Guarding Agentic AI
“The risk isn't malice, it's specification failure at scale”
Einat Shimoni, Chief Information Security Officer at Lusha, joined CTech to share her thoughts on agentic AI security, and why she thinks the real danger in agentic AI is agents doing exactly what they were told and not what anyone meant.
“Internally, agents are becoming autonomous executors. They have agency, they make decisions, they touch systems. If you don't have tight permission boundaries, audit trails, and feedback loops, they'll do exactly what you told them to do, just not what you meant them to do. The risk isn't malice; it's specification failure at scale. If an agent autonomously deleting the wrong user cohort or exposing a dataset because its instructions were ambiguous — that's a business-critical incident before you even see it,” said Einat Shimoni, Chief Information Security Officer at Lusha, on her biggest fear about agentic AI rollout in the tech industry.
“Externally, the attack surface explodes. An exposed agent endpoint, a prompt injection flaw, a model that regurgitates training data these aren't new attacks, but the blast radius is amplified when the agent can actually act. Compromised credentials, data exfiltration, reputational damage from the agent saying something it shouldn't, all before the security team even knows there's a problem,” she explained.
CTech reached out to a spread of Israeli companies to find out how they're actually handling agentic AI security, and whether local security leaders are ahead of the curve on the risk, or simply closer to it.
Are any AI agents currently operating with real autonomy?
We operate with a tiered approach to autonomy. For example, our marketing team has built a QA agent that autonomously checks our website for changes and errors. I don’t see a problem with that. However, for higher-stakes areas, such as corporate finance or sensitive production tasks, we maintain a strict 'human-in-the-loop' requirement. These workflows require enhanced quality assurance measures, so the level of autonomy is always calibrated based on the criticality of the task.
What security controls are in place versus on the roadmap?
We take a shift-left approach of rigorous testing and security by design before anything goes live. We use Wiz scanning and maintain internal guardrails across the stack and ongoing testing. On the governance side, we've stood up a cross-functional AI Committee (Security, Engineering, Product, Legal) that owns agentic policy and approval gates. We conduct structured vendor assessments of third-party tools and actively hunt for shadow AI to bring it under governance. Basically, we move fast but with mature discipline, clear ownership, supply chain rigor, and controls that address real risks like hallucinations and prompt injection.
Have you had an incident or near-miss?
Yes, we have. Early on, when an agent was in the testing phase, it entered a section he was not approved to enter and deleted a few lines from our database. It was a valuable learning moment; we caught the issue using our internal monitoring tools, investigated the root cause, and have since implemented more preventative tracking and tracing measures to ensure our agents can't execute such actions in a production environment.
Where has AI already made things better or safer?
The first is our SOC agent. We built it to autonomously validate and triage security incidents. Most alerts come in; the agent evaluates them against our incident criteria, makes a decision, and either closes them or routes them appropriately. We're only escalating to humans when there's genuine uncertainty—suspicious identity patterns, potential data exposure, policy violations that need context. What matters here isn't just the speed. We went from our team being bottlenecked on triaging 50+ daily findings to them actually having time to hunt, investigate, and work on the risky stuff. Our MTTR on legitimate incidents actually improved because we're not wasting cycles on false positives.
The second is less glamorous but probably more valuable: we automated our security questionnaire process. Customers and prospects constantly ask us to complete these lengthy compliance assessments. Our team was manually drafting responses—it's detail-heavy, time-consuming, and you need consistency across answers. Now the AI agent handles it end-to-end while we spot-check. Turnaround went from weeks to days, and honestly, the answers are more thorough because the agent doesn't get tired.
