Guarding Agentic AI
Israel’s security leaders aren’t afraid of rogue AI. They’re afraid of permissions.
CTech asked security and technology leaders how they’re handling autonomous agents. Their answers describe an industry that is disciplined, candid about its gaps, and no less exposed than anyone else.
For the past month, the AI industry’s biggest stories have read like science fiction. Google disclosed that its Gemini model broke into three outside companies on its own during red-team testing by Israeli startup Irregular. OpenAI paused training of its next model after agents it was testing found exposed API keys at the U.S. Department of Education and accessed Australia’s Medicare system.
Strip away the rogue-AI framing, though, and both stories turn on something mundane: credentials. Gemini got in by brute-forcing a password in one case and finding leaked credentials in a public code repository in the other two. OpenAI’s agents found keys someone had left exposed.
That is the risk the security leaders interviewed for CTech’s Guarding Agentic AI series have been warning about since August. The series asked security and technology leaders at 17 companies with Israeli operations the same five questions: whether their agents act autonomously, what controls are in place, whether they’ve had an incident, what they fear most, and where AI has actually helped. The starting point was a global survey of 160 CISOs by NeuralTrust, which found that 72% of enterprises are deploying AI agents but only 29% have real security controls in place, and about one in five have already had an incident. Israel builds a disproportionate share of the vendors selling into that gap, which raised the series’ central question: are local security leaders ahead of the curve, or just closer to the risk?
Judging by what they told CTech, the answer is both.
Nobody is worried about the robot uprising
Asked about their biggest fear, almost none of the 17 named a malicious model, and several dismissed the idea outright. “Not rogue AI. I think that framing is mostly a distraction,” said Aviv Nahum, CEO of Above Security. Raul Zayat Galante, CISO at Port, said his concern was “the legitimate actor, with the legitimate credentials, executing the legitimate action under the wrong context, and executing it at machine speed.” Einat Shimoni, CISO at Lusha, put it in one line: “The risk isn’t malice; it’s specification failure at scale.” Ido Mantsur, VP of Products at Imperva-Thales, framed the same risk in procedural terms: “An agent can have valid credentials, use an approved tool, and still do something the user never intended.”
What they fear instead is identity sprawl. Nir Mishal, CISO at Orca Security, described “thousands of well-intentioned agents with standing privileges, chained tools, and no owner.” Amit Ninio, who manages security engineering at Silverfort, said agents “pick up delegated permissions one at a time, and each one looks harmless on its own.” Nahum’s version: “We are effectively creating a new population of synthetic insiders at enormous speed.”
Close behind is visibility. Eli Hakimov, CISO at Immunai, called unvetted agents “a shadow workforce, autonomous, fast, and invisible,” adding: “The companies that get hurt will be the ones that never knew they had agents in the first place.” Akamai’s Yoav Chen, UVeye’s Noam Brosh and Madsec’s Doron Sivan all pointed to the same driver: employees spinning up agents faster than security teams can track them. Brosh and Sivan both noted that many of those employees aren’t developers at all. Sivan flagged a specific failure mode, an employee who leaves and takes the only knowledge of an undocumented agent with them.
The single most common fear, though, cut across both: governance that can’t keep pace with how fast agents gain authority. Eyal Alkalay, CIO at Verbit, put the core problem in physical terms — “an AI agent can potentially take many actions across multiple systems in seconds” — and said the task is making sure “security, identity, permissions, and monitoring evolve at the same speed.” Guy Stern, Global CISO at Alice, worried “that the industry is shipping agents faster than it’s learning what they do.” Doron Sivan named the same dynamic as his top concern: “the speed at which organizations are adopting these technologies.” Lior Mazor, CISO at Appcharge, and Mantsur each put it almost identically: organizations are giving agents the ability to act before anyone has built the ability to govern that action. “My biggest concern is that autonomy will move faster than accountability,” Mazor said.
3 View gallery
6 of the 17 leaders interviewed named governance failing to keep pace with agent authority as their single biggest fear.
(CTech)
A smaller group worried about the humans. “I’m concerned by the human who stops looking,” said Yigal Elefant, CISO at AU10TIX. Chris Jones, chief trust and security officer at Axonius, said development teams with code review and QA saw a manageable rise in security findings after adopting AI, while teams without that discipline were overwhelmed. “The tooling was the same in both cases,” he said. Only Atera CISO Noam Vander put attackers first: “Attackers’ agents don’t need change management or a security review, and that asymmetry worries me.”
Autonomy, on a leash
On autonomy, the answers were strikingly uniform. Every company tiers it by blast radius: agents act alone on low-stakes, reversible work and stop at a human gate before anything consequential. At Unframe, agents write and publish release notes with no human review. At Silverfort, an open-source vetting pipeline approves or rejects low-risk packages on its own. Lusha’s marketing team runs a QA agent that checks the company website unsupervised. Mantsur described the same calculus in general terms: “An agent analyzing information has a different risk profile from one changing a system or taking an action that could affect customers. The greater the potential impact, the stronger the validation, monitoring, and boundaries need to be.” At the other end, Axonius said flatly: “We have not turned anything loose.” None of the 17 described letting an agent make production changes on its own.
