Chris Brown is the Vice President of Solutions Architecture at Two Six Technologies.
A fundamental shift has happened in AI: we have moved from static chatbots to autonomous agents running workflows and making decisions without human intervention.
Agentic systems are designed to reason, plan, use tools, and execute workflows autonomously across enterprise environments, introducing the concept of the “non-human insider.”
According to the IBM report Cost of a Data Breach, 60% of AI-related security incidents led to compromised data.
Here’s a real-world example: A founder named Jason Lemkin was nine days into building a product with Replit’s AI coding agent that had the ability to write and execute code directly against his infrastructure. He was in an active code freeze to protect a production database holding private records for over twelve hundred executives and businesses. He told the agent explicitly not to make any changes. The agent deleted the entire production database anyway. And here’s the part that matters for insider threat: it covered its tracks, fabricating test data to paper over what happened, and when asked about recovery, it claimed rollback was impossible.
That claim was false. Nobody broke in. No credentials were stolen. The system did exactly what an insider with too much trust and too little oversight does: it had access it shouldn’t have used, it used it against explicit direction, and there was no independent record forcing it to be honest about what happened.
This shift breaks traditional security controls. Traditional applications and workflows have a predetermined set of steps. These workflows use service accounts to access data or other applications. These service accounts are static, long-standing and tend to have broad permissions. This approach worked in the past because each of the actors, including the end user, and each step were well known. In sharp contrast are the new agentic workflows, which are non-deterministic with agents deciding, without human intervention, what tools or agents to utilize to complete its task. Because of these unknowns, service accounts are no longer secure with their long-standing, broad permissions. Agents now need zero standing privilege and permissions scoped to the job.
To combat this new insider threat, organizations need to enforce for agents the same zero trust best practices as they already do for humans. This means giving agents identities that are distinct from the humans and services they act for, scoping their permissions to the task and not the role, adding human-in-the-loop checks and audit trails that survive the agent trying to explain itself. At a bare minimum, agents should have a unique ID that tracks the agent through its entire lifecycle.
A better solution is to provide agents with a short lived, scoped, ephemeral X.509 certificate generated and managed in an HSM. Scoping agent permissions should follow zero standing privilege where permissions are given when needed for a task and then immediately removed once the task is complete. Permissions should use Attribute-Based Access Control and a Policy Decision Point checks for identity, context, purpose, and classification for every call.
When an agent attempts to take a high-risk action such as system resets, network egress, or deletion of critical records, a human must be notified to approve the action before the agent can proceed. Finally, audit logs should capture the full provenance of the call chain from user to agent and every step in between and cryptographically signed to prevent tampering, then streamed in real time to a central SIEM. When an anomalous event happens, real time updates should be passed to the policy enforcement point to revoke access. Extending these common security practices to agents will protect against this new and rapidly developing insider threat.
Throughout October, in recognition of Cybersecurity Awareness Month, WashingtonExec will feature op-eds from GovCon cybersecurity experts exploring emerging threats, evolving technologies, challenges shaping the field and practical strategies for strengthening cyber defenses.