Why do AI agents break traditional likelihood and impact scoring?

Why This Matters for Security Teams

Traditional likelihood and impact scoring assumes the thing being scored behaves in a fairly stable way. AI agents do not. Their exposure changes as tasks change, their tool access can expand mid-workflow, and their identity footprint can span APIs, secrets, data stores, and downstream services. That makes intuition-based scoring unreliable because the risk is not just what the agent is, but what it can do next.

NHI Management Group’s research on agentic risk shows why this is already operational, not theoretical: the AI Agents: The New Attack Surface report found that 80% of organisations report agents performing actions beyond intended scope. Current guidance from the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10 both point toward measuring capability, autonomy, and control gaps rather than relying on static assumptions. In practice, many security teams encounter a “medium” score only after an agent has already chained tools, touched sensitive data, or widened its blast radius.

How It Works in Practice

For agents, likelihood is better estimated from observable conditions at runtime: what the agent can access, whether it has standing credentials, how much autonomy it has, whether its outputs are human-reviewed, and whether the environment logs actions reliably. Impact should also be treated as a moving target. An agent with read-only access to a test system is one thing; the same agent with token access, write permissions, and secrets exposure is a different risk tier entirely.

Security teams are increasingly replacing gut feel with measurable inputs and policy checks. That usually means:

• scoring exposure by actual tool reach, data reach, and identity blast radius
• weighting autonomy higher when the agent can chain actions without approval
• treating weak instrumentation as a risk multiplier, not a neutral factor
• using runtime policy evaluation rather than one-time role assignment
• linking risk tiers to secrets TTL, session scope, and revocation speed

This approach aligns with the CSA MAESTRO agentic AI threat modeling framework, which emphasises agent behaviour, orchestration paths, and control points, and with NHIMG analysis such as OWASP NHI Top 10, which reflects how identity and tool misuse become the real hazard. Where possible, use workload identity, short-lived tokens, and request-time policy decisions so the score reflects current authority rather than inherited permissions. These controls tend to break down in loosely governed multi-agent pipelines because one agent’s action becomes another agent’s trusted input without a fresh authorization step.

Common Variations and Edge Cases

Tighter scoring often increases operational overhead, requiring organisations to balance accuracy against speed, cost, and alert fatigue. That tradeoff matters most in environments where agents are experimental, high-volume, or embedded in customer-facing workflows.

Best practice is still evolving for hybrid systems that mix human approvals with autonomous execution. In those cases, a single score may understate risk if the agent can pre-stage actions, cache secrets, or escalate through indirect tool use. The same is true when the model has broad reach but the environment has weak telemetry, because low visibility can make impact look smaller than it is. Current guidance suggests treating missing data as a risk signal rather than assuming absence of evidence means low exposure.

Researchers and practitioners should also separate model capability from deployment capability. An agent may be harmless in a sandbox yet materially dangerous once connected to production SaaS, internal APIs, or credential stores. Related incidents covered in NHIMG research, including the CoPhish OAuth Token Theft via Copilot Studio and the Gemini AI Breach, show how tool trust and prompt injection can inflate real-world impact well beyond what a conventional risk matrix predicts. There is no universal standard for this yet, so teams should validate their scoring model against actual agent actions, not just policy documentation.

Related resources from NHI Mgmt Group

• What evidence is needed to understand the impact of shadow AI agents?
• How does the rise of AI identities impact traditional IAM systems?
• Why do AI agents create a different access-risk profile than traditional applications?
• Why do AI agents make compromise detection harder than traditional systems?