Should organisations include AI agents in human cyber risk programmes?

Why This Matters for Security Teams

AI agents should be included in human cyber risk programmes when they can act on behalf of people, handle sensitive data, or trigger changes in systems. That is not just an AI governance issue; it is a security and identity issue because the agent inherits context from the human workflow, yet often operates with broader tool access than the person would have alone. NIST’s NIST AI Risk Management Framework frames this as a lifecycle governance problem, not a one-off control check.

The practical risk is that teams often assess the human user but ignore the automation layer that can send emails, query systems, approve actions, or move data between environments. That creates blind spots in access review, incident response, and acceptable-use policies. In a cyber risk programme, the key question is not whether the agent is “human”, but whether it meaningfully expands the attack surface or the blast radius of a mistake. Security teams also need to distinguish between a chatbot that drafts text and an agent that can execute tasks with production privileges. In practice, many security teams encounter agent-related exposure only after a workflow has already automated an unsafe action path, rather than through intentional risk classification.

How It Works in Practice

Operationally, organisations should treat AI agents as part of the control environment surrounding the human operator, while also assigning direct governance to the agent’s permissions, prompts, and tool connections. The most useful starting point is to map where the agent can read, write, approve, delete, or exfiltrate information, then compare that to the human’s intended role. If the agent can act independently, the programme should record it as a distinct risk-bearing component rather than an informal productivity aid.

This works best when teams define the workflow in terms of identity, privilege, and decision impact:

• Identify the human owner, sponsor, and approver for each agentic workflow.
• Inventory the data sources, APIs, and administrative tools the agent can reach.
• Set explicit approval gates for high-impact actions, especially where finance, customer data, or infrastructure changes are involved.
• Log prompts, tool calls, and outputs so investigations can reconstruct how a decision happened.
• Review whether the agent is operating under the human’s account, a service identity, or a dedicated non-human identity with scoped privileges.

Threat modelling should incorporate patterns from the MITRE ATLAS adversarial AI threat matrix and the OWASP Agentic AI Top 10, especially around prompt injection, tool abuse, and insecure delegation. For higher-risk environments, use the CSA MAESTRO agentic AI threat modeling framework to formalise trust boundaries and failure modes. These controls tend to break down when agents are given broad API access inside legacy workflows that lack granular logging, approval segregation, and a clean service identity model.

Common Variations and Edge Cases

Tighter control over AI agents often increases operational friction, requiring organisations to balance productivity gains against the cost of review, logging, and permission scoping. That tradeoff is real, and current guidance suggests a risk-based approach rather than a universal prohibition. Not every AI-assisted task needs the same level of scrutiny, but anything that can modify records, initiate payments, or access regulated data should be treated as materially different from low-risk content generation.

There is also a meaningful difference between agents used in internal productivity workflows and agents exposed to external inputs. Public-facing or customer-facing agents face higher exposure to manipulation, data leakage, and prompt injection. Best practice is evolving on how to measure that exposure, so organisations should document local policy decisions and review them regularly rather than assuming industry consensus exists.

Where human cyber risk programmes already track phishing susceptibility, privilege misuse, or policy violations, AI agents should be added as a separate modifier when they can amplify those same outcomes. The CISA cyber threat advisories remain useful for understanding active attacker behaviour, while the NIST Cybersecurity Framework 2.0 helps anchor governance, protection, detection, and response. Organisations that delay this classification usually discover the gap during an access review, an incident investigation, or a policy exception that was never designed for machine-initiated action.

Related resources from NHI Mgmt Group

• Why do AI agents increase non-human identity risk in existing IAM programmes?
• Why do AI agents create new risk in non-human identity management?
• Why do AI agents increase non-human identity risk?
• Why do AI agents create new risk for IAM and NHI programmes?