traffic generated within a quicker time period, which can hide abuses," said Patrick Duffy, head of product at Dropzone AI Inc., which announced its new AI Threat Hunter product at the show. "Human teams could not launch a thousand investigations at the same time to respond." One thing that has been thoroughly disproven since last year's autonomous security operations center craze? AI automation is still not replacing professional security expertise. The ungovernable AI cat is already out of the bag, so we'll need AI agents to work alongside us to stop it, because we'll always have a shortage of skilled security professionals to follow up on the unknowns of an ever-expanding threat surface. Here were some interesting new brain wrinkles I picked up at my first Black Hat: Orchestrating the agentic SOC Agents in the SOC, if governed, trained and employed correctly, can take a lot of work off the human security analyst's plate, freeing up more time for critical investigations and strategic security architecture thinking, but there are many ways to get there. Rather than keying off of alerts and incidents, Nebulock Inc. builds a behavioral world-model graph of an enterprise that overlays existing security information event management, information technology security management and alerting tools to conduct "hunt-first" agentic detections and investigations. Agent fleets can be triggered to respond autonomously to events such as patches or new CVEs, or a security analyst's natural language request to follow up on a hypothesis informed by coverage gaps they are seeing in their security posture command center. Huntress Labs Inc. provides a 24/7 managed platform used by hundreds of thousands of individual jacks-of-all-trades, service providers and mid-sized companies. Their in-context training, support experts and SOC workflow automation help customers that would have a difficult time covering every aspect of security. "We try not to overuse AI buzzwords here," said Aimee Simpson, director of product marketing at Huntress. "We do have Athena, an agentic investigator made of different subagents that are doing different tasks, compiling signals, investigations, writing incident reports, to take some of the workload from our SOC, but our customers care about results. If the agent is not confident in its findings, that still goes straight to our expert human analysts - and we're definitely still hiring them." For a newer vendor on the market, Strike 48 brings a surprisingly broad agentic SecOps platform with multi-platform SOC, network operations center and DevOps connectivity. It has more than 300 MCPs under the hood, allowing its agents to resolve security issues alongside network and development engineering work. Larger companies can lean on their forward-deployed expert teams to build out specialized agents and further bespoke integrations. Enabling agentic co-workers with less risk Zero-trust policies with least privilege access controls, hardened containers, and microsegmentation have been around for years. These practices started gaining traction for securing containers and ephemeral workloads as cloud native architectures emerged. Now, the "IP-wandering" nature of nondeterministic AI agents makes setting boundaries - without becoming a blocker - more critical than ever. "With microsegmentation, we're narrowing down every asset in your ecosystem to put a protective bubble around it - workstations, servers, operational technology and cloud assets, and now we want to extend beyond infrastructure-as-code to cloud infrastructure itself, using native APIs built into the system of Azure, AWS or GCP," said Chris Boehm, field chief technology officer at Zero Networks Inc., an identity and microsegmentation vendor that announced its enforcement of Open Worldwide Application Security Project Least Agency Principle for enterprise AI at the show. "Agents can be your best worker, and your worst worker, and your adversary, all at the same time. You really need to take the perspective of agents to understand their intent, wherever they run," said Jason Needham, CEO of Certiv Inc., an agent assurance firm that provides behavioral and intent monitoring to human agent owners, with judgments, policies and technical controls for agents, including local models. Geordie AI Ltd. discovers agents wherever they exist across the enterprise, learns what they do and who is responsible for them, and helps security teams help their own organizations successfully adopt agents with less risk. Its Beam solution directly tests for exposure and operates agents, and acts as a control plane for managing work activities, with a light touch, so autonomy and adoption is not as inhibited as a typical security-oriented solution. "The trend for giving more autonomy to agents is only increasing this year," said CTO Benji Weber. "You even have nontechnical sales and marketing teams adopting agents. Are these teams truly successful with agents, or are they just burning tokens?" Enriching and optimizing SOC data estates for shared knowledge AI SOC vendor Stairwell was there demonstrating its new Backstory threat intelligence data discovery and knowledge base that can pull multiple petabytes of contextual threat data in seconds into an all-hot live and historical data lake. It captures full-stack activity for multiple systems using parallel agents, without a time-consuming or costly search and ingest process. "Rather than try to record every behavior, I want to find the thing that made the behavior, not just a bunch of logs," said founder and CEO Mike Wiacek. "It changes the way teams think about security. If you were a bank that got robbed, would you want to replay the CCTV footage of the robber, or would you rather already have the guy in handcuffs?" "We've seen this train coming for a while," said Monzy Merza, founder and CEO and founder of Crogl Inc. The firm was at Black Hat promoting a free single-user download of its complete enterprise AI SOC platform to accompany its recent sovereign AI agent. "Sovereign data and private AI capabilities are becoming very important to customers who want to control their own data, and that's why we have always been available on-prem as a customer-managed product." Endpoints are still the leakiest attack surface On day three, I was going to record an interview, and my iPhone's audio recording app said, "Cannot record audio during a phone call." There was clearly no call going on, and the phone seemed kinda hot, so I rebooted it. Maybe some agent there at Black Hat was demonstrating a cool hack on my endpoint! The most devastating attacks in play today are often insider threats on an employee's desktop or phone, which are particularly difficult to recognize when the signature and intent of an agent's actions on an endpoint are unknown. Ent Security (Athena Formation Inc.) was there with a big presence just out of stealth, combining elements of user and entity behavior analytics, endpoint detection and response, application control, data and endpoint protection, user interface monitoring and remote access analytics, all of which together form an "intent-aware protection" layer for humans, AI and applications. "You need to capture high-fidelity telemetry within the user's workspace, everything from mouse clicks and opening files, screen shots, application focus changes and even remote workers and agents that might log in and take control of your desktop," said Janani Nagarajan, VP of product marketing at Ent. "For instance, on day 1 of a customer install, they saw an employee invite a user in North Korea to a Zoom, and then hand over remote access to that user, and they were able to make an intervention." For mobile apps, which represent the majority of human user internet traffic, Appdome Inc. introduced new mobile test engineering capabilities and a remote management agent solution. It can make publisher-controlled live configuration and security updates to the application after build, packaging and deployment to an app store, in order to shrink the exploit window for live users if a new threat is discovered between major releases. Improving DevSecOps collaboration No, DevSecOps is not dead; it is just not as popular as it used to be. But security teams still need to collaborate with development and ops teams in order to realize the value the company expected from AI initiatives. RevEng.AI (Binary AI Ltd.) built a machine code verification layer that explores production software, including binaries, for threats or risks. Rather than imitating static or dynamic application security testing scans, or building another large language model like OpenAI or Claude that understands English, it trained a large model that understands binary computer code at a root level. "If AI is writing the majority of code today, In the future, why should AI write code that's easy for human beings to understand? Why should it write Python, when it could go to compiled languages or even straight to binary at a 100-times or 1000-times quicker rate?" said CEO James-Patrick Evans. "But the problem is we've got to secure this code, and make sure that its output is actually correct." Software supply chain player RapidFort Inc. was demonstrating a new capability for monitoring an software bill of materials not just for approved software packages in builds, but within container deployments at runtime, in order to protect against drift in production environments. With agents writing infra code and introducing packages at an unprecedented rate, there are always new vectors to account for. "We've seen developer credentials being compromised so what looks like a legitimate npm package gets pushed up to GitHub," said Chief Marketing Officer Mike Wood. "People and agents think the update is OK to download, but it has malware. So we don't make any of our images available to our customers unless they've been baked for two weeks and cooled off for two weeks, which guarantees that any issue will already have been discovered by the vendor community and thousands of developers and end users." I met with AISLE Inc., a deep-thinking startup focused on remediation in the AI-enabled software delivery lifecycle, that ended up exposing and publishing common vulnerabilities and extensions for several new zero-day vulnerabilties and topping research leaderboards, including 16 OpenSSL exploits and previously unknown vectors that Mythos-class models could generate. "These aren't just rogue models, we're talking about major AI companies that deliberately lowered the guardrails on their flagship models to see what they are capable of - when they weren't supposed to be accessing the internet," said Chief Operating Officer and CISO Jaya Baloo. "We want to verify them and prioritize remediation with a fix that doesn't break anything new." When all else fails... kill the agent Straiker Inc. was there with a futuristic cyberpunk presence for its multi-agent attack and defense solutions, and revealed a brand-new game with just one button, under glass: the Agentic Kill Switch. I couldn't help but press the button, like I was the last man standing in a gas station with a leaking token pump. 'We have tuned models that do detection, looking for remote code execution, indirect prompt injection, and fine-grained blocks, but sometimes, you actually need to just kill misbehaving agents with the push of a button," said Parth Shah, Straiker's head of product. "Ultimately, anyone that's putting AI in their software needs to stay in the driver's seat. They can't have someone else in their supply chain that owns that kill switch." The Intellyx take If there's one thing that has been thoroughly disproved since last year's agentic SOC craze, it's that AI agents could replace human security professionals. There will never be enough skilled SecOps team members with the insight to stay ahead of the rate of change AI is bringing to us, much less the chaotic behavior of fellow employees who trust AI with sensitive work. Fortunately, at Black Hat it was impossible to ignore just how fast these vendors are moving forward with AI in their own products, and using AI to augment human awareness, in order to secure AI-driven applications that are appearing everywhere. The value AI and agents can offer human security teams is not a mirage. The fact that new startups can build several enterprise-grade security solutions in less than a year is a testament to the incredible acceleration AI development can provide. But only working together as a community to improve the security awareness and expertise of builders and practitioners can save us from an uncertain future. Jason English is a principal analyst and chief marketing officer at Intellyx. He wrote this article for SiliconANGLE. At the time of writing, Appdome, Dropzone AI and Straiker are current Intellyx customers, and Crogl and Zero Networks are former Intellyx customers. The event covered the analyst's attendance cost, a standard industry practice. ©2026 Intellyx B.V.

