As AI systems gain access to tools, data and workflows, cybersecurity must move beyond protecting a model and start governing what an agent is allowed to do.
The next phase of enterprise AI is not only about systems that generate text. It is about systems that can take action: query databases, open tickets, draft code, trigger workflows and communicate with other services.
This shift creates enormous potential. It also changes the security question. The central issue is no longer merely whether a model can produce an unsafe answer. It is whether an AI-enabled system can perform an unsafe action—and whether the organization can detect, contain and explain it.
From content risk to action risk
A chatbot that gives a poor answer creates a quality problem. An agent with access to email, customer data or infrastructure can create an operational incident. The difference is authorization.
Every useful agent sits inside a network of permissions. It receives context, calls tools and acts on behalf of a person or organization. Security therefore depends on the boundaries around those capabilities: identity, access, logging, approval and recovery.
The safest agent is not the one that never makes a mistake. It is the one whose mistakes are constrained, observable and reversible.
Three overlapping security challenges
NIST’s emerging Cyber AI Profile frames the field around three related areas: securing AI systems, using AI for cyber defense and defending against AI-enabled attacks. This is a useful structure because organizations often focus on only one side of the equation.
Securing AI systems
AI applications introduce familiar security concerns—identity, access control, data protection and third-party risk—alongside newer issues such as prompt injection, model manipulation and unsafe tool use. Security teams should treat an agent as a privileged software component, not as an intelligent colleague.
Using AI for defense
AI can help analysts summarize alerts, correlate events and investigate anomalies. The opportunity is real, especially in environments where teams face more signals than they can manually review. But automation must preserve evidence, distinguish facts from inference and allow analysts to reconstruct why a recommendation was made.
Thwarting AI-enabled attacks
Attackers can use AI to scale social engineering, adapt malicious content and lower the skill threshold for certain operations. The defensive answer cannot be a vague instruction to “use more AI.” It requires stronger identity controls, better telemetry and rehearsed response processes.
Least privilege must become dynamic
Traditional least privilege assumes relatively stable roles. Agents may need temporary access to complete a specific task. This makes time-limited, task-specific permissions especially important.
An agent preparing a supplier review may need read access to a defined document set, but it should not automatically gain access to all procurement records. An agent drafting a customer response may be allowed to suggest a message but not send it without approval. Capability should be granted in small increments.
Human approval is not a universal solution
Organizations often propose “human in the loop” as a complete safeguard. It is not. A reviewer who receives hundreds of low-context approval requests may simply click through them. Effective oversight requires meaningful information: what the agent intends to do, what data it used, what policy applies and what could happen next.
High-impact actions should be easy to stop and difficult to approve casually. Low-risk actions can be automated more freely. The control should match the consequence.
A practical control baseline
Before deploying an agent, organizations should be able to answer six questions:
- Which identity does the agent use?
- Which tools and data can it access?
- Which actions require approval?
- What is logged, and for how long?
- How can access be revoked immediately?
- How will the organization test failure and recovery?
These questions are not glamorous, but they determine whether agentic AI becomes a durable capability or an uncontrolled experiment.
Security as an enabler
The organizations that move fastest will not be those that ignore control. They will be those that make safe experimentation easy. Clear permissions, reusable guardrails and reliable audit trails reduce the cost of trying new use cases.
In the age of AI agents, cybersecurity is not the department that says no. It is the architecture that makes a responsible yes possible.