Notifications
Clear all
Topic starter
02/08/2026 11:46 am
TL;DR: By 2026, AI systems are embedded in business processes and can act across tools, data sources, and workflows, creating risks such as prompt injection, shadow AI, and unauthorized tool use, according to Akto. Traditional security assumes predictable software; agentic behaviour breaks that assumption and demands lifecycle governance.
NHIMG editorial — based on content published by Akto: AI Security Platform for Agentic AI and LLM Applications in 2026
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
Questions worth separating out
Q: How should security teams govern AI agents that can choose tools at runtime?
A: Security teams should govern runtime agent choice as an access event, not as a simple application action.
Q: Why do AI agents complicate traditional IAM and PAM controls?
A: AI agents complicate IAM and PAM because they can make decisions, chain tools, and act faster than human review cycles can respond.
Q: What breaks when security teams rely on prompt filtering alone?
A: Prompt filtering breaks when the user can paste data through another route before inspection happens.
Practitioner guidance
- Map every AI system to an accountable owner Create a live inventory of approved models, agents, copilots, and MCP servers, then tie each to an owner, purpose, and data scope.
- Enforce tool-level policy checks at runtime Move controls to the point where an agent invokes a tool, accesses a database, or calls an API.
- Integrate AI posture findings into IAM and compliance workflows Treat overprivileged API keys, exposed data stores, and weak audit trails as identity issues that belong in certification, remediation, and evidence collection processes.
What's in the full article
Akto's full blog post covers the operational detail this post intentionally leaves for the source:
- Implementation guidance for runtime protection across AI agents, MCP servers, and LLM applications.
- Examples of continuous AI red teaming, prompt-injection testing, and incident-response logging in production environments.
- A closer look at platform functions such as AI-SPM, shadow AI discovery, and policy enforcement across the AI lifecycle.
👉 Read Akto's analysis of AI security platforms for agentic AI and LLMs in 2026 →
AI security platforms in 2026: are your controls keeping up?
Explore further
02/08/2026 12:57 pm
AI security platforms are becoming the governance layer for agentic behaviour, not just a detection layer for model risk. The article is directionally right to treat discovery, runtime controls, and lifecycle governance as one stack because agentic AI crosses boundaries that traditional AppSec, cloud security, and IAM often handle separately. The key shift is that the subject of control is no longer only a model or an endpoint, but an acting identity with tool reach and data exposure. Practitioners should treat this as an identity governance problem with AI-specific mechanics.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: Who is accountable when an AI agent accesses the wrong data?
A: Accountability sits with the team that defined the agent’s scope, the owner of the delegated user context, and the operators who allowed access to persist beyond the task. For customer workflows, audit logs should show both the agent and the user identity so responsibility can be traced clearly.
👉 Read our full editorial: AI security platforms expose the governance gap in agentic AI
