Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Agentic vulnerability assessment has to move beyond component scanning and examine how an AI agent’s identities, permissions, tools, memory, and actions combine into a complete chain of risk, according to Apono. The core issue is that inherited privilege, dynamic tool use, and multi-step execution can create a trust-boundary failure that conventional vulnerability processes miss.
NHIMG editorial — based on content published by Apono: Vulnerability Assessments in an Agentic World: Step-by-Step Guide
By the numbers:
- 64% said their organizations had processes in place to assess the security of AI tools.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: What breaks when AI agents are evaluated like ordinary software functions?
A: Function-style tests assume fixed inputs produce fixed outputs, but agents are path-dependent and can choose different tools, memory paths, or timings on each run.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: How do security teams know whether an agent has too much privilege?
A: The clearest signal is whether the agent can reach systems, data, or tools that are not necessary for the task and still complete its objective.
Practitioner guidance
- Inventory every agent identity and connected permission path Build a live register of agent-owned identities, delegated accounts, API keys, OAuth tokens, tools, data sources, and writable destinations so you can see the full effective access picture.
- Separate read, write, and destructive actions Design workflows so an agent cannot reuse a read-only discovery path to reach production write access, and require explicit approval when the next step crosses that boundary.
- Test action chains, not just configurations Run adversarial scenarios that follow prompt, tool call, retrieval, and output validation paths end to end, including indirect prompt injection through tickets, emails, or retrieved documents.
What's in the full article
Apono's full guide covers the operational detail this post intentionally leaves for the source:
- A seven-step assessment workflow for agentic systems, including scope definition, inventory, threat modelling, testing, scoring, remediation, and retesting.
- Practical examples of how to evaluate effective permissions across agent-owned identities, delegated accounts, API keys, OAuth tokens, and administrator credentials.
- Checklist items for inventorying MCP servers, RAG stores, long-term memory, writable knowledge sources, and cross-environment dependencies.
- Runtime privilege guidance for just-in-time access, approval thresholds, and audit logging across tool calls and downstream actions.
👉 Read Apono's guide to agentic vulnerability assessments and runtime privilege control →
Agentic vulnerability assessment: are your controls tracing action chains?
Explore further
14/09/2026 10:10 am
Agentic vulnerability assessment is now an identity problem, not just a model-security problem. The article is right to move the centre of gravity from software flaws to effective permissions, action chains, and trust boundaries. That is where NHI governance and agentic AI governance converge, because the risk is created by what the agent can do at runtime, not by what it was nominally assigned at provisioning. Practitioners should treat the assessment as an identity-control exercise with security testing attached.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to the 2026 Infrastructure Identity Survey.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How should organisations govern agentic risk as tools and models change?
A: Treat assessment as continuous, not point in time. Re-test whenever a model, tool, MCP server, permission set, or writable data source changes, and require evidence that the original action chain is still blocked after remediation. Agentic risk drifts quickly, so governance has to move at the pace of the system.
👉 Read our full editorial: Agentic vulnerability assessments must follow identity and action chains
