AI is changing security in four directions at once: employees are moving more data through AI services, attackers are using AI to work faster, defenders are automating more analysis, and agents are gaining permission to act. For CISOs, the last change may be the most important.

For the first few years of generative AI, the standard security question was fairly simple: “What did someone paste into the chatbot?”

That question still matters. It is just no longer enough.

An AI agent may read email, search internal files, query a customer database, write code, open a ticket, update a record, call another agent, or send a message. It may also remember information between tasks and decide which tools to use along the way. The security boundary has therefore expanded from the prompt box to the agent’s identity, credentials, tools, data sources, memory, instructions, and downstream systems.

A chatbot can draft a bad email. An agent can send it.

This does not mean every agent is a miniature rogue administrator waiting to happen. It means security teams need a better mental model. The most useful one is to treat an agent as a new class of non-human security principal: an actor with an identity, an owner, a purpose, permissions, a history of actions, and a blast radius.

The AI security portfolio has four fronts

“AI security” is becoming an overloaded term. A CISO can make the subject more manageable by separating four related but distinct problems.

Security front Core question Common blind spot
Workforce AI use What data are employees sharing, and through which approved or unapproved services? Blocking a tool without addressing why employees need it
AI systems and agents What can the model or agent access, remember, decide, and do? Testing the model while ignoring identities, tools, and workflow integrations
AI-enabled adversaries How is AI changing the speed, scale, or quality of attacks? Treating every AI-assisted attack as a fundamentally new capability
AI-enabled defense Where can AI improve prevention, detection, investigation, and response? Giving defensive automation more authority than the organization can safely monitor

These fronts share controls, but they do not have the same threat model. A data-loss prevention rule may reduce accidental disclosure to a public AI service. It will not prevent a properly authenticated internal agent from misusing an overly broad permission. A red-team exercise may reveal prompt injection. It will not tell leadership why employees keep moving work to personal AI accounts.

The portfolio view also helps security leaders avoid two equally unhelpful positions: “AI changes everything” and “AI is just normal software.” AI systems are built on familiar software, cloud, data, and identity layers, but their probabilistic behavior, natural-language control surface, persistent context, and ability to select tools create additional failure paths.

AI-assisted attackers are getting leverage, not magic

Attackers do not need an all-powerful autonomous hacking system to benefit from AI. A reliable 20% improvement in research, translation, scripting, target profiling, or phishing preparation is useful when repeated across a campaign.

Google’s Threat Intelligence Group reported in February 2026 that government-backed actors were using large language models for technical research, reconnaissance, scripting, vulnerability research, phishing preparation, and post-compromise support. It also observed early experimentation with AI-integrated malware and agentic tooling. Just as importantly, Google said it had not observed advanced persistent threat actors achieving breakthrough capabilities that fundamentally changed the threat landscape (Google Threat Intelligence Group, 2026).

That distinction matters. AI is already a force multiplier, but it has not repealed the attacker’s need for access, infrastructure, persistence, and operational security. For most enterprises, credential theft, phishing, vulnerable software, exposed services, supply-chain compromise, and poor segmentation remain more immediate concerns than a fully autonomous cyber supervillain.

The sensible response is to update threat models without abandoning security fundamentals. Assume that convincing lures will become cheaper, reconnaissance will become faster, and malicious code will be easier to modify. Strengthen identity controls, phishing-resistant authentication, attack-surface management, software supply-chain security, and behavioral detection accordingly. The threat is becoming more efficient, even when it is not entirely new.

The everyday data problem is already large

While autonomous attack scenarios attract attention, a more ordinary AI risk is happening all day: people are sending work data to AI services.

Netskope’s Cloud and Threat Report: 2026, based on anonymized activity observed through its platform from October 2024 through October 2025, found that the number of SaaS generative-AI users in the average organization tripled and prompt volume increased sixfold. Among observed generative-AI users, 47% used personal AI applications. The average organization recorded 223 detected generative-AI data-policy violations per month; source code accounted for 42% of those incidents, regulated data for 32%, and intellectual property for 16% (Netskope, 2026).

Those figures describe Netskope’s customer telemetry, not every employer everywhere. They are still a useful reminder that AI has become a major data-egress channel. Summarizing a document, debugging code, or analyzing a spreadsheet often requires the user to provide the very information the organization is trying to protect.

IBM and the Ponemon Institute examined a different population: 600 organizations that experienced a breach between March 2024 and February 2025. In that study, 63% lacked AI governance policies. Among the subset reporting a security incident involving an AI model or application, 97% said they lacked proper AI access controls. Organizations reporting high levels of Shadow AI had average breach costs $670,000 higher than those reporting little or none (IBM, 2025).

These are associations within a sample of breached organizations, not proof that Shadow AI alone caused the additional cost. The practical message is narrower and stronger: unmanaged AI use tends to coexist with weak visibility, weak access control, and slower discovery—exactly the conditions that make incidents harder to contain.

DLP, secure web gateways, managed accounts, approved tools, retention controls, and plain-language data rules are therefore necessary. But a block page is not a complete governance strategy. If an external tool is meaningfully better, faster, or easier than the approved option, employees still have a business problem after security blocks it. The durable response is to restrict clearly unsafe use, replace risky workarounds with capable approved services, and bring useful lower-risk practices into supported workflows.

Security telemetry explains what moved. Employee and workflow evidence often explains why.

Agents turn prompt risk into permission risk

Prompt injection is sometimes discussed as if it were an AI version of a mischievous sentence hidden in white text. The real concern is what happens after the model follows the sentence.

Consider an email assistant that can read messages, retrieve files, and prepare external replies. A malicious instruction hidden in an incoming document might attempt to redirect the agent, induce it to retrieve unrelated information, and include that information in an outgoing message. The language-model failure is important, but the severity comes from the surrounding architecture:

  • The agent could read untrusted content and interpret it as an instruction.
  • It had access to data beyond what the task required.
  • It could invoke tools with the user’s authority.
  • A downstream system trusted its output.
  • The action did not require meaningful approval.

In other words, prompt injection becomes dangerous when paired with excessive agency.

OWASP’s agentic security guidance maps this broader attack surface across tool misuse, privilege compromise, memory poisoning, identity spoofing, goal manipulation, untraceable actions, cascading failures, and attacks that overwhelm human reviewers. Its recommended mitigations include granular permissions, function-level authentication, sandboxing, just-in-time access, immutable logging, validation of memory updates, explicit approval for consequential actions, and monitoring for abnormal tool behavior (OWASP Agentic Security Initiative, 2025).

Identity deserves special attention. An agent should not quietly inherit a human user’s broad, long-lived access simply because that is convenient during a pilot. A separate agent identity makes ownership, authorization, revocation, monitoring, and incident investigation much clearer. Short-lived credentials and action-level authorization also reduce the damage possible from a compromised token, manipulated workflow, or abandoned experiment.

The same reasoning applies to Model Context Protocol (MCP) and other connection layers that let models discover and call external tools. In May 2026, the NSA warned that MCP adoption was accelerating in sensitive business workflows and highlighted risks involving dynamic tool invocation, implicit trust, context sharing, serialization, and agent misuse. Its guidance argues that agentic environments must be secured as a continuum rather than as isolated endpoints (NSA Artificial Intelligence Security Center, 2026).

MCP is not automatically unsafe, and an agent is not automatically privileged. The lesson is that convenient connectivity creates security dependencies quickly. Every tool description, connector, token, server, data source, and trust relationship becomes part of the agent’s effective code and attack surface.

Use least autonomy as well as least privilege

Traditional access control asks, “What resources may this identity access?” Agentic security adds another question: “How independently may it act?”

A useful autonomy ladder is:

  1. Suggest only: The AI recommends; a person performs the action.
  2. Draft for approval: The AI prepares an artifact or action; a person reviews and completes it.
  3. Execute after approval: The AI performs the action only after explicit approval.
  4. Automatic low-risk execution: The AI performs a narrow, reversible action within defined limits.

Many organizations jump too quickly from stage one to stage four because the demo works. A better default is the lowest autonomy that still creates worthwhile value. Autonomy can expand after the organization has evidence that the use case is reliable, monitored, recoverable, and genuinely improved by removing the approval step.

Joint guidance published in 2026 by CISA, the NSA, the Australian Cyber Security Centre, and other international partners recommends exactly this kind of careful adoption: begin with well-defined, lower-risk tasks and expand incrementally while enforcing strong identity, privilege, monitoring, segmentation, and human-oversight controls (ASD’s Australian Cyber Security Centre, 2026).

“Human in the loop” should not be accepted as a control description by itself. The reviewer needs the competence to recognize a problem, the context to understand what the agent did, enough time to evaluate it, and the authority to stop it. If one person must approve hundreds of plausible-looking actions before lunch, the loop may be human-shaped but it is not much of a safeguard.