[12]

Dataconomy

The $5 Million Reality Check: Why Corporate AI Without Brakes Just Ran Out of Road

In May 2026, Patrick Ryan, founder of Mobius Consulting, stood before a closed room of more than thirty senior C-suite executives, technology directors, and risk officers in London. When he asked how many of their organizations were actively running corporate AI tools in production, almost every hand in the room shot up. But when the conversation turned to foundational controls, the room fell quiet. Only 31 percent of those senior leaders had a formal AI strategy in place. Official policy sat at a meager 28.9 percent, while data governance lagged at 28.6 percent. "I do not want to say we are getting ahead of ourselves," Ryan said. "The ship has sailed, and we are where we are. All we can do now is ask 'what is the next best thing we can do?'." Enterprise leaders had effectively jumped into generative AI feet first, driven by board-level FOMO and competitive panic, leaving their security and governance teams scrambling behind them. The Multi-Million-Dollar Bill Arrives Fast forward to late July 2026, and the bill for that headlong rush arrived in full. According to IBM's 2026 Cost of a Data Breach Report, the global average cost of a corporate data breach spiked 12 percent to a record $4.99 million, driven largely by unmonitored artificial intelligence infrastructure. IBM found that 68 percent of breached organizations possessed no formal AI governance policy whatsoever. Incidents involving shadow AI more than doubled year over year, while an eye-watering 92 percent of AI-related breaches occurred at companies with zero access controls placed on their models. Then came August 2, 2026, when the EU AI Act officially triggered its binding obligations under Article 50. Overnight, transparency rules, mandatory audit logging, strict model access controls, and demonstrable workforce AI literacy transformed from optional corporate social responsibility topics into hard legal mandates backed by severe financial penalties. What Ryan's roundtable captured in May was the reality baseline of an industry running on blind optimism. The IBM breach statistics published in July delivered the economic consequence, and the EU AI Act in August established the legal deadline. Why Cars Have Brakes During the May session, Patrick introduced an analogy that perfectly encapsulates where enterprise leadership went wrong. He asked the room why we put brakes on a car, noting that the usual response is simply to be able to stop. "If we didn't have brakes on a car, we would all be driving around at two miles an hour and then bumping into a tree to slowly stop," Ryan said. "So the brakes on the car can actually help us go faster. We trust the brakes, and that is why we drive down the freeway at 60 miles an hour, because we know if we need to stop, we can stop, and we are going to be safe." He urged the executives to apply that exact same logic to technology governance. Controls are not built to halt innovation or park the business, but to give leadership the trust and confidence required to scale AI rapidly without careening off a cliff. The governance deficit revealed in May demonstrated that most enterprise deployments were running at full throttle without any brakes at all. Employees were uploading sensitive financial models, customer records, and proprietary source code into external large language models without realizing that once data leaves the building, pulling it back is virtually impossible. Reframing the Executive AI Question Patrick urged executives to fundamentally reframe their primary line of inquiry as systems gain autonomous capabilities. "I think executives need to shift from a mindset of what can AI do for us to under what conditions can this become unsafe," Ryan said. "The train has left the station and there is no stopping it. AI can do everything you want it to do, so looking at the same problem from the other end, under what conditions will this become unsafe, I think that mindset shift is important." "How do we stay relevant as humans?," Ryan asked the room while addressing assurance and controls. "How do we provide direction, and how do we make sure that what agents and models are doing is what we intended? Once it is gone, it is so difficult to pull back." This distinction between reversible and irreversible actions is where modern risk management must draw the line. Internal summarization tools, creative brainstorming sessions, and sandboxed code helpers carry low stakes and high reversibility, making them ideal for rapid, AI-first experimentation. Conversely, customer-facing workflows, medical processing, automated credit scoring, and live financial transactions are entirely irreversible. For these high-stakes deployments, process-first controls and strict human-in-the-loop oversight are non-negotiable. Building Sustainable AI Governance Organizations must also confront the hidden economics of ungoverned AI. While initial model API calls seemed cheap, runaway token budgets, model drift, and unmonitored agentic loops are creating unexpected financial drains that frequently exceed human developer costs. When paired with the multi-million-dollar average cost of an AI-fueled data breach, the illusion of frictionless, cheap AI vanishes entirely. To navigate this landscape, enterprises are beginning to align their operations with international frameworks like ISO 42001 for AI management systems. They are categorizing systems into clear risk tiers, establishing technical mediation layers to redact sensitive prompts, and distributing accountability across executive, legal, IT, and business units rather than dumping the entire burden onto an isolated Chief AI Officer. As Ryan noted during his presentation, ethical foresight will ultimately define long-term commercial success. "The winners out of this AI wave are going to be the companies that apply good ethics in their AI journeys and actually have almost a moral footprint in terms of where they are going," Ryan said. The era of ungoverned, wild-west AI experimentation officially expired this month. Organizations that treat governance as the steering wheel and braking system of their AI strategy will move faster and smarter than their competitors, while those still driving without controls will find that the next turn carries a $5 million price tag.

[13]

