By NHI Mgmt Group Editorial TeamBased on Pillar Security: “Pillar Security Named as a 2026 Gartner® Cool Vendor in AI Software Security” (July 6, 2026)

TL;DR: Gartner recognised an AI software security approach while the company framed SAIL 2.0 around discovery, red teaming, and runtime guardrails for AI agents, according to Pillar Security. The broader signal is that AI agent security is moving from point controls to continuous governance over identities, tools, and execution paths.

At a glance

What this is: Pillar Security frames SAIL 2.0 as a runtime AI agent security model that ties discovery, red teaming, and guardrails together around agent identities, tools, and execution paths.

Why it matters: It matters because AI agent governance is now an identity and runtime control problem, not just a visibility or policy exercise, so IAM and security teams need controls that work at machine speed.

By the numbers:

  • Gartner forecasts worldwide AI cybersecurity spending to nearly double in 2026, from $25.9 billion to $51.3 billion, and to reach $86 billion by 2027.
  • Just 14% of software engineering teams surveyed have advanced skills in AI security or platform engineering.

Context

AI agent security is becoming a governance problem because agents do not just generate outputs, they request credentials, call tools, and act inside live systems. Traditional security models break down when discovery, testing, and enforcement are disconnected from the place where an agent can actually cause damage.

That creates a direct intersection with IAM and NHI governance. When an agent is granted credentials, tool access, or production reach, it behaves like a non-human identity with delegated authority, so the control question shifts from static approval to runtime containment, evidence, and revocation.

Key questions

Q: What breaks when AI agents have production access without containment?

A: What breaks is the assumption that identity permission alone is enough to control impact. If an AI agent can reach production systems directly, one mistaken action can delete environments, modify configurations, or disrupt services before review processes can intervene. Containment must limit where the permission can be exercised, not just what the identity is allowed to request.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: How do security teams know whether an AI agent control stack is actually working?

A: Look for three things: every agent has a traceable identity, permissions are narrow enough to explain in operational terms, and actions can be audited end to end. If any of those are missing, the control stack is incomplete even if the data layer uses advanced privacy techniques. Identity, scope, and logging should all line up.

Q: What is the difference between AI discovery and AI runtime protection?

A: AI discovery identifies where AI assets exist, such as models, datasets, agents, API calls, and MCP servers, while runtime protection enforces policy when those assets are being used. Discovery gives inventory and context. Runtime protection reduces exposure in active sessions. Mature programmes need both, because visibility without enforcement leaves risk, and enforcement without discovery leaves blind spots.

Technical breakdown

Why AI agent runtime security changes the control model

Runtime security for AI agents means the control point moves from design-time review to the moment an agent chooses and executes an action. That matters because an agent may chain prompts, tools, APIs, and credentials in one session, which makes static approval lists too slow to contain misuse. In practice, the security model has to account for tool invocation, privilege boundaries, and state changes as part of one continuous execution path.

Practical implication: govern agents at execution time, not only at onboarding or policy approval time.

How AI-BOM visibility supports agent governance

An AI-BOM is an inventory of the components that make an AI system operational, including agents, models, prompts, MCP tools, skills, datasets, and configurations. The governance value is not the list itself, but the ability to connect each component to ownership, access scope, and risk context. Without that mapping, teams cannot tell which agent is connected to which tool, which data source, or which production pathway.

Practical implication: build a live inventory that links each agent to the tools, secrets, and systems it can reach.

Why red teaming and guardrails need to feed each other

Red teaming finds how an agent can be manipulated or overextended, while runtime guardrails decide what the agent is allowed to do when those conditions appear in production. If the two processes are separated, findings stay forensic and controls stay generic. A feedback loop lets validated attack paths become policy logic, which is the only way to keep pace with agent behaviour that changes across prompts, tasks, and contexts.

Practical implication: treat attack simulation results as input to enforcement rules, not as a standalone report.

Threat narrative

Attacker objective: The attacker objective is to steer a trusted AI agent into performing actions or reaching systems that the attacker could not access directly.

  1. Entry occurs when an enterprise grants an AI agent credentials, tool access, or a route into production systems that can be reused by an attacker steering the agent.
  2. Credential abuse escalates when the agent chains permissions across tools, prompts, and APIs faster than human review can intervene.
  3. Impact follows when the agent reaches production systems or data paths with machine-speed actions that are difficult to reverse once executed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime governance is becoming the real control plane for AI agents. Once agents can request credentials, call tools, and act inside production systems, static policy checks stop being enough. The control question shifts to what the agent can do at the moment of execution and whether the organisation can constrain it before action completes. For IAM and PAM teams, that means agent governance now belongs in the same conversation as privilege, authorization, and session control.

AI agent inventories are only useful when they are tied to authority. A live map of agents, tools, prompts, models, and datasets matters because security teams need to know which non-human identity can reach which asset. If inventory is detached from access scope, it becomes posture theatre rather than control. The field is moving toward identity-aware AI-BOM thinking, where discovery is only valuable if it feeds revocation, containment, and review.

