Decisions that required human sign-off just a year ago are now being made and executed autonomously by AI. A new report from breach-containment firm Illumio reveals that while 70% of companies now grant AI this authority, less than half can fully track or audit what those agents actually do.
As businesses race to unlock AI's value, this widening gap between autonomous authority and security oversight creates a dangerous new blast radius inside enterprise networks.
Raghu Nandakumara, vice president of industry strategy at Illumio, told TechTarget that security leaders need to put meaningful guardrails around AI agents with access to sensitive enterprise systems.
“CISOs need to pay as much attention to the blast radius of autonomous action as to the accuracy of the AI itself,” Nandakumara said. “When an agent’s behavior and output are inherently non-deterministic, the focus should be on putting hard controls in place that limit the scale and impact of a worst-case scenario.”
The illusion of least privilege
Illumio’s findings come on the heels of an NBC interview with Microsoft CEO Satya Nadella, who expressed his own concerns with AI having free rein across a company's infrastructure.
“You don't give the agent all permissions,” Nadella said. “And then in time, as you get confidence that this agent is able to do more autonomous action, you can escalate that permission, but it should work with the least amount of privilege to start with.”
But limiting an AI agent’s permissions might not be enough. Security teams also need to prevent agents from changing the rules designed to constrain them.
“An AI agent with admin rights can change them, just as an administrator or an attacker can,” said Andrea Sivieri, chief product and technology officer at CoreView, which specializes in Microsoft 365 management and security.
Sivieri said companies need visibility into what each agent can access. They also need to monitor configuration changes and, if necessary, reverse those that compromise security or governance.
The first challenge is knowing where AI agents are operating and what they can access. Eric Parizo, president and chief analyst at Cernivera Research, points to a recent survey from the Cloud Security Alliance, which found that 82% of enterprises had discovered previously unknown AI agents in their environments over the past year.
“Teams can’t assess risk or propose controls for agents they haven’t found, and many can’t say where agents are running, what data and systems those agents can reach, or what they are doing,” Parizo said.
But finding those agents is only the first step. Parizo said security teams also need controls that limit what agents can do without disrupting the business processes they support. One promising approach is to limit each AI agent’s access to what it needs to do its job. Organizations can then monitor agent activity and automatically step in when it violates security rules, Parizo added.
Narrow scope vs. unbounded risk
Mark Ehr, principal research analyst at 451 Research, said keeping agents narrowly focused can make them easier to monitor.
“Another challenge is creating agents that ideally have a very limited scope, which makes it easier to detect when their actions potentially stray from their intended purpose,” said Ehr.
Those concerns show up in the Illumio survey results. More than three in four (76%) companies had at least one AI-related security issue or a warning sign in the past year. More than one-third (35%) said AI recommended something that, if followed, would have created a security issue. Another one in four (26%) said an AI agent or tool had connected to systems without approval from security teams.
Even more eye-opening for CISOs is that 56% of respondents in the Illumio research said they are willing to accept more risk if it means their companies can unlock more value from AI. Furthermore, controls that define and enforce limits on what AI can access were among the top priorities for only about one in four companies surveyed.
“The biggest AI risk may not be a system that breaks its rules,” said Nandakumara. "It may be one that was never given meaningful limits in the first place.”
Craig Galbraith is the founder and owner of Galbraith Multimedia, an independent journalism company that provides writing, editing, video hosting, podcasting, onstage presentation and consulting services to the technology industry.
