Guarding Agentic AI
“Staying current is most of the job, along with understanding how the AI models actually reason”
Guy Stern, Global CISO at Alice, joined CTech to share his thoughts on agentic AI security, and why he sees AI's real value as amplifying human judgment, not replacing it.
“One of the clearest wins has been operational: reducing the signal-to-noise ratio and accelerating the synthesis of alert context,” said Guy Stern, Global CISO at Alice, on where AI agents have already made things better or safer.
“The real value comes from treating AI not as an autonomous decision-maker, but as a force multiplier for human governance, with human approval retained for state-changing actions,” he explained. “Properly scoped agents can deliver significant operational leverage while keeping risk within defined boundaries.”
CTech reached out to a spread of Israeli companies to find out how they're actually handling agentic AI security, and whether local security leaders are ahead of the curve on the risk, or simply closer to it.
Are any AI agents currently operating with real autonomy?
As a CISO, my approach is to govern agentic autonomy through a risk-based operational framework that separates analytical execution from state-changing actions. For low to medium risk use cases, such as read-only tasks and automated analytical workflows, agents can operate with a high degree of autonomy. This allows them to process large volumes of security data at machine speed without creating unnecessary administrative bottlenecks. For actions that can modify production state, however, I maintain a mandatory human-in-the-loop model. An agent may assess the situation, evaluate the potential blast radius and recommend a remediation path, but a human must review and explicitly authorize the execution before any change is made.
What security controls are in place versus on the roadmap?
Securing autonomous AI agents requires moving beyond legacy perimeter controls. You cannot simply firewall a non-deterministic agent that holds valid credentials and executes complex chains of logic. AI agents should be governed as non-human identities within a unified control plane, with contextual identity controls and just-in-time access scoping rather than static, overprivileged permissions.
Credentials should be limited to the specific task and expire immediately once that task is completed. Security controls should also evaluate the semantic intent behind an agent's tool invocations in real time. If an action deviates from defined policy boundaries, the system should be able to intercept it and trigger an automated kill switch at the gateway level before it reaches core infrastructure.
That needs to be complemented by continuous telemetry into the agent's actions, decisions and tool calls, as well as synthetic adversarial inputs that stress-test enforcement boundaries against emerging attack vectors.
Have you had an incident or near-miss?
I would be cautious about treating incident disclosure as a measure of security maturity. In our case, we have not experienced a policy breach tied to an AI agent. We intentionally design our defense architecture so that safety does not depend on luck or on a model's ability to align itself with instructions. We work from an assume-breach mindset: agents will inevitably encounter untrusted inputs or indirect prompt injections. Our goal is therefore to enforce guardrails in real time and neutralize policy deviations before they can reach core systems.
What's your biggest fear about agentic AI rollout in the tech industry right now?
That the industry is shipping agents faster than it's learning what they do. Every large platform added agentic features. They read untrusted content, they hold real permissions, and they can call other tools. That combination is in every environment, including production, and the practice for securing it is younger than the products it's meant to secure. An agent will tell one employee about another because nobody defined that as off limits. It hands over data because someone asked for it.
The internal and external versions are often the same problem. One of the concerns is that an agent that will tell one employee about another will also be able to tell one customer about another. The mechanism is identical whether the person asking works for you or buys from you, what changes is who ends up holding the data. None of it is a one-time exercise. As the CISO of Alice, I'm honored that my company handles exactly these risks. One of the practices is attacking the system before it ships, together with its data, its permissions and its tools. Decide what it's allowed to do. Then keep testing it against the latest techniques.
Staying current is most of the job, along with understanding how the models actually reason. It's worth saying that none of this is completely solved. What worries me is how few rollouts get past the deployment.
