Notifications
Clear all
Topic starter
19/08/2026 3:29 pm
TL;DR: Agentic security is moving beyond lookup tasks into long-running investigation, exploitability analysis, compliance query building, and remediation workflows, with adoption up 750% and nearly 235 hours of manual work saved, according to Cycode’s analysis of 500 Maestro conversations. The operational shift is toward agents that help security teams prioritise, contextualise, and eventually automate response in high-velocity environments.
NHIMG editorial — based on content published by Cycode: Agentic Security in Action: Insights from 500 Real Cycode Maestro Conversations
By the numbers:
- Cycode says its team mapped the conversations to almost 235 hours saved in equivalent manual work.
Questions worth separating out
Q: How should security teams govern AI agents that can change behaviour at runtime?
A: Security teams should govern AI agents with runtime monitoring, behavioural baselines, and identity-triggered response, not just static approval workflows.
Q: Why do AI agents create new risk in non-human identity management?
A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts.
Q: What breaks when AI agents have broader access than their tasks require?
A: Over-privileged agents break segregation of duties, weaken auditability, and expand blast radius across transactions, data lookups, and workflow triggers.
Practitioner guidance
- Define agent scope as a delegated identity Assign explicit repository, dependency, and policy boundaries to each AI agent, then review those boundaries as part of lifecycle management.
- Require approval for agent-created policies Treat any query or policy saved by an AI agent as a governed change request, with review, versioning, and rollback before it becomes persistent enforcement.
- Separate investigation rights from remediation rights Allow agents to analyse vulnerability exposure and exploitability, but keep remediation execution and production policy changes behind stronger approval controls.
What's in the full article
Cycode’s full article covers the operational detail this post intentionally leaves for the source:
- The conversation taxonomy behind the 500-session sample, including how the vendor grouped platform guidance, exploitability analysis, and compliance work.
- Examples of the multi-turn security investigations that produced the strongest time savings and how those sessions were structured.
- The specific conditions under which Cycode expects agentic workflows to move from conversational support into triggered automation.
- The broader Cycode AI product context across Maestro, the Exploitability Agent, AI Remediation, and the Graph Agent.
👉 Read Cycode’s analysis of 500 real Maestro conversations on agentic security →
Agentic security conversations are changing how teams triage and remediate?
Explore further
19/08/2026 4:12 pm
Agentic security is becoming a governance problem, not just an automation problem. Once AI systems can sustain multi-turn investigations, the question is no longer whether they answer correctly. The real question is whether their access, memory, and delegated actions are controlled like any other non-human identity. That brings IAM and NHI discipline directly into AI operations, because the agent is making or shaping security decisions inside live workflows.
A question worth separating out:
Q: How do teams decide whether an AI agent needs human approval?
A: Use the sensitivity of the action, not the cleverness of the model, as the decision point. If the agent can change records, move funds, send external messages, or access regulated data, human approval or an independent policy engine should remain in the path. The more irreversible the action, the less autonomy the agent should have.
👉 Read our full editorial: Agentic security shifts from chat to automated remediation at scale
