Agentic AI means enterprises are no longer moving just data across their networks, but decisions and actions too. In this article I explore three forces driving that shift, and why connectivity and security now need to work as one system.
Agentic AI makes that systems argument immediate. Software is acquiring identities, invoking tools, crossing domains and making consequential changes. Advanced models are also accelerating vulnerability discovery and exploit development. Three forces stand out. The vulnerability window is shrinking, software is becoming an enterprise principal and security operations are becoming machine-paced.
Together, these forces expose architectures built around stable human identities, separate controls and human-speed hand-offs. Enterprises are no longer moving only data across networks. They are delegating decisions and actions across them. This new scenario requires connectivity and security to share identity, context, telemetry, policy and response.
AI is compressing the time and effort required to discover vulnerabilities, validate exploitability and construct working exploits. Remediation does not accelerate as easily. Findings must still be verified, patches engineered / tested, dependencies addressed and submitted to change control. These two clocks are diverging. Defenders have less time to contain an exposure, while a durable fix may still take days or weeks.
A good example to illustrate this is Claude Mythos Preview, which I recognise is a threshold case but certainly signaling the advent of this new normal. In authorised environments, Mythos found previously unknown flaws, validated exploitability and constructed working exploit chains. Anthropic’s Project Glasswing has since applied related capabilities to widely used software. In the UK AI Security Institute’s evaluation, Mythos became the first model to complete a 32 stage simulated corporate network attack. Even though it succeeded in only three of ten attempts, which is significant. This is not evidence that every attack is autonomous or instantaneous. It shows that advanced models can now perform substantial parts of work that once required sustained specialist effort.
This asymmetry is important. Agents can inspect code, test hypotheses and explore targets in parallel. Remediation remains constrained by process (at least for now). The period between exposure and a production ready patch therefore becomes more dangerous.
Patching remains essential, but it can no longer be the first and only response. Organisations must identify affected assets, restrict attack paths and apply compensating controls while a durable fix is prepared. These may include segmentation, access restrictions, egress controls, quarantine or a virtual WAF patch. The principle is simple. Contain at machine pace. Patch at an assurance appropriate pace.
The systems being protected are also gaining a new kind of participant. An agent is a non human enterprise principal. It operates under delegated authority, selects tools, accesses data, communicates with systems and assembles actons into consequential sequences.
The security boundary therefore extends beyond the model. It includes instructions, context, memory, tools, skills, identities, data, orchestration, runtime and network. A well behaved model can still be undermined by poisoned content, a compromised tool, excessive permissions or a weak runtime. Enterprises must protect agents from manipulation, protect others from agent actions and preserve accountability through every delegation.
Each agent needs a distinct, lifecycle-managed identity bound to an owner and purpose. Credentials should be ephemeral, task scoped and audience restricted. Delegation should reduce authority, not expand it. Additionally, tools, skills and MCP servers need approval, version control and declared capabilities. Also, execution needs sandboxing, protected secrets, restricted filesystem access and deny-by-default egress.
NIST’s draft concept paper identifies dynamic authorisation, traceable delegation, provenance and accountable logging as areas for implementation. Also, Anthropic’s containment work makes a related point. Probabilistic model controls need hard boundaries around the environment and external content. Governed autonomy also needs a causal trail from human intent to agent decision, tool call, data access and network activity, plus ways to stop action.
Safety considers whether an uncompromised agent might cause harm. Security considers whether it can be manipulated or used without authority. At runtime, both depend on identity, permissions, context and containment. There is another element, risk can also spread through capability diffusion. Mythos is proprietary, but cheaper models, stronger scaffolding and open-weight systems will spread advanced techniques. AISI estimated in July 2026 that leading open-weight cyber models trailed the closed frontier by four to seven months….only.
