Agentic AI is a powerful force reshaping the digital landscape, and it's time for security professionals to take notice. As these intelligent systems become increasingly integrated into our workflows, they present both opportunities and challenges that demand our attention. This article delves into the critical issue of security professionals' understanding of agentic AI, highlighting the risks and the need for proactive engagement.
The Understanding-Security Paradox
The crux of the matter lies in the fundamental principle of information security: you can't secure what you don't understand. Agentic AI, with its ability to execute tasks and make decisions, is already permeating production environments. However, many security teams are still grappling with the basics of this technology. This knowledge gap is a ticking time bomb, as it hinders their ability to effectively secure and manage these systems.
Consider the analogy of firewalls. Without a deep understanding of networking, configuring firewalls becomes a daunting task. Similarly, cloud computing demanded a new level of expertise, giving rise to cloud security as a distinct discipline. Agentic AI is now demanding the same level of understanding from security professionals, and the consequences of falling behind are severe.
Three Categories, Three Risks
The agentic AI landscape is diverse, and so are the risks associated with it. We can categorize these risks into three distinct areas:
- General-Purpose Coding and Productivity Agents: These tools, like Claude Code and GitHub Copilot, are already seamlessly integrated into developer workflows. While they enhance productivity, they also present security concerns related to data access and interactions with codebases.
- Vendor-Built Agents (MCP): The Model Context Protocol (MCP) enables agents to connect to external services and act on their behalf. A malicious actor could exploit this by crafting a calendar invite with hidden instructions, showcasing the real-world attack vectors that require careful configuration and security review.
- Custom Agents: The democratization of AI development empowers anyone to build functional tools without traditional coding skills. This includes security teams, but also marketing, finance, and operations teams. However, without proper security reviews, these custom agents could introduce significant supply chain risks.
The Cost of Lagging Behind
When security teams fall behind in major technology shifts like agentic AI, the consequences are far-reaching. The pattern is predictable: the rest of the organization moves forward without security input, and security is consulted as a formality or not at all. This leads to compounding exposure as agents gain more access and permissions.
A single agent with access to both a terminal and an email inbox can be manipulated to act in the other's interest, creating a lateral movement path that attackers will exploit. This highlights the importance of genuine engagement with the technology to understand its architecture and inner workings.
Skills for the AI Security Era
Building competency in agentic AI security requires a two-pronged approach:
- Architectural Understanding: Security professionals need to grasp how AI applications are built, including the components, input consumption, tool chaining, and output generation. This foundational knowledge enables them to ask the right questions and challenge design decisions.
- Staying Current: The AI security landscape is rapidly evolving. Vendors are developing security controls, open-source frameworks are emerging, and threat taxonomies are constantly updating. Security teams must stay informed about relevant tools, frameworks, and questions to ask vendors.
Configuration as a Security Control
Many agentic AI deployments face risks due to inadequate security-conscious configuration, not because of inherent flaws in the tools. A self-hosted AI assistant connected to Telegram, for instance, could be vulnerable to unauthorized access without proper controls. A simple configuration change, such as pairing the agent with a single trusted account, can significantly reduce this exposure.
The key principle here is scope. Agents should be granted access only to the resources necessary for their intended functions. This minimizes the potential blast radius and attack surface.
Getting Ahead at SANSFIRE 2026
The organizations that are ahead of the curve in building AI security fluency will have a significant advantage. They will be instrumental in shaping the deployment of these systems. Conversely, those who arrive late will find themselves playing catch-up, applying controls to architectures that have already been decided without their input.
I will be teaching the course SEC545: GenAI and LLM Application Security at SANSFIRE 2026, offering a comprehensive exploration of AI application architecture, agentic systems, attack surfaces, and available tools and controls. This hands-on course will equip practitioners with the skills to engage with AI systems from a place of genuine understanding.
Register for SANSFIRE 2026 to embark on this transformative journey into the world of AI security.