A control stack for production agents

Security teams do not need to invent an entirely new discipline. They need to extend existing identity, application, cloud, data, and operational controls around the complete agent workflow.

Control area Practical requirement
Inventory and ownership Record the agent’s owner, purpose, model, tools, data sources, memory, identity, autonomy level, environments, and review date
Identity and authorization Use a distinct identity, least privilege, short-lived credentials, action-level authorization, and explicit rules for agent-to-agent delegation
Tool and execution security Allowlist tools, authenticate each invocation, validate parameters and outputs, sandbox code, and enforce network and resource limits
Data and memory Apply classification and minimization, separate sessions, validate persistent memory writes, retain source lineage, and support memory rollback
Human control Require approval for consequential or irreversible actions and make the reviewer’s required checks explicit
Runtime monitoring Log prompts, retrieved context, tool calls, permissions used, outputs, approvals, errors, and changes in behavior without collecting unnecessary personal data
Containment and recovery Set transaction and rate limits, provide a kill switch, rotate or revoke credentials quickly, and make important actions reversible
Change management Re-test after changes to models, prompts, tools, permissions, connectors, memory, or workflows

The agent’s blast radius should be testable. If the agent is manipulated, hallucinates, loses context, or receives a compromised dependency, what is the worst action it can complete before another control intervenes? That question is usually more useful than asking whether the model is “safe.”

NIST’s AI Risk Management Framework provides a good operating rhythm: Govern, Map, Measure, and Manage. Its Generative AI Profile extends that approach to risks including information security, data privacy, human over-reliance, confabulation, intellectual property, and third-party components across the AI lifecycle (NIST, 2024). For a CISO, the important word is lifecycle. A one-time vendor review does not cover a system whose model, tools, data, permissions, and behavior can all change.

AI can improve defense—if automation remains accountable

The security impact of AI is not exclusively negative. The same technology that accelerates attacker research can help defenders correlate alerts, summarize cases, identify anomalies, analyze malware, produce detection logic, and guide response.

In IBM’s 2025 breach study, organizations reporting extensive use of security AI and automation had average breach costs of $3.62 million, compared with $5.52 million among organizations reporting no use. They also identified and contained breaches 80 days faster on average. The study is observational, so it does not prove that the tools alone produced the entire difference; organizations with mature automation may also have stronger teams, processes, and architecture. Still, the size of the association makes defensive AI difficult to ignore (IBM, 2025).

The safe path is to automate analysis before authority. Let AI enrich, cluster, summarize, recommend, and prepare response actions. Require stronger evidence before allowing it to disable accounts, isolate systems, modify production controls, delete data, or communicate externally without approval. Then expand autonomy only where the action is narrow, reversible, observable, and demonstrably reliable.

This approach also preserves accountability. “The model decided” is not an incident-response finding. A named person must own the system, someone must approve its operating boundaries, and the organization must be able to reconstruct what happened.

Questions for the next CISO review

A productive agentic-security discussion can begin with ten questions:

  1. Which AI systems can take actions today, including features embedded in existing SaaS products?
  2. Does each agent have a named business owner, technical owner, and risk owner?
  3. Which human or machine identity does it use, and how quickly can that access be revoked?
  4. What untrusted content can enter its context?
  5. Which tools, data stores, and other agents can it reach?
  6. Can it send, spend, publish, delete, deploy, approve, or change a system of record?
  7. Which actions require approval, and what exactly must the reviewer verify?
  8. Are prompts, context, tool calls, permission use, approvals, and memory changes reconstructable after an incident?
  9. What is the rollback plan, and has the kill switch been tested?
  10. What employee need or workflow pressure might create a Shadow Agent if the approved path is too slow or limited?

The tenth question is easy to miss. Agentic risk is not only a software problem. Employees can assemble personal automations, browser agents, code assistants, and SaaS connectors much faster than most organizations can review them. Security teams need visibility into both technical deployments and the work needs that produce unsanctioned ones.

Sources and further reading

Behaviture’s AI Adoption Pulse helps security and business leaders see the workforce conditions that technical controls cannot explain. Its privacy-first assessment identifies policy confusion, approved-tool gaps, external-tool pressure, training needs, psychological safety, and readiness for agentic workflows, then turns those findings into role-aware actions and a practical autonomy ceiling. It complements DLP, identity, telemetry, and GRC platforms by connecting observed activity to the reasons behind it—so organizations can reduce Shadow AI and Shadow Agent risk while helping employees use approved AI more safely and effectively.