AI Agents Expose Critical Identity Security Gap as 69% of Enterprises Share Credentials

The Replicant in Your Directory: AI Agents and the Identity Security Gap

By Grady Summers, CEO, Netwrix Security was built for people. AI agents are exposing the gap. Forty-four years after Blade Runner imagined replicants walking among us, security teams are managing their own version of a non-human workforce. These replicants already have accounts, permissions, and access to sensitive data. They are AI agents, service accounts, OAuth applications, workload identities, and the growing number of machine identities that already outnumber people in many enterprise environments. That distinction matters because identity security was built around human behavior. People join companies, change roles, take vacations, and eventually leave. Those lifecycle events became the foundation of identity governance. Machine identities rarely follow that pattern. According to the Non-Human Identity Management Group, machine identities now outnumber human users by as much as 50 to one in many environments. Some exist for minutes. Others remain active years after the application or automation that created them has been forgotten. Most organizations still struggle to answer basic questions about who owns them, why they still exist, or what they can access. Trust scales faster than governance In 2025, a threat actor tracked as UNC6395 obtained an OAuth token associated with Salesloft's Drift chat integration and used it to move through Salesforce environments across hundreds of organizations. The token wasn't dangerous because it exploited a software vulnerability. It was dangerous because it was already trusted. From there, attackers reached AWS credentials, Snowflake tokens, and additional secrets stored where they shouldn't have been. One trusted machine identity became the path to several more. AI agents don't create this problem. They accelerate it. Organizations are deploying AI agents that create identities, inherit permissions, interact across systems, and expand the number of trusted credentials operating inside the environment. If security teams don't know those identities exist -- or don't understand what they can access -- the attack surface grows quietly in the background. Identity programs were built for people I've spent my career in identity and security, and identity was at the center of nearly every incident my teams investigated. Stolen credentials. Forgotten permissions. Access that outlived the employee or system it was originally issued to. AI isn't creating a new identity problem. It's exposing one that already existed. Human identity programs assume someone owns an account, reviews access periodically, and eventually removes it. AI agents don't naturally fit that lifecycle. They can be created automatically, inherit permissions from other identities, interact with systems at machine speed, and even create additional identities as they work. The result is an identity population growing faster than most governance processes were designed to handle. Visibility isn't enough Our 2026 Data and Identity Security Report found that organizations where AI significantly expanded the number of identities in their environment reported a 43% breach rate over the previous year, compared with 11% among organizations where AI hadn't significantly changed their identity footprint. The surprising part wasn't the breach rate. It was who got breached. Organizations where AI rapidly expanded identity counts generally reported stronger governance practices than their peers. They were more likely to monitor shadow AI, govern non-human identities, and maintain continuous visibility into sensitive data. They invested in the playbook. They still got breached. Security teams need continuous answers to four questions: What identities exist? Who owns them? What can they access? When should they no longer exist? Without those answers, every new AI deployment quietly expands the number of trusted identities operating inside the environment. The accountability question When an AI agent contributes to a security incident, who owns that identity? Who approved its permissions? Who reviews its access? Who decides when it should be retired? For a service account, there's usually a trail. For an agent operating at machine speed, creating downstream identities, and interacting across systems, that line back to a person can disappear quickly. Knowing where sensitive data lives is only half the equation. Knowing every identity that can reach that data, maintaining a current inventory, and ensuring each identity has a clear owner is the other half. The trusted identities that matter most aren't always the ones security teams are watching. Increasingly, they're the ones nobody remembers creating. To learn how organizations are adapting identity security for AI, read the 2026 Data and Identity Security Report.

Why AI coding agents keep stalling before production and the governance controls that fix it

