Agentic security strategy faces a shrinking breach window

The agentic security strategy must adapt to software capable of acting on legitimate instructions in unexpected ways. Agents can use credentials, call tools, and select their routes towards a goal, expanding the paths security teams need to monitor. Zulfikar Ramzan, former CTO and CDO of RSA Security USA LLC, pointed out that even without explicit instructions to cause harm, agents can choose multiple paths to accomplish a task.

This complexity has led to a shrinking time window between intrusions and breaches, according to Ramzan. Traditional controls such as least privilege and defense-in-depth become increasingly significant as agents gain authority. Ramzan emphasized the importance of broad access to tools, as it complicates the application of longstanding security principles across multi-step tasks.

He argued that organizations need protection throughout an attack, including when sensitive data resides, making it the final line of defense if an attacker bypasses earlier controls. The time available to intervene after an intrusion is narrowing due to AI-assisted attackers finding and exploiting weaknesses, making it crucial for defenders to speed up verification, remediation, and patching while still checking the effects of patches before deployment.

Organizations that understand which assets and operations matter most to their business can prioritize their defenses effectively. Ramzan stressed the importance of continuously learning from incidents and near-misses to inform and improve the security program regularly.