Why traditional cybersecurity approaches are not enough for AI
AI adoption outpaces most security programs’ ability to adapt. That gap is now one of the most consequential sources of cyber risk facing enterprises. As organizations embed generative and agentic AI into development workflows, business operations, and security tooling itself, the question is no longer whether AI will introduce risk. The question is whether organizations understand where that risk actually lives and how to manage it operationally.
Two recent pieces of guidance underscore this shift:
- The upcoming Cybersecurity Framework Profile for AI from NIST
- The Five Eyes government guidance on the careful adoption of agentic AI services
Taken together, they point to a critical conclusion. AI security cannot be reduced to model hardening or prompt filtering. It requires a defense in depth strategy that treats AI as both a new attack surface and a force multiplier for defense, while accounting for how AI fundamentally changes scale, speed, and autonomy.
Recent threat research suggests that today's cyber risk is driven less by initial compromise and more by an adversary's ability to blend into normal operations over time. AI systems create the same exposure in a new form: more autonomy, more scale, and more opportunities for risky behavior to blend into normal operations.
How NIST defines the three core pillars of AI security
The NIST profile organizes AI risk across three inseparable focus areas that span all cybersecurity functions, Secure, Defend and Thwart. These areas are not sequential. They exist simultaneously and must be addressed together.
Secure
This treats AI as an attack surface. It includes models, prompts, agents, pipelines, training and inference data, retrieval augmented generation corpora, and the AI supply chain itself. AI systems are opaque, probabilistic, and non-deterministic by design. Some vulnerabilities are inherent in how models are trained or how data is sourced. Traditional patching does not fully mitigate these risks. This is also where many enterprises are weakest today and, critically, where many security programs stop.
Defend
This is AI as a defensive force multiplier. AI can improve detection speed, scale, correlation, and response, but only if the right models are used and operationalized correctly. Machine-speed behavior-based detection, response and containment becomes critical in defending non-deterministic systems. Accuracy, explainability, governance, testing, validation, and integration into SOC workflows matter as much as capability. Without those controls, hallucination risk, over automation, and misplaced trust become security risks themselves.
Thwart
This treats AI as an adversarial accelerant. Threat actors are already using AI to generate targeted social engineering attacks, deepfakes, malware, and autonomous attack agents. Asymmetric warfare is highlighting faster vulnerability discovery and exploitation with a lag on patch development, testing and deployment.
How this looks in practice
Darktrace researchers observed scaled, automated exploitation of the React2Shell vulnerability within days of disclosure. A vulnerable cloud asset was exploited in under 120 seconds of being deployed. Darktrace research team observed an AI/LLM-generated malware sample used in exploitation activity tied to React2Shell. The significance isn't novelty. It is that AI lowers the barrier to producing usable offensive tooling and compresses the time between experimentation and deployment.
Tactics are getting more and more creative in order to string together steps of an attack kill chain. This creates a dependency on behavior-based detection, autonomous investigation, autonomous containment, training, resilience investment, and recovery planning across the entire enterprise.
Why agentic AI fundamentally changes enterprise cyber risk
The Five Eyes guidance on agentic AI highlights material changes to the cyber risk profile of an organization. Unlike generative AI systems that produce content for human consumption, agentic AI systems reason, plan, and act autonomously across tools, data, and environments. That autonomy, combined with access to real systems, amplifies the impact of traditional cyber failures and introduces new system level risks that are difficult to predict, observe, and contain.
Risk in agentic systems does not live in the model alone. It emerges from interactions between models, prompts, memory, tools, APIs, identities, privileges, inter-agent trust relationships, and human assumptions baked into design. Vulnerabilities are often introduced through data, connectors, natural language interfaces, protocols, and drift by design.
In supply-chain incidents, attackers did not need sophisticated exploits to scale impact. They abused trusted systems built for automation and implicit access. Agentic AI inherits that model. Once a system can act across tools, data, and workflows, compromise propagates through trust relationships that were never designed for machine autonomy.
The major agentic AI risk classes include the following:
- The identity control for non-human identities or autonomous agents makes it difficult to mitigate over-permissioning, limiting access, scope, and duration, as well as access hygiene
- Agents are frequently over permissioned
- Compromised tools inherit agent authority
- Static secrets enable impersonation
- Implicit trust between agents enables lateral movement
Design and configuration risks compound this, including privileges evaluated once at startup, poor segmentation, unvetted third party tools, reused authorization decisions outside their original context, and guardrail limitations.