Across 100 engineering organizations, 61% already run AI agents. Yet almost none trust them enough to bring them into production. There are a few reasons for this. Firstly, agents are prone to making mistakes that humans know to avoid through experience. They move at a much faster pace, and by their nature operate autonomously. If something goes wrong, there's often no audit trail or visibility into what they are doing across the organisation. This is problematic when a rogue agent inevitably leaks credentials, hits unauthorized repositories, or burns through cloud budget before anyone notices. This unreliability is why most organizations keep agents away from anything that matters. However, the real problem is not the agents. It's the absence of governance around using them. The controls already exist, and have for a long time. They are the same principles that have been applied to human engineers for years: minimal privileges, audit logging, identity management, and scoped access. Though familiar, companies struggle to apply these fundamental rules. To ensure organizations get off to a good start with deploying AI agents, they should implement three simple governance controls: isolate, scope, and approve. Isolate by default Start with isolated, ephemeral workspaces. Every task that is spun up from a clean template should be erased the moment it is completed. No shared state or bleeds between runs. This means that should something go wrong, the damage will be confined to that task, and nothing beyond it. Then from that workspace, all agents should have zero outbound access by default. Not limited. Zero. An explicit 'allowlist' then defines exactly which domains, methods, and paths an agent can touch. Everything else gets blocked. And even with narrow access, sensitive systems such as GitHub or Salesforce should get read-only access also. Your agent is in an isolated workspace. Network connectivity is limited. Now it's time to control tool calls. Model context protocol (MCP), for instance, is how agents invoke external tools, including file systems, databases, and APIs. Without airtight guardrails, an agent can reach any MCP server available to it. The danger is that this is a significant and largely invisible attack surface. Proxies that sit in front of those tools allow administrators to define an approved list, filter at the per-tool level, and log anything that tries to reach outside the boundary. Scope permissions and real-time monitoring Even a well-isolated agent can cause problems if it's running with more permissions than it needs. Agents should never inherit a user's full credentials. API keys should only carry the permissions required for that specific task, and nothing more. In addition to scoped identities, there must be clear visibility. Streaming every request through real-time monitoring and alerting teams when an agent makes 10x its typical API calls, contacts a new domain, or starts burning tokens unusually fast will provide timely, and actionable signals. Identity-aware LLM routing ties it all together. Authenticating users through existing SSO, and routing all model requests through centrally managed keys solves the problem of API key sprawl. Without this measure of control, hundreds of loose keys with no attribution or clear revocation path quietly accumulate. Approve agentic tasks with a human in the loop Think of an agent as a talented junior employee. High output, eager to help, but not yet trusted to push to production unsupervised. AI agents should generate output but not decide what ships. This is where human approval gates, backed by existing role-based access controls, come in. Humans must be held mutually accountable for their agent's output. This is as much a mindset as a technical control. However, there is one area where you should assist human oversight: model selection. Not every task should go to the same model. For example, regulated data has different requirements than content generation. Routing by policy ensures that compliance requirements are met without relying on individual developers to make the correct call every time. Full audit trails make the whole lot accountable. Every prompt, every tool call, every model interaction should be mapped to an authenticated identity and exportable to whatever observability stack is already in place. It should always be clear which authenticated user sent which prompt to which model, and why. Embed governance in your infrastructure, not your apps Overall, the goal is to empower organizations with the confidence to deploy their AI agents safely without slowing down their developers, agents or the business. Ensure this happens by laying down a governance layer to make AI agent adoption sustainable. But there's a catch. Implement governance at the infrastructure layer. There are two reasons why. Firstly, it avoids duplicating policy for every AI stack you deploy. Secondly, it ensures a consistent governance across a very fast-changing world where agents, models, and harnesses will leapfrog each other monthly. You do not want to rewrite governance policies at the pace of AI change. Done right, infrastructure-lever governance makes AI production ready. Security teams with visibility over what agents are doing will be more inclined to approve more, compliance teams with clear audit trails will sign off faster, and developers who trust the guardrails will be able to push further. Those enterprises that build in governance now will not just have better security posture, they'll outpace competitors waiting for sign-off to run their first pilot. We've reviewed and ranked the best small business software. This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