AI also changes the tempo and economics of the attack. It can parallelise reconnaissance, attack-surface mapping, vulnerability analysis, credential testing and attack-path exploration. Agent scaffolding can coordinate these tasks with less human intervention. This does not make every campaign autonomous, reliable or instantaneous. The structural change is that more targets and hypotheses can be explored at a lower marginal cost. AISI’s evaluations show both the advance and the remaining inconsistency.
Obviously, defense cannot respond by placing more alerts in front of analysts. It needs a layered control loop. Deterministic controls stop known, high-confidence threats through predefined policy. Reasoning agents correlate evidence, investigate unfamiliar activity and orchestrate bounded responses. Then we need humans setting risk tolerance and escalation boundaries, then approve destructive, irreversible or externally significant actions.
Autonomy should be granted by class of action. A system may observe and recommend, act with approval, then execute predefined, low-risk and reversible containment once controls are proven. But high-impact actions should still reach authorised humans. The NCSC’s Cyber Shield vision points towards machine-speed discovery and containment, followed by automated remediation under system owner authority. Every action must be policy-bound, attributable and continuously revalidated. This is to say that machine-speed defense must not become machine sovereignty.
It’s clear that these forces invalidate the assumptions behind many enterprise architectures. Human users are no longer the only important actors. Identity and permission are no longer stable for a full session. Network location says little about intent or delegated authority while change cannot always wait for a ticket. And then investigation cannot begin only after the event. In this scenario, separate consoles and data stores create hand-offs just when context and response must move fastest.
An agent’s effective authority can change during one task. It may ingest new information, invoke a different tool, delegate work or request an unexpected resource. Its address can remain unchanged while its purpose and risk change. Trust must therefore be reassessed as identity, context, data, tools and destinations change. That’s why static policy and post-event correlation cannot keep pace.
Consider a developer asking a coding agent to inspect an unfamiliar repository. A poisoned README directs it to find cloud credentials and send them to an external service. A model safeguard may detect the instruction but it may not know the agent’s effective authority or the destination. Identity controls can limit delegation but cannot see the malicious content. Runtime controls see execution but may not understand data sensitivity. Network controls see the flow but not why it was initiated. As we see, no single control has enough context or enforcement reach to contain the chain.
A converged control system combines all those partial views in time to act. Agent identity limits authority, runtime and data controls keep credentials out of reach and tool policy blocks an unapproved skill. Segmentation protects production systems while egress security blocks the destination. Then correlated telemetry links the human request, repository, agent identity, tool call, data access and network flow. A bounded playbook can then stop the session, revoke the task credential and verify the resulting state. These controls remain modular, but they need to act as one system.
At machine pace, context cannot be reconstructed after a sequence of hand-offs. It must travel with the interaction. The architecture needs a common control loop. It must sense across network, runtime and data, decide against shared identity, context and policy, enforce at the nearest control point, and verify the outcome. Connectivity provides distributed visibility and enforcement across many interactions among agents, tools, workloads, data and external services. Identity supplies authority. Application, runtime and data controls supply semantic context and security intelligence correlates the evidence and directs the response. If any domain remains isolated, the control system loses meaning, reach or speed.
Convergence therefore means shared identity and context, correlated telemetry, coordinated policy and distributed enforcement across modular controls. It does not mean one vendor or one console. The network does not replace endpoint, application, data or supply-chain security. It cannot secure agents alone. Yet agentic security cannot operate at enterprise scale without an identity-aware, observable and programmable network. A good starting points for enterprises can be inventorying agents and delegation chains, restricting credentials and egress, governing tools and MCP servers, and automating only bounded containment with rollback.
The defining challenge is not simply more sophisticated attacks. Identity, agency and decision making are becoming distributed across systems that operate continuously. Enterprises no longer move only data across their networks. They delegate decisions and actions across them. Connectivity, identity, security and observability may remain modular, but they cannot operate independently.
They need a shared control loop spanning context, policy, telemetry and distributed enforcement. It must move at machine pace within human-defined authority, without surrendering coherence, control or trust.
Links:
