Enterprise AI is entering a fundamentally different phase. Until recently, most generative AI systems operated primarily as assistants: employees asked questions, generated content, summarized information or requested recommendations. Agentic AI changes that relationship because AI systems can increasingly interpret objectives, access applications, retrieve enterprise information, call APIs and execute actions with limited human intervention.
For CIOs and CISOs, this creates a new security challenge. An AI agent connected to enterprise systems is no longer simply a tool being used by an employee. Operationally, it begins to function more like a digital participant in the organization, with an identity, permissions, access to information and, potentially, the authority to act.
Google Cloud has described AI agents as the “ultimate insiders,” reflecting how deeply they may become integrated into enterprise systems. Its 2026 State of AI Infrastructure research also found that 79% of technology leaders identify security, governance or operations as their biggest challenge to scaling inference.
The question for technology leaders is therefore changing. It is no longer simply what can AI generate? Increasingly, organizations need to understand what can AI access, what can it decide and what can it do?
From AI Assistant to Enterprise Operator
The distinction between recommendation and action is critical.
Consider an AI system monitoring an enterprise environment. One system might identify a configuration problem and recommend a change to an administrator. The administrator reviews that recommendation, evaluates the consequences and decides whether to implement it. An autonomous agent could potentially identify the same problem, access the appropriate system and perform the change itself.
The underlying intelligence may be similar, but the security implications are very different. The difference is agency.
Importantly, the risk does not require an AI system to become malicious. A legitimate agent could receive manipulated instructions, operate with excessive permissions, access information outside its intended scope or perform an action that is technically authorized but operationally unsafe.
As organizations give AI greater autonomy, security therefore needs to move beyond protecting the model itself. The environment in which that model operates becomes equally important.
Agentic AI Expands the Enterprise Attack Surface
An enterprise agent can potentially connect to databases, cloud platforms, productivity applications, security tools, code repositories and third-party services. Each connection creates another route through which information can be accessed or an action performed.
The emerging security chain increasingly resembles:
AI Agent → Identity → Credentials → Applications → Data → Actions
An agent connected only to an internal knowledge repository presents one level of risk. Give that same agent access to email, customer information, cloud infrastructure and administrative APIs, and its effective capabilities expand significantly.
Microsoft’s 2026 security guidance for AI agents highlights an important dimension of this problem: permissions that appear relatively limited individually can become much more powerful when an autonomous agent is capable of combining access across multiple tools and systems.
That means security teams need to look beyond individual permissions. They must understand the combined capability those permissions create.
Every AI Agent Needs an Identity
Identity management consequently moves to the center of agentic AI security.
Organizations have spent years establishing identity governance for employees, contractors, applications and workloads. AI agents now need to enter the same security model.
Every production agent should have a distinct identity, a documented purpose and a clearly accountable human owner. Organizations should know which credentials an agent uses, which systems it can reach, which information it can retrieve, what actions it can perform and how quickly that access can be revoked.
This is particularly important because convenience can easily lead to excessive privilege. Giving an agent a broad service account may make integration easier, but it can also provide considerably more access than the agent requires to perform its intended function.
The same principle organizations apply to human administrators should therefore apply to AI: least privilege. An agent should receive the access necessary for its specific role and nothing more.
Permission Creep Could Become a Hidden AI Risk
One of the most significant risks may develop gradually rather than through a dramatic security event.
An AI agent might initially be deployed as a read-only assistant. Later, the business asks it to create tickets. Then it receives permission to resolve certain issues automatically. Eventually, it is connected to another application, followed by another database or cloud service.
Over time, an agent designed for a narrow purpose can accumulate privileges across multiple systems.
This makes lifecycle governance particularly important. Permissions should be reviewed as an agent’s responsibilities evolve, and organizations should avoid assuming that access granted during an earlier stage remains appropriate indefinitely.
The challenge is familiar to identity teams, but autonomous AI increases its importance. A human employee with excessive access can create risk. A machine identity capable of operating continuously and at software speed can potentially amplify that risk.
Zero Trust Has to Include AI
Zero Trust is based on the idea that being inside the enterprise environment should not automatically create trust. That principle needs to extend to autonomous AI.
An authenticated agent should not automatically be considered a trusted agent.
Organizations need to verify identity, restrict resources, constrain available tools and continuously evaluate activity. Security teams should therefore monitor more than successful logins or authentication attempts. They need visibility into whether an agent’s behavior remains consistent with its intended role.
If an agent suddenly begins accessing a database outside its normal workflow, dramatically increases its API activity or attempts an unfamiliar administrative action, the organization needs the ability to detect and investigate that behavior.
This changes the security question from “Was the agent authenticated?” to “Is the authenticated agent behaving as expected?”
That distinction will become increasingly important as autonomous systems proliferate.
The Real Question Is Where Autonomy Should Stop
Greater autonomy is one of the primary reasons enterprises are interested in agentic AI, so requiring human authorization for every action would undermine much of its value. At the same time, unrestricted autonomy is unlikely to be appropriate for every workflow.
Organizations need to establish boundaries based on consequence.
Routine, reversible and low-risk actions may remain automated. Higher-impact activities, such as changing security controls, modifying privileged access, deleting critical information, exporting sensitive data or making irreversible production changes, may require additional authorization.
The objective is not to place a human between the agent and every decision. It is to ensure that the level of oversight increases with the potential impact of the action.
For CIOs, this creates an important governance principle: autonomy should be proportional to risk.
AI Governance Becomes Harder at Scale
Managing one production agent is relatively straightforward. Managing hundreds or thousands creates a very different challenge.
