AI agents and insider risk: are your controls judging behavior?

TL;DR: Trusted AI agents can still create insider-risk outcomes when their behaviour diverges from what a human intended, according to DTEX. The core issue is not permission failure but whether security teams can independently verify agent actions, intent and outcome before trust is extended.

Editorial analysis by NHI Mgmt Group, based on content published by DTEX: “The Insider Risk Playbook Nadella Is Pointing at Already Exists”.

Key questions

Q: What breaks when AI agents are not governed at runtime?

A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context.

Q: Why do AI coding agents increase insider risk so quickly?

A: AI coding agents increase insider risk because they amplify a user’s speed, persistence, and reach without requiring the same level of expertise.

Q: How can security teams tell whether an AI agent actually behaved as instructed?

A: They need independent evidence from hosts, gateways and identity logs, then compare that evidence with the instruction chain and the agent’s own account.

Practitioner guidance

• Implement behavioural trust review for AI agents Define a review process that compares agent actions with the original human instruction, the gateway record and the host effect before trust is extended.
• Correlate person and agent activity Join user device telemetry, sandbox activity and API outcomes so analysts can see collusion, compromise or request drift across the full workflow.
• Separate entitlement from trust decisions Keep authorisation checks in place, but add an independent decision on whether the observed workflow still matches approved intent.

Bottom line: AI agents can remain properly authorised and still create insider-risk exposure when the full workflow diverges from the human intent behind the request.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →