- Key findings
- MCP expands the agentic attack surface
- The shift to behavioral governance
- Managing data exposure
- How CISOs can govern the agentic enterprise
- New strategies for the new agentic era
As we’ve explored in many of our State of the Internet (SOTI) publications this year, today’s AI is not limited to answering prompts. Increasingly, AI agents are used to retrieve data, call APIs, modify workflows, and act autonomously on behalf of human counterparts.
With this definitive pivot into the agentic era, a new security problem has arisen: It’s no longer enough to verify who, or what, has access. Organizations must also govern what autonomous systems are allowed to do once they are inside.
This shift has fundamentally changed the implications for CISOs, requiring a move from traditional identity management toward real-time behavioral governance. Security leaders must now account for which agents can access enterprise systems as well as the actions that those agents are permitted to take across APIs and workflows.
Key findings
In our newest SOTI Security report, Speed, Scale, and Nonhuman Identity: The Agentic Threat Landscape, we examine how agentic AI is changing enterprise risk. The report’s most recent key findings include:
- The Model Context Protocol (MCP) provides the “hands” for agentic AI to execute actions across APIs, but it also blurs data and code, which can allow malicious servers to hijack large language model (LLM) logic through prompt injection or cross-server attacks.
The Model Context Protocol (MCP) provides the “hands” for agentic AI to execute actions across APIs, but it also blurs data and code, which can allow malicious servers to hijack large language model (LLM) logic through prompt injection or cross-server attacks.
- The browser has become a critical, unmonitored attack surface: More than 40% of enterprise users have installed these tools and 25% of the installed extensions have altered permissions within 12 months.
The browser has become a critical, unmonitored attack surface: More than 40% of enterprise users have installed these tools and 25% of the installed extensions have altered permissions within 12 months.
- More than 6% of AI chatbot conversations on enterprise devices contain sensitive data.
More than 6% of AI chatbot conversations on enterprise devices contain sensitive data.
- As AI-driven systems take on greater responsibility for enterprise workflows, organizations must prioritize visibility into machine-to-machine activity and API authorization while applying Zero Trust architecture to secure machine identities, agent permissions, and autonomous decisions.
As AI-driven systems take on greater responsibility for enterprise workflows, organizations must prioritize visibility into machine-to-machine activity and API authorization while applying Zero Trust architecture to secure machine identities, agent permissions, and autonomous decisions.
MCP expands the agentic attack surface
While the MCP gives AI agents standard access to external tools and APIs, that same seamless connectivity opens new doors into sensitive systems. Each MCP service can introduce permissions, dependencies, and instructions that shape what an agent can access or do.
Security teams should treat MCP connections as part of the enterprise attack surface and maintain visibility into MCP services, connected tools, permissions, and runtime behavior. This visibility can help prevent untrusted or compromised services from influencing agent behavior, reaching sensitive data, or triggering unauthorized actions.
Growing autonomy means enterprise security must extend beyond traditional identity controls to govern not only what agents can access, but also how they operate.
The shift to behavioral governance
Security is evolving as organizations adopt AI systems that can act with increasing autonomy. Identity and access are only part of the equation; governing nonhuman systems across APIs is now just as critical.
As frontier AI capabilities, including Project Glasswing, compress the time required to discover system weaknesses from weeks to hours, existing patching cycles may struggle to keep up. Organizations need adaptive, edge native runtime protections and risk-based autonomy, which allow AI systems to take actions that are easy to verify and reverse while maintaining human oversight for high-impact or anomalous behavior.
Not every AI risk demands the same response. The greatest priorities are threats that combine high business impact with the need for rapid intervention, such as agentic AI attacks, AI-driven vulnerability discovery, and prompt injection (Figure 1).
Managing data exposure
With the proliferation of unmanaged AI extensions and tools, browser-based visibility has also become a critical attack surface. Research indicates that AI browser extensions are 60% more likely to have known vulnerabilities than other tools, and nearly half of all enterprise users have installed AI extensions (Figure 2).
Similarly, interactions with AI chatbots represent a significant channel for sensitive data exposure, with more than 6% of conversations containing sensitive information. These risks reflect the security exposure created by unmonitored browser activity and chatbot interactions.
The security challenge has shifted beyond simple visibility to securing the frequency, context, and identities through which sensitive information flows into AI systems.
How CISOs can govern the agentic enterprise
To effectively counter AI-driven threats by governing behavior and managing data exposure, security teams must move beyond static rules and embrace a new, adaptive standard of enforcement. This revised security approach is in response to the evolving AI landscape (Figure 3).
The agentic enterprise depends on APIs to move fast, but those same connections can become an easy path for abuse. Protecting APIs in real time at the edge helps stop attacks and automated misuse before they reach the applications and services AI agents rely on. Security teams should also:
- Set clear employee AI policies and browser controls to reduce sensitive-data exposure without disrupting legitimate work.
Set clear employee AI policies and browser controls to reduce sensitive-data exposure without disrupting legitimate work.
- Maintain an AI software bill of materials and monitor MCP services when natural language interfaces can access proprietary or business-critical data.
Maintain an AI software bill of materials and monitor MCP services when natural language interfaces can access proprietary or business-critical data.
- Update security controls, patching, regulation, and training to keep pace with rapidly evolving AI and identities.
Update security controls, patching, regulation, and training to keep pace with rapidly evolving AI and identities.
- Move beyond isolated indicators of compromise and use context, relationships, and behavior to identify attacks in progress.
Move beyond isolated indicators of compromise and use context, relationships, and behavior to identify attacks in progress.
Graph neural networks (GNNs) can reveal hidden connections and expose threats (such as lateral movement) and expose anomalous relationships sooner. AI-assisted vulnerability analysis, like PatchDiff-AI, can similarly significantly reduce the time from patch release to root-cause understanding. In both cases, speed is valuable, but human oversight remains essential for high-impact decisions.
New strategies for the new agentic era
The agentic enterprise is here, and securing it requires new strategies. While some AI risks are being assessed and monitored, many emerging AI threats still remain overlooked. Organizations need to assess quickly and control what AI agents, MCP services, browser extensions, and connected applications can access and what they can do in real time.
The goal is not to limit AI adoption, but to govern it. Enterprises that combine AI innovation with behavioral governance will be better prepared to manage today’s evolving AI threat landscape.
