Securing the Agentic Enterprise

A chatbot that gives a wrong answer is embarrassing. An agent that wires a payment to the wrong account, deletes a production table or emails a customer list to an attacker is an incident. The difference is action. As enterprises connect agents to systems of record, they are creating a new category of worker with credentials, and most of their security architecture was not designed for it.

What is different about agents

Three properties make agents a distinct security problem. First, they act: they call tools that change state in real systems. Second, they read untrusted content: web pages, emails, documents and tickets that may contain instructions planted by an adversary. Third, they are non-deterministic: the same input can produce different sequences of actions, which makes testing harder than for conventional software.

The controls that matter

1. Identity. Every agent gets its own identity with scoped, revocable credentials. Shared service accounts are the fastest route to an unattributable incident.
2. Least privilege. Agents get access to the tools and data the task requires, and nothing more. Read access by default; write access by exception.
3. Input isolation. Untrusted content is treated as data, never as instruction, and passed to the model with clear boundaries. Where possible, high-risk tools are unavailable while processing untrusted input.
4. Approval checkpoints. Irreversible or high-impact actions, such as payments, deletions and external communication, require a human or a policy engine to approve.
5. Action logs. Every tool call, with inputs and outputs, is recorded so incidents can be reconstructed and audited.
6. Kill switches. Operators can pause or revoke an agent immediately, fleet-wide.

Why now

• Agent permissions are growing faster than defences against injection.
• Identity vendors are extending workforce identity products to non-human agents.
• Regulators and insurers are beginning to require AI-specific controls.
• Adversaries are using AI to lower the cost of sophisticated attacks.

Who benefits, who is at risk

Identity, observability and red-teaming vendors gain a new market. Organisations with mature access controls can deploy agents faster than rivals. At risk are companies deploying agents against legacy systems with broad service accounts, and any team running shadow agents outside security review.