With enterprises moving quickly to adopt AI agents, it's an ongoing challenge for security controls to match the same pace.
As AI agents become embedded across business workflows, they are acting inside systems, accessing data, connecting applications, triggering tasks and making decisions with increasing levels of autonomy, creating one of the most urgent challenges facing technology, security and customer experience leaders.
As Yevgeny Dibrov, SVP and GM, Cybersecurity and Risk at ServiceNow, told CX Today, that shift changes the cybersecurity conversation. “Now you have AI agents everywhere, non-human identities, every part of every single process that the company is doing.”
The risk is that enterprises are adopting a new class of digital identity, often faster than existing security, governance, and access controls were designed to manage.
Dibrov warned that enterprises need to act in real time in an environment where AI can accelerate cyberattacks as well as business processes. “In order to be ready from a cybersecurity perspective in this era, enterprises must detect issues in real time and also act in real time and remediate in real time.”
“If you are not able to remediate, do the workflows and actually solve this, you've done nothing, basically. You've done nothing in this era.”
AI Agents Are Creating a New Identity Security Problem
Dibrov said that identity and access management is now the foundation of any serious AI security program, because AI agents can quickly multiply across departments, supporting developers, customer service teams, IT operations, HR workflows, finance processes, and increasingly, customer-facing systems. Each one may need access to business assets to perform its task, creating a new point of exposure if enterprises do not know what it is doing, what it can reach and whether its permissions are appropriate.
“The AI world and… the explosion of AI agents accelerated so much the need for identity security,” Dibrov said. “They need to see ‘what are my agents, what are they doing, what are the permission levels that I should assign to each of them, what they can access, what they are accessing, and how do I really control it.’”
The need for advanced monitoring is escalating as enterprises make the transition from implementing generative AI to using autonomous agents. The first step is to understand what asset management identities are in place and the context each agent is working in.
“We need to understand what this AI agent is doing, what's good, what's bad for that AI agent and how do we put the right controls and permissions for that."
The visibility problem is becoming harder as the number of agents grows. Dibrov said AI agents could significantly outnumber employees, pointing to organizations where ratios have already reached 50 or even 80 agents to one employee.
If enterprises struggled to manage human identities, cloud assets, applications, devices, and vulnerabilities before, AI agents add another fast-moving layer to an already complex environment, expanding the attack surface “exponentially,” Dibrov said.
