Artificial intelligence (AI) agents are quickly moving from experimental tools to active participants in enterprise workflows. For chief information security officers (CISOs), the immediate priority should be gaining visibility of agents and establishing deterministic controls over what existing agents can access and do.
Unlike traditional generative AI applications that primarily produce content, agentic AI systems can interact with tools, call application programming interfaces (APIs), retrieve corporate information, and make changes to enterprise systems. This creates significant opportunities for automation, but it also means AI-generated decisions can translate directly into real-world impacts.
In response, a compelling cyber security proposition has emerged: use AI agents to secure other AI agents.
The idea has understandable appeal. If enterprises deploy autonomous systems at a scale and speed human security teams cannot match, an equally autonomous defensive layer may appear to be the logical answer. However, this may actually risk unnecessarily expanding one’s attack surface.
Why the concept of “agents securing agents” remains largely aspirational right now
Large language models (LLMs) are probabilistic systems. Their responses are based on statistical predictions rather than consistently repeatable rules, in contrast with deterministic systems.
This characteristic is acceptable, and beneficial, for many tasks. But it becomes problematic when an AI agent is responsible for enforcing a security boundary or taking automated remediation action. You cannot use a probabilistic model for deterministic ends.
A security agent could incorrectly allow a harmful action or wrongly block a legitimate, business-critical process. In serious cases, an enterprise AI agent might be permitted to delete information, alter digital assets or interrupt operational systems based on an incorrect judgement.
This exposes a fundamental limitation in the agent-securing-agent proposition. But this does not mean AI has no role in securing AI agents; models can help interpret ambiguous behaviour and investigate activity that would be difficult to assess through static rules alone.
More agents risk creating more problems
Deploying additional AI agents to monitor a growing population of enterprise agents could repeat familiar mistakes from earlier generations of cyber security.
Organisations have previously responded to emerging risks by adding more endpoint clients, tools and management layers. Over time, this created overlapping functionality, operational complexity and higher costs.
Agent sprawl could produce a similar outcome. Each additional agent may consume more tokens, introduce latency, require access permissions, and create another component that must be monitored and secured.
Layering probabilistic systems also risks abstracting the underlying risk. If a defensive agent interprets the actions of an enterprise agent, security teams still need to understand how both systems reached their decisions and which control ultimately permitted or prevented an action.
Security begins with visibility and identity
Before organisations can control AI agents, they need to know where those agents are operating. Security teams need visibility of sanctioned agents, their business owners, the systems they can access, and the actions they can perform.
However, an inventory of approved agents will not provide the complete picture. Employees and business teams are likely to adopt unsanctioned AI assistants, embedded software-as-a-service agents, and other AI-enabled tools.
Attempting to prevent this through blanket bans may simply drive usage outside established governance processes. CISOs should plan to discover and manage shadow AI; prioritising agents that handle sensitive information, connect to enterprise systems, or have the ability to modify data and resources.
Regardless of the technical approach, the principle remains the same: every agent needs a verifiable identity, clear ownership, and no more authority than necessary.
Control what agents can actually do
For CISOs, the most important place to intervene is where an agent turns model output into action. Prompt filtering may help identify malicious or inappropriate inputs, but it cannot determine whether an agent should be allowed to query a database, alter a customer record or invoke an external tool.
As agents connect to more enterprise resources through tools, APIs and standards such as the Model Context Protocol (MCP), organisations need strict containment around these interactions. Every tool or function available to an agent should be governed by deterministic runtime controls defining when it can be invoked, which parameters are permitted, and which resources it can access.
An agent might be authorised to retrieve a customer record, for example, but not modify it. It might access records associated with one approved account ID, rather than the entire database. Allow lists, parameter constraints, identity-aware authorisation, and runtime policy checks can prevent prompt manipulation or malformed calls from expanding an agent’s privