Agentic AI & The End of Deterministic Security (Part 1)

Historically, security has been a deterministic game. We identify gaps, assess the associated risks and implement various controls to address them. That is coming to an end.

Every few years, the cybersecurity industry gets hit with a buzzword that forces everyone to re-evaluate their stack and at the moment, it’s Agentic AI.

Industry hype suggests that around 80% of enterprises plan to deploy autonomous AI agents this year but only around 30% of security leaders feel ready to secure them. ^{[1] [2]} That gap isn’t because CISOs are dragging their feet, it is because agentic AI breaks the foundational model of traditional security.

Deterministic Controls to Probabilistic Reality

For decades, security has been a deterministic game. We identify gaps, assess the associated risks and implement various controls to address them, measure the performance and manage residual risk.

This has largely been a deterministic process, with predictable and measurable outcomes.

Agentic AI breaks this model.

Autonomous agents operate on probabilistic reasoning. The agent is given instructions, a goal, and access to tools/data and it reasons through the process of achieving that goal with limited human involvement.

Because the agent’s path is dynamic, we cannot engineer away unexpected behavior. A perfectly configured agent might escalate its own privileges given a specific prompt. It might chain tools together in an unanticipated way, leading to data corruption or loss. The outcome is unpredictable.

You cannot “prevent” an agent from misbehaving, only manage the probability of it happening and contain the blast radius when it does.

This requires a different mindset from the traditional approach. We need to stop designing for deterministic prevention and start designing for architectural resilience.

3 Hidden Attack Vectors of Autonomous Agents

If you are evaluating agentic systems in your environment, traditional application security is not enough. You now also have to consider the orchestration layer. Below are a few of the more prominent items to consider.

1. Orchestration & Chaining Risks

The real danger isn’t just the model; it’s how agents chain tool calls together, create sub-agents, and pass data between systems. A single compromise or mis-configuration in the chain has the potential to corrupt the whole execution.

2. Supply Chain Poisoning (MCP & Prompt Templates)

Agent ecosystems rely heavily on third-party plugins, prompt templates, and Model Context Protocol (MCP). A poisoned template or a rogue MCP server can silently alter agent behavior, effectively hijacking the agent for nefarious purposes.

3. Emergent Behavior

When multiple agents interact, they create unpredictable execution loops. When an agent acts outside its parameters, it’s not necessarily a “software bug”, it’s an inherent property of probabilistic software.

To understand more about the items above as well as other attack vectors and mitigation techniques, I recommend the OWASP Top 10 for Agentic Applications and the OWASP Top 10 for LLM.

Governance Reality

Most businesses deploying AI today are flying blind, lacking basic visibility into agent behavior or composition. We love to say you cannot secure what you don’t know about. We are at a crossroads with that statement more so than ever before.

Many organizations sit in one of the two following states:

• Level 1 (Reactive): Shadow AI agents being deployed via low-code platforms (like Power Platform) with limited to no security review or inventory.

• Level 2 (Developing): Security reviews of the model or the vendor, but no runtime visibility into what tool calls agents are making.

If you want to safely deploy agentic workflows without opening your enterprise to unauthorized data exposure/loss, Level 3 (Optimized Governance) is your minimum viable baseline.

Level 3 (Optimized) means you have continuous agent discovery, identity-scoped access, and hard blast-radius containment controls in place before execution happens and as gates to production deployment.

Check out Part 2

In Part 2 of this series, we will break down the exact 4-Level AI Security Maturity Model, how to map it directly to the NIST AI RMF, and the 7 specific questions every IT leader should ask before approving agents for production.