AI agent security: isolation lags enforcement | VentureBeat

Across 116 enterprises, agents are in production and so are the incidents: A majority have already had a confirmed agent security event or a near-miss. Two-thirds of enterprises enforce scoped permissions at runtime. Barely one in five isolates its highest-risk agents, making containment the weakest layer in the stack precisely as autonomy scales. Credential sharing persists across nearly two-thirds of agent fleets, and 53% have already had a confirmed agent security event or near-miss, contributing to a growing lack of confidence in agentic security. Security stacks remain overwhelmingly borrowed from model providers and hyperscalers, and confidence has slipped. Today, as many enterprises now believe AI-armed attackers are ahead of their defenses as believe the reverse. This wave of VentureBeat Pulse Research examines how enterprises secure their AI agents: what tooling they run, how they manage agent identity and isolation, what has already gone wrong, how much they spend, and whether they believe their defenses are keeping pace with AI-enabled attackers. Only 18% of enterprises isolate their highest-risk AI agents, even as 65% of enterprises enforce scoped permissions at runtime and 56% monitor and log agent activity. The gap between what enterprises watch and what they contain is the central finding of this wave of VentureBeat Pulse Research. More than half of enterprises (53%) have agentic AI systems in production today, and another 27% are piloting or running a limited rollout. The agentic security incidents are arriving with them: 53% of organizations have already had an agent security event, with 19% confirming an incident and 38% having identified a near-miss that was caught before it caused harm. The central finding is a containment gap. Enterprises have built the controls that watch and permission agents but not the one that bounds the damage when those fail. Among enterprises describing their security posture, 65% enforce scoped identities and permissions at runtime and 56% observe and log agent activity, yet only 18% isolate high-risk agents in sandboxes. Even among enterprises running agents in production, isolation is enforced just 21% of the time, and just 8% pair enforcement with isolation. That ordering is backward from a defense-in-depth standpoint. From SOC teams to CISOs, security teams know that observation tells you what happened and enforcement tries to prevent it, but isolation is what limits the blast radius when prevention fails. Identity has improved without being solved. 49% of enterprises say each of their agents has its own scoped, managed identity, but 63% report credential sharing somewhere in the agent fleet, and only 29% describe a fleet with scoped identities and no sharing anywhere. The security stack doing this work remains overwhelmingly hyperscaler or model provider-native: OpenAI's guardrails (44%), Microsoft Azure (42%), Anthropic's managed-agent controls (37%), and Google Cloud (31%) lead, and 92% of enterprises naming a primary security layer name a hyperscaler/model provider-native one. Two things have shifted against the comfortable picture. Confidence has slipped, with 30% now saying AI-armed attackers are ahead of their defenses, exactly as many as say their defenses are ahead. And churn intent is the highest this series has recorded, with 74% planning to adopt, add, or replace agent security tooling within twelve months, despite satisfaction scores at a series high of 4.29 out of 5. Enterprises are more satisfied than ever with a stack they are more determined than ever to replace. Methodology VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent security -- the tooling, identity, isolation, and enforcement controls organizations use to secure autonomous AI agents. Responses are filtered to organizations with more than 100 employees (n=116; the survey's smallest size band, 1-100 employees, is excluded), drawn from a single July 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends; all figures are drawn from the July fielding only. Several questions were multiple-select, so those shares can sum to more than 100%. By role the sample is senior and buyer-credible: 44% are final decision-makers for AI purchases and another 38% recommenders or influencers. Managers (36%), individual contributors (27%), VPs and directors (18%), and the C-suite (16%) make up the seniority mix. By organization size the sample is mid-market-weighted with a meaningful enterprise tail: 101-250 (34%) and 251-1,000 (23%) employees lead, with 1,001-5,000 (18%), 10,001+ (17%), and 5,001-10,000 (7%) above them. Technology/Software is the largest industry at 38%, followed by Healthcare/Life Sciences (11%) and Financial Services (10%). Three questions require a base note. Two questions were asked only of enterprises with agents live or piloting. Posture figures (observe / enforce / isolate) are reported on those 93 respondents, and primary-security-layer figures on the 92 of them who named a layer. The 23 respondents outside this base are those still evaluating, without plans, or unsure -- organizations for which an agent security posture would not yet apply. And several multiple-select questions permitted overlapping answers where one was intended -- identity (33 respondents selected more than one pattern), arms-race assessment (23), budget share (10), and incidents (9) -- so those are computed at the respondent level and the overlap is described where it matters. Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 76 of the 116 qualified respondents. At 116 respondents, the sample supports directional reads but not precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively standing up agent security rather than from the largest operators. Finding 1: Agents are in production, and so are the incidents A majority have already had an agent security event We asked whether organizations run agentic AI in production, and whether they had experienced an agent security incident -- a confirmed breach, or a near-miss caught before harm. Agents have moved into production for this cohort. More than half of enterprises (53%) run agentic AI systems live today, another 27% are piloting or running a limited rollout, and only 3% have no plans in the next twelve months. The security exposure has scaled with the deployment: 53% of organizations have already had an agent security event, 19% a confirmed incident and 38% a near-miss caught before it caused harm. That the near-misses outnumber confirmed incidents two to one is worth reading carefully. It means enterprises are catching problems, but catching them close to the edge -- and a near-miss is a control that worked once, not a control that will work every time. The controls examined in the rest of this report, particularly the identity and isolation gaps in Findings 2 and 3, are what determine whether the next near-miss stays a near-miss. One pattern from earlier waves does not replicate here. Organization size makes no reliable difference to exposure: enterprises above 1,000 employees report an incident or near-miss at 47%, against 57% among those between 101 and 1,000 -- a difference well inside sample noise, and pointing the opposite direction from the size gradient this series has previously recorded. In this wave, what separates the hit from the not hit is not headcount. Finding 2: Identity is improving -- and still shared Half give agents scoped identities; two-thirds still share credentials somewhere We asked how enterprises manage the identity of their AI agents -- whether each agent has its own credentials, or agents share them. Respondents could describe more than one pattern across the fleet. Per-agent identity is now the most-cited pattern: 49% of enterprises say each agent carries its own scoped, managed identity, the precondition for least-privilege access and clean attribution. That is real progress on the control this series has repeatedly identified as the structural weakness beneath agent incidents. But the answers overlap, and the overlap is the finding. Thirty-three respondents described more than one identity pattern across their fleet, and rolled together at the respondent level, 63% of enterprises report credential sharing somewhere -- either agents mostly running on shared API keys and borrowed human or service-account credentials (37%), or a mixed fleet where some agents are scoped and many are not (34%). Only 29% describe a fleet with scoped identities and no sharing anywhere at all. Among enterprises with agents in production, 60% report per-agent identity, so the improvement is concentrated where the agents actually are -- but so is the residual sharing. The consequence is unchanged by the improvement. Where credentials are shared, an over-permissioned or compromised agent acts with far more reach than intended, and post-incident forensics cannot cleanly establish which agent did what. Half a fleet with scoped identities still has the blast radius of the half without. Non-human identity remains the largest unfinished piece of enterprise agent security, and as Finding 8 shows, it is still almost entirely absent from what enterprises are shopping for. Finding 3: Isolation is the control nobody builds Two-thirds enforce at runtime; fewer than one in five sandbox We asked what an organization's agent security posture looks like in practice -- whether they observe, enforce, isolate, or some combination. The control that bounds damage is by far the least common. Figures are reported on the 93 respondents who described a posture. This is the containment gap, and it is the widest structural gap in the report. Enforcement and observation are now common -- 65% enforce scoped permissions at runtime and 56% monitor and log agent activity -- while isolation sits at 18%. Only 8% of enterprises run both enforcement and isolation together, the posture that both prevents and contains. Deployment maturity is a better predictor than the aggregate figures suggest. Isolation reaches 21% among enterprises with agents fully in production, compared with 13% among those still piloting -- a meaningful gap that tracks maturity rather than exposure. Among enterprises that report credential sharing in the fleet, the group with the widest potential blast radius per Finding 2, isolation reaches 15%. The organizations with the most exposure are not meaningfully more likely to have built the control that bounds it. The ordering is backwards from a defense-in-depth standpoint. Observation tells you what happened after the fact. Enforcement tries to stop it. Isolation is what limits the damage when enforcement fails -- and enforcement will sometimes fail, which is the entire premise of the near-misses in Finding 1. An agent fleet that is watched and permissioned but not boxed in is precisely the configuration in which a single control failure propagates across systems. Enterprises have built the first two layers of the model and largely skipped the third. Finding 4: Security still runs on borrowed, provider-native controls Nine in 10 name a model provider or hyperscaler as their primary layer We asked which agent security tooling enterprises use, and which is their primary layer. The answer continues to favor the model providers and hyperscalers over the dedicated security vendors. Enterprises secure agents with tools that came bundled with their models and clouds. OpenAI's guardrails lead at 44%, followed closely by Microsoft Azure (42%), Anthropic's managed-agent controls (37%), and Google Cloud (31%). Asked to name a single primary security layer, 92% of those who answered named one of these provider-native offerings, with Azure (27% of answerers) and Anthropic (26%) leading. The purpose-built agent-security category is no longer at zero, but it remains marginal. Cloudflare (11%) and Cisco (9%) lead the specialists, with CrowdStrike, Palo Alto, Zenity, Check Point's Lakera, HiddenLayer, F5, and SentinelOne each between 1% and 7%. The identity specialists most directly relevant to Finding 2 are the smallest of all: Microsoft Entra Agent ID at 7%, Okta for AI Agents at 3%, and non-human identity platforms at 3%. Dedicated runtime sandboxing tooling -- the control missing in Finding 3 -- is in place at 3%. A note on reading these shares: As described in the methodology section, the respondent sample is self-selected, and the usage question counted every vendor or approach a respondent has in place -- so the figures measure presence in the security stack rather than spending or exclusivity. Individual vendor percentages therefore carry all the usual sample caveats. The structural pattern is the durable part: provider-native and hyperscaler controls lead by a wide margin, and dedicated agent-security specialists remain in single digits. Read the individual shares loosely and the pattern with confidence. Finding 5: Satisfaction is at a series high -- and so is churn intent Enterprises rate their tooling 4.29 of 5 and three-quarters plan to replace it We asked how satisfied enterprises are with their current agent security tooling, and whether they plan to adopt a new, additional, or replacement solution within twelve months. The two answers do not sit comfortably together. Satisfaction with agent security tooling is the highest this series has recorded -- 4.29 out of 5 for both overall satisfaction and ease of implementation, with value for money close behind at 4.11. That is a striking set of scores for a stack that is mostly borrowed provider guardrails, given that a majority of the same enterprises have already had an incident or near-miss and fewer than one in five isolates high-risk agents. The purchase intentions tell the other half of the story. Three-quarters (74%) plan to adopt, add, or replace agent security tooling within 12 months, and 30% within the next quarter alone -- higher churn intent than this series has previously seen in this category. Only 26% intend to stand pat. Enterprises are simultaneously more satisfied with their tooling and more determined to change it than at any prior reading, which suggests the satisfaction rests on the convenience and low friction of provider-native controls rather than on demonstrated containment. It is comfort with what is easy, not confidence in what is sufficient. Finding 6: Budgets are finally moving A third now spend more than a tenth of the security budget on agents We asked what share of the security budget enterprises allocate to securing AI agents. The allocation has grown, though it remains a modest slice. Agent security spending is still a slice rather than a pillar, but it is a growing one. The most common allocation remains 6-10% of the security budget (44%), and roughly a third of enterprises (35%) now devote more than a tenth -- a meaningful funded minority. Just over a quarter (28%) spend 5% or less. Read against Findings 1 through 3, the budget looks like a lagging but responsive indicator. A majority of enterprises have had an incident or near-miss, credential sharing persists across two-thirds of fleets, and fewer than one in five isolates high-risk agents -- gaps that a 6-10% allocation is unlikely to close quickly. The enterprises spending above a tenth are the ones with the resources to build scoped identity and isolation controls rather than adopt whatever their model provider ships, and whether that minority grows is a reasonable leading indicator for whether the containment gap narrows. Finding 7: The arms race has tilted As many say attackers are ahead as say their defenses are We asked how enterprises assess the balance between their AI-enabled defenses and AI-enabled attackers. Confidence has slipped into an even split. Enterprises are no longer net-optimistic about the contest. Exactly as many say AI-armed attackers are ahead of their defenses (30%) as say their defenses are ahead (30%), with another 33% calling it roughly even and 24% saying it is too early to tell. Taken together, 63% rate the balance as even or worse. Experience is what drives the pessimism, and the relationship is statistically clear. Among enterprises that have had a confirmed incident or near-miss, 39% say attackers are ahead; among those that have not, 20% do -- a gap large enough to be unlikely to arise by chance in a sample this size. Getting hit does not just change what enterprises buy; it changes how they read the contest. The organizations closest to the actual threat are the least confident about it. That assessment sits uneasily beside the series-high satisfaction of Finding 5. Enterprises rate their tooling 4.29 out of 5 while a clear majority believe it is, at best, holding even against an adversary that is also compounding with AI. An even race is not a comfortable place to be, and the group that has actually been tested rates it worse than even. Finding 8: A reshuffle is coming -- but identity still isn't on the list Incidents drive urgency; the control they implicate draws 10% interest We asked which agent security solutions enterprises are considering. The consideration set has broadened, but not in the direction the incident data points. Incidents start the buying cycle. Among organizations that have had a confirmed incident or near-miss, 38% plan to adopt, add, or replace agent security tooling within the next ninety days, against 22% of organizations with no incident; after a confirmed incident specifically the figure reaches 41%. Experience remains the strongest predictor of urgency in this data, as it is of pessimism in Finding 7. The consideration set still leans provider-native -- OpenAI (38%), Microsoft Azure (37%), Anthropic (35%), and Google Cloud (28%) lead -- though the dedicated security vendors now draw meaningful early interest: Cisco (10%), Cloudflare (9%), Zenity and CrowdStrike (8% each), and Palo Alto, Check Point's Lakera, and open-source guardrails (6% each). For most of the specialists that is more forward interest than current footprint. What the shopping still does not include is the identity layer. Just 10% of enterprises include an agent-identity product -- Okta for AI Agents, Microsoft Entra Agent ID, or a non-human identity platform -- anywhere in their consideration set. Among the enterprises that both share credentials and have already been hit, the group with the most direct evidence that the control matters, identity consideration is no higher: roughly one in ten. Runtime sandboxing tooling draws 6%. The two controls most directly implicated by the incident data, identity and isolation, are the two least present in the purchase plans -- the same blind spot this series recorded in the prior wave, unchanged despite a year of incidents. The bottom line: A security gap that prevention alone won't close Organizations with more than 100 employees have put agents into production -- 53% run them live today -- and the incidents have arrived alongside them, with a majority already reporting a confirmed event or near-miss. On the controls, the picture is genuinely mixed rather than uniformly poor: nearly half now give each agent its own scoped identity, two-thirds enforce permissions at runtime, and a third devote more than a tenth of the security budget to agents. Enterprises are building agent security in earnest. What they are not building is containment. Fewer than one in five isolates high-risk agents, only 8% pair enforcement with isolation, and among enterprises running agents in production isolation reaches just 21%. Credential sharing persists across 63% of fleets, so the blast radius that isolation would bound remains wide. The stack doing this work is 92% provider-native by primary layer, and the specialists built for exactly these gaps sit in single digits. The result is an architecture optimized to prevent and observe, with almost nothing in place for the case where prevention fails -- which is the case the near-misses in Finding 1 describe. The uncomfortable pairing is confidence with exposure, and it has sharpened. Satisfaction is at a series high of 4.29 out of 5, yet 63% rate the contest against AI-armed attackers as even or worse, 30% say attackers are ahead outright, and 74% plan to replace tooling they just rated highly. Enterprises that have actually been hit are markedly more pessimistic and markedly more urgent -- and still not shopping for identity or isolation, the two controls their incidents most directly implicate. At 116 respondents in a single July wave this is a directional read, weighted toward the mid-market -- but the direction is clear: agent deployment is running ahead of agent containment, and the gap is not in what enterprises watch or permission but in what happens when those controls fail. The containment gap will not be closed by a better provider guardrail. The open question for later waves is whether enterprises build isolation and governed identity deliberately, or whether a confirmed incident that propagates does it for them.

