Topic starter
06/09/2026 9:33 am
TL;DR: AI agents can speed up triage, investigations, and response, but Swimlane’s analysis argues that isolated deployments create AI sprawl when workflows, human oversight, and accountability are not coordinated. The real differentiator is orchestration, because value now depends on governance and visibility, not the number of agents deployed.
Editorial analysis by NHI Mgmt Group, based on content published by Swimlane: “Are You Orchestrating AI or Adding Complexity?”.
Key questions
Q: How should security teams govern AI agents that run long, multi-step workflows?
A: Security teams should require durable execution, full event history, and clear ownership for every multi-step agent workflow that touches sensitive data or privileged tools.
Q: Why does AI washing create operational risk in security tools?
A: AI washing makes teams believe a product has changed the operating model when it has only changed the interface.
Q: What signs show that AI orchestration is failing?
A: The clearest signs are repeated enrichment, inconsistent recommendations, unclear handoffs, and analysts compensating for what the agents do not coordinate.
Practitioner guidance
- Define agent ownership and decision boundaries Assign a named owner to each AI agent, then document what tasks it may perform, what it may recommend, and what requires human approval.
- Map orchestration paths before scaling deployment Inventory where outputs flow between agents, workflows, and analysts so duplicated steps and conflicting actions can be removed early.
- Require human checkpoints for consequential actions Keep escalation, containment, and response approvals under explicit human control until the governance model proves it can handle exceptions safely.
Bottom line: AI agent orchestration is emerging as a governance discipline because isolated deployments can create AI sprawl, duplicate effort, and weaken operational clarity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 9:34 am
AI orchestration is now an identity governance problem, not just an automation design choice. Once agents can act across workflows, the real issue becomes scope, authority, and accountability. That is a familiar identity question in a new form, because every agent needs a defined boundary of action and a governed path for escalation. Practitioners should treat orchestration as part of access governance, not as an optional optimisation.
A few things that frame the scale:
- 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
A question worth separating out:
Q: When should human approval remain mandatory in AI-driven security workflows?
A: Human approval should remain mandatory when an action can change containment status, alter response direction, or create downstream operational risk. AI can support those decisions, but it should not own them until the governance model demonstrates reliable control over scope, escalation, and exception handling.
👉 Read our full editorial: AI agent orchestration is becoming a governance problem