Offensive testing and runtime enforcement should be treated as one system. Red teaming exposes how agents can be manipulated, but the value appears only when those findings change guardrails in production. That closes the detection-to-mitigation loop and gives security teams evidence they can use for governance and audit. In practice, AI agent security will increasingly be judged by how quickly a discovered abuse path becomes an enforced rule.

AI agent security is converging with NHI governance rather than replacing it. An agent granted credentials and tool access is operating as a non-human identity, even if its behaviour is dynamic rather than scripted. That means existing NHI control themes such as scope, ownership, revocation, and lifecycle offboarding now need to be applied to AI systems with much tighter runtime scrutiny. Teams should expect agent governance to be folded into broader identity programmes, not run beside them as an isolated AI project.

From our research library:

What this signals

Identity-aware AI governance is becoming unavoidable. Once an agent can obtain credentials and act across tools, access review alone is too slow to protect the environment. The programme question is no longer whether an AI system exists, but whether its authority is bounded at issuance time and continuously constrained in runtime.

Agent authority should be treated as a living entitlement. That means ownership, scope, and revocation must move from static documentation into operating controls that change as models, prompts, and integrations change. The 17% incident rate versus 76% for over-privileged systems shows how quickly weak scoping turns into a security outcome, according to the 2026 Infrastructure Identity Survey.

Runtime containment is the governance gap most teams still miss. Discovery and red teaming help, but they do not by themselves stop a harmful action chain once an agent is active. The practical signal is whether the organisation can still explain, bound, and revoke what a non-human identity is allowed to do after its task begins.

For practitioners

  • Define agent authority boundaries Document which credentials, tools, and production systems each AI agent may access, and make that boundary explicit before deployment.
  • Build a live AI asset inventory Maintain an AI-BOM that links agents, models, prompts, MCP tools, datasets, and configurations to owners and access scope.
  • Tie red-team findings to guardrails Convert validated agent attack paths into runtime policies so the next execution attempt is blocked by enforcement, not just documented in a report.
  • Review production agent privileges continuously Reassess which non-human identities still need access to live systems after each model, prompt, or tool change.

Key takeaways

  • AI agent security is shifting from static approval to runtime governance because agents can combine credentials, tools, and execution paths inside a single session.
  • The article ties that shift to a broader market pattern, with AI cybersecurity spend forecast to rise sharply and skills still lagging behind deployment.
  • For practitioners, the priority is to connect discovery, red teaming, and guardrails so that validated abuse paths become enforced runtime controls.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.

FrameworkControl / ReferenceRelevance
OWASP Non-Human Identity Top 10NHI-05 — Overprivileged NHIThe article centres on agents receiving more access than they should have at runtime.
NHI-04 — Insecure AuthenticationThe article links agent security to credentials, tool access, and trust in runtime authentication paths.
Recommendation — Scope agent credentials and tool access so each non-human identity has only the authority needed for the task. Harden agent authentication paths so tokens, secrets, and delegated access cannot be reused outside intended scope.
OWASP Agentic AI Top 10ASI02 — Tool MisuseThe source discusses agents chaining tool calls and accessing systems through execution paths.
ASI03 — Identity & Privilege AbuseThe core issue is agents acting through delegated identities and excessive privileges.
Recommendation — Limit agent tool use to approved actions and block chained calls that exceed the intended workflow. Bind agent identities to narrow privilege scopes and continuously verify access before each sensitive action.
NIST AI RMFMANAGE — Manage AI RisksThe article focuses on runtime guardrails, validation, and ongoing control of AI system behaviour.
Recommendation — Implement runtime controls that monitor, constrain, and revoke risky agent actions as part of AI risk management.
MITRE ATT&CKTA0006;TA0008 — Credential Access; Lateral MovementThe article describes attackers steering agents through credentials and production pathways.
Recommendation — Map agent abuse paths to credential access and lateral movement so detections target the actual execution chain.

Key terms

  • AI-BOM: An AI bill of materials is a structured inventory of the components that define an AI agent, including the model, prompt, tools, retrieval sources, and dependencies. In practice, it is the evidence base for review, change control, and risk assessment when the agent evolves after deployment.
  • Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
  • Agentic AI Security: Agentic AI security is the discipline of securing autonomous AI systems that can take actions, use tools, and chain decisions without direct human approval at each step. It covers identity and access management for AI agents, prompt injection defence, tool call governance, credential scoping, and runtime monitoring. As agentic systems acquire real-world authority, API access, file writes, workflow triggers, the security model must treat them as non-human identities with explicit lifecycle controls, not trusted processes.
  • AI-SPM: AI Security Posture Management extends security visibility into AI models, prompts, outputs, and supporting workflows. It gives teams a way to identify risky AI usage, check policy alignment, and monitor how AI systems interact with data and identity controls over time.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps practitioners build the control thinking needed for agent authority, lifecycle, and runtime containment.
NHIMG Editorial Note
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org