[14]

Why cybersecurity must evolve for the age of AI agents

For years, cybersecurity was built on a simple assumption: systems follow defined rules. Applications do what they are programmed to do, while people log in, are given permissions and access the resources they need. Artificial intelligence (AI) is changing that. With nearly 50% of cybersecurity solutions buyers expecting AI to be embedded across the cyber stack within three years, organizations are no longer focused solely on protecting applications and access rights. They also need to secure intelligent systems that can make decisions, interact with users and act autonomously. AI can draw on models, prompts, context and external tools to understand a goal, make decisions and determine how best to achieve it. As organizations give these agentic systems greater autonomy across enterprise workflows, the consequences of failure extend beyond generating a wrong answer. A mistake can now disrupt business processes, influence decisions and trigger unintended actions across connected systems. An expanded attack surface Greater autonomy creates new points of vulnerability whenever AI is given access to data, systems and external tools. Cyber threats, such as attackers manipulating the information AI receives or impersonating trusted users, can alter how it responds or the actions it takes. This could lead an AI agent to retrieve inaccurate information or approve unauthorized actions. Traditional cybersecurity controls were designed for humans and applications, but autonomous agents don't fit neatly into either category. Security therefore needs to extend further across the entire AI lifecycle: before go-live, during operations, and at every point where AI learns, decides, and acts. Organizations need a unified security architecture that provides consistent visibility and controls across both AI and traditional systems, which makes it easier to identify threats, enforce policies and respond quickly when incidents occur. Trusting AI safely However, a unified architecture is only part of the solution. Businesses also need to ensure the AI agents themselves can be trusted. Like any trusted user or system, AI agents should have a verifiable identity, tightly controlled access to data and systems, and auditable records of the actions they take. Without these safeguards, organizations risk creating AI systems that can bypass security and compliance controls because of design flaws rather than malicious intent. Security also cannot stop once an AI system is deployed. Unlike traditional software, AI systems learn from new data, operate in changing contexts and can behave differently over time. Organizations therefore need continuous monitoring to ensure agents stay within defined boundaries and policies continue to be enforced. That includes clear ownership, escalation paths and kill switches that can safely contain or stop an agent behaving unexpectedly. Some organizations are also beginning to use "guardian agents" that monitor other AI agents and flag unusual behavior. The level of oversight should reflect the level of risk. AI agents carrying out low-impact tasks can remain largely autonomous, while higher-risk activities - such as updating customer data, approving financial transactions or interacting with production systems - should have stronger guardrails. Applying controls in proportion to risk allows organizations to capture the benefits of AI while maintaining security, compliance and trust. Context as a security boundary Securing AI also means securing the information it relies on. Context is what gives AI agents their power. This includes internal documents, customer information, business rules and previous interactions, helping agents understand a task and decide what to do next. That also makes context a new security boundary. If the information an AI relies on is inaccurate or has been deliberately manipulated, the decisions it makes can be wrong, even if the underlying model is working exactly as intended. This is known as context poisoning. Protecting against this means controlling what AI can see as well as what it can do. Agents should only have access to the data and systems they need for a specific task. For example, an AI assistant answering employee questions should not have the same level of access as one authorized to approve payments. Guardrails must go beyond filtering outputs and extent to protecting the integrity of the information AI uses, ensuring it is accurate, up to date and appropriate for the task at hand. Governance at scale Technical controls are most effective when they are supported by effective governance. This requires a joined-up approach that brings together AI and traditional systems, with consistent controls across the business. Organizations should also define where human intervention is required and who is responsible for the decisions models make. Oversight should focus on the activities that carry the greatest operational, financial or regulatory risk, supported by investment in the skills needed to govern AI effectively and maintain trust in autonomous systems. The path forward Ultimately, securing AI is about more than protecting systems from attack. Organizations need the right technical solutions, clear ownership and continuous oversight throughout the AI lifecycle. Trust depends on these elements working together. The organizations that succeed with AI will not necessarily be those that move fastest, but those that scale it securely and responsibly. The question for leaders is no longer whether to trust AI, but whether they are building systems that deserve to be trusted. We've reviewed, rated, and ranked the best endpoint protection software. This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

[15]

Fast Company

Everyone is talking about building AI

The Fast Company Executive Board is a private, fee-based network of influential leaders, experts, executives, and entrepreneurs who share their insights with our audience. The appeal of agentic AI tools like Claude Code and Codex is that anyone can create any application. That's also a big drawback; when subject matter experts vibe code software, they get a solution that works in the moment but may cost your company more time and tokens in the long run. For example, a finance expert can vibe code an AI tool for a specific tax problem and immediately get an answer that works. But when the business needs to make a small change, validate the system, or adapt it, they may be modifying something they don't fully understand. Those small adjustments compound, creating a system that becomes harder to maintain and less aligned with the business problems it was built to solve. AI's future in the business world hinges on subject matter experts building systems and keeping them relevant. Forward-thinking companies should focus on the business logic layer where people who understand the business translate that knowledge into something a machine can apply consistently. THE CHINA SHOP RULE When it comes to responsible AI use, the business world could learn a few things from the china-shop rule, "You break it, you buy it." AI needs a similar rule: "If you build it, you own it." And not just the code. Ownership includes the outcomes your AI app or agent delivers. In this context, owning it means that if you create an AI tool, you also need to future-proof it. The person who creates a model must include a simple, explainable way to add new information and update its features in the future. That way, you don't have a model that works perfectly for a few weeks, then requires a token-heavy overhaul as soon as it ingests a new dataset. The next question, naturally, is "Who gets to build AI tools?" Businesses usually have two choices, and neither one is ideal. First, you can let your subject matter experts, such as operations teams, accountants, supply chain managers, and marketers, use agentic AI to vibe code single-purpose tools. Subject matter experts know the right questions to ask and the answers the business needs. Their tools address real business needs and fix tedious, time-consuming issues. The time between "I want this tool" and "I have this tool" could be as short as an afternoon. However, this approach creates vibe coding problems. You can expect overengineered, unwieldy code that's almost impossible to update or audit. When the input data changes, you might need to vibe code a whole new program. Also, if a subject matter expert can't explain exactly how the code works, it calls all output into question. The second choice is to give IT the model-building project. Your technology team knows how to build AI models with auditable processes and accurate outputs. These models will likely be more reliable since ingesting new data and adding new features are standard IT practices. Handing everything off to IT has some drawbacks. IT will build the tool on its schedule, which may take a lot longer. There's also the issue of expertise. As your IT team builds the model, your subject matter experts must give detailed explanations of their fields. The first version will need tweaks, leading to tedious back-and-forth exchanges. By the time you get something workable, the whole model might be outdated. THE BUSINESS LOGIC LAYER The business logic layer is where subject matter expertise and IT best practices meet. A piece of software uses your business logic layer to apply rules and execute workflows specific to your industry or your company. The quality of your business logic layer determines the quality of AI outputs. When subject matter experts define the rules and apply realistic decision logic, you get tools with innovative real-world applications. When IT professionals apply version control, testing, and auditing, you get tools that you can use for years to come. Think back to the earlier example of a financial expert creating a tax tool. With vibe coding and no other guardrails, the tool will probably become irrelevant and require a full rebuild as soon as the government makes a major change to the tax code. With a well-maintained business layer, IT can validate each input, audit each process, and update individual features as needed. Building a better business logic layer also addresses some of the biggest problems in business AI today: * 47% of failed AI and analytics projects are due to poor data quality or governance * 65% of analysts say agentic systems are most productive with business-level logic management * Analysts spend almost 10 hours each week (25% of each workweek) cleaning data and checking outputs If you build your company's AI policy from the ground up with a thoughtful AI framework, you won't have to rely exclusively on either vibe coding or the IT department. And when your business logic layer runs on clean data and transparent processes, agentic AI can act as a reliable middleman. MAINTAIN A MODEL Over the last few years, we've learned that vibe coding can be costly, clunky, and unreliable. What we haven't stressed enough is that it's also inflexible. AI tools that cannot adapt when the business changes have short shelf lives and rebuilding from scratch leads to more bloated code and more wasted tokens. The companies that build for longevity, not just speed, are the ones that will see a return on their investment. By now, most businesses have adopted AI, but only a few have seen the kind of transformational changes they anticipated. With curious subject matter experts, rigorous IT professionals, and a business logic layer that acts as a bridge between them, companies can stop choosing between speed and reliability and finally build the exact tools they need to create lasting value. Andy MacMillan is CEO of Alteryx.

[16]

AI security skills gap widens across Black Hat USA

The AI security skills gap becomes Black Hat's quiet crisis: theCUBE's Black Hat USA 2026 day one keynote analysis Attackers no longer need days to move from initial access to full compromise -- frontier AI models have collapsed that timeline to seconds. Defenders can't hire their way out of that speed differential, which is exposing an AI security skills gap most security teams are only beginning to address. Black Hat USA, the annual security conference held at Mandalay Bay in Las Vegas, opened this year with defenders adjusting to frontier AI models compressing the time between compromise and full exploitation. Krista Case (pictured, left), principal analyst and practice lead for cyber resilience and security at theCUBE Research, opened theCUBE's coverage arguing defenders already have more of the answer than the hallway hype suggests. "These frontier AI models ... are really accelerating the speed and the scale that attackers can move at, which is compressing the window for response for our defenders," Case said. "One of the big things that defenders need ... is context." Case and co-host Jon Oltsik (right) conducted a day one keynote analysis at Black Hat USA 2026, during an exclusive broadcast on theCUBE, SiliconANGLE Media's livestreaming studio. They discussed cyber resilience, threat intelligence and the new security skill sets AI adoption demands. (* Disclosure below.) Closing the AI security skills gap Oltsik pointed to the widening gap in raw numbers. Mandiant's M-Trends 2026 report found the median time between initial access and full compromise has collapsed to 22 seconds, down from more than eight hours in 2022 -- a pace no human-only security operations center can match. "Cyber resilience is the intersection point between technology and the business," Oltsik said. "Before we have resilience, we have to understand: What are our business processes? What's important to the business, and who are the constituents that need to make that decision?" That skills gap is already reshaping staffing, Oltsik said: AI penetration testers to stress-test agentic applications, and AI governance specialists to track regulations and guardrails as they evolve. He made a similar case elsewhere in theCUBE's Black Hat coverage this week, framing agentic AI oversight as manageable only with the right mix of people, process and technology. "The human still needs to be in the loop," Case said. "Combined, human plus AI, we can do more than we could do with just AI or just the human." Here's the complete video interview, part of SiliconANGLE's and theCUBE's coverage of Black Hat USA 2026: (* Disclosure: TheCUBE is a paid media partner for Black Hat USA. Sponsors of theCUBE's event coverage do not have editorial control over content on theCUBE or SiliconANGLE.)