69% of enterprises share AI agent credentials | VentureBeat

Share one API key across five AI agents, and a single compromised agent inherits the reach of all five. The attacker immediately benefits from the accumulated permissions of every workflow that the key touches. The forensic trail goes cold at the credential level because five agents on one account leave no record of which agent did what. Sixty-nine percent of enterprises run agents with credential sharing somewhere in their deployments, according to VentureBeat's June 2026 Pulse Research wave of 107 enterprises. That one number explains the buying spree reshaping enterprise security this year. Palo Alto Networks, CrowdStrike, and Cisco have collectively bet more than $22 billion on it in the past year, targeting exactly the layer most enterprises in this survey haven't finished building. Palo Alto Networks completed its acquisition of CyberArk on February 11 for $21.1 billion in total consideration at close -- a deal it announced last July at roughly $25 billion and the largest in the company's history. CrowdStrike closed its $740 million acquisition of runtime authorization platform SGNL and, by June 15, shipped the first product from the deal, Continuous Identity for AI Agents. CrowdStrike integrated SGNL in less than a year, delivering a product that validates every agent action in real time based on who owns it, who is calling it, and the device's risk posture. Cisco announced its intent to acquire non-human identity specialist Astrix Security on May 4 for a reported $400 million. For a security director, this survey reads as a board-level question, not a trend line. It also surfaces a finding no competitor's data shows, one that exposes which companies are the most at risk. The data below is the first look at VentureBeat's Q2 Agentic Security report, drawn from 107 qualified respondents at organizations with more than 100 employees. The full report will be released to attendees at VB Transform, the event in Menlo Park next week (July 14-15) focusing on enterprise autonomous agents. Forty-five percent are final decision-makers for AI purchases. The sample skews mid-market, so read the numbers as the view from organizations adopting agent security right now rather than from the largest enterprises. More than half of respondents, 54%, have already had an agent security incident or near-incident. Eighteen percent confirmed an incident, and thirty-six percent caught a near-miss before a breach. Security teams are stopping most of these events at the last control point in the chain, but the rest of the data shows how thin that margin is. Your agents are sharing credentials Only 32% of enterprises give every AI agent its own scoped, managed identity. Nearly half (48%) report that some agents have scoped identities, while many still share credentials. Another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. The survey question allowed more than one selection, and 24 of the 107 respondents chose multiple options -- which is why the three categories sum to 112%. Deduplicated by respondent, 74 organizations, or 69%, flagged credential sharing in at least one answer. One number explains why the acquisitions target this layer. A shared credential converts a single compromised agent into many, and CyberArk's research puts machine identities at 82 for every human in organizations worldwide, with agents as the fastest-growing category of the ratio. Cisco made the same diagnosis when it bought Astrix, whose founders built the company around API keys, service accounts, and OAuth tokens. Cisco's announcement calls those the credentials AI agents are now "using (and abusing)" to execute work at scale. Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, described the mechanism directly in an interview with VentureBeat. Some AI systems have their own identities, he said, and in other cases "people give their identity to the AI to take action on their behalf, and that also further kind of murkies the water and makes it very complex." The murk is the point, because when the identity is shared, attribution dies with it. Exposure scales with size, and containment does not Forty-nine percent of enterprises enforce scoped permissions at runtime, and 47% monitor and log agent activity, which can help reduce security incidents. Only 30% sandbox their highest-risk agents, the one control that limits blast radius when the first two fail. Isolation is what keeps a single compromised agent from becoming a deployment-wide event. Enterprises have funded detection and resistance, but the containment layer barely exists. The sharpest finding in the survey, and the one no vendor report captures, shows up when you split results by company size. The incident rate is 49% for companies with 101 to 1,000 employees, but it shoots up to 63% for companies with more than 1,000. Sandbox isolation moves the other way, falling from 35% to 20% at the larger companies. The chart above shows the same finding at finer granularity: the 49%/63% split above is a binary cut at 1,000 employees, while the bars here break incident rate and isolation rate into four size bands. The red line measures incidents and near-misses, and the navy tracks the one control that contains damage after everything else fails. At organizations with 101 to 250 employees, the two sit 7 points apart, but above 5,000, the gap blows out to 60 points. That top band pools the survey's two largest size groups and holds only 15 respondents, so treat the number as directional. Larger enterprises run more agents across more systems, which drives incidents up while sandboxing, the engineering project that would contain them, goes unfunded. The enterprises with the most agents have the least isolation around them. The deals target exactly those accounts. Palo Alto Networks, Cisco, and CrowdStrike sell to large enterprises first, where incident rates are highest and containment is the thinnest. Guarded by whoever shipped the model The model providers are the security layer. OpenAI's built-in guardrails lead at 51%. Google Cloud reaches 36%, Microsoft Azure's Purview and Copilot Studio DLP 35%, and Anthropic's managed-agent controls 29%. Eighty-two percent of respondents name a provider-native or hyperscaler control as their single primary agent security layer. The purpose-built specialists are in single digits, with Palo Alto Networks' Prisma AIRS at 7%, CrowdStrike at 6%, and Okta for AI Agents at 4%. Zenity and the dedicated non-human identity platforms are at 3% each. Microsoft Entra Agent ID is the highest-penetration identity-specific control in the dataset at 13%, the only one from a hyperscaler, and it still falls outside the top four. Only 5% of enterprises run no dedicated agent tooling at all, and the rest have tooling that came pre-installed. Bundled controls lead because they ship free and are enabled by default. Most filter prompts and outputs, but they do not give an agent its own identity or sandbox it. Hyperscalers sell identity-layer products, and Entra Agent ID is in the dataset at 13%, but adoption stays low. The two controls that reward incident data the most, scoped identity and isolation, are the two that the default stack does not include. Prompt-and-output filters evaluate whether a call looks malicious. That is an intent problem, and intent cannot be solved at the language layer. CrowdStrike CTO Elia Zaitsev drew the line in an interview at RSAC 2026. "Observing actual kinetic actions is a structured, solvable problem," Zaitsev said. "Intent is not." CrowdStrike's Falcon sensor walks the process tree on an endpoint and tracks what agents did, not what agents appeared to intend. A scoped identity and an isolation boundary give that sensor something to track, while a shared credential on a bundled guardrail does not. Cloud security went through the same cycle a decade ago, and Palo Alto Networks, CrowdStrike, and Wiz built multi-billion-dollar businesses on the gaps native cloud controls left open. Agent security is tracking the same path faster. A misconfigured storage bucket sat open until a human noticed. A misconfigured agent exploits its own over-permissioning on every run, and no human is watching when it does. Merritt Baer, chief security officer at Enkrypt AI and a former deputy CISO at AWS, told VentureBeat that the default layer is thinner than enterprises assume. "Enterprises believe they've 'approved' AI vendors, but what they've actually approved is an interface, not the underlying system," Baer said. "The real dependencies are one or two layers deeper, and those are the ones that fail under stress." Comfortable, unconvinced, and already shopping Here is the contradiction worth a keynote slide. Enterprises rate their agent security tooling 4.2 out of 5, with value for money at 4.1 and ease of implementation at 3.9. Those scores would make most SaaS vendors envious. Only 35% believe their AI-enabled defenses are ahead of AI-enabled attackers, while thirty-two percent call it roughly even. Twenty-one percent say attackers lead, and another 21% say it is too early to tell, showing how enterprises trust their tooling more than they trust its outcomes. Budgets confirm it. Forty-six percent allocate 6 to 10% of the security budget to agent security, and a full third spend 5% or less. Half the sample has already had an incident or near-miss, but the funding does not match the exposure. Fifty-nine percent plan to adopt, add, or replace agent security tooling within 12 months, and twenty-nine percent plan to move this quarter. OpenAI leads forward interest at 34%, followed by Google at 30%, Anthropic at 29%, and Azure at 25%. The dedicated vendors draw more interest looking forward than their current single-digit footprint suggests. Satisfied customers do not reshuffle this fast unless they know the stack they're currently using is provisional. Three moves for security directors 1. Inventory every agent's credentials this quarter. Map which agents share credentials with other agents and which run on borrowed human or service-account identities. The goal is not one credential per agent. Agents that touch multiple systems need multiple scoped identities. The goal is zero shared credentials between agents and zero borrowed human identities. Thirteen percent of surveyed enterprises already run Microsoft Entra Agent ID. Okta for AI Agents and the non-human identity specialists sell equivalents. Shared and borrowed credentials are the first thing to eliminate. 2. Sandbox the riskiest agents first. Isolation is the least-adopted control at 30% and the only one that contains blast radius after prevention fails. Rank agents by the sensitivity of what they touch and isolate the top of the list. Above 1,000 employees, where isolation falls to 20%, this is the single highest-return move in the dataset. Sandboxing does not require replacing the agent or the platform. It requires a policy decision and an isolation layer. 3. Match the budget to the incident rate. A third of enterprises fund agent security at 5% or less of the security budget, even though more than half have already had an incident or near-miss. Nine percent allocate more than 25% today. The full report breaks out exposure and containment by company size, showing which bands carry the most risk and the least protection. The board's question is simpler. If one of our AI agents was compromised this afternoon, which systems did it touch, and whose credentials was it holding? For the 69% of enterprises running agents on shared credentials, the answer is a shrug. The trail goes cold at the key. The full Q2 Agentic Security report, with the complete vendor matrix, industry cuts, and the full dataset behind these charts, debuts July 14 and 15 at VB Transform, held at Hotel Nia in Menlo Park. The open question it leaves is whether enterprises close the agent security gap on their own terms, or whether a confirmed breach closes it for them.

