Agentic AI at RSAC 2026: what governance gap are teams missing?

TL;DR: RSAC 2026 was dominated by agentic AI, with security leaders discussing a market where adoption is accelerating faster than governance, control and isolation capabilities, according to DTEX, while new research cited in the article shows major gaps in purpose limits, shutdown and network separation. The defining risk is not AI as a tool, but AI behaving like a new insider that can act at machine speed before humans can intervene.

Editorial analysis by NHI Mgmt Group, based on content published by DTEX: “Agentic AI: The Star of RSAC 2026”.

By the numbers:

• 650 vendors had exhibits at RSAC 2026, with almost every one emphasizing agentic AI.
• 63% of organisations cannot enforce purpose limitations on their AI agents.
• 60% cannot terminate an agent that’s misbehaving.

Key questions

Q: What breaks when organisations deploy AI agents without lifecycle governance?

A: What breaks is not only access control but the assumption that deployment is a one-time event.

Q: Why does machine-speed agent behaviour change access governance?

A: Machine-speed behaviour collapses the time available for manual review, exception handling and human approval.

Q: What are the signs that shadow AI is becoming a governance problem rather than a productivity aid?

A: The clearest signs are widespread use outside IT visibility, repeated sharing of corporate data with GenAI tools, and no consistent approval path for new applications.

Practitioner guidance

• Build an agent inventory with ownership and purpose Record every approved agent, its owner, intended task, connected data sources and permitted tools so governance starts with a real inventory rather than assumptions.
• Enforce task-scoped access decisions Require policy checks at issuance time so agents receive only the minimum access needed for the specific workflow and cannot accumulate standing privilege.
• Add termination and isolation controls for misbehaving agents Define the kill switch, isolation boundary and escalation path before deployment so a rogue agent can be contained without waiting for manual investigation.

Bottom line: Agentic AI is becoming a governance problem because organisations are granting software the ability to act, not just to assist.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →