Oracle puts database security controls beneath AI agents

Oracle is shifting database security controls to be integrated within the database itself, as opposed to relying on individual applications to enforce them. This strategy, called "Secure at Source," aims to protect data regardless of the application, user or agent that accesses it. Vipin Samar, senior vice president of Database Security at Oracle, emphasized that databases are the most valuable assets for companies and require comprehensive protection, including patching and securing data.

Samar explained that security is not the same as encryption and highlighted the need for consistent security measures across all databases, even as AI tools enable attackers to move easily between them. Oracle's Secure at Source approach places encryption, access controls and other protections directly inside the database, allowing permissions to follow users and data across different applications and agent access paths.

The company demonstrated how an indirect prompt could bypass application guardrails and expose sensitive data when access restrictions were not enforced inside the database. To manage security across large fleets of databases, Oracle offers tools like Oracle Data Safe for cloud-based security assessment and monitoring, and Oracle Database Security Central for a unified, self-managed view of users, sensitive data, configurations and policies.

By providing fleet-wide visibility, organizations can identify configuration drift, excessive privileges and inconsistent policies before they are exploited. Oracle's database security portfolio combines centralized posture management with protections applied during database access, ensuring that security is enforced consistently and effectively across all database environments.