The AI security paradox: Why are organizations trusting what they can't fully see?

Businesses are racing to adopt and operationalize AI, but many are deploying the technology faster than they can govern it. This gap is quietly becoming one of the biggest security risks facing enterprises today. AI agents are being embedded into everyday workflows as teams chase efficiency gains, and organizations are under increasing pressure from boards and senior leadership to automate processes faster. However, beneath this perceived momentum sits a more uncomfortable reality: businesses still have limited visibility into how these systems behave once deployed. Security teams need to take a step back and rethink what proper governance looks like in a world where AI systems operate with autonomous access, inherited permissions and limited visibility. Confidence is outpacing verification Understandably, many businesses view successful AI deployment as evidence that they are ready to scale AI across their business. Recent research found that 87% of organizations believe their identity management posture is prepared to support AI-driven automation. Yet, at the same time 46% admit that their identity governance falls short. This contradiction sits at the core of the AI security paradox. The core problem is that organizations are granting AI systems increasing levels of access and autonomy before they have established clear ways to monitor or verify how these systems behave. If nobody can explain why an AI agent took an action, the permissions it inherited, the systems it accessed and whether or not that behavior was actually intended, governance quickly becomes reactive rather than preventative. AI agents undermine traditional identity governance foundations Unfortunately, securing these new AI identities won't happen overnight, as legacy governance models simply aren't cut out for the challenges facing security teams today. Traditional identity management was built around four key assumptions: predictable behavior, human intent and bounded permissions. Agentic AI changes all four. Security teams already understand the risks of AI agents and non-human identities. The problem is that operational realities are forcing many organizations to accept those risks regardless. Research shows that 73% of organizations believe standing access for AI agents increases security risk. In other words, leaders recognize the dangers associated with giving AI systems privileged access, but feel under pressure to prioritize speed and operational efficiency anyways. Crucially, the governance issue extends beyond risk. The fact that 80% of organizations said they cannot always determine why an AI agent took a privileged action suggests a fundamental issue. That creates an entirely different governance challenge from one that ever existed in traditional identity management. Humans can typically justify intent, context or decision-making -autonomous systems can't. Shadow AI is becoming operational infrastructure AI usage in the workforce has long moved on from a select few employees experimenting with ChatGPT. Now, the technology is deeply woven into production systems, workflows and enterprise data. The scale of the problem is significant - 53% of organizations say they regularly encounter unsanctioned AI tools or agents accessing company systems or data, but only 28% can detect shadow AI in real time. In reality, businesses are effectively allowing unknown contractors to roam freely through their corridors, with limited insight into where they're going, what they're doing and what they have access to. This shift is forcing organizations to rethink traditional security priorities and focus on continuous monitoring and validation. As a result, businesses need to begin focusing on how effectively they can monitor and verify what their AI systems are accessing, and whether that access is still appropriate. Solving the governance contradiction We know that organizations can't afford to slow down on AI adoption given the competitive and operational incentives. But they also can't afford to expand AI access and permissions faster than they can secure them. This means bringing identity security to the forefront of AI governance strategies. Much of the discussion around AI risk still focuses on models, regulation and data privacy and those issues are important. But the true operational challenge increasingly sits between inherited permissions and unmanaged trust between systems. For business leaders, the first priority should be improving visibility rather than adding more controls. They need to understand which AI identities exist within their organisation, what systems they can access, how permissions are inherited and where standing privileges have accumulated over time. Organizations will also need to move away from persistent privilege models towards more dynamic models that provide temporary access only when required. Ultimately, the organizations that will reap the greatest rewards from AI will be the ones that can understand, govern and validate the systems they use. Deploying automation as fast as possible may lead to some quick wins, but doing so without the right governance measures in place could come back to haunt you. We've reviewed and ranked the best firewall software. This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

AI has collapsed the cyber response window -- resilience now starts before the attack

