Security Was Built for Humans. The Enterprise No Longer Runs on Humans Alone.

Cybersecurity has spent decades learning how to distinguish trusted users from attackers. The agentic enterprise complicates that model. An AI agent can be trusted, authenticated, authorized, and functioning as designed, yet still produce an unintended or risky outcome through a sequence of otherwise legitimate actions.

That scenario does not require a malicious agent. It only requires an agent that participates in enterprise activity differently from the humans and static systems that security controls were designed to watch.

Closing the gap between authorized activity and intended behavior requires identity-agnostic security: an approach that applies consistent behavioral risk principles to every identity, human or machine, while preserving the context that makes each one different.

This is the second article in a three-part series. The first, Shadow IT Was Just the Beginning. Meet Shadow Automation, showed how AI agents and automated workflows end up operating outside security oversight.

The Assumption Built Into Traditional Security Models

Most security programs rest on an assumption so familiar that it rarely gets stated: somewhere behind every action, there is a person or a static machine. Traditional models generally expect a person to authenticate and initiate activity. They compare that person against a stable role or peer group, track a recognizable session, assume machines execute deterministic logic, and count on an analyst having time to review and respond.

Traditional security models remain necessary. They were not designed, however, to fully explain autonomous activity that spans identities, systems, and workflows.

Why AI Agents Are an Identity Security Problem

The modern identity surface includes humans, service identities, systems, and AI agents. Non-human identities can request access, move data, and make decisions at machine speed and scale, and their number grows with every new deployment.

Identity expansion changes what identity controls can tell security teams. Authentication establishes who or what presented a credential. Authorization establishes what that identity is allowed to access. Neither one, on its own, determines whether the resulting behavior still matches the identity’s intended role.

Authentication answers the question “Who are you?” It does not answer the question “Should you be doing this now?”

How Authorized Actions Can Create Security Risk

Exabeam research found that sequences of individually authorized actions can reveal behavior that exceeds intended permissions, exposes sensitive information, or creates operational and business risk. The same activity looks very different depending on how closely you examine it.

At the event level, each action appears permitted. At the sequence level, the actions form an unusual or risky progression. At the business-context level, the sequence no longer matches the agent’s intended role or workflow.

Consider an illustrative scenario. An agent retrieves an approved document, summarizes its content, calls an approved API, and sends the result to an approved application. Each step looks routine. The risk becomes visible only when the complete execution chain is evaluated against the agent’s purpose, its historical behavior, the sensitivity of the data, and the destination.

Why Rule-Based Detections Struggle With AI Agents

Rule-based detections are effective for known conditions and explicit violations. An AI agent can create risk without violating a single obvious rule. The meaningful signal may be a change in sequence, frequency, destination, privilege use, or interaction with another identity. That signal often appears only when activity is connected across tools, systems, and time.

Insider risk programs have long recognized that risk emerges through deviations that accumulate across sessions, systems, and identities rather than through one isolated event. Established behavioral frameworks, including the CERT Insider Threat Framework, can extend to non-human identities when they add long-duration correlation and risk-based prioritization. The principles still hold. Their scope has expanded.

How Machine Speed Changes Security Operations

AI agents execute multi-step workflows, operate continuously, interact with multiple systems, and trigger downstream activity without a person approving every step. In many organizations, security operations still runs on a different clock.

Analysts triage alert by alert. They search multiple tools, rebuild timelines by hand, and wait for an identity owner to explain what expected behavior should look like. Too often, response begins only after impact becomes evident. As agents act and adapt at machine speed, security teams need to accelerate detection, investigation, and response without losing context or control.

The Security Assumptions Leaders Should Revisit for AI Agents

Five long-standing security assumptions were reasonable when they formed, and each now needs reinforcement for AI agents.

What Is Identity-Agnostic Security?

Identity-agnostic security applies consistent risk principles to every identity type while preserving the context that makes each one different. It does not mean treating agents exactly like people, or people exactly like agents. In practice, that approach includes the following commitments:

• Apply the same risk principles to humans, service accounts, and AI agents.
• Preserve the context specific to each identity type.
• Establish what expected behavior looks like for each identity.
• Connect activity across systems rather than evaluating tools in isolation.
• Prioritize the deviations that carry meaningful risk.
• Keep human oversight and accountability in consequential response decisions.

Identity-agnostic security reflects how the agentic enterprise actually operates. AI agents work alongside people, service accounts, machines, APIs, and automated workflows, and much of the risk they create appears legitimate at the event level.

Security Must Understand Work, Not Only Access

The agentic enterprise does not eliminate the need for identity controls, rules, or prevention. It raises the bar. Security must understand not only whether an identity was allowed to act, but also whether its behavior still belongs within its intended role, workflow, and business purpose. That expanded responsibility creates new obligations for every organization deploying autonomous systems. When those obligations accumulate faster than the organization can manage them, the result is AI security debt, the subject of the final article in this series.

Frequently Asked Questions About AI Agents and Security Models

Why do AI agents challenge traditional security models?

Traditional security models assume a person or a static machine sits behind every action. AI agents act autonomously, adapt, and work across systems, so they can produce risky outcomes through sequences of actions that are each authenticated, authorized, and legitimate.

Can an authorized AI agent create security risk?

Yes. An authorized AI agent can create risk through a sequence of individually permitted actions. The risk becomes visible only when the full execution chain is evaluated against the agent’s intended purpose, historical behavior, data sensitivity, and destination.

Why aren’t authentication and authorization enough for AI agents?

Authentication confirms who or what presented a credential, and authorization defines what that identity can access. Neither one confirms whether an AI agent’s behavior still matches its intended role, workflow, and business purpose.

How is identity-agnostic security different from treating agents like users?

Identity-agnostic security applies the same behavioral risk principles to people, service accounts, and AI agents, but it keeps the context specific to each identity type. It also keeps human oversight and accountability in consequential response decisions.

Go Deeper

Read Securing the Agentic Enterprise for a lifecycle approach to verifying, observing, analyzing, and improving agent security. For the data behind this article, see The Agentic Insider: From Monitoring to Understanding.