Behavioral risk
Agents can optimize for goals in unsafe ways, misinterpret ambiguous intent, chain actions into unintended sequences, change behavior during evaluation, and exhibit deceptive or sycophantic responses.
Structural risk
Structural risk follows from agentic systems that are tightly coupled, multicomponent ecosystems. Failures can propagate across agents. Hallucinations cascade downstream. Resource exhaustion becomes systemic. Tool misuse enables indirect prompt injection and command execution. Rogue agents can poison peer agents through trust relationships.
Accountability
Accountability becomes unclear as autonomy increases. Autonomous agents assume human identity permissions, and humans should have clear ownership of these agents, but they don’t, and this model is flawed. Decision paths are opaque and non-deterministic. Logs are fragmented and difficult to interpret. Reproducing an incident will be impossible without explicit design for observability and forensics. An agent compromise is functionally an insider threat, often with better access and fewer behavioral constraints than a human.
What does defense in depth look like for AI?
Agentic AI runs on software, networks, identities, and data. It must be governed using the same foundational principles that have proven resilient under uncertainty, including secure by design, defense in depth, zero trust, least privilege, continuous monitoring, behavior-based advanced threat detection and containment, and incident response and recovery.
Core components to a Defense in depth Strategy for Securing the use of AI:
- Strong, precise identity control plane to include an identity per agent (cryptographic, non‑shared)
- Privilege monitoring and just‑in‑time access
- Secure‑by‑default configurations
- Security Posture Management
- Zero Trust principles
- Strong guardrails, deny‑by‑default policies, and isolation
- Explicit instruction hierarchies and controlled context
- Behavioral-based detection across entire enterprise to include inputs, tools, and outputs as well as AI used on the endpoint, across the network, cloud, SaaS, email, and OT
- Runtime anomaly detection and goal‑drift detection
- Autonomous containment to mitigate risk and minimize damage
- Hard boundaries on autonomy and delegation
- Testing, Evaluation, Validation and Verification
- Determine when autonomous action and when human in the loop
- Adversarial training and agent‑specific testing
- Simulation, red teaming, and chaos testing
- Kill‑switches, rollback, and containment mechanisms
- Forensics data captures, interpretability, autonomous containment, and remediation/recovery plans
Until standards, tooling, and assurance methods mature, organizations should assume agentic AI systems will behave unexpectedly and design deployments around resilience, behavior-based detection, reversibility, and containment, not efficiency.
How security leaders should prepare for enterprise AI adoption
AI security is not model security alone. Data, pipelines, identities, and agents are first class assets. Many AI attacks succeed through standard cyber failures amplified by AI. Identity, data, and supply chain risk dominate. Behavior-based detection and response are critical, not optional. Logging, provenance, versioning, and forensics data capture of detections are mandatory because you cannot investigate or recover from AI incidents without them.
Risk will often be visible in behavior before it is clearly defined in policy or guidance. The same pattern has been seen in pre-CVE disclosure detection, where abnormal activity appears before the industry has named or described the vulnerability. AI systems introduce that uncertainty by design.
Security leaders should prioritize controls before AI is fully deployed, avoid generic AI security checklists, integrate AI risk into existing cyber programs, and mitigate the risk of non-deterministic technology with continuous oversight, monitoring, behavior analytics, anomaly detection, autonomous investigation, and autonomous containment.
Visibility has a different connotation with AI. Previously, audit logging worked for software/people, but with Generative AI-based systems, interpretability and explainability is difficult to understand, you cannot "undo" what has been done, or see the logic or control a chain of events. This is why behavioral-based detections and containment becomes critical.
What capabilities should every AI security program include?
If an organization asked “what must be in place before scaling AI?”:
- AI Risk board and approval workflow
- IAM + PAM for all AI services and agents
- AI asset inventory
- Prompt/output DLP with sanctioned AI access – This is not just pre- and post- filters, but behavior-based detections of semantic interface as well as behavior-based analysis of output with associated risk context.
- Shadow AI identification
- Secure MLOps – This is an entire paper itself
- Runtime guardrails and tool restrictions
- Including AI Gateway/SASE/Zero trust/
- Runtime security with behavior-based detections
- Complete visibility, monitoring, behavior analytics, anomaly detection, risk/intent/context evaluation of anomalies, autonomous investigation and autonomous containment of all AI assets across endpoint, network, SaaS, SASE, cloud, OT, email, and messaging platforms
- Secure data pipelines and data governance
- SOC workflow changes from malicious classification workflows to behavior-based detection workflows
- Remediation plans for AI-related incidents
Layered Governance and Security Stack for Securing AI
The following outline considers governance and security tools that should be considered, well-integrated, deployed, tested, operationalized and embedded within security workflows. These tools and controls map to NIST’s CMF for AI.
