{"id":8655,"date":"2026-07-06T14:47:22","date_gmt":"2026-07-06T14:47:22","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=8655"},"modified":"2026-07-06T14:47:22","modified_gmt":"2026-07-06T14:47:22","slug":"the-agentic-blind-spots-in-your-zero-trust-program","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=8655","title":{"rendered":"The agentic blind spots in your zero trust program"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Stephen Wilson, field chief technology officer for HashiCorp, an IBM company, likens AI agents to \u201creally smart kindergartners.\u201d<\/p>\n

\u201cThey know how to do something, but they have no clue as to why they should do it,\u201d Wilson says.<\/p>\n

This combination of superior execution power and lack of judgment can create a significant challenge for organizations trying to fit AI agents into their existing zero trust architectures. In a robust zero trust environment, Wilson notes, human users are first authenticated, then given escalating decision-making powers and access over time, with many organizations potentially taking weeks to onboard an IT employee with elevated privileges. But that model breaks down with AI agents that can be spun up for single tasks and then quickly destroyed.<\/p>\n

\u201cImagine having to onboard and offboard one of these entities within your ecosystem once every second,\u201d Wilson says. \u201cThe introduction of AI agents isn\u2019t necessarily creating new problems. But it is exacerbating problems that have always been there.\u201d<\/p>\n

\u2018You don\u2019t know when they\u2019re going to be wrong\u2019<\/h1>\n

The pressure for organizations to aggressively adopt AI has brought a corresponding pressure to lower or delete barriers between authentication, decision-making, execution, and authorization, Wilson says. Rather than rearchitecting their zero trust programs for AI agents, many organizations are essentially giving the tools broad access and hoping for the best.<\/p>\n

\u201cThese agents move so quickly, and no one is quite certain exactly what access they should have,\u201d Wilson says. \u201cI\u2019ve never seen this before, where really smart security people are just closing their eyes and moving at a rate that can be dangerous.\u201d<\/p>\n

Already, unfettered access for agentic AI could unleash \u201ccalamity\u201d within some organizations, Wilson says, with a report<\/a> emerging that an AI agent deleted entire production databases. \u201cWe\u2019ve seen an example of months and months of work disappearing, even in stable software development environments,\u201d Wilson says. \u201cEven if we estimate that AI agents are right 80% of the time, the problem is the other 20%\u2014what happens when they\u2019re wrong?\u201d<\/p>\n

Taking the long view<\/h1>\n

While agentic AI can raise short-term security problems, Wilson sees the technology as a forcing function that will spur long-term improvements to organizations\u2019 zero trust environments. \u201cWe\u2019re at an inflection point where we\u2019re going to have to do the hard things,\u201d he says. \u201cWith human users, we\u2019ve accepted that we\u2019re not going to move as fast as we want, and we\u2019re going to have to say no a lot. But this is a tidal wave.\u201d<\/p>\n

Wilson likens the rise of agentic AI to the debut of the iPhone (\u201cbut 10 times more potent\u201d), noting that smartphones forced organizations to create security and governance practices for bring-your-own-device (BYOD) and remote work programs. \u201cBefore the iPhone, there was no such thing as BYOD,\u201d he says. \u201cIt was very painful at first, but we would not have remote work if it wasn\u2019t for the iPhone.\u201d<\/p>\n

\u201cAI brings that same challenge,\u201d Wilson says. Doing the hard things, he adds, means moving to zero standing privilege, issuing dynamic credentials at the moment of use rather than relying on long-lived secrets, and building security in rather than bolting it on. The goal is to keep the human \u201con the loop\u201d rather than in it, supervising agents without slowing them down. \u201cSome organizations are going to take some hard lumps, but I think we\u2019re going to be more secure in the long run.\u201d <\/p>\n

To learn more, visit us here<\/a>.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Stephen Wilson, field chief technology officer for HashiCorp, an IBM company, likens AI agents to \u201creally smart kindergartners.\u201d \u201cThey know how to do something, but they have no clue as to why they should do it,\u201d Wilson says. This combination of superior execution power and lack of judgment can create a significant challenge for organizations […]<\/p>\n","protected":false},"author":0,"featured_media":8656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-8655","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8655"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8655"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/8656"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}