For a while now, enterprise AI security has mostly meant watching model inputs, outputs, and prompt manipulation. Those risks haven’t gone away, but AI has started doing more than generate information. It’s acting. Today, agents can log in to an application, change data entries, trigger workflows, and make decisions at different steps without much supervision. According to Gartner, by the end of 2026, task-oriented AI agents will be integrated into 40% of enterprise applications, compared to less than 5% by the end of 2025.
When Did AI Stop Just Talking?
Classic security relies on the principle that the individual performs the act and software implements it. The AI agent subverts the process, it will understand the goal, select tools, and go through actions without much need for human involvement. Therefore, the key issue is not only what the model can see but what it is allowed to do. An agent that simply reads from the knowledge base is relatively safe. However, an agent that can update customer details, authorise payment transactions, switch identities, and manipulate cloud resources is a different matter altogether.
Have Enterprises Priced in Risk?
There is a clear gap between the rate at which this technology is being implemented and the governance behind it. Based on one of the studies done in the industry, although 82% of the businesses were implementing AI agents, only 44% had set up any kind of policies governing it. What does that mean? A prompt injection against a simple chatbot might just produce a weird or inappropriate answer. Run the same trick against an agent with real operational privileges, and now you could be looking at a triggered transaction, exposed data, or a business process quietly altered. And because agents typically act through legitimate credentials, their behaviour often looks perfectly normal to conventional security tools.
Add their ability to move across several systems at machine speed, and the window to catch a problem before it does damage gets very small. An agent that can act is an agent that can be exploited. The question is whether the enterprise has designed for that risk. Security teams need to clearly define what an agent is allowed to decide, what it’s allowed to execute, and when it must stop and check with a human.
Governance: A new Architecture?
The goal isn’t to stop agents from acting. It’s to make sure their authority is bounded, contextual, and something you can observe. That means agents should only get the access a specific task requires, with permissions that can be pulled back the moment circumstances change. Check instructions for manipulation before they shape an agent’s reasoning or tool choices. Any action the agent proposes should be checked against business rules before it touches a system of record. Human approval shouldn’t be a blanket requirement for every single action; it should scale with risk. The required approval level depends on the risk involved. In the case of transactions involving money, privilege modification, irreversible data processing, and compliance, human approval is mandatory.
However, low-risk activities may proceed without issue, provided they stay within defined boundaries. Similarly, observability is also crucial in such a scenario. Organisations must know what an agent did, the resources it used, the input that influenced its decision, and the changes it made. The World Economic Forum’s “Global Cybersecurity Outlook” found that 66% of organisations expect AI to have the biggest impact on cybersecurity in the years ahead, yet only 37% have a process for assessing an AI tool before it goes live. The message here is clear, awareness is running well ahead of readiness.
Strategic Shift: Model Security to Decision Security
Model security asks whether an AI system can be manipulated. Agent security asks whether that manipulation can turn into unauthorised action. Decision security goes a step further, it asks whether the enterprise can trust the action an agent is about to take, given everything it knows, everything it’s allowed to do, and the policies it’s supposed to follow. That distinction matters, because you can lock down the underlying application perfectly well and still end up with a vulnerability, simply by handing an AI agent legitimate credentials and too much autonomy. An attacker doesn’t necessarily need to breach the application. Influencing the agent might be more than enough. Conventional security exists to keep unauthorised users out. Agentic security must do something different, protect systems from authorised AI actors that have wandered outside their intended boundaries.
Conclusion
Agentic AI isn’t likely to slow down anytime soon. As agents spread into customer service, finance, operations, software development, and infrastructure management, their permissions will keep expanding, and so will their appeal to attackers. The enterprises that come out ahead won’t necessarily be the ones running the most autonomous agents. They’ll be the ones that set clear trust boundaries around autonomy, defining exactly what an agent can access, decide, and execute, when it needs to ask permission first, and how fast it can be stopped if something goes wrong. The agentic attack surface isn’t a passing AI risk. It’s a structural shift in how enterprise computing works. AI is only going to take more action from here. Security must evolve right along with it, from protecting what AI says, to governing what AI is allowed to do.
Contributed by: Dhwanit Shah, Senior Vice President, Delivery – Digital Solutions.
