Notifications
Clear all
Topic starter
02/08/2026 9:46 am
TL;DR: Enterprise AppSec teams are being pushed toward AI agent security platforms because autonomous agents expand the attack surface across discovery, identity, runtime enforcement, and red teaming, while 77% of organisations still lack essential data and AI security practices, according to Accenture. The governance problem is no longer model safety alone, but whether identity and execution controls can follow agent behaviour at runtime.
NHIMG editorial — based on content published by Akto: AI Agent Security Platforms: What Enterprise AppSec Teams Actually Need
By the numbers:
- 77% of organisations lack the essential data and AI security practices to adequately protect their critical business models, data pipelines, and cloud workloads.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams enforce least privilege for AI agent identities?
A: Start by treating every agent as an NHI with a dedicated identity, a tight permission boundary, and a named owner.
Q: Why do AI agents create more governance risk than ordinary integrations?
A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services.
Q: What breaks when AI agent discovery is incomplete?
A: When discovery is incomplete, the organisation cannot know which agents exist, what they are connected to, or what they can access.
Practitioner guidance
- Define the agent security boundary in identity terms Map each AI agent to the user, service account, or workload identity that authorises it, then record which tools, APIs, and datasets that delegation can reach.
- Inventory shadow AI and connected tooling Continuously discover agents, MCP servers, APIs, and linked identities so that access reviews cover the full dependency chain instead of only named applications.
- Test runtime enforcement before procurement Validate whether the platform can block prompt injection, unsafe tool calls, and data exfiltration during execution rather than only detect them after the session ends.
What's in the full article
Akto's full blog covers the operational detail this post intentionally leaves for the source:
- Platform comparison criteria for discovery, runtime protection, red teaming, and MCP security across named vendors.
- Feature table details on deployment models, CI/CD integration, and SIEM integration for implementation-stage evaluation.
- The article's maturity model for agent identity and the associated controls expected at each stage.
- Examples of how the vendor maps controls to OWASP, MITRE ATLAS, NIST AI RMF, EU AI Act, and ISO 42001.
👉 Read Akto's analysis of AI agent security platform requirements →
AI agent security platforms: are your controls keeping up?
Explore further
02/08/2026 12:38 pm
AI agent security is becoming an identity problem before it becomes a model problem. The article correctly frames discovery, least privilege, runtime protection, and lifecycle governance as the real evaluation criteria. Once agents can use tools and data on behalf of users, the decisive question is who or what is authorised to act, not merely whether the model is producing safe text. Practitioners should therefore judge this category through IAM and PAM controls as much as through appsec features.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
- Another finding from the same research shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How do security teams decide whether an AI security platform is actually useful?
A: Look for three things: discovery of hidden agents and dependencies, runtime enforcement that can stop unsafe actions, and lifecycle governance that removes stale access. If a platform only reports model activity, it may improve visibility without materially reducing identity risk.
👉 Read our full editorial: AI agent security platforms need lifecycle controls, not point tools