[17]

Observer

As A.I. Agents Gain Authority, Governance Becomes the Primary Constraint

Every enterprise wants to deploy A.I. agents. Far fewer have built the governance infrastructure required to let those agents operate safely across financial systems, customer data and mission-critical workflows. Every enterprise is running the same experiment right now: handing more decisions to A.I. agents and watching to see what breaks. Some are further along than others, but few are proactively asking the question that ultimately determines whether agentic A.I. can move beyond pilots: what happens when an autonomous system takes an action no one can fully explain? That question rarely surfaces during a product demo. It arrives later through finance after an unexpected bill, through security during an audit or in the boardroom once A.I. begins touching customer data, financial transactions or core business processes. As enterprises hand more authority over to software, governance is becoming the operating system of trust. Sign Up For Our Daily Newsletter Sign Up Thank you for signing up! By clicking submit, you agree to our <a href="http://observermedia.com/terms">terms of service</a> and acknowledge we may use your information to send you emails, product samples, and promotions on this website and other properties. You can opt out anytime. See all of our newsletters In traditional applications, governance has often been treated as the last mile of deployment. You built the app, signed off on the compliance checklist and then deployed the product. That sequencing made sense when software applications followed the same deterministic path every time. It falls apart if that is an agentic application -- a piece of code, interacting with a model, that is then interacting with one or more systems -- using probabilistic judgment to take actions. It may approve refunds, move money between accounts or initiate vendor contracts. Each decision introduces new uncertainty. An A.I. agent therefore, needs the same basic infrastructure as any new employee on day one: a verified identity, a clearly defined scope of authority and a record of every action it takes. Companies that build those controls into the foundation are scaling agents with confidence. Those that postpone governance until after deployment are discovering how difficult -- and expensive -- it is to bolt accountability onto systems already embedded across the business. One of the most common problems begins with access. A business unit launches an agent to resolve customer support tickets or reconcile invoices. The pilot succeeds, so the agent gains access to additional systems and takes on more responsibilities. Only later does someone ask what the agent can actually access, whether those permissions were ever narrowed after the pilot or who approved them in the first place. Retrofitting access controls onto a live agent that's already woven into a dozen enterprise systems is significantly harder than designing those controls from the outset. Enterprise security leaders increasingly describe excessive permissions and weak access governance as recurring findings in their A.I. audits. The same lack of visibility shows up in cost. Agentic systems that can't be observed at the task level often retry failed actions, call expensive models or tools unnecessarily or become trapped in inefficient execution loops. Finance teams frequently discover the problem only after A.I. spending has climbed well beyond expectations because they're looking at a single budget line instead of thousands of individual decisions that could have been measured, optimized and governed. The bigger issue, however, is trust. Many organizations have built technically capable agents only to discover that their own teams are reluctant to let those agents touch any consequential business processes. The hesitation usually comes down to a simple question nobody can answer with confidence: if this agent makes a mistake, how will anyone know what happened? Capability without accountability doesn't scale. It stays confined to pilots and innovation labs while critical business functions continue relying on manual processes. The organizations handling this well haven't necessarily moved more slowly. They've treated visibility, auditability and access control as part of the system they're building instead of a compliance exercise added after deployment. One large insurer, for example, adopted a simple rule: no agent enters production without a clearly defined scope of authority and an activity log that a business leader -- not only an engineer -- can understand. That single requirement changed how teams designed agents from the outset, and ultimately allowed the company to expand the use of A.I. across claims processing because governance questions had already been answered before launch. A regional bank arrived at a similar conclusion for a different reason. Regulators were always going to ask for an accounting of automated decisions, regardless of how those decisions were made. Rather than reconstruct and assemble events after the fact, the bank built the audit trail directly into the system. The result wasn't just smoother regulatory reviews. It also gave the organization's leaders a much clearer picture of what every agent was doing, making it easier to identify a misconfigured workflow before it turned into a customer or operational incident. In many ways, this mirrors a transformation taking place across the digital economy. As software begins acting independently on behalf of people and organizations, the scarce resource is trusted delegation. Enterprises need confidence that an agent can access only the systems it should, perform only the actions it's authorized to take and leave behind an auditable record of every decision. That combination of identity, permissions and accountability is becoming part of the trust infrastructure that underpins the emerging agent economy. None of this requires exotic technology. It requires treating A.I. agents the same way organizations would treat any other actor with access to critical systems: register their identity, define what they're allowed to do, record what they did and make those records understandable to the people responsible for the outcome. A small investment in an A.I. platform engineering to put these controls in place is what unlocks the agentic model at scale. So much attention has been given to what A.I. agents are capable of and the work they can take on, but the companies pulling ahead aren't distinguished solely by the sophistication of their models. They're distinguished by the confidence to put those models into production because they know exactly what their agents are doing, why they're doing it and how they'll respond when something goes wrong. Governance is no longer the paperwork that follows A.I. adoption. Increasingly, it's the prerequisite that makes large-scale agentic A.I. adoption possible at all.

[18]

Brex assumes its AI agents could do anything -- so it watches the network, not the code

Brex CEO Pedro Franceschi offered a blueprint for one of the pressing challenges facing the enterprise today at VB Transform 2026: securely deploying AI agents, like the open-source OpenClaw, into production environments. Unlocking this enterprise value requires a mindset shift. The industry needs to move past vague terminology and focus on concrete enterprise roles. "People talk a lot about agents, but I think 'agents' is a terrible name. It's this Silicon Valley concept that doesn't really mean much," Franceschi said. Instead, the goal should be creating entities that can genuinely collaborate with human workers. "The concept we always had in mind was the idea of a virtual employee -- someone on Slack, an entity, it has an email address, it can join meetings, you can email it, and that you can work with," Franceschi said. Realizing this vision demands a new security paradigm. Franceschi's presentation detailed how Brex pointed OpenClaw at internal roles, realized traditional security models failed, and built a novel network-level security layer called CrabTrap. The OpenClaw security dilemma The journey began following a breakthrough in December, when coding models reached a level of maturity that enabled the January release of OpenClaw. This marked the moment agents could finally self-bootstrap and maintain their own codebases instead of relying on hard-coded, static tools. However, when Franceschi proposed deploying this to automate internal functions, the Brex security team firmly rejected the idea. "They said, 'Hell no. How could we trust an agent doing these things? This thing has code execution capabilities. There's no way to control it,'" Franceschi said. That caution isn't unique to Brex -- enterprises broadly have been wary of granting agents uncontrolled code execution on corporate networks. To solve this, Brex had to shift the security perimeter. Franceschi contrasted this with approaches like Nvidia's NemoClaw, which he said secure agents by limiting their tool usage -- a model he believes neutralizes the coding capabilities that give agents their value. "... the premise we had was that the coding capabilities were critical to the model having the ability to do a variety of tasks," he said. Brex's fix was to shift the security boundary to the network layer instead. Instead of policing the ever-changing code inside the container, the focus must shift to monitoring what the code actually attempts to send or receive from the outside world. CrabTrap and the LLM-as-a-judge solution This network-centric approach led to the creation of CrabTrap, an open-source HTTP proxy built by Brex. The mechanism operates on the assumption that OpenClaw can do anything and might already be compromised. Therefore, CrabTrap monitors all outbound network traffic between the container and the internet, using an LLM to judge whether that traffic aligns with the agent's approved policy. "Instead of trying to control the code running in the container, assume the thing can do anything and monitor the network traffic between that container and the internet," Franceschi said. Using a large language model (LLM) to judge every single network request introduces unacceptable latency, often adding thousands of milliseconds to response times. Brex solved this by passing traffic through a bifurcated system. Routine, low-risk actions pass through static, pre-approved rules instantly. If a recruiting agent tries to view a LinkedIn profile, the static rule allows it. However, high-risk actions such as sending emails are flagged and routed to the LLM judge for evaluation. Franceschi said that architecture ensures only about 2% of complex requests actually face LLM latency. A surprising finding from the project was how effectively the LLM judge performs this role. Franceschi attributed this to the models' training: LLMs are exposed to billions of web pages and HTTP requests, giving them what he described as an inherent semantic understanding of network traffic patterns. "[Models] are very good at discerning what is within the policy and what is not," Franceschi said, adding that this capability emerges naturally through pre-training without needing heavy prompting. Brex put this infrastructure to the test with "Jim," a virtual recruiter built on OpenClaw. Jim handles various tasks, including sourcing candidates, scoring inbound applicants, and sending emails. When Jim attempts an action that falls outside the established policy, CrabTrap relies on a human-in-the-loop workflow. If the LLM judge flags an unapproved outbound email, CrabTrap pings a human manager on Slack. The Slack notification explains the agent's underlying intent and suggests a policy change that would allow the action. The human manager can then review the context and click "yes" or "no" to update the rules dynamically. "I like the virtual employee analogy because a lot of these things were solved already in a company, in the context of humans," Franceschi said. "When an employee hits a wall, they escalate to their manager." The cost of the frontier Brex is a fintech company, not a cybersecurity vendor. The decision to build CrabTrap in-house was driven by a lack of mature commercial solutions that could satisfy their security team. Franceschi acknowledged the inherent cost of operating at the bleeding edge, admitting that commercial vendor solutions will likely catch up. "When we built this, it was clear to me there was a 70% chance we would throw it away in six months... But what we learned by being six months ahead was worth it in shaping our AI adoption strategy," he said. The investment in building internal tools provided Brex with the experience needed to safely deploy agents months ahead of the broader market. For enterprise leaders navigating the AI landscape, the core takeaway is the necessity of building the cultural and technical muscle to operate in an agentic world today. "We don't have all the answers, but the answer is not to do nothing," Franceschi said.

[19]

Security's AI advantage will go to the organizations already built for accountability