These considerations do not need to be implemented in order. Runtime Detect and Respond will help mitigate risk while Governance, Visibility, and Identity mature.
| Category |
Tooling |
Controls |
| Governance & Visibility |
- AI asset inventory / AI CMDB
- Shadow AI discovery
- SaaS discovery
- AI usage on non-endpoint managed systems via network or cloud telemetry
- MCP server/client usage via protocols
- Browser telemetry
- Gateway or SASE telemetry
|
- Establish a risk board to set up controls
- Mandatory registration of AI systems
- Owner, data classification, intended use, and risk tier
- Supplier disclosure requirements
- Risk mitigation plan for AI adoption, innovation, or development
|
| Identity, Access & Agent Control |
Non-human autonomous agents should not have the full permissions associated with a human user.
- IAM with workload identities
- PAM for AI service accounts
- Secrets management with short-lived tokens
- Zero Trust principles
- Identity, permission, and token hygiene
|
- Unique identities per model, agent, and pipeline
- Least privilege for tools, data, and APIs
- Explicit approval for autonomous actions
|
| Data Security & Privacy |
- Data classification and labeling
- Enterprise DLP across endpoint, email, network, cloud, and SaaS
- Forensics data capture after risky detections
|
- Prompt-level DLP through behavior-based semantic analysis with risk and intent context
- Input/interface analysis for risky data requests
- Output analysis for sensitive data
- Data integrity evaluation
- Retention and redaction policies for prompts and responses
|
| Secure MLOps / LLMOps |
- Secure CI/CD with AI-specific gates
- Model registries with approval workflows
- Dependency, container, and artifact scanning
- SBOM/AIBOM generation
- IaC security scanning
- Security posture management
- Misconfiguration identification
- Hardening recommendations
|
- Signed models and prompts
- Versioned datasets, configurations, logging, and controls
- Securing data pipelines
- Controlled promotion
- Quality assurance
- Adversarial testing
|
| Runtime Security |
Securing runtime goes beyond guardrails and model firewalls to include behavior-based detections, response, and containment.
- Detection, monitoring, and SOC integration
- Centralized visibility into prompts, outputs, and tool calls
- AI-specific detections
- Behavior-based detection for AI usage patterns
- Model drift and behavior monitoring
- Autonomous containment
- Behavior-based detection of model inputs and outputs
- Prompt injection detection
- Model manipulation, including jailbreaking, poisoning, and related attacks
- Sensitive data access attempts
- Behavior-based detection across low-code agents, high-code agents, MCP clients and servers, endpoint, network, cloud, email, SaaS, SASE, IoT, and OT
|
- Policy enforcement between users, models, tools, agents, SaaS models/tools, and MCP servers/clients
- Risk, intent, and context evaluation for detections and response actions
|
| Response & Recovery |
- Autonomous containment
- AI-assisted playbooks
- Forensics data capture for AI-related events
- Model rollback mechanisms
- Backup and restore for models and datasets
|
- Kill switch for agents
- Autonomous response to agents performing risky behaviors
- Model and dataset rollback
- Remediation plans
- Tabletop exercises
- Supplier coordination plans
- Post-incident AI performance validation
|
AI security requires continuous visibility and behavioral detection
AI changes how fast systems move, how decisions are made, and how risk propagates. It does not change the fundamentals of security. Organizations that succeed will be the ones that apply those fundamentals rigorously, assume failure, and build systems that can detect, contain, and recover when AI behaves in ways they did not anticipate. Security is not what AI is allowed to do. It is whether the organization can understand, trust, and control what AI actually does in practice.
Take this guidance to understand different initiatives that organizations should be considering. Securing AI is the most critical component to AI safety. As organizations invest more in AI adoption, they should be investing in security in order to mitigate the risk of AI adoption. Organizations should be evaluating their governance and security stack to include well-integrated tools that are deployed, tested, operationalized and embedded within security workflows. While organizations mature in governance, visibility and identity access management, they should be investing in behavior-based detection and autonomous containment to mitigate AI risk.
.avif)
