AI agentic security tools need stronger governance, not just more power

At a glance

What this is: PortSwigger says AI-driven AppSec tools are becoming powerful enough to automate vulnerability discovery and validation, but they still need a governance cage to stop unsafe actions and preserve assurance.

Why it matters: IAM, PAM, NHI, and security teams should treat agentic tooling as a governed execution environment, because action authority, auditability, and approval boundaries matter more as automation scales.

Context

The core problem is not that AI cannot find vulnerabilities, but that agentic security tools can act on them without the determinism assurance teams need. Once a model can choose actions, chain tools, and operate at scale, the control question becomes how to constrain those actions so they remain reviewable, auditable, and bounded.

This matters for IAM and NHI governance because the article treats the agentic core as a system that issues and consumes tool authority in real time. When a security tool can self-select actions, the identity and privilege question shifts from who uses the tool to what the tool is allowed to do, and under what policy envelope.

That is a familiar pattern in mature security programmes: capability expands faster than governance unless the control layer is designed first. The article suggests that is now the central issue for AI-enabled AppSec rather than a future concern.

Key questions

Q: How should security teams govern AI in cybersecurity operations?

A: Security teams should govern AI in cybersecurity operations as a workflow control, not just a detection feature. Define where AI may summarise, prioritise, or route work, then keep approval authority, access changes, and exception handling under explicit human or policy control. This prevents convenience from quietly becoming delegated authority across the security programme.

Q: Why do agentic security tools create new access control risks?

A: Because they can select actions dynamically, chain tools, and operate across systems without a human approving every step. That means the trust boundary moves from a single scan job to a runtime identity with delegated authority. If that authority is too broad, the agent can observe or influence more than intended.

Q: What signs show that an AI agent is not yet governable?

A: Warning signs include unexplained completions, repeated mistakes after feedback, outputs that cannot be traced to evidence and workflows where operators cannot see intermediate actions. If the agent cannot show what it considered, what it used and how it decided, then the organisation does not have accountability, only a plausible-looking result.

Q: Should organisations prioritise model testing or access governance first for AI security?

A: Access governance should come first when AI systems can reach sensitive SaaS data, because the most dangerous failure is usually over-scoped permission, not the absence of a model test. Testing still matters, but it cannot compensate for a privilege model that grants the AI more reach than its task requires. Security needs both, in that order.

Technical breakdown

Why non-deterministic models are a governance problem

Large language models are inherently non-deterministic, which means identical prompts can produce different outputs and action paths. That is acceptable for brainstorming, but it is a control weakness when the system can execute security tasks, pick targets, or trigger tool use. In agentic security tooling, the model is no longer only generating text; it is participating in an action chain. The result is that the assurance burden moves from output quality alone to decision consistency, bounded authority, and repeatable execution. If the system cannot be made deterministic at the policy layer, it cannot be treated as a trustworthy operational control.

Practical implication: enforce deterministic policy gates around model actions before allowing autonomous tool execution.

How agentic AppSec tools change the identity and privilege model

Once an AI system can select tools and continue iteratively, it behaves like a non-human operator with delegated authority. That creates an identity and privilege problem, not just a model-quality problem, because the system can hold temporary authority over scanners, payload generators, and target interactions. In NHI terms, the relevant control surface is not the model itself but the permissions, boundaries, and accountability attached to the agentic workflow. If those rights are broad or implicit, the agent can leak data, attack the wrong target, or conceal what it did. The control objective is to make every action explicit, scoped, and attributable.

Practical implication: treat AI security tools as NHIs and bind them to least-privilege, auditable access.

Why safety guards and audit trails are now first-class controls

The article makes a strong case that prompt instructions alone cannot provide safety. Reliable assurance depends on policy enforcement, human approval for key decisions, and a durable audit trail that shows what the system attempted and why. This is especially important in offensive or semi-offensive AppSec workflows, where the same capability that finds a weakness can also cause damage if misdirected. Auditability is not a reporting extra here; it is part of the control architecture that makes the tool usable in serious environments. Without those guardrails, the system can be powerful but not governable.

Practical implication: require approval checkpoints and immutable logging for high-impact agent actions.

Threat narrative

Attacker objective: The objective is to turn agentic tooling into an execution engine that can operate at scale without effective oversight, increasing damage, leakage, or deceptive outcomes.

