Opinion
CISOs cannot say yes to AI one agent at a time
"Employees are using agents across the business," writes Pluto Security CEO Shahar Bahat. "They need clear limits and support to take responsibility for the results."
Management teams increasingly see the risk of not using AI as greater than the risk of adopting it without perfect control. I share that urgency. But asking employees to work with agents also means letting software act on company data and systems from their laptops. Leadership has to make clear who owns those actions and how they are kept within bounds.
A finance employee can ask an agent to prepare a report. Marketing can use one to gather customer information. Operations can automate updates across systems. I want more of that. Agents can read files, use connected services and carry out tasks from the employee’s workstation. They save the employee manual work, while introducing actions and connections that the employee may not understand.
The security leaders I speak with are already feeling the pressure. Employees across the business are choosing agents, connecting services and adding capabilities as they work. Security teams that were used to working with engineering and IT now have to understand what software is doing on behalf of the rest of the company, often without more people to do the work.
For a sales employee, an agent can identify prospective customers and draft outreach using public information. Connecting it to customer records or allowing it to send messages on the company’s behalf gives it much broader authority. The employee sees a faster way to reach prospects. Behind the scenes, the agent may be using credentials, invoking an added tool or accessing more data than the task requires. A useful result on screen tells the employee very little about those actions.
Our research team demonstrated this in a controlled experiment: a test tool returned a normal weather forecast while quietly sending dummy credentials to a collector. It delivered the expected answer and performed a harmful action in the background. An employee checking the result would have seen only a tool that worked.
Related articles:
The employee who directs an agent and the business team relying on its work remain responsible for the results. Delegating a task to an agent does not transfer that responsibility to the AI provider or the security team. The employee needs to remain involved when something goes wrong and work with the right people to fix it. Security retains responsibility for understanding the organization’s exposure, setting boundaries and making sure serious issues are addressed. Leadership has to establish that division of responsibility as part of the decision to adopt AI.
Someone in HR may ask an agent to organize employee information without knowing which credentials it uses or what other records a new connection makes accessible. Expecting that person to become a security expert is unrealistic. If every new use of an agent requires security’s review, the productivity gains depend on how quickly that team can respond. A company that wants people to work more independently with AI has to give them a safe way to do so.
Business and security leaders need to agree on where employees can act independently and where the consequences warrant review. An agent reading a spreadsheet to prepare a report should have different limits from one that changes sensitive live records. Enforcement must stop unauthorized data transfers and malicious add-ons while allowing safe work to continue.
Security has to follow what agents do on employees’ endpoints, including the tools and components they use. An agent can read files, use credentials and connect to services during a task. Traditional endpoint security has to account for software taking these actions on the user’s behalf, with controls that apply while the work is happening. Those controls must keep working as new connections and capabilities change what an agent can access and do.
To someone in marketing, a warning about a token or a dependency says little about the business consequence. Explaining that an agent is about to share customer records with an outside service makes that consequence clear. Where an action crosses a firm boundary, the system must stop it and explain how to continue safely. An organization cannot base its AI ambitions on every employee remembering a policy email at the right moment.
An agent can keep data inside the company and still damage it. A finance team has to check that its report is accurate and that any updates the agent makes to financial records are correct. Security controls alone do not establish whether the task was carried out correctly. The business owns that outcome, while security oversees exposure. Treating every failure as security’s responsibility would leave the people who understand the work out of decisions they are best placed to make.
Leaders need to track the value employees gain from agents alongside the exposure they create and their progress in closing security gaps. Security can say yes to more of that work when clear limits are built into the process and people have support they can actually use. Leaders who ask employees to work with agents are responsible for making those conditions possible. Employees can delegate the work. They remain accountable for the results.
Shahar Bahat is co-founder and CEO of Pluto Security.
