Agentic AI security risks are forcing enterprises to rethink how they approach cybersecurity as AI evolves beyond traditional use cases. Like previous technological shifts, such as cloud computing, AI adoption is accelerating faster than security strategies can adapt, creating new vulnerabilities across organisations.
We can understand the evolution of AI in three waves. The first wave focused on predictive analytics, where security concerns largely centred around data protection. The second wave, generative AI, introduced broader risks as tools became more widely accessible, exposing organisations to shadow AI usage and data leakage. Research from Zscaler shows that 70% of organisations lack visibility into employees’ use of unsanctioned AI tools, while 56% believe sensitive data may already be exposed.
The third wave (agentic AI) represents a fundamental shift. Agentic AI is different from older systems in that it doesn’t just make outputs; it also takes actions, interacts with enterprise systems, and runs workflows. This introduces new risks, as autonomous systems can operate with limited oversight and make decisions that directly impact business operations.
Adoption is already underway. About 42% of organisations are testing agentic AI, and 34% have deployed it in some form. However, nearly half of these deployments lack proper governance or security controls, exposing a critical gap between innovation and protection.
- AI adoption is outpacing enterprise security capabilities.
- Generative AI introduced visibility and data leakage risks.
- Agentic AI adds autonomous decision-making and execution risks.
- Many deployments lack governance and security guardrails.
The key challenge is that traditional security models are no longer sufficient. Retrofitting existing controls in AI systems fails to address the complexity of autonomous behaviour. Instead, organisations must redesign security from the first principles, embedding governance, visibility, and control directly in AI systems.
As AI continues to evolve, enterprises that align security with innovation will be better positioned to manage risk. In 2026, success will depend not on how quickly organisations adopt agentic AI but rather on how effectively they secure it.
ソース：