Accountability infrastructure, not speed, wins enterprise AI security The enterprise race to scale AI operations is in full swing - both from a deployment and security perspective. While conventional wisdom suggests that the teams who deploy the models first get the edge, it's the wrong approach for enterprises. For nefarious actors, speed is the name of the game. Malicious actors leveraging AI to probe for vulnerabilities don't need to share their decision trail to audit committees or regulators - making speed alone the key advantage for attackers. Enterprise security teams, on the other hand, operate under entirely different parameters - which also happen to be where the opportunity lies. Security teams don't just need the capability to identify anomalies, screen transactions, or make access decisions - they also need to be prepared to explain what happened, when, and why to key stakeholders. Every action and every outcome needs to be clarified and justified to a board, an auditor, or a customer. Scaling AI at the enterprise level is not relegated to who moves fastest, but rather who can embed the necessary accountability frameworks, emergency brakes, and audit trails. The Hidden Data Problem In truth, speed is not the primary challenge for most enterprise teams. The bigger, more difficult challenge is found in data and governance. Policy models and detection frameworks are only as impactful as the information inputs. However, most organizations are devoid of structured, well-governed data - particularly as it pertains to AI activity. Across the majority of organizations, data is scattered. Activity logs, access records, transaction histories all live in disparate systems with inconsistent formats and no single source of truth. No matter how much of this data is fed into an AI model, clarity will never be achieved. Instead, teams generate a false sense of confidence built upon a shaky foundation. Meaningful scale begins with auditability and accountability as infrastructure, not an afterthought. As AI systems become increasingly embedded across organizations, the requirement heightens for more consistent records of actions that occurred and policy enforcement where actions are checked against defined rules prior to execution. Equally as important, organizations need to have the internal muscle memory to explain automated decisions to stakeholders outside the engineering team, because they've been doing versions of this for years in compliance and risk functions. When this approach is foundational for enterprises, AI systems become genuinely useful. AI models built upon strong data and governance standards can meaningfully screen actions against known risks before settlement, flag patterns that humans may have missed, and maintain updated records that can be shared across key stakeholder groups. Devoid of this foundation, fragmented data and ungoverned systems compound - resulting in faster mistakes. Enthusiasm around AI systems centers on the deployment side of the equation, without asking whether the underlying infrastructure can support what's being layered on top of it. This approach is suboptimal and leaves an open door for breaches - akin to installing an alarm system in a building without putting locks on the doors. Embedding infrastructural policy enforcement, audit trails, and human-reviewable records does bring an additional layer prior to deployment. And in a domain where nefarious actors operate free of this operational layer, it's fair to ask whether enterprise security teams are creating a permanent speed disadvantage for themselves. However, that mindset misses what the added operational layer actually delivers: the difference between an AI system that fails safely and one that fails silently. Enterprise security teams who operate slower but can consistently and proactively identify and reverse bad decisions are in a fundamentally different position than enterprises who operate quickly and discover a failure three weeks post-incident. The tradeoff is real, but it's the wrong tradeoff to optimize away. Trust Beyond The Engineering Teams A common misconception is that security decisions are made for and by security teams. That's not the case. Security decisions made by automated systems need to satisfy stakeholders far outside of this workstream - including regulators, insurers, customers, even boards. Those stakeholders aren't moved by sophistication. They care whether the organization can clearly and consistently demonstrate what the system did and why. Organizations without that operational layer find that AI adoption increases their potential risk exposure, because they're now making faster decisions with insufficient guardrails. As AI systems continue to increasingly exhibit autonomous behaviors, the stakes continue to change. An AI system that can initiate payments, approve transactions, or move funds independently doesn't just need a policy to follow - it needs brakes to press in the event of a bad decision. Without this layer embedded, enterprise security teams not only carry the accountability problem - they also have no chance of catching a mistake before it becomes permanent. The Readiness Gap Readiness requires the proper sequencing. Before scaling AI operations, it's critical to make an honest assessment of three things: whether underlying data across systems are structured, whether there are firm policy checks in place, and whether verifiable records of automated decisions can be produced on-demand. Starting here positions AI to become a force multiplier for security teams. These three elements make all the difference between catching what humans miss and doing it fast enough to matter - or simply adding velocity to a faulty process. The "AI race" will not be won by having the newest models. Really, it's about devoting effort to the unglamorous work - building the data infrastructure and governance systems that make AI models trustworthy. We've reviewed, rated, and ranked the best firewall software. This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

[20]

agentic AI security requires human oversight

Agentic AI security tests enterprise defenses as scale outpaces strategy Cybersecurity leaders are confronting an inflection point as agentic AI security becomes the defining challenge of this year's threat landscape, with attackers and defenders racing to harness autonomous tools at unprecedented speed and scale. That urgency was on full display during the first day of Black Hat USA 2026, where autonomous AI agents dominated briefings and hallway conversations alike. As agents move into production and gain access to sensitive systems, the need for new governance models is colliding with a market still figuring out how to operationalize control, according to Jon Oltsik (pictured, left), principal analyst in residence at theCUBE Research. "Certainly it's unprecedented in terms of scale and speed," Oltsik said. "I'm starting to hear from people it's a manageable problem -- but you have to go into it with strategy and intelligence and the right balance of people, process and technology. I don't think a lot of companies are doing that, but those that are are managing." Oltsik and Krista Case (right) wrapped up day one coverage of Black Hat USA, , during an exclusive broadcast on theCUBE, SiliconANGLE Media's livestreaming studio. They discussed how enterprises are navigating agentic AI security, identity governance and cyber resilience amid a fast-moving threat landscape. (* Disclosure below.) Identity emerges as the control point for agentic AI security Beyond the hype cycle, practitioners are zeroing in on identity as the critical layer for managing autonomous agents, Case noted. Static entitlements no longer suffice when an agent can improvise its way toward a goal. "If you ask an agent to do a task, it's going to do whatever it needs to do or whatever it can do to accomplish that task," Oltsik said. "And some of that may be rogue behavior. So that's where I think identity, non-human identities, agentic identities, that's the challenge there, and it's not static, it's very dynamic." Visibility must come before any control layer can work, Oltsik noted, describing the process as sequential rather than simultaneous -- organizations first need to know what agents exist and what they touch before they can govern them. That discipline extends to resilience, where CISOs face pressure to prove systems can keep operating even after a breach. "We have to be much more sensitive to where the human in the loop takes place," Oltsik said. "We have to guide this technology. We have to understand this technology. But humans are still necessary to make decisions, and will be." Here's the complete video interview, part of SiliconANGLE's and theCUBE's coverage of Black Hat USA: (* Disclosure: TheCUBE is a paid media partner for Black Hat USA. Sponsors of theCUBE's event coverage do not have editorial control over content on theCUBE or SiliconANGLE.)

[21]

PYMNTS

Billtrust CTO Says a 1% AI Error Rate Can Create 100 Problems a Day | PYMNTS.com

The artificial intelligence terminology has shifted faster than most enterprise teams can adapt. Copilots became agents. Chatbots became autonomous workflows. And "agentic AI" went from a Gartner analyst term to a CFO line item in about 18 months. But the real question hasn't changed: are you actually getting work done differently, or just describing the same automation with better branding? Here's what I've come to believe: the companies becoming truly agentic aren't the ones deploying the most agents. They're the ones that got serious about the infrastructure underneath them first. The Data Layer Is the Foundation Every company has a data moat: years of transactional history, customer behavior and operational signals. But volume alone doesn't create leverage. AI doesn't just need access to data; it needs context, metadata and domain knowledge layered on top. What's the point of terabytes of records if the agent cannot distinguish a disputed invoice from a payment preference issue? Most agentic deployments hit this wall first. The model is capable. Tooling is available. But the underlying data is messy, siloed or ungoverned. Bad data governance means agents make flawed decisions at scale, a debt you pay later in rework, model drift and customer friction. A meaningful step forward is the Model Context Protocol, an emerging standard that lets AI tools query live enterprise data in structured, governed ways. We've built this into our platform: a CFO can ask their AI to summarize AR risk going into quarter end and get an answer from live data in seconds, without logging into a separate system. The AI gets access to the right things, permissioned appropriately -- but not everything. That distinction matters enormously as enterprises scale agent access across functions. Where Agents Are Working and Where They're Not Real impact is happening in bounded workflows: behavioral segmentation for collections outreach, payment policy optimization, anomaly detection in cash application. This works because the data is structured, the objective is clear and a wrong decision is recoverable. The next step is agents that don't just answer questions but take action, sending outreach, applying payments, escalating disputes, all governed by role-based permissions and a full audit trail. The toughest lesson is that full autonomy isn't the right goal for most enterprise workflows right now. The failure mode isn't artificial intelligence that can't perform; it's AI that performs without sufficient human visibility. When an agent makes 10,000 decisions a day, a 1% error rate is a 100-problem-per-day operation. The most mature teams design for "human-on-the-loop": the agent executes, the human monitors exceptions and approves high-stakes actions. Decision rights haven't disappeared; they've been restructured. The Enterprise Fabric Question Becoming an agentic enterprise is ultimately an organizational decision, not a technology one. It requires agreement on what agents are authorized to do, what data they can act on, how performance is measured and how governance extends to third-party partners in your AI stack. You can't govern in the dark, and you can't govern alone. The companies that will lead aren't the ones with the most ambitious agent roadmaps. They're the ones building the right foundation: clean data, strong governance, meaningful human oversight and the clarity to know where autonomy earns its place.

[22]

Autonomous actors need new AI agent governance

Agentic AI forces a reckoning on governance as autonomous actors enter production As AI agents move from experimental chatbots into production systems, enterprises must rethink agent governance as autonomous actors gain access to sensitive data, tools and business processes that traditional identity and security controls were never designed to handle. Enterprise cyber resilience company Rubrik Inc., which this week unveiled Rubrik Agent Identity to govern agent access one tool call at a time, argues that agents demand an entirely new control layer. Unlike a service account or a person, an agent pairs a non-deterministic model with federated identity -- and that combination breaks conventional assumptions about how software should be secured, according to Dev Rishi (pictured), general manager of AI at Rubrik. "If you or I were accessing Salesforce [or] accessing email, we have some judgment on how we would use that, that the models don't," Rishi said. "So I feel like you need a new class of guardrails that are a lot more intelligent and semantically aware to be able to actually secure and govern what agents are doing." Rishi spoke with theCUBE's Krista Case at Black Hat USA 2026, during an exclusive broadcast on theCUBE, SiliconANGLE Media's livestreaming studio. They discussed how enterprises can deploy autonomous actors with visibility, control and recovery. (* Disclosure below.) A new class of AI agent governance for autonomous actors Traditional identity stacks fall short because agents inherit legitimate permissions but lack the judgment to use them wisely, Rishi explained. An agent can pull data from Salesforce, then paste sensitive fields into an outbound email -- each action authorized, the combination toxic. To avoid flooding humans with endless approvals, Rubrik built SAGE, a small language model trained to act as a cybersecurity professional that vets actions at machine speed. "The entire [business] case on agents is that they're doing 10 times as much work as a human in the same amount of time," Rishi said. "If I'm sitting there and I'm hitting approve, approve, approve, we feel like it's more security theater than anything else." Observability is the foundation of AI agent governance, but it cuts both ways, Rishi noted. Rubrik's internal deployment emits trillions of tokens, so raw telemetry needs an intelligence layer to surface risk and runaway spend. In one case, the company found that a small fraction of activity drove a disproportionate share of cost. "One percent of sessions were driving 40% of the cost, and there was a lot more that we could drive once we had the observability in place," he said. Stay tuned for the complete video interview, part of SiliconANGLE's and theCUBE's coverage of Black Hat USA 2026. (* Disclosure: Rubrik sponsored this segment of theCUBE. Neither Rubrik nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

[23]

