Guarding Agentic AI
“My biggest concern is that organizations will give agents the ability to act faster and only then develop the ability to govern those actions”
Ido Mantsur, VP of Products at Imperva-Thales, joined CTech to share why he thinks the real risk is an AI agent with valid credentials doing something the user never intended.
“My biggest concern is that organizations will give agents the ability to act faster and only then develop the ability to govern those actions,” said Ido Mantsur, VP of Products at Imperva-Thales, on his biggest fear about agentic AI's rollout in the tech industry.
“The holy grail is understanding what the agent is trying to accomplish and continuously checking its actions against the mandate the user gave it and the organization's policies,” he explained. “That means assessing the actual behavior in context; the agent's own explanation is not sufficient proof that an action is justified.”
“And because that assessment will never be perfect, we also need enforceable limits that contain the consequences of mistakes or manipulation. Having permission to access a system does not mean having authority to take every action within it.”
CTech reached out to a spread of Israeli companies to find out how they're actually handling agentic AI security, and whether local security leaders are ahead of the curve on the risk, or simply closer to it.
Are any AI agents currently operating with real autonomy?
“Yes. We already have AI agents performing defined tasks autonomously, although their maturity and level of autonomy vary across the organization. Teams in product management, engineering, threat research, and support use agents in different ways. Some assist employees with individual tasks; others independently execute parts of a workflow without requiring approval at every step. Not all run complete processes from beginning to end.
We are deliberately careful about expanding that responsibility. An agent analyzing information has a different risk profile from one changing a system or taking an action that could affect customers. The greater the potential impact, the stronger the validation, monitoring, and boundaries need to be.
Our objective is to give agents room to operate independently within clear limits, while keeping people accountable for how that authority is granted and supervised.”
What security controls are in place versus on the roadmap?
“Our framework is built around three stages: visibility, risk assessment, and control. We need to understand which agents are operating, what they can access, and what they are doing; assess the risks involved; and apply controls appropriate to their authority and potential impact.
We use our own technology across that workflow—to govern identities, protect sensitive data, and secure the inputs and outputs of LLMs and agents. Each agent has its own identity and permissions. We log and analyze audit trails, and we can quarantine agents when necessary.
We have also built an AI Firewall that inspects and sanitizes LLM inputs and outputs. This provides a security layer around the model powering the agent, helping protect against malicious instructions and sensitive data exposure. In our application security use cases, human sampling and additional validation guardrails also assess output quality and potential customer disruption.
The objective is to secure the entire agent workflow: its identity, access to data, interaction with the model, and the actions it takes.
Looking ahead, I would prioritize checking consequential actions against the agent’s specific assignment, limiting permissions to the task and duration required, and ensuring delegation cannot expand that authority. We also need to test containment and recovery end to end—including whether stopping an agent stops the work it has delegated or initiated.”
Have you had an incident or near-miss?
“We have yet to have a security incident involving an AI agent. But we do not interpret that as evidence that the risk is absent.
Unexpected agent behavior may look less like a conventional cyberattack and more like a plausible action taken in the wrong context. That makes validation and visibility essential: we need to understand what happened, trace the actions involved, and intervene when necessary.
Our approach is to build monitoring, validation, and containment into the process from the outset. Those capabilities need to be in place before an incident tests them.”
Where has AI already made things better or safer?
“When critical vulnerabilities emerge, protecting applications requires more than a fast response. It demands early intelligence, precision, continuous adaptation, and customer trust. Our ambition is to discover vulnerabilities and defensive gaps at machine speed, before attackers can exploit them. That is why we built our red and blue AI agents.
Red team agents generate thousands of attack variations and search for ways around the protections in our web application firewall. Blue team agents analyze those attempts, develop and refine protection rules, and evaluate both their effectiveness and the risk of blocking legitimate traffic. The red agents then challenge the updated defenses, creating a continuous cycle of testing and improvement.
This expands the range of attack scenarios we can investigate and helps us identify weaknesses in our protections earlier. Speed matters, but so does precision: a protection that stops an attack while disrupting legitimate customer activity is not a good outcome.
Human experts sample and review the output, while additional guardrails validate proposed protections and assess potential customer impact. The goal is to turn early intelligence into effective, continuously tested defenses- at the speed the threat demands, while preserving the trust our customers place in us.”
