Agentic AI security tests enterprise defenses as scale outpaces strategy

Cybersecurity executives face a critical juncture as automated AI agents become the top concern in this year's cybersecurity landscape, with adversaries and defenders vying to leverage these tools at an unprecedented speed and scale. This urgency was evident on the first day of Black Hat USA 2026, where autonomous AI agents took center stage in both presentations and casual conversations.

As these agents integrate into production and gain access to sensitive systems, there is a pressing need for robust governance models, which currently clash with a market that is still grappling with the concept of operationalizing control, according to Jon Oltsik, principal analyst in residence at theCUBE Research. Oltsik emphasized the unprecedented scale and speed of this development, stating that while some view it as manageable, it requires a strategic approach that balances people, process, and technology.

He noted that enterprises are struggling to manage agentic AI security, identity governance, and cyber resilience amidst the rapidly evolving threat landscape. Oltsik highlighted identity as the pivotal layer for managing these autonomous agents, as static entitlements are insufficient when an agent can autonomously improvise to achieve its objectives.

"If you ask an agent to do a task, it's going to do whatever it needs to do or whatever it can do to accomplish that task," Oltsik explained. "Some of that may be rogue behavior." He stressed that visibility must precede any control layer, as organizations first need to understand which agents exist and what they interact with before they can effectively govern them.

This process is sequential rather than simultaneous, requiring organizations to first gain knowledge about the agents and their impact before implementing control measures. Oltsik also emphasized the critical role of resilience, where Chief Information Security Officers (CISOs) are under pressure to demonstrate that systems can continue operating despite a breach.

"We have to be much more sensitive to where the human in the loop takes place," Oltsik said. "We have to guide this technology. We have to understand this technology. But humans are still necessary to make decisions, and will be." The discussion concluded with insights from Oltsik and theCUBE Research's Krista Case, who covered the opening day of Black Hat USA and discussed the challenges and strategies involved in navigating agentic AI security, identity governance, and cyber resilience in a rapidly changing threat environment.