1. Entry occurs when a frontier model or open-weight model is given access to offensive AppSec tools and a target context.
2. Credential or tool authority is then used iteratively, allowing the agent to probe, select actions, and consume results without human review on each step.
3. Escalation happens when the agent is allowed to chain actions at scale, increasing the chance of wrong-target activity, data leakage, or concealment.
4. Impact is the loss of control over testing outcomes, evidence quality, and potentially sensitive data or real targets when the agent acts beyond intended boundaries.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Governance, not raw capability, is now the limiting control. As frontier and open-weight models converge on similar practical capabilities, the differentiator becomes whether the surrounding system can constrain action, preserve evidence, and support accountability. That is a security architecture problem, not a model-selection problem. For practitioners, the question is no longer whether AI can assist AppSec, but whether it can be made governable enough to trust.

Agentic security tools should be treated as non-human identities with delegated authority. Once a model can choose actions and interact with live tools, it occupies the governance role of an NHI, even if it is not autonomous in the strictest sense. That means access scope, decision rights, and revocation mechanics matter as much as model quality. Practitioners should design for tool authority as if they were onboarding a high-risk machine operator.

Deterministic enforcement is the new assurance baseline for AI-enabled testing. Prompting cannot create reproducibility, so the cage around the model must do the real work. This aligns naturally with NHI governance, where ephemeral authority is acceptable only when it is tightly scoped, observable, and removable. Teams that skip that layer will get impressive demonstrations, but not evidence they can defend.

Governed agentic execution: the security industry is moving toward systems that can act, not just recommend, and that creates a new category of control debt. If the governance layer is bolted on after the agent is powerful, the organisation inherits risk it cannot reliably explain or audit. Practitioners should assume that the control plane, not the model, will determine whether the system is operationally safe.

Security practitioners are moving from operators to supervisors of execution engines. The work shifts from running every test manually to deciding what the agent may attempt, which results deserve review, and when human judgement must interrupt automation. That does not reduce the skill requirement. It raises it, because oversight has to be strong enough to trust outputs that were not manually produced step by step.

What this signals

Governed execution is the decisive pattern for agentic security tooling. Security teams should expect AI-enabled AppSec to shift from interactive assistance to partial automation, which means the operating model must change from manual oversight of tasks to governance of permitted actions. If an agent cannot be bounded, it cannot be trusted with real targets.

The identity question is becoming central because these tools function like high-speed NHIs. That means teams need an explicit policy for tool authority, revocation, and audit evidence before they allow agentic workflows anywhere near production systems or sensitive testing environments.

For practitioners

• Define hard action boundaries for agentic tools Separate suggestion, execution, and approval so the model cannot cross from analysis into action without policy enforcement.
• Scope agent permissions as NHI credentials Assign the tool only the minimum authority needed for the task, and revoke access when the workflow ends.
• Require human approval for high-impact steps Place explicit checkpoints before target changes, exploit execution, data retrieval, or any action that could affect a live environment.
• Log every agent action with enough context to replay decisions Capture prompts, tool calls, outputs, and policy decisions so teams can explain what happened after the fact.
• Test for wrong-target and leakage failure modes Run controlled scenarios that check whether the agent can attack the wrong system, expose sensitive content, or conceal its trail.

Key takeaways

• AI-enabled AppSec tools are moving from recommendation engines to action engines, which raises the governance bar far above prompt quality alone.
• The core risk is not model intelligence by itself but non-deterministic execution, excessive tool authority, and weak auditability.
• Security teams need policy-enforced action boundaries, human approval on high-impact steps, and logs detailed enough to reconstruct every agent decision.

Key terms

• Agentic Security Tooling: Security software that can reason over goals, use tools, and take multi-step actions within defined boundaries. These systems are useful for scale and consistency, but they must be governed like privileged identities because they can affect live environments and generate real operational risk.
• Deterministic Enforcement: A policy model that produces a clear allow or block decision based on defined rules rather than probabilistic model judgment. For AI agents, deterministic enforcement is valuable because it can stop risky execution even when language is obfuscated, multi-turn, or designed to evade classifier-based guardrails.
• Audit Trail: An audit trail is a record of who accessed a system, what they did, and when they did it. For PHI environments, it provides the evidence needed to investigate incidents, support breach determinations, and demonstrate that access was attributable to a specific identity or workflow.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps security and identity practitioners build the control mindset needed to govern agentic systems and other non-human actors.