Thought for the week: AI agents raise new cybersecurity and liability questions

To begin your week, a recent Forbes article highlights a growing governance challenge: companies should treat agentic AI as a privileged user and make sure they are building in appropriate security controls. In part, the author writes: 

"An agent that can access Microsoft 365, GitHub, a financial system or an internal database effectively has an identity. If it can call an API, execute code or modify a configuration, it has privileges and authority that need to be managed just like any other privileged identity. For CISOs, that creates a familiar problem in an unfamiliar form. Organizations should be asking these five basic questions:

• Inventory: Which agents are operating in the environment and who owns them?
• Access: What systems, credentials and data can each agent access?
• Authority: What actions can an agent take without human approval?
• Monitoring: Are its activities logged and continuously monitored?
• Containment: Can access be immediately revoked if the agent behaves unexpectedly?"

Several observations on this insightful article from a cyber risk and legal perspective.

Speed and automation are critical for defense

As companies consider these five basic questions, they need to consider these issues from the speed at which these systems can be misused by threat actors and the automation that may be needed to have any realistic chance at monitoring and containment.