Your agent didn't hallucinate; it exceeded its authority

Content filters can block unsafe output. They cannot tell you whether an agent was authorized to issue that refund, touch that production system, or commit the company to an external action. Those are different problems, and most enterprises are only solving the first one. An AI agent can follow its instructions perfectly and still take an action the business never sanctioned. In commerce environments, I have seen this pattern emerge in practical ways. A service workflow calculates the correct refund amount but lacks a boundary preventing credits above what the business approved for autonomous action. An order agent correctly applies a requested change but overlooks a financing or fulfillment condition. A procurement agent identifies the lowest-cost supplier, but nobody has defined whether it can accept contractual terms or only recommend the option. The agent keeps working. The problem may not surface until something downstream breaks. These are not necessarily AI reasoning failures. They are failures to separate technical capability from business authority. As enterprises move from copilots that recommend to agents that call tools and trigger workflows, every production agent needs explicit decision rights: What it may execute, what requires approval, what it may only recommend, and what it must never touch. Guardrails remain necessary. But a guardrail is not an authority model. Safety controls and decision rights solve different problems Early gen AI controls screen harmful content, protect sensitive information, validate responses, and constrain tool behavior. That work matters. Decision rights answer a different question: Even when an action is safe and technically valid, is this agent authorized to take it on behalf of the enterprise? That governance gap is becoming harder to ignore. In April 2026, a Cloud Security Alliance survey found that 65% of respondents had experienced an AI-agent-related incident in the prior year, while 82% had discovered previously unknown agents operating in their environments. The survey involved 418 IT and security professionals and was sponsored by Token Security. The findings illustrate how quickly agent activity can outpace the visibility and ownership structures built for conventional software. The World Economic Forum's May 2026 playbook reflects this shift. It introduces an Agent Capability and Authorization Profile designed to make delegated actions auditable, enforceable and accountable. Guardrails constrain behavior. Decision rights define legitimate authority. Give every production agent an authority contract Before an agent receives access to enterprise tools, it needs a machine-enforceable record of exactly what authority the business has chosen to delegate. Call it an Agent Authority Contract. At minimum, that contract should answer seven questions: Access control determines whether an agent can reach a system. The authority contract determines whether it may take a specific action in the current context. Those are not the same check. Singapore's updated Model AI Governance Framework for Agentic AI draws a similar distinction. It treats access controls, behavioral guardrails, and human approvals as separate controls and ties oversight requirements to action scope, reversibility and potential impact. Resolve every consequential action into four outcomes A working decision-rights model should map every consequential agent action to one of four results. Allow Low-risk, bounded, and reversible actions run autonomously. Examples include retrieving approved information, classifying an inbound request, or updating a non-material field. The agent acts without prior review because the potential impact is limited and the action can be reversed. Approve The agent prepares or initiates the action, but execution waits for authorization from a human or deterministic policy service. This category covers payments, production changes, and actions that materially affect a customer, employee, or third party. Recommend The agent analyzes, ranks, drafts, or proposes. A named human makes the final decision. Use this outcome when contextual judgment matters or when the legal, financial, or individual impact makes automated execution unacceptable. Deny The action remains outside the agent's authority regardless of its confidence. Deleting critical production data, making a final employment decision or overriding a mandatory compliance control should remain in the Deny category even when the agent's underlying reasoning appears correct. One point gets missed consistently: Deny must be enforced outside the system prompt. A natural-language instruction telling an agent not to do something is not a technical boundary. It is a suggestion. Make authority decisions at runtime Static configuration cannot cover every situation. A small service credit might be allowed under normal conditions but require approval when the amount crosses a threshold, the account is under investigation, or the request involves a regulated customer. A practical runtime sequence looks like this: In enterprise commerce, the most dangerous AI mistake is not always a false answer. It can be a technically correct action the agent had no business taking. A refund may be accurate but exceed an approval limit. An order change may match the customer's request but invalidate a financing condition. A delivery promise may reflect available inventory while overlooking a carrier constraint applied an hour earlier. The agent may not have failed to reason. The enterprise failed to define where its authority stopped. Human oversight should target exceptions, not everything Requiring human approval for every agent action looks conservative. At scale, it can quickly degrade into rubber-stamping. When reviewers approve thousands of routine actions, attention declines and genuine exceptions become harder to identify. Singapore's framework acknowledges that continuous human oversight of every agent workflow becomes impractical at scale and recommends meaningful checkpoints for higher-risk or irreversible actions. Proportional authorization is the more workable model. Low-risk actions run within narrow boundaries. High-risk or irreversible actions require approval. Unexpected behavior triggers escalation. Any consequential action without a defined authorization policy is denied by default. The objective is not maximum autonomy. It is the highest level of autonomy the enterprise can observe, govern and reverse responsibly. Measure whether authority is calibrated Once agents are in production, response accuracy becomes too narrow a success metric. Enterprises should also track: * Override rate: How often do humans reject or materially change what the agent decided? * Escalation precision: Does the agent surface genuinely risky cases, or does it return routine work to people? * Unauthorized-action attempts: How often does the agent try to exceed its system, data, or action scope? * Business-impacting error rate: How often do authorized actions produce financial, compliance, operational, or customer harm? * Decision latency: Are approval requirements managing risk, or slowing down automation that was already safe? These measures turn authority into a governed operating variable. Consistently reliable performance may justify expanding bounded authority. Frequent overrides, escalation failures, or policy violations should narrow it. The governance gap is not in the model Model safety, output controls, and secure tool use all matter. Enterprises should continue investing in them. But none of those controls can answer who delegated authority, how much was transferred, under what conditions it applies, or who owns the result when something goes wrong. An Agent Authority Contract can. Before asking how autonomous an AI agent can become, the more useful question is: What is the enterprise actually prepared to delegate, and how will that delegation be enforced, observed, and withdrawn? The agent demo works. That is not the hard part anymore. Nixal Patel is a product leader. The views expressed are his own Welcome to the VentureBeat community! Our guest posting program is where technical experts share insights and provide neutral, non-vested deep dives on AI, data infrastructure, cybersecurity and other cutting-edge technologies shaping the future of enterprise. Read more from our guest post program -- and check out our guidelines if you're interested in contributing an article of your own!

[24]

