AI Agents: A Security Challenge for Businesses

AI Agents: A New Attack Surface for Businesses

As artificial intelligence (AI) agents become workplace partners within organizations, they may inadvertently create new vulnerabilities. These agents, if not properly secured, can be manipulated to access sensitive systems and proprietary data, thereby increasing risks for businesses.

In some modern companies, non-human identities (NHIs) already outnumber human identities. This trend is set to intensify with the rise of agentic AI, making robust governance and enhanced security essential.

Massive Deployment but Immature Governance

The "Deloitte AI Institute 2026 State of AI" report reveals that nearly 74% of companies plan to deploy agentic AI within the next two years. However, only 21% of them currently have a mature model for governing autonomous agents. Leaders express significant concerns regarding data privacy and security (73%), legal compliance and intellectual property (50%), as well as governance and oversight capabilities (46%).

The Need for a Robust Control Plan

Companies may not be aware that they are treating agents as first-class entities, which can create blind spots and potential exposure points. A robust control plan is essential to govern, monitor, and secure the operation of AI agents, along with their tools and models within the organization.

Andrew Rafla, principal at Deloitte Cyber Practice, emphasizes the importance of a centralized control plan. This plan should determine who can execute which agents, with what permissions, under which policies, and using what models and tools. Without this, companies risk unmanaged execution, fraught with risks.

Governance: The Key to Secure Automation

Governance must make responses to agent actions clear and non-aspirational. It is the bridge that allows companies to transition from impressive experiences to secure and repeatable automation at scale. Without adequate governance, agent deployments risk failing unpredictably and on a large scale.