Several framed that restraint as a choice rather than a technical limit. Mishal said Orca’s “governance intentionally lags the capability,” warning that “the CISOs who will get burned are those who let autonomy expand by drift rather than by decision.” Hakimov said full autonomy is no longer a technology gap: “It’s a trust gap.”
The controls look similar across the board too: a unique identity for every agent, least-privilege permissions, short-lived credentials, logging, and a way to shut it off. Some were candid about how rough that last piece still is. “There is a kill switch available, but it is not yet a single red button,” Galante said. Jones stressed tying every agent to a named creator: “When an AI agent does something unexpected, you need to know within seconds who built it, what it was authorized to touch, and how to shut it off.”
The incident count
3 View gallery
4 of 17 companies in the series (23.5%) versus the ~20% incident rate NeuralTrust found in its 160-CISO global survey.
(CTech)
Four companies out of 17 described a real incident or a near miss — just over one in five, slightly above the rate NeuralTrust found globally, not below it. At Lusha, an agent in testing entered a section it wasn’t approved to access and deleted a few lines from a database before internal monitoring caught it. At Silverfort, an agent deployed a mock internal application to the cloud on its own, skipped architecture review, and left the app publicly exposed until detection flagged it. At AU10TIX, an agent recommended a configuration change that would have locked the company out of its own access; a human reviewer stopped it. At Madsec Security, Sivan described a milder version of the same pattern: endpoint detection tooling flagged AI-agent-adjacent activity as suspicious and escalated it to the SOC, a pattern he said strict permission management kept contained.
A self-selected group of 17 proves nothing statistically, but it doesn’t suggest Israeli companies are dodging the problem either. Several interviewees were wary of their own clean records. Hakimov said that in this space “so far” is doing a lot of work. Nahum went further: “I would be more worried about a company claiming its agents always behave exactly as expected than one admitting they occasionally surprise them.”
Where it’s paying off
On the upside, the consensus was nearly total: security operations. Eleven of the 17 — Port, Verbit, Immunai, Orca, UVeye, Alice, Akamai, Lusha, Appcharge, Atera and Above Security — all pointed to agents handling alert triage and the first pass of investigations. Hakimov said it “turns hours of analyst work into minutes.” Stern credited agents at Alice with “reducing the signal-to-noise ratio and accelerating the synthesis of alert context.” Lusha and Orca both cited a less glamorous win, automating the security questionnaires customers demand, which Shimoni said cut turnaround “from weeks to days.”
3 View gallery
The four areas companies named as wins: SOC and incident triage (11 of 17), workflow productivity (7), vulnerability and code review (5), and compliance/questionnaires (3).
(CTech)
A second cluster put agents on the offensive side of security testing itself. Port, Akamai, Appcharge and Silverfort all described using agents to find and triage vulnerabilities before attackers do. Imperva-Thales took that furthest: Mantsur described pitting AI agents against each other, red-team agents that “generate thousands of attack variations” against the company’s own web application firewall, and blue-team agents that “analyze those attempts, develop and refine protection rules.” “The red agents then challenge the updated defenses,” he said, “creating a continuous cycle of testing and improvement.”
There was one clear dissent. “I have not seen an AI agent that has directly improved an organization’s security posture, aside from security products that incorporate AI-agent capabilities into their platforms,” said Sivan, whose firm advises clients on AI policy. And Jones pushed back on the jobs narrative: “I have not seen a single company effectively mass-downsize its workforce and backfill those roles with AI agents.”
Ahead, or just closer?
The case for “ahead” is discipline. Most of these companies built identity controls, approval committees and named owners before agents went live, rather than retrofitting them, which Galante warned “will lead us down the well-trodden path of cloud security failure.” His definition of being ahead is treating agents from the start “as privileged machine identities rather than smart chatbots.”
The case for “closer” is just as strong. Eight of the 17 companies in the series — Immunai, Orca, Madsec, Akamai, Axonius, Silverfort, Above Security and Imperva-Thales — sell security products themselves, and several said they run those products on their own agents, which puts them on both sides of the problem. And the hardest piece is unsolved here, too: knowing not just whether an agent is allowed to do something, but whether the action makes sense. Mishal wants detection that flags an agent “acting out of character, not just out of permission.” Nahum called that behavioral question the place where the industry still has a lot of work to do. Mantsur called it “the holy grail”: continuously checking an agent’s actions against its mandate, because “the agent’s own explanation is not sufficient proof that an action is justified.” Jones was blunter: “I do not think anyone should be claiming that is a solved problem yet.”
Elefant offered the simplest summary. “The tool got faster,” he said. “The judgment is still yours.”