Enterprise cybersecurity is facing a fundamental speed problem. Frontier AI models are now enabling autonomous attacks that can move from initial access to full system breakout in as little as 27 seconds. That's faster than any human-operated security workflow can detect, escalate, and respond. As a result, security operations can no longer assume there is time for humans to respond between breach and damage. The security posture that enterprises need for the AI era centers on cyber resilience: continuously identifying clean recovery states, mapping critical data and identity dependencies, and automating restoration so that operations can recover in hours not days. "Everything that relied on process or human-in-the-loop intervention is no longer going to be able to execute at the speed of the attacks," says Dev Rishi, GM of AI at Rubrik. "If the attacks are happening in 27 seconds, it means I need my recovery to happen just as quickly." Traditional detection and prevention are failing against AI-driven attacks The rules-based logic that has defined enterprise security for decades, such as static access controls, known signature detection and deterministic behavioral policies, was engineered for deterministic software. AI agents behave differently. They're non-deterministic, capable of pursuing the same objective through many different paths, and increasingly capable of circumventing static guardrails by finding alternative routes when one is blocked. The deeper problem is that conventional security logic checks identity, permissions, and access, and asks whether each individual access is permitted. But it can't evaluate whether a sequence of permitted actions, taken across multiple applications, constitutes either a data leak, a destructive operation, or an attack. "You need a system that can understand context," Rishi says. "You need to use AI to look at what an agent is doing and say, 'it looks like what you're doing might be a risk of leaking sensitive data externally.'" How AI agents are blurring the line between internal and external cyber threats Enterprise security has historically maintained a meaningful distinction between external and internal threat vectors. External threats can be multidimensional, lightning fast, and come from a variety of vectors. On the other hand, internal threats were traditionally bounded by what a single human actor could accomplish before detection, constrained in speed, scope, and scale, but that distinction is falling apart as AI agents operate inside enterprise environments. These agents have access to multiple systems simultaneously and move at speeds no human employee can match. When an agent makes a mistake, such as a hallucination, misread instruction, or an unintended data transfer, the resulting damage can look operationally identical to a malicious insider attack. And when an external attacker compromises an internal agent, they inherit its full access profile across every connected application. "Whether or not the agent is an internal threat because of an inadvertent mistake or because it's been maliciously compromised, you need runtime guardrails that enforce your organizations policies consistently across agents," Rishi says. "The practical answer is an AI-native guardian layer that monitors agent behavior semantically, understands intent across actions, and can block or terminate a misbehaving agent at machine speed, then trigger recovery immediately." Preparing for a world of inevitable compromise Frontier AI models, including those capable of discovering and operationalizing zero-day vulnerabilities autonomously, are changing the economics of attacks. As a result, interest in Mythos readiness is growing. Enterprises are increasingly operating under two assumptions: that attacks are inevitable, not exceptional, and that investment in resilience and rapid recovery must be treated as strategically as investment in prevention has been. The shift reframes recovery from a post-incident activity into a capability that is deliberately designed, tested, and continuously validated. "The idea that you can recover quickly from an attack is going to become one of the most important facets of security," Rishi says. "It's the insurance policy that organizations now have to treat as a first-class citizen." Why AI-powered cyber resilience depends on small models True cyber resilience is a two-sided coin: it demands both real-time intelligent enforcement to intercept threats in motion, and automated recovery to restore operations immediately. While having backups is a baseline, organizations need workflows that can continuously monitor systems at machine speed, and instantly determine the most recent clean state under attack conditions. Applying AI to the first half of that equation -- real-time enforcement -- creates a fundamental technical and economic challenge. Relying on massive frontier models to monitor every agent action introduces crippling latency overhead and exorbitant computing costs. A guardian AI system that slows down operations or costs as much as the systems it monitors is simply not viable for widespread adoption. "It has to be a fast, small, and cheap AI model," Rishi says. "No one wants to sign up for a secure solution that doubles their cost or latency." This is why small language models (SLMs) are critical for real-time enforcement. Rubrik's approach, anchored by its acquisition of Predibase, is to build this frontline defense layer on small models optimized specifically for speed and efficiency. Unlike heavy frontier models, SLMs can semantically evaluate agent behavior at machine speed and at a fraction of the cost, acting as a real-time checkpoint. That hyper-efficient enforcement layer is what enables a tighter, seamless connection to recovery. When the system observes an agent taking a destructive action -- such as deleting a database, corrupting a critical file, or exfiltrating sensitive data -- the small model detects it immediately, halts the damage, identifies the most recent clean snapshot from before the incident, and initiates recovery in a single, automated workflow. The shift from incident response to architectural resilience The broader implication of Mythos and similar frontier AI systems is a shift in how organizations think about security. As AI compresses the gap between attack and impact, resilience and recovery become architectural requirements rather than operational considerations. Rubrik's view is that security systems can no longer stop at detection. As AI agents gain greater autonomy, observability, identity context, and recovery must operate as a coordinated resilience layer. The goal is not simply to identify when something has gone wrong, but to shorten the gap between detection and restoration. "The same thing that's introducing the threats, the frontier capabilities of models like Mythos, can also be used to help us combat the threat," Rishi says. "Positioning yourself for the AI era means closing the gap between detecting that something has gone wrong and restoring the systems that were affected, before the cost of that gap compounds." Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they're always clearly marked. For more information, contact [email protected].

