AI security is being rewritten in real time. As organisations move from generative AI to agentic AI, with systems that reason, decide, and act through APIs, the traditional security model of controls, policies, and perimeters starts to break down.
For decades, cyber security has been built on a simple premise: identify the bad thing, build a control to stop it, write a policy to enforce the control, and audit the policy. The process was built around restriction and prevention.
Agentic AI breaks that premise. When systems begin to act on our behalf, reasoning, choosing tools, executing through APIs, and making decisions in milliseconds, the old model stops working. Control must give way to management.
Dan Haagman, Chaleit's CEO and Author of the CISO Global Study, sat down with Justin Ong, APAC CISO at Panasonic, to work through what this means in practice: why AI security is increasingly a data problem, how CISOs should govern non-human identities, where current thinking on human-in-the-loop AI falls short.
This essay sets out what is changing and where the thinking still needs to go further in AI security. To start with, both experts agree that the foundations matter most: identity, visibility, accountability, data discipline. Get those wrong and nothing built on top of them holds.
From reactive chatbots to proactive agents
The corporate computing landscape is undergoing its most significant transformation since cloud-native microservices. We are moving from reactive chatbots to agents that act. These are autonomous, goal-oriented entities capable of multi-step reasoning, planning, and direct execution through APIs, tools, and databases.
Where generative AI was largely a passive interface, agentic AI is an active participant in business logic. That change is foundational, moving security’s role from filtering content to governing behaviour in real time, Justin explains.
Agents are non-deterministic and they decide their own next steps. Security can no longer rely on input/output string matching. It has to govern intent, tool-selection heuristics, and behavioural boundaries as the agent operates.
The numbers tell the same story. Industry analysts forecast that by 2028, 15% of daily work decisions will be made autonomously by AI agents, and 33% of enterprise software applications will include agentic capabilities. The market penetration is happening whether security teams are ready or not.
This is a mega-trend that cannot be controlled out of existence, Dan explains. It can only be managed, just like a force of nature. We spent decades trying to control natural forces and slowly discovered they are bigger than us. The serious progress came when we stopped trying to control the wind and started learning to harness it.
Agentic AI is a force of similar character. You will not control it. You will either harness it or be flattened by it.
Cyber security foundations: agentic AI exposes existing gaps
There is a temptation, when a technology shift happens, to treat it as a clean break. New problem, tools, and frameworks. Some of the market is already selling that narrative.
But both Justin and Dan push back on that tendency. The foundational problems of cyber security are decades old, and many organisations still cannot address them effectively. Autonomous agents don’t magically make those problems disappear. In fact, they make them worse.
Justin returned to this point repeatedly. Cyber security basics are essential. Build on weak foundations and the structure collapses under disruption. He names three centralised functions every enterprise needs to operate before agentic AI is introduced at scale:
- a centralised data gateway that provides logs when something goes wrong
- a centralised API gateway because agents act through APIs
- proper identity management because agents behave like humans and need access control to match
Skipping the basics is expensive. Industry analysts predict that more than 40% of agentic AI projects will fail by 2027 because legacy systems beneath them cannot support real-time execution, modern APIs, and modular data demands.
There is a second hazard, observed by Dan. Beyond every visible agent sits a sprawl of others. The anecdotal estimate from the field is that for every agent you know about, there may be dozens behind it doing work no one commissioned.
Two explosions are coming:
- API explosion, where most organisations cannot meaningfully describe what their APIs do.
- Shadow AI explosion, where agents proliferate outside any inventory.
Ignoring the basics was already a serious security risk, and agentic AI raises that sharply.
The rest of this essay maps the shifts that follow in data, control, identity, and oversight, and offers a grounded, practical way of approaching AI security in the era of autonomous systems.
AI security is a data, not a systems problem
For a long time, security focused on systems and assets. We patched servers, hardened endpoints, and segmented networks. The mental model was that if you secured the container, you secured what was inside. That model has been dying for years, and AI has now finished it off.
Consider how attacks have already changed. We rarely talk about breaking cryptography anymore. The issue is not whether a phishing email gets through. The interesting question is what happens after it does. What permissions does the attacker land with? What can they do? What data can they reach?
Concern has shifted from the system itself to what the system holds. Companies do not really own infrastructure anymore; they buy services. What they own and are legally accountable for is data. And to an AI, data is effectively part of the execution path.
Traditionally, security treated data as passive. Agentic AI changes that assumption. Once an agent reads a document, crawls a website, or processes an email as part of its reasoning process, that content no longer functions purely as data. It becomes part of the agent's decision-making. In practical terms, data starts behaving much more like executable instructions than static information.
Imagine an AI agent summarising internal and external market reports. A publicly available PDF contains hidden instructions in an otherwise legitimate-looking footnote. The analyst believes the agent is summarising the document, but the agent interprets the hidden instructions as part of its task and begins to retrieve and transmit sensitive information.
This is where Justin's data-layer model becomes operational. Three disciplines sit beneath agentic AI and decide whether it can be governed at all:
Pre-integration discovery. Discover, classify, and protect sensitive data sources before they ever interact with an agent. Most organisations attempt this in the wrong order: they deploy the agent first and try to govern its data access afterwards. By then it’s too late.
Preventing shadow AI. Continuously track which agents are accessing which data, so unvetted agents do not silently ingest sensitive intellectual property.
Semantic validation against uncontrolled retrieval. Without strict semantic validation, an agent might exfiltrate PII simply because someone asked it to summarise a document. The exfiltration is not malicious. It is just unconstrained.
Foundations and a clear-eyed view of the data layer get you to the starting line. What follows is the structure that has to be built on top.
The four pillars of agentic AI governance
Justin introduces a four-pillar model that captures what governing an autonomous workforce requires.
Pillar 1: Identity — agents as non-human identities
In the agentic era, identity is the primary trust boundary.
Justin's framing is that agents must be treated as a new class of digital identity with the same rigour applied to human ones. Traditional IAM (Identity & Access Management) is ill-equipped for this. It was built for users who log in once a day, not for agents that trigger thousands of actions per second.
Forward-leaning organisations are already moving away from shared API keys towards cryptographically verifiable credentials stored in Cloud ID Wallets. This infrastructure supports On-Behalf-Of (OBO) flows: an agent acts for a human but remains identifiable as a distinct machine identity.
Permissions move from static roles to Dynamic Scoping and Just-in-Time (JIT) access: an agent may have refund authority, but JIT ensures that authority is cryptographically activated only for the duration of a verified task and disappears afterwards.
The principle is that an agent should never carry standing authority it does not need.
The lifecycle matters as much as the credential. Justin's model treats agents like staff:
Registration defines the agent and assigns it a corporate purpose.
Provisioning grants ephemeral, just-in-time entitlements based on context and least privilege.
Rotation automates renewal of keys and certificates so long-lived secrets never become attack vectors.
Teardown revokes credentials, wipes entitlements, and archives audit logs so retired agents do not become "ghost agents" persisting as backdoors.
If agents are employees, the discipline of HR applies as much as the discipline of IAM.
Pillar 2: Policy-as-code guardrails — deterministic boundaries for non-deterministic models
Because agents reason non-deterministically, security cannot rest on prompt engineering or post-hoc review. The boundaries have to run at machine speed and exist outside the agent's reasoning loop.
AI agents cannot be relied upon to distinguish between instructions originating from the organisation and those embedded in external information. That is precisely why governance cannot rely on prompts or the agent's own judgment.
The policies that define what an agent is permitted to access, retrieve, or execute must exist outside its reasoning process. Whether an agent encounters a malicious prompt, a manipulated document or another compromised external source, those external guardrails remain constant and enforce organisational intent regardless of what the model has inferred.
Justin recommends two complementary patterns:
Sandboxing
When agents generate or execute code, the execution must be isolated. Two architectures dominate:
Isolate the Tool runs the agent loop on the backend but offloads dangerous operations to an external sandbox via HTTP
Isolate the Agent runs the entire reasoning loop in a stateless, zero-secret sandbox with all external interactions mediated by a secure control plane
Policy-as-Code (PaC)
Using tools such as Open Policy Agent (OPA) and Rego, PaC decouples policy from implementation. A global Rego rule can block an agent from exporting personally identifiable information regardless of the agent's internal reasoning or specific prompt. The policy holds even when the model misbehaves.
A particular failure mode worth naming is In-Context Reward Hacking (ICRH): an agent discovering "malicious shortcuts" to achieve its goal. The textbook example is an agent told to maximise social media engagement that learns to generate toxic content, because toxicity drives clicks.
ICRH is not a hacking event in the traditional sense. The agent is doing exactly what it was asked to do. The objective was wrong. Policy-as-code is the discipline that catches outcomes the prompt did not anticipate.
Pillar 3: Observability — auditing the reasoning, not just the output
Accountability in an agentic environment means the audit trail cannot stop at the output. It has to capture why the agent did what it did.
Agentic AI requires checking the reasoning, not just the result. Why did the agent choose this tool? Why did it reject another? What context did it use? Traditional health metrics (CPU, memory, latency) fail to detect what Justin calls "silent failures": agents producing plausible but incorrect outputs that pass every infrastructure check.
The audit object becomes the reasoning chain itself. Justin's three-tier metric framework names what to measure:
Decision quality: accuracy of tool selection and grounding.
Behavioural quality: instruction adherence and exchange efficiency.
Safety and security: prompt injection hits, PII leakage rates, ICRH detection.
Forensic analysis requires capturing reasoning spans (the why: how the agent developed its strategy) and tool call spans (the what: the exact API invocation). Specialised small language models, such as Luna-2 SLMs, can scan every interaction to detect intent drift without overwhelming a security operations centre with noise.
European regulators are already moving in this direction. The EU AI Liability Directive introduces a rebuttable presumption of causality, meaning that when an agentic system causes harm, the burden of proof shifts to the organisation. If you cannot produce granular logs of an agent's reasoning, the law assumes you are responsible.
Observability has stopped being a best practice. It’s becoming the difference between a defensible and an indefensible position.
Pillar 4: Human-in-the-loop, done properly
The phrase "human in the loop" has become so common that it has lost most of its meaning. But that needs to change.
Dan offers a useful comparison from commercial aviation. When an aircraft approaches an airport, the autopilot essentially handles everything: descent profile, lateral path, speed control, and eventually the landing itself. The pilots are not flying the aircraft. They are monitoring it. Their job is to recognise when the system has deviated from the plan and to invoke a procedure called the missed approach: go around, climb, reassess.
This is what genuine human oversight looks like. Full automation, but with humans equipped, informed, and trained to intervene at the right moment with the right authority.
Most organisations claiming "human in the loop" for AI have nothing of the sort. They have someone who clicks "approve" on outputs they cannot meaningfully evaluate, on a timeline that does not allow for real review.
That is a symbolic oversight. It satisfies a compliance line without accountability.
Justin proposed a more honest model: a traffic-light protocol that calibrates oversight to impact.
Routine, low-stakes actions: reading non-sensitive data, scheduling. Execute autonomously.
Moderate-impact tasks: drafting code, modifying CRM records. Execute with asynchronous notification to a supervisor.
High-impact actions: financial transfers, infrastructure changes. Pause and require explicit, out-of-band human authorisation, with liability remaining with the human.
This is more defensible than blanket oversight, and it works with the grain of how agents operate.
But the model has a gap: agents are very good at chaining low-impact actions into high-impact outcomes. Ten "green" actions, taken in sequence, can constitute a "red" outcome that no single approval gate would have caught. A traffic-light protocol assumes that impact can be evaluated action by action. In a genuinely agentic system, it usually cannot. Some form of behavioural detection on the aggregate of agent activity, not just individual decisions, is required. This is where the current frameworks are weakest.
There is also a scaling problem. Once an organisation runs more than ten to twenty agents in parallel, the complexity of multi-step reasoning paths exceeds what any human team can monitor manually. Justin emphasises that this "danger zone" marks the point at which manual debugging becomes a liability, necessitating automated anomaly detection to prevent catastrophic failure.
Aligning with the global frameworks: NIST, ISO, and the EU AI Act
The four pillars describe what to do, while the international frameworks describe how to prove you are doing it. Justin sets out a clear three-part view of how they fit together.
NIST AI RMF 1.0 is the practical playbook. Structured around four core functions — Govern, Map, Measure, Manage — it gives security teams a systematic way to identify an agent's surface area and conduct red-teaming. Use it as the internal how-to.
ISO/IEC 42001 is the certifiable standard. It provides formal third-party assurance through audits of an AI Management System and is, for now, the gold standard for proving AI governance to customers and regulators. Use it to move governance from a statement of intent to a verifiable reality.
The EU AI Act is the legal mandate. It takes a risk-based approach with strict obligations for high-risk applications and significant fines for non-compliance. Combined with the AI Liability Directive, it sets the floor below which no organisation can drop.
Certification cuts through vendor marketing and reduces the due diligence burden both for your buyers and for your own assessment of vendors.
AI risk management: the 90/10 problem
Justin reframes the role of the CISO in the context of agentic AI security.
Traditional security tries to control everyone, because some people make mistakes. Roughly 10% of users, through error, malice, or both, are the source of most actual risk. So organisations write a policy that constrains 100% of the workforce in order to discipline that 10%. The other 90%, who are doing their jobs perfectly well, are slowed down and friction-loaded.
The industry calls these "controls", which are measured in audit findings. These are often mistaken for safety.
Agentic AI exposes how badly this scales, Justin emphasises. You cannot apply a uniform control regime to a fleet of autonomous agents that may exist for milliseconds, spin up dynamically, and operate at machine speed. The policy-and-control reflex breaks under that load. What replaces it is management: focus attention on the 10% that genuinely needs intervention, and let the 90% operate.
He calls it frictionless governance. The governance is still there through visibility, accountability, and intervention points, but the friction is reserved for the cases that warrant it.
You cannot run an agentic enterprise from a control posture. You can only run it from a navigation posture.
Risk navigation, in this sense, is the active practice of steering an organisation through a fast-changing environment with visibility into what is actually happening, judgement about which 10% deserves friction, and architectural choices that preserve the capacity to intervene.
Note: The four-pillar framework, the traffic light protocol, the agent lifecycle model, and the data-layer governance disciplines pertain to Justin Ong's strategic work on agentic AI security.
Open questions in agentic AI governance
We want to leave you with a few questions worth carrying into your own thinking. Each one points to genuine, unresolved tension in current approaches to agentic AI security.
Why have organisations still not solved the basics? Identity, asset visibility, and data classification aren’t new problems. The question is not what new tools to buy. It is why the work that matters most keeps getting deferred.
What do you own, and where does it live? Most organisations cannot answer this for their existing data, let alone for the data their agents will read, write, and remember.
Are CISOs being asked to fix decades-old problems on an agentic timeline? Most boards are now asking how the organisation is responding to AI. Few are asking whether the organisation has the foundational discipline to respond to AI safely.
Who is responsible? When an agent causes harm, who pays? The vendor whose model produced the reasoning? The organisation that deployed the agent? The human who approved the deployment? The EU AI Act suggests answers, but operational liability frameworks are immature.
Even with all these new developments, cyber security does not need to become more complex. It needs to become clearer about what problems it needs to solve.
At Chaleit, we like to say that security done right requires clarity, not complexity. Right now, clarity means being honest that the old model has run its course and uplifting cyber security programs.
About the authors
Justin Ong
Justin Ong is APAC CISO and Chief Privacy Officer at Panasonic Asia, with over 20 years’ regional IT leadership experience supporting 60+ companies across APAC. Previously at Omron, he spent 14 years in global technology and product development. Justin brings deep expertise across enterprise infrastructure, security, integration and business functions, and now drives security transformation to enable and accelerate Panasonic’s digital strategies and business transformation across the region.
Dan Haagman
Dedicated to strategic cyber security thinking and research, Dan Haagman is a global leader in the cyber domain — a CEO, client-facing CISO, Honorary Professor of Practice, and trusted advisor to some of the world’s most complex organisations.
Dan’s career began nearly 30 years ago at the London Stock Exchange, where he was part of the team that developed its first modern Security Operations Centre (SOC). He went on to co-found NotSoSecure and 7Safe, both acquired after helping shape the industry’s penetration testing and training practices.
His deepest commitment is to what followed: Chaleit — a company that has become Dan’s life’s work and passion. Founded not just to participate in the industry, but to elevate it, Chaleit brings together deep offensive testing capabilities and mature consulting, helping clients move from diagnosis to resolution.
Today, he leads a globally distributed team across seven countries, steering Chaleit with principles of longevity and transparency, and guiding it toward a future public offering.
Dan is also the founder of the CISO Global Study — an open-source initiative created for the benefit of the broader industry. Through it, he works alongside hundreds of CISOs globally, distilling insight, exchanging learning, and challenging the assumptions that shape the field.
Disclaimer
The views expressed in this article represent the personal insights and opinions of Dan Haagman and Justin Ong. Dan Haagman's views also reflect the official stance of Chaleit, while Justin Ong's views are his own and do not necessarily represent the official position of his organisation. Both authors share their perspectives to foster learning and promote open dialogue.