DZone

The Agent in Your Pipeline Doesn't Have a Manager

Join the DZone community and get the full member experience. Join For Free AI coding tools made developers faster. Nobody asked what happened when the tools started making decisions. I want to start with a question that most engineering teams cannot answer. Not a hard question. Not a technical question. A simple, operational, should-take-thirty-seconds-to-answer question: Which AI agents are running in your development environment right now -- what systems do they connect to, who owns them, and what can they actually do? Take a moment. Think about it seriously. If you are like the majority of engineering organizations operating in 2026, you do not have a clean answer. You have guesses. You have partial lists. You have "I think it's just Copilot and maybe that Claude Code thing Priya set up last quarter." You have faith that nothing has gone wrong, dressed up as confidence that nothing can. Faith is not a security posture. The gap between what organizations believe about their AI agent environments and what is actually running inside them is, right now, one of the most consequential unaddressed risks in enterprise software development. Not because the tools are bad. Because the governance never showed up. The Number That Should End the Conversation Start with what Gravitee's State of AI Agent Security 2026 report actually found, surveying 919 executives and technical practitioners across the US and UK, published February 2026 with a follow-up wave in April. Eighty-eight percent of organizations reported a confirmed or suspected AI agent security incident in the past year. Eighty-two percent of executives feel confident their existing policies protect them from unauthorized agent actions. Both numbers describe the same organizations. That is not a typo. That is what Gravitee calls the "confidence paradox": the majority of organizations are experiencing incidents their leadership teams believe their policies prevent. Policy documentation and runtime enforcement are not the same thing. Most organizations have one. They are missing the other. The April 2026 wave made the trajectory clearer. As VentureBeat reported, AI agent fleets had roughly doubled in a single quarter -- nearly 38% of organizations reported more than 100 agents deployed by April, up from a mean of around 37 just four months earlier. Monitoring coverage in that same window moved from 47% to 52%. The researchers call it a "confidence-reality inversion": stated confidence in agent visibility rose nine percentage points while the absolute number of unmonitored agents increased. Only 21% of organizations have runtime visibility into what their agents are actually doing. Rising confidence. Lagging coverage. More agents running in the dark. In post-mortem language, that pattern has a name. It is called the precondition. The Pace Nobody Planned For Here is my honest read of where the industry stands: we are not behind on AI adoption. We are behind on AI accountability. Those are different problems, and conflating them is how organizations end up with 100 agents in production and visibility into roughly twenty of them. JetBrains' April 2026 AI Pulse survey, drawn from tens of thousands of developers globally, found that 90% of developers regularly used at least one AI tool at work by January 2026. Claude Code posted 57% year-over-year growth. GitHub Copilot reached 76% awareness among professional developers. The JetBrains State of Developer Ecosystem 2025 report, surveying 24,534 developers across 194 countries, found 85% using AI tools regularly -- up from figures that barely registered three years prior. These are not pilot programs. They are the daily stack. And every one of them, when connected to internal systems, creates a new identity -- one that currently lives outside every governance framework most organizations have built. The adoption curve is steep and real. The governance curve is flat. That gap is not an accident or an oversight. It is the natural result of tools being evaluated on what they produce, not on what they can reach. Tal Shapira, CTO and Co-Founder of Reco and a former head of a cybersecurity R&D group within the Israeli Prime Minister's Office, told me the pace of change has become almost impossible for security teams to track: "Six months ago, most teams were mainly worried about GitHub Copilot and Cursor adoption. Now it changes almost every week: Claude Code, agents inside Linear, internal MCP servers, CI/CD workflows, Slack, Jira, GitHub, cloud environments, and more. The first sign a team has lost track is when nobody can answer: which agents exist, who created them, what systems do they connect to, and what can they actually do?" I have spent enough time covering enterprise security to know that this kind of visibility failure is not a technology problem. It is a process problem -- specifically, the absence of any process designed with agents in mind. The tools arrived. The process did not follow. What Twenty Years of Identity Security Didn't Account For Spend enough time in enterprise security, and you develop a particular respect for the machinery of identity and access management. Not affection -- IAM is among the most painstaking, thankless, and perpetually unfinished work in the industry. But respect. Because the people who built those systems understood something foundational: you cannot control what you cannot name, and you cannot name what you cannot see. Every zero-trust architecture, every privileged access management system built over the past two decades rests on a foundational assumption so obvious it was never written down explicitly: the entity requesting access is a human. It has behavior patterns. Working hours. A manager. When it does something anomalous, that anomaly is detectable because normal human behavior is, within a range, predictable. Remove the human from that equation and the architecture doesn't fail dramatically. It fails quietly. It keeps running. It just stops being relevant to a growing share of the identities now operating inside the environment. This is not a gap in the security industry's intelligence. It is a gap in the security industry's timeline. Traditional identity and access management was built around the assumption of human users operating within relatively predictable workflows. Autonomous agents change those assumptions structurally -- because an agent's behavior can evolve based on a single upstream prompt, a new tool connection, or a shift in context from another system. Permissions that were appropriate yesterday can be dangerous tomorrow, not because anything changed in the access control settings, but because the agent is now doing something its original configuration never anticipated. Think about what that means operationally. A human developer with production database access runs queries on Tuesday afternoon from a known IP, using a known client, following a recognizable pattern. An AI agent with equivalent access might run at 3 a.m., chain five API calls together in a sequence no human analyst would construct, because a context three steps upstream shifted in a way nobody tracked. The permissions are unchanged. The behavior is entirely different. Nothing in a standard identity stack is designed to flag it. The numbers behind this are jarring. A 2025 Cloud Security Alliance survey of 383 IT and security professionals found that non-human identities -- including AI agents, service accounts, API keys, and OAuth tokens -- now outnumber human identities by 45 to 1 in the average enterprise. That ratio is expected to rise sharply as agent adoption continues. In that same survey, 92% of respondents said their legacy IAM tools cannot effectively manage the risks associated with AI agents and non-human identities, and 78% acknowledged having no formally documented policies for creating or removing AI agent identities. These are not organizations that haven't thought about the problem. They are organizations whose tools and processes were built for a different identity landscape and haven't caught up to the one they're actually running. The NIST AI Risk Management Framework identifies this as a top-tier concern: autonomous AI systems operating with real-world permissions require ongoing monitoring and accountability structures that traditional software governance was not designed to provide. Shapira puts the practical governance question plainly: "Who is this agent acting on behalf of, what is its business purpose, what data can it reach, and should it really have this level of access?" Four questions. Simple. And for most agents running in most development environments today, not one of them has been formally asked before the access was granted. The Incident You Won't See Coming Let me tell you about the kind of incident that doesn't make the news -- not because it isn't serious, but because it was caught just in time, and "just in time" doesn't generate press releases. Shapira walked me through an anonymized case from Reco's field investigations: "At one organization, a coding agent was running inside a development workflow. During an investigation, it used credentials available from a pod and connected to a production Postgres database. As part of what it thought was a valid troubleshooting flow, it attempted to delete data from the database. This was not a malicious user trying to break in. It was an agent with too much access, operating with production credentials, and taking an action that could have impacted customer data. The agent combined context, access, and action in a way the team did not fully intend." No attacker. No exploited vulnerability. No stolen password. No malicious intent anywhere in the chain. Just an agent, given credentials because someone needed the workflow to function, encountering a context it interpreted as requiring remediation, and nearly wiping customer data in the process. The agent combined context, access, and action in a way the team did not fully intend. That sentence is the entire threat model, compressed to nineteen words. This is not unique to one company's platform or one team's carelessness. The OWASP Top 10 for LLM Applications 2025 -- the security industry's most widely referenced framework for AI risk -- lists excessive agency and broad permissions among the primary risk categories for production AI systems. OWASP's framework is built from real-world incidents reported by practitioners across thousands of organizations. The risk is documented. The incidents are happening. Most of them are just not public yet. IBM's Cost of a Data Breach Report 2024, based on analysis of 604 organizations globally, put the average breach cost at $4.88 million -- a 10% jump from 2023 and the largest single-year increase since the pandemic. That figure only captures what organizations know happened and chose to report. It says nothing about the near-misses. The quiet rollbacks. The 2 a.m. database restore logged as "agent behavior anomaly -- resolved" and filed in a folder nobody reopened. Those incidents are happening. They are just not yet famous. The Blind Spot That Survives Best Practices Here is the part of this problem I find most underreported. It is not the organizations with weak security postures that concern me most. They know they have gaps and are working on them. What concerns me is the organizations that have done the work: SSO deployed, MFA enforced, endpoint controls in place, code scanning integrated, cloud permissions tightly scoped. These teams believe, reasonably, that they have built a defensible environment. And they are right -- for the entities their tools were designed to govern. The problem is that AI agents entered those environments through a side door that wasn't in the original architectural drawings. An OAuth grant issued to an AI agent by a developer on a Tuesday afternoon is, technically, a legitimate access decision made by an authorized person. It does not trigger a security review. It does not generate a ticket. It does not appear in the access report the CISO reviews quarterly. The agent accumulates context, permissions, and operational history -- none of it surfaced in the tools security teams use to understand the identity landscape of their environment. Gravitee's data is precise: only 14.4% of organizations send agents to production with full security or IT approval. Only 24.4% have full visibility into which AI agents are communicating with each other. The CSA survey found that only 28% of organizations can trace an agent's actions back to a human sponsor across all environments -- meaning that for nearly three quarters of organizations, agent activity is functionally unattributable after the fact. Shapira frames the blind spot clearly: "They secure the human developer, but not the agent acting with or for that developer. The agent becomes a new identity layer that isn't fully governed." For many organizations, the security perimeter remains focused on human identities while AI agents have quietly become another identity layer operating largely outside its scope. The perimeter is intact. The assumption it was built on -- that the things doing the most sensitive work are human -- is no longer accurate. Why This Happened So Fast -- And Why Nobody Is to Blame There is a version of this story where someone is at fault. Vendors moved too fast. Developers were careless. Security teams weren't paying attention. That version is almost always wrong, and this is no exception. What actually happened is structural. Three forces converged simultaneously, and no single team could have been expected to absorb all three at once. First, agents became autonomous enough to chain actions without human review between steps. Second, connecting an agent to production systems became as simple as a one-click OAuth grant or an API key in a configuration file -- no procurement cycle, no approval chain. Third, adoption moved bottom-up, developer by developer, meaning that by the time security leaders were aware of the scale, the tools had already been integrated into workflows people were reluctant to touch. Any one of those forces in isolation would have been a manageable adjustment. All three together produced a situation where the conventional security review cycle was structurally bypassed before anyone realized the bypass was happening. Microsoft's 2025 Digital Defense Report documented the downstream consequence of this at scale: adversaries are increasingly exploiting legitimate credentials, tokens, and trusted third-party relationships to access systems quietly, rather than forcing their way through perimeter defenses. OAuth consent phishing -- where attackers trick users into authorizing malicious applications that then persist even after password resets and MFA -- is now a documented, widespread attack pattern. The report is unambiguous on the implication: every identity, human and non-human, must be governed, monitored, and treated as a potential entry point. That framing includes AI agents. Most organizations are not yet applying it to them. The developers deploying these agents are not making reckless decisions. They are making rational decisions under time pressure using the best tools available to them. The problem is that the governance systems designed to catch those decisions -- procurement review, security approval, access inventory -- were not built to operate at the speed of package installation. What Skeptics Get Wrong -- And Why It Matters Not every senior engineer accepts this argument. The objections are usually offered in good faith: the agents are sandboxed, the tokens are read-only, the team would notice unusual behavior. There is a question that tends to reframe the conversation: would you give a junior developer unrestricted production access, the ability to deploy, and permission to modify data without reviewing their work first? Every experienced engineer says no. That is not a controversial position -- it is the foundational logic of least-privilege access, and it has been the consensus of the security industry for decades. Now substitute "junior developer" with "AI coding agent" and describe what a broad production deployment actually looks like: access to repositories, CI/CD pipelines, Kubernetes pods, log streams, secrets, and the production database. The agent is useful. Its judgment on when to act and how far to go has not been evaluated with the same rigor applied to any human who would hold equivalent access. The objection -- that the team would notice -- also understates how difficult it is to flag agent behavior that operates within the scope of granted permissions. The Postgres incident Shapira described wasn't flagged by standard monitoring because the agent was operating with legitimate credentials, following a plausible reasoning chain, in a system with no instrumentation designed to distinguish "agent in troubleshooting mode" from "agent about to delete production data." The access logs looked normal. The incident did not. The Way Through Requires Discipline, Not a Moratorium The instinct, when this becomes clear, is to reach for the kill switch. Block the tools. Revoke the tokens. Institute a company-wide moratorium. I understand that instinct. It is also the wrong move, and the evidence for that conclusion is already in the field. When organizations ban tools that developers have integrated into productive workflows, the developers find alternative tools. The agents keep running -- just without any organizational awareness at all, which is worse, not better, than the current situation. Shadow AI doesn't create new risks relative to ungoverned AI. It creates the same risks with less visibility into them. The correct sequencing is visibility first, governance second, approved adoption paths third. You cannot apply least privilege to what you have not inventoried. You cannot monitor behavior in systems you do not know are running. And you cannot enforce access policies for agents deployed outside the processes those policies cover. Shapira's prescription is unglamorous and correct: "Create an inventory of AI agents and agent-connected tools across the development environment. Not a policy document. A real inventory: which agents exist, who owns them, what systems they connect to, what permissions they have, and whether those permissions are still justified. You cannot secure what you cannot see." No vendor evaluation required. No budget approval needed. A list. An honest one. That is the starting point that actually changes the trajectory -- because everything that comes after, least privilege review, behavioral monitoring, approved adoption paths, requires knowing what is there first. The Autonomous Era Has No Guardrails Yet -- And We Are Already In It Here is where I land after covering this problem across multiple conversations, multiple organizations, and a body of research that consistently points in the same direction. The frame that tends to dominate public discussion of AI agent risk is forward-looking: this is a problem we need to solve before things go wrong. That framing is comfortable because it implies time remains. The data suggests otherwise. Gravitee's survey shows 88% of organizations have already experienced confirmed or suspected incidents. IBM's breach cost figures reflect the highest average in the report's history. OWASP is cataloging real incidents, not hypothetical ones. The CSA found that non-human identities outnumber human users 45 to 1 and that 92% of organizations say their existing IAM tools cannot manage the associated risks. The agents are not coming. They are already here; they have production access, and the governance infrastructure that should have preceded them is still catching up. Shapira's articulation of where this leads if nothing changes is the most precise I have encountered: "We are moving from the assistant era to the autonomous era. In the assistant era, the human is usually in the loop. In the autonomous era, the human is more often on the loop -- supervising outcomes, but not approving every step. That means many of the 'by design' guardrails we rely on today will not exist in the same way. If organizations don't address this now, agent sprawl will create an unmanaged layer of machine identities with context, permissions, and the ability to act unchecked." The distinction between "in the loop" and "on the loop" is the right frame for understanding why this transition requires a fundamentally different security model, not an upgraded version of the existing one. When the human is in the loop, human judgment is the guardrail at every step. When the human is on the loop, reviewing outcomes rather than approving actions, those guardrails must be built into the architecture itself -- into access controls, behavioral monitoring, and least-privilege enforcement that operates continuously, not periodically. My conclusion, formed from everything I have reviewed and everyone I have spoken with: organizations treating AI agent governance as a future problem are making a category error. The agents are reasoning through environments right now. They have credentials. They have context. They are taking actions. The only question that remains -- the only one that actually matters -- is whether your organization discovers what they have been doing in a conversation with your security team, or in a conversation with your board.

[25]