Anthropic's Mythos leak hands enterprises a timely warning

What governance actually needs to look like to keep pace with AI Anthropic's Mythos Preview had barely been announced before it was compromised - accessed by a private Discord group on the day of its public release through a third party vendor environment. For a model distributed across 40 companies and their associated contractor networks, the breach was, to many security experts, a matter of when. Anthropic is not an outlier - the conditions that enabled the breach are structural, and most enterprise AI deployments are built on the same foundations. The enterprise reality - capable agents, variable controls Most enterprise AI deployment is neither centralized nor consistently visible. Capable AI agents are already embedded in production workflows across most large enterprises - accessing live systems, informing decisions, operating across vendor and contractor networks where boundaries such as what agents can see, act on and escalate may not have been formally mapped. The Mythos investigation has brought attention on what happens when powerful AI operates without proper governance. With only one in five enterprises holding a mature governance model for autonomous agents despite deployment accelerating sharply across the same period, the control plane governing those deployments is more likely to exist in strategy decks and risk frameworks than in tested, operational infrastructure. For enterprises, the question is what the control plane governing those agents actually looks like in policy, architecture and operational practice. Four governance imperatives for agentic automation The Mythos breach was enabled by failures across vendor access, identity controls and contractual oversight - the same pressure points that determine whether any enterprise agent deployment is auditable, recoverable and regulatorily defensible. Getting ahead of them requires focus on four areas: * Access control and least privilege - Define exactly what an agent can touch. Agentic systems should never inherit blanket privileges. Apply role-based and context-aware access controls so agents operate with the minimum permissions required for a task. Treat agents like employees - with identity, just-in-time access and revocation mechanisms. * Auditability and decision traceability - If an agent acts, you must be able to reconstruct why it did so. Capture inputs, model versions, prompts, intermediate reasoning artifacts and the final actions. Immutable logs and explainability tooling convert opaque outcomes into auditable trails that satisfy internal compliance teams and external regulators alike. * Human-in-the-loop and fail-safe controls - Design where humans must intervene, and where agents can act autonomously. For high-risk decisions institute gating workflows - pause points, manual approvals and automated rollback options. Ensure operators can pause or reverse agentic actions and that escalation paths are well rehearsed. * Supplier and model provenance - Know what you consume. Whether you use third-party APIs, licensed foundation models or internally trained agents, document model lineage, training data assumptions, performance boundaries and known failure modes. Contracts and SLAs should require transparency, update cadences and liability clauses for material failures. Governance is not a speed bump - it unlocks speed Most organizations have assembled controls reactively, after a deployment has scaled or after something has gone wrong, at which point the cost of remediation consistently exceeds what building it in from the start would have required. The Financial Stability Board's engagement with Anthropic this month - convened at the request of Bank of England Governor Andrew Bailey - signals how quickly regulatory expectations are forming around AI governance, and how little runway organizations have to get ahead of them. Procurement cycles move faster and regulatory conversations are considerably less fraught for organizations that can demonstrate auditable controls before they are asked to. From reaction to readiness Mythos, in the classical sense, is the story a culture tells about itself. It will not be the last model to escape its controlled environment, and the conditions that enabled the breach will only become more prevalent as agentic AI moves from experimentation into production across enterprises. Anthropic's choice to withhold Mythos underscores a simple truth: capability outpaces governance. The story most enterprises are currently telling about their AI governance doesn't yet match the reality of what they've deployed - and that distance is closing faster than most have planned for. But it should not provoke panic. Running controls through simulated breach conditions, mapping agent access across the full estate, and requiring contractual transparency from vendors is where that work begins - before the next breach makes it urgent. We've featured the best AI tool. This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Understanding cyber resilience in the age of internal threats, AI, and emerging data loss risks

Human error, insider threats, and AI reshape cyber resilience External cyberattacks, especially ransomware, are now viewed as a matter of when, not if. It's no wonder they dominate cybersecurity discussions and make frequent headlines. IBM's 2025 Cost of a Data Breach report found that the average global cost of a data breach stands at $4.4million, underscoring why the threat of an attack keeps business and IT leaders up at night. But they represent only one side of the data risk landscape. What's less understood and often underestimated are the internal threats that can be just as disruptive and damaging. From simple employee errors to deliberate insider actions, and even the unintended consequences of generative AI tools, these risks pose serious challenges for every organization's data security strategy. Human Error and Malice Human error remains one of the most persistent vulnerabilities in cybersecurity. In fact, 2024 research found that the human element played a role in 68% of breaches, ranging from simple mistakes to social engineering and misconfigurations. Ignoring this reality leaves a critical gap in any security strategy. Human error isn't the only internal risk. Insider threats - both intentional and negligent - represent a growing portion of today's breach landscape. In fact, 83% of organizations experienced at least one insider-related incident last year. Whether it's a disgruntled employee exfiltrating data or a staff member mistakenly over-provisioning access, incidents involving trusted credentials are notoriously difficult to detect and recover from. Whether it's accidental human error or deliberate insider attacks, the first step to reducing these types of risks is to acknowledge that the weakest link in any cybersecurity chain is people. Even the most advanced internet security infrastructure can be compromised by a single careless mistake or a trusted user with bad intentions. Creating a culture of continuous education mixed with accountability can mitigate some of these threats. Reducing privileged access to only what is necessary can also significantly lower the risk of employee caused data leaks. However, organizations should always assume that human errors will occur and prepare accordingly. User and Entity Behavior Analytics (UEBA) plays a critical role in identifying suspicious activity that may indicate insider threats. By flagging anomalies such as unexpected data transfers or unusual access patterns, UEBA enables security teams to respond swiftly before significant damage occurs. Just as important is having strong technical safeguards in place. These act as a critical safety net when human controls fail. For example, it's important to verify that automated backups are running efficiently and include all data sources, such as cloud applications and endpoints. This can ensure that no critical data is left unprotected or overlooked in the event of a disruption or breach. These backups need to be immutable and tamper-proof, so that even a rogue insider cannot alter or delete recovery points. The AI Conundrum While AI promises a boost to productivity and innovation, it also brings with it new threats. As an example, the rise of AI co-pilots and agents in various workflows such as coding, writing and data analysis widens the attack surface. For AI to operate efficiently, it requires access to sensitive internal data such as documents and proprietary systems, which means that the slightest oversight in access permissions and data governance can severely cost an organization. This is not going unnoticed. The U.S. National Institute of Standards and Technology (NIST) states in its AI Risk Management Framework that AI models may "leak, generate, or correctly infer sensitive information" even data not explicitly included in the input, through memorization, adversarial attacks, or by combining disparate sources. This concern is echoed in the private sector, with over 80% of security leaders expressing concern that generative AI could leak company secrets, and security experts warning that only 24% of generative AI initiatives are fully secured. Furthermore, a staggering 90% of organizations report a lack of adequate security standards to defend against AI-centered threats. Gartner predicts that by 2027, more than 40% of AI-related data breaches will be caused by the improper use of generative AI. So how can enterprises continue to implement the evolving world of AI into business processes while ensuring it doesn't open the door to a bevy of cyberattacks? The first step is to treat AI agents as part of the threat model. The same security principles that are often implemented to traditional IT environments need to be applied to AI implementation - zero trust, data minimization, encryption, segmentation, etc. AI agents need to be viewed as tools with privileged access, and handled accordingly. The data that is being fed into these AI agents needs to be reviewed and cleaned-up, including removing outdated or overly sensitive files from training sets and ensuring only approved data sources are utilized. Close monitoring and keeping a log of all AI interactions is also critical. This needs to be detailed enough to enable an audit trail that can help to detect potential abuse or oversharing of confidential data. To reduce the risk of human error, AI guidelines should also include security awareness training so that employees can understand that AI agents are not sandbox environments, and any sensitive data could be logged, stored, and in the worst-case scenario, shared. Immutable Backups Delivered as a Managed Service While the threat landscape continues to expand, the reality is clear - no security stack is impenetrable. Cybercriminals will always search for new angles, whether through ransomware, insider threats, or AI-driven exploits. That's why true resilience depends not only on prevention but also on the ability to recover quickly and confidently when defenses are breached. Immutable backups, delivered as a managed service, provide that safety net. Unlike traditional backups that can be corrupted, deleted, or encrypted by attackers, immutable backups are unchangeable and tamper-proof. By layering this with 24/7 monitoring, expert management, and tested recovery processes, a managed service ensures that recovery points remain secure and always available. This approach dramatically shortens downtime, from days to hours and removes the operational burden from internal IT teams who may lack the time or expertise to manage complex recovery environments. Looking for the best cloud backup? This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

