This content is sponsored by FIOR Group.
The volume of AI agents operating in enterprise architecture has surged during the past 18 months, creating significant cybersecurity challenges for organizations.
Businesses are suffering from a lack of visibility and control over the activities of these agents, which are capable of accessing data, interacting with systems and taking action independently. This can lead to AI agents gaining unauthorized access to sensitive systems and data, resulting in damaging cybersecurity incidents.
Current security approaches, including in security information and event management (SIEM) and identity and access management (IAM), are designed to manage human users. They are ill-equipped to manage the activities of AI agents, which operate at machine speed and are relentless in pursuing their goals, deploying increasingly creative and unpredictable approaches to achieving them.
On October 8, 2026, Infosecurity Magazine hosted a webinar titled Who Authorized That Agent? Enforcing AI Authority Before the Action, sponsored by FIOR Group, to examine this issue in depth and discuss how security teams must adapt their approaches to govern AI agents.
A distinguished panel of speakers provided their insights for the webinar. These were James Patrick, chief technology officer at FIOR Group, Gemma Ungoed-Thomas, senior advisor on cyber, resilience & emerging tech and a former director for state threats, cyber and technology in the UK Cabinet Office, and Lt Gen Sir Tom Copinger-Symes, former deputy commander of the UK’s Cyber & Specialist Operations Command.
The Unique Threat Posed by AI Agents
The webinar began with a presentation by Patrick, which offered context around the current risks posed by AI agents. He first set out FIOR Group’s mission: to provide the identity and enforcement layer for AI agents and autonomous systems, giving every agent a verifiable identity and enforcing what it is allowed to do before it acts.
“Organizations should be able to adopt agentic AI at scale without surrendering control of what they can actually do,” he explained.
Patrick noted that there are many real-world examples of agents undertaking actions outside of their intended scope, including hacking third-party systems. This was demonstrated by the breach of healthcare data in an Australian government portal by an OpenAI agent in June 2026.
Most security controls today are set up to manage human users’ activities in the scope of a single session. Agents can act well beyond this scope, gaining unauthorized access with delegated credentials – essentially borrowed authority that is usually not checked or reviewed by IT teams.
“We aren’t setting up service accounts anymore, we are giving these machines part of our own identity and permissions and unleashing them on the world in a goal-orientated way,” Patrick said.
Agents also communicate with other agents, including delegating tasks to those that can access systems that the original could not reach.
Current IAM and privileged access management (PAM) tools cannot manage the creativity, speed and relentless nature of AI agents, he noted.
In this environment, Patrick emphasized the need for a new security layer that separates AI’s probabilistic reasoning from deterministic security enforcement.
In this model, all agents should be issued a unique and revocable cryptographic identity.
Every consequential agent request should be overseen by a human user, enabling actions to be approved or denied at runtime.
Organizations should also ensure there are named individuals who are accountable for the actions of specific agents operating in their environments. This will create an audit trail of every agent action and every decision made by the human user responsible for that agent.
Patrick concluded the presentation by setting out three questions organizations should be able to answer in the context of agentic AI security. These are:
- How many agents do we run, and who is responsible for each one?
- What can each agent reach, and who approved that?
- If one goes wrong at 3am, how fast can we stop it, and what evidence do we keep?
Commenting on the responses to the first poll question, Patrick said he was not surprised to see such a mixed level of agentic AI adoption, and the high proportion of respondents who are unaware of the number of agents operating within their environment.
He noted that software vendors are constantly deploying new agents through their products, often without end users’ knowledge.
“The security question changes from which AI products we have approved and we know about to what machine actors are operating in my environment right now that no-one’s told me about – that requires continuous discovery rather than a spreadsheet or a static assurance accreditation piece,” Patrick explained.
The Macro-Level Threat of Agentic AI
At the start of the panel discussion, Copinger-Symes outlined his particular concerns about the threat AI agents pose to operational technology (OT) environments, their potential use in influence operations and their role in exacerbating shadow IT risk.
“When you’ve got agents working as shadow IT, clearly the insider threat gets more powerful and difficult to control,” he said.
Ungoed-Thomas, citing her experience working in the UK government, noted that the rise of AI agents comes amid a febrile geopolitical environment, which makes the security of these tools a major priority for policymakers. She added that agentic AI adoption is currently outpacing governance approaches.
Reflecting this focus, the UK’s National Cyber Security Centre (NCSC) published guidance in August 2026, which offers practical security advice for organizations deploying AI agents.
While such guidance is a positive step, Ungoed-Thomas expressed concern that government cybersecurity messaging over the past decade has not been acted on by many of the organizations it targets. As a result, many still lack resilience against even relatively unsophisticated attacks.
“The current challenge is translating all of this messaging into operational decisions,” she commented.
Both Ungoed-Thomas and Copinger-Symes agreed that agentic AI governance is a business problem – not one that should be solely the responsibility of the CISO.
The Need to Move to Deterministic Controls for AI
AI models are often described as probabilistic, as they make decisions and generate outputs based on predicted outcomes rather than fixed rules.
Patrick said that the unpredictable nature of how AI agents act means a separate, deterministic approach to governing these models must be established, in which every agent’s actions are allowed or denied based on definitive policies.
“If policy says an agent can’t access a production database, it doesn’t matter how persuasively that agent argues it should be able to access it – it has to be a hard control,” he said.
“The model can decide what it wants to do but it should never be the final arbiter on whether it is allowed to do it,” Patrick continued.
Ungoed-Thomas emphasized that such an approach will be a significant challenge for CISOs, with agentic AI adoption already so high and many organizations operating complex legacy systems.
“We need to look at how we can equip network defenders with adequate tools and assurance mechanisms in real time – it’s not just as simple as detection,” she noted.
Identity Is Key to Agentic AI Governance
Copinger-Symes emphasized that identity is fundamental to building a deterministic model of agentic AI governance.
Only once an identity is assigned to each AI agent can access controls be applied and human accountability be established.
“If you’ve got an agent doing activities inside your infrastructure, you’ve got to know what that agent is, what it is allowed to do, what it’s not allowed to do, in the same way as we onboard human beings – we don’t just let the intern behave like they’re the CEO,” he explained.
Patrick said it is important to treat machine identities separately from human identities given their differing behaviors and capabilities – requiring clearer guardrails for machines.
FIOR has created an approach to machine identity that aims to complement, rather than replace, existing identity models built around human behavior.
“We want to give people a recognizable system where they can identify these agents – who owns them and how policy is applied and make sure they’ve got an audit trail all the way through,” Patrick outlined.
Ungoed-Thomas noted that in the current geopolitical environment, where no minimum security standards have been placed on frontier AI companies, firms like FIOR are offering a vital level of assurance by enabling organizations to have oversight and control over the agents operating in their environments.
In a final takeaway message, Patrick urged security leaders to consider the three questions he set out in his opening presentation as the foundation for building an effective agentic AI governance strategy.
“If your vendors can’t help you answer those questions then cast your net a bit further until you get better answers,” he advised.
