COVER story
Mortada Ayad, VP – META at Delinea, explains why AI agents must be treated as privileged identities and why runtime controls and clear accountability are essential to enterprise security.
AGENTS OF CHANGE
gentic AI is changing enterprise
A cybersecurity. Unlike conventional AI applications that primarily analyse information or generate content, autonomous agents can interact with systems, access sensitive data and execute tasks with limited human intervention.
For CISOs, the challenge is no longer simply determining whether an agent has permission to access a system. It is ensuring that every subsequent action remains appropriate to its assigned task.
Research cited by Delinea highlights this challenge in the UAE. Although all respondents reported having formal policies governing AI access, only 59 % said these were actively enforced. More concerningly, 98 % reported confirmed or suspected instances of AI accessing sensitive data beyond what its task required.
These findings expose a growing gap between governance policies and operational enforcement.
AI agents as privileged identities
Ayad believes organisations must recognise AI agents as a distinct category of privileged identity, combining human-like decision-making with the speed and scale of software.“ While an agent is software, it can make choices about how to complete a task and move between systems to do it. That is more akin to the behaviour of a human employee. But then again, being software, it has the ability to act at speed and scale. So, neither existing category quite describes the access it needs,” he said.
Unlike traditional applications, AI agents can determine their own routes towards completing objectives, potentially accessing systems that were not anticipated.
“ With a conventional application, you generally know the steps it will take. Give an agent an objective and it may find a route nobody thought to specify.”
Ayad advocates assigning each agent a distinct identity, with permissions linked to a specific task and a named business owner. Organisations must understand not only what an agent can access, but why it is requesting access.
Closing the enforcement gap
According to Ayad, governance gaps often arise because security policies and business workflows are developed independently.
WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 15