Different departments may independently deploy agents for customer service, finance, software development, infrastructure management, cybersecurity and internal productivity. Individually, each deployment may appear manageable. Collectively, they can create a rapidly expanding population of non-human identities with different credentials, permissions and data access.
This is where AI governance begins to converge with security governance.
Organizations need visibility into which agents exist, who owns them, why they were created, which systems they can access and what actions they are authorized to perform. They also need processes for reviewing those permissions and retiring agents that are no longer required.
The principle is straightforward: an organization cannot govern an AI agent it does not know exists.
Creating an enterprise inventory of agents and their privileges should therefore become an early component of agentic AI adoption rather than something introduced after deployment reaches scale.
AI Security Is Also a Data Resilience Problem
Identity and access controls are essential, but they address only part of the risk.
Once AI agents can interact with production systems and enterprise data, organizations also need to consider what happens when an incorrect or compromised action succeeds.
An agent could accidentally modify or delete important information. Compromised credentials could allow an attacker to use a legitimate agent. Manipulated instructions could cause authorized tools to perform destructive actions. Automated workflows could propagate incorrect changes across interconnected systems before a human recognizes the problem.
Prevention remains the first line of defense, but resilient organizations also plan for prevention to fail.
This brings data protection, monitoring, immutability, incident response, disaster recovery and cyber resilience into the agentic AI conversation. Organizations need to understand what changed, determine whether data remains trustworthy and recover affected information or systems when necessary.
AI security is therefore becoming increasingly difficult to separate from infrastructure security.
The Skills Behind AI Resilience Matter Too
There is another side of the AI security conversation that deserves greater attention: the people responsible for operating these increasingly complex environments.
As infrastructure becomes more autonomous, the technical knowledge required to manage it does not disappear. In many cases, it increases.
Identity teams need to understand machine identities. Security teams need visibility into agent behavior. Infrastructure teams need to understand increasingly interconnected systems. Data protection professionals need to recognize how automated workflows affect recovery requirements. Recovery teams need confidence that critical data and services can be restored to a trusted state after disruption.
Technology controls are valuable only when organizations have the capability to configure, monitor and operate them effectively.
This is where Tsunati’s broader approach to education and enablement becomes relevant. Tsunati’s model connects structured technical education with professional services and knowledge transfer, with the objective of building internal capability rather than long-term dependency.
Building Data Resilience Skills with Veeam University, Powered by Tsunati
As AI expands the number of systems interacting with enterprise data, understanding how that data is protected, monitored and recovered becomes increasingly important.
Veeam University, powered by Tsunati, provides structured, on-demand education across several of these core data resilience capabilities.
The portfolio includes Veeam Backup & Replication, with 26 hours covering backup, recovery, configuration and replication; Veeam ONE, with 16 hours focused on monitoring, reporting and analytics; Veeam Recovery Orchestrator, with 12 hours covering disaster recovery, orchestration, testing and compliance; and Enterprise Data Security, with 16 hours focused on immutability, ransomware protection and security hardening.
Importantly, these courses should not be positioned as a replacement for AI-specific identity, access or governance controls. Their role is different. They help strengthen the data resilience knowledge required to operate the infrastructure surrounding increasingly autonomous enterprise systems.
The learning experience also extends beyond passive video instruction. Veeam University incorporates interactive learning, scenario-based education, knowledge checks, practice assessments, downloadable study resources and simulated labs, supporting the practical capability Tsunati emphasizes across its education model.
For organizations investing heavily in AI, that human capability matters. Greater automation does not reduce the need to understand the environment. It makes that understanding more important.
What CIOs Need to Prioritize Now
Organizations do not need to wait for agentic AI to reach maturity before establishing the foundations for secure adoption. The work can begin by creating visibility into which agents are being deployed and assigning clear ownership to every production system.
From there, CIOs and security leaders can establish distinct identities for agents, map their permissions, enforce least privilege and separate experimental AI environments from production infrastructure. Organizations should also monitor agent behavior rather than relying solely on authentication controls and introduce additional approval requirements for actions capable of creating significant or irreversible consequences.
Equally important is the ability to respond when an agent moves outside its intended boundaries. Credentials and tokens need to be revocable, agents need to be isolatable, and organizations need recovery processes for situations where data or systems have already been affected.
These controls should not be viewed as barriers to AI adoption. They are the foundations that allow autonomy to scale without allowing risk to scale at the same rate.
The Tsunati Perspective
Agentic AI illustrates a larger challenge facing enterprise technology leaders. Deploying sophisticated technology does not automatically create organizational capability.
As AI becomes more deeply integrated into business operations, organizations will need to understand not only the models they deploy but also the identities, applications, infrastructure and data surrounding them. They need visibility when something changes, controls when an autonomous system exceeds its intended boundaries and recovery capability when prevention is not enough.
Tsunati’s approach brings education, enablement and professional services together around that challenge. Through technical education, Veeam University powered by Tsunati, professional services and knowledge transfer, the focus is on helping organizations strengthen both their technology environments and the expertise of the people responsible for them.
Agentic AI will undoubtedly make enterprise systems more autonomous. That should not make the organizations operating them less informed.
For CIOs, three questions will become increasingly important: What can our AI agents access? What are they allowed to do? And if something goes wrong, can we detect it, contain it and recover?
The future of AI security will not be determined solely by how intelligent autonomous agents become. It will also depend on how intelligently enterprises design, govern and protect the environments around them.
Add your first comment to this post