AI Agents in Enterprise IT Need Operational Guardrails, Not Just Policy Controls

The moment an AI agent can restart a service, change a configuration or trigger a workflow, it stops being software that assists and becomes something enterprises have spent a decade learning to govern: a privileged identity operating inside production. Most organisations have not made that mental shift yet, and it is the shift that matters most. For years, automation executed predefined workflows, reduce repetitive tasks and improve operational efficiency. AI agents are a different proposition. They interpret information, analyse situations, recommend actions and, increasingly, execute those actions on behalf of human teams. The opportunity is real; faster incident resolution, stronger service management, patterns surfaced across complex environments that a human team would never catch in time. But the interesting question is no longer whether agents are capable enough. It is whether enterprises are prepared for the responsibility that comes with deploying them. The distinction between an AI assistant and an AI agent is where that responsibility begins. An assistant that analyses a ticket, summarises information or recommends a possible solution creates limited operational risk. An agent that can modify configurations, restart services, initiate workflows or interact with production environments operates with a completely different level of consequence. A wrong recommendation may require additional human review. A wrong action inside a live enterprise system can result in service disruption, security exposure or compliance challenges that organisations must address. This is where the difference between policy controls and operational guardrails becomes important. Policies define what an organisation expects an AI system to do. Operational guardrails define what the system is technically capable of doing. In enterprise IT environments, this distinction is crucial. A policy may state that an AI agent should not make unauthorised production changes, but only technical controls can ensure that the agent does not have the ability to perform those actions in the first place. Most enterprises are still evaluating AI agents through the lens of productivity. They measure tickets resolved, issues identified, manual effort reduced. Those numbers are easy to celebrate and easy to mistake for the whole story. The question they skip is the one that actually carries risk: what level of access did the agent need to produce that outcome? Enterprises have spent years strengthening identity and access management practices for employees, applications and systems. AI agents need to be brought into the same discipline. The first requirement for trustworthy AI agents is scoped access. AI agents should receive the minimum permissions required for the specific task they perform. An agent responsible for categorising incidents does not need access to production configurations. An agent recommending remediation steps does not necessarily need the ability to implement those changes independently. The principle should be clear: autonomy should expand only when organisations have confidence in the controls surrounding it. The second requirement is auditability. Traditional automation systems generally follow predictable, deterministic workflows, making it easier to understand what actions were performed and why. AI agents introduce a more fundamental challenge: non-determinism. The same or similar inputs may not always lead to the same decisions or actions, making outcomes harder to reproduce, explain and govern after the fact. This makes complete visibility essential. Enterprises need to know what information an agent accessed, what recommendations it generated, what actions it performed and who reviewed those actions. The real test of an enterprise AI agent is not simply whether it completes a task, but whether the organisation can reconstruct the entire sequence of events when something goes wrong. The third requirement is human oversight based on consequence. Not every AI-driven action carries the same level of risk. An agent summarising an incident report or identifying trends in system logs requires a different level of oversight compared to an agent changing infrastructure settings, modifying security configurations or triggering business-critical workflows. The level of human involvement should therefore be determined by the potential impact of the action, not merely by the convenience of automation. This approach becomes increasingly important as enterprises adopt AI agents across complex technology environments. Large organisations today operate across hybrid cloud infrastructure, multiple applications, distributed systems and strict regulatory requirements. In such environments, even small automated actions can have wider operational implications. The mistake organisations must avoid is deploying AI agents first and introducing controls later. That approach may work during experimentation, but production environments require a different mindset. Guardrails cannot be treated as an additional layer added after implementation. They need to be embedded into the architecture from the beginning. Enterprises must define clear boundaries around what an agent can access, what it can recommend, what actions it can execute independently and where human approval remains mandatory. The future value of AI agents in enterprise IT will not come from replacing human decision-making. It will come from creating a more intelligent operating model where humans and AI systems work together with clearly defined responsibilities. The organisations that benefit most from agentic AI will not necessarily be those that deploy the highest number of agents or grant them the greatest autonomy. They will be the ones that build the strongest foundations of trust, security and accountability around them. The next phase of enterprise IT will not be measured only by the number of automated tasks completed. It will be measured by whether organisations can confidently answer a fundamental question: when an AI agent acts on behalf of the enterprise, do we know exactly what it did, why it did it and who remains accountable? AI agents have the potential to transform IT operations. But trust in these systems will not come from intelligence alone. It will come from the operational guardrails that allow enterprises to use that intelligence responsibly, securely and at scale. (Th author is Ajay Soni, Business Head, Digital Solutions, Writer Information, and the views expressed in this article are his own)

The Agent Is Inside the Perimeter: Why Indian Enterprises Can't Afford to Ignore AI Agent Governance

In April 2026, Vercel disclosed that a breach of its internal systems began with an AI tool that an employee had connected to their work account months earlier. The attacker simply rode the agent's existing access permissions into the enterprise. No sophisticated exploit and no insider threat. Just an ungoverned AI integration doing exactly what it was authorized to do, by someone who had either failed to consider the implications or had simply forgotten the extent of the access they had provided. Indian CISOs and CIOs would be mistaken to read this as a distant, Western enterprise problem. The same dynamics are playing out in booming metro cities including Bengaluru, Mumbai, and Gurugram. AI agents, autonomous tools that connect to email, code repositories, cloud consoles, and customer data systems are being adopted rapidly across Indian enterprises, often faster than the governance frameworks meant to oversee them. And the consequences of that gap are already being quantified. Almost every organization that had an AI-related breach in 2025 lacked proper access control. Furthermore, Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps identified only after production incidents occur. Therefore, the risk is not on the horizon but already inside the perimeter. A new identity class, an old security playbook For two decades, enterprise security has been built around two principal actors: humans, governed through identity providers and MFA; and machines, governed through service accounts tied to infrastructure. AI agents are neither; they are invoked by humans, act on humans' behalf, take decisions on their own to take actions, and hold standing access permissions across SaaS boundaries, and critically can be reprogrammed at runtime by whoever can reach their prompt interface. This is a genuinely new identity class, and it has entered the enterprise through the side door. A single employee, acting in good faith, can in five minutes grant a third-party AI platform read access to the corporate mailbox, write access to a code repository, and deployment rights to production infrastructure. The consent screen looks identical to every other login dialog that the employee has clicked through. Meanwhile, the security controls that organizations build like the identity provider, the CASB, the DLP, and the SIEM largely do not register what just happened. For Indian enterprises operating under the DPDP Act, RBI's data localization mandates, or SEBI's cybersecurity framework, this is not merely a technology gap. It is compliance exposure. Customer PII, financial transaction data, and source code are among the categories of data that AI agents routinely touch and potentially exfiltrate through outbound API calls to external model providers, often without any enforcement point in the path. Shadow AI is already a boardroom problem The conversation in Indian boardrooms has shifted from "should we adopt AI?" to "how do we govern what's already been adopted?" And the numbers are sobering. According to IBM's 2025 Cost of a Data Breach report, shadow AI, ungoverned AI tools adopted without IT oversight adds an average of $670,000 to the cost of a breach. Only 37% of organizations globally have AI governance policies in place. In India, where AI adoption among enterprises is accelerating sharply, the governance gap is likely no smaller. The default posture in most organizations today is tool-by-tool, employee-by-employee, consent-by-consent. That posture does not scale, and it does not survive a serious regulatory audit. Agent governance needs to be elevated to the same organizational level as identity governance: a centrally administered program, with a registry of every approved agent, clearly assigned ownership, defined lifecycles, and the ability to revoke access across the organization within minutes of a vendor incident. Egress is the new perimeter Here is the reframe that most Indian security teams have not yet made; classical enterprise security is overwhelmingly concerned with ingress, i.e., who is coming in, what they are authenticated as, what they are allowed to reach. AI agents invert that model entirely. An agent's risk profile is defined largely by what it calls out to; which APIs, which data stores, which external model providers. Sensitive data leaves the enterprise every time an agent makes an outbound call, and in most deployments today, nothing is watching. Governing egress in the agentic enterprise means enforcement and not just logging in at the point of every agent-originated outbound call. It means scoped, short-lived credentials issued at invocation rather than standing permissions issued at installation. It means policy decisions that consider which agent is calling, on whose behalf, with what data, and to which destination. And it means audit trails detailed enough to answer, after an incident, exactly which agent touched which data, on whose authority, and when. Governance is not a blocker but a business enabler The instinct in fast-moving organizations is to treat governance as friction. That framing is wrong, and increasingly costly. Enterprises that build sanctioned agent catalogues, clear approval of workflows, and default-deny postures on high-risk OAuth grants are not slowing down AI adoption but are making it sustainable. They are the organizations that will be able to demonstrate compliance to regulators, maintain customer trust after an incident, and scale agentic workflows without accumulating hidden risk. India's AI moment is real, and the productivity gains from well-deployed agents are significant. But the enterprises that capture those gains over the long term will be those that treat AI agents as a first-class identity category today; registered, scoped, bounded, and audited. The alternative is to wait for the incident that forces the reorganization. One has already been disclosed this month. There will be more, and the next one may be closer to home. (The author is Ayesha Dissanayaka - Software Architect, IAM at WSO2, and the views expressed in this article are his own)