Topic starter
20/08/2026 5:25 pm
TL;DR: Traditional AI-SPM is built for static models, but agentic AI needs governance over identity, permissions, tool chains, and runtime behaviour because 40-plus agents can operate across cloud accounts without clear ownership or visibility, according to Fiddler. The practical shift is from configuration scanning to runtime observability, because autonomous workflows create security decisions that CSPM and DSPM cannot see.
Editorial analysis by NHI Mgmt Group, based on content published by Fiddler: “AI Security Posture Management in the Age of Agents”.
Key questions
Q: How should security teams govern AI agents that can choose tools at runtime?
A: Security teams should govern runtime agent choice as an access event, not as a simple application action.
Q: Why does runtime behaviour matter more than configuration scanning for agentic AI?
A: Runtime behaviour matters because agents make decisions dynamically, so the risk is created in execution, not only in setup.
Q: What are the signs that an AI posture programme is not actually governing agents?
A: The clearest signs are a missing AI inventory, no per-agent identity, broad inherited permissions, and no traceability for tool calls or sub-agent activity.
Practitioner guidance
- Build a living AI inventory Track every model, agent, pipeline, dataset, and owner in a continuously updated AI-BOM so posture reviews start from complete scope rather than discovered fragments.
- Assign distinct identities to agents Give each agent, including dynamically spawned sub-agents, a unique and auditable identity so tool use, data access, and delegation can be tied to a specific runtime actor.
- Scope tool access by task Limit allowed tools, commands, and APIs to the minimum required for the agent’s function, and explicitly deny code execution or shell access where those actions are not essential.
Bottom line: Agentic AI changes posture management from scanning models to governing runtime actors with identity, permissions, and delegation paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:15 pm
AI-SPM is becoming an identity-control problem, not just a model-control problem. Once agents can select tools, inherit permissions, and spawn sub-agents, the security question changes from "is the model configured safely" to "is each execution path governed safely". That is a different control plane, and cloud posture tools alone do not reach it. Practitioners should treat agent identity and permission scope as part of the posture baseline.
A few things that frame the scale:
- A Harris Poll survey of more than 300 technology decision-makers found that 86% expect agentic AI to deliver positive ROI, yet fewer than half had AI governance policies in place.
A question worth separating out:
Q: What is the difference between AI security posture management and AI governance?
A: AI security posture management focuses on identifying misconfigurations, exposure, and data protection gaps in AI systems. AI governance is broader: it defines inventories, approved use cases, workflows, accountability, and policy controls for how AI is built and used. Strong programs need both. Posture management finds and reduces technical risk, while governance shapes acceptable use and decision making.
👉 Read our full editorial: AI security posture management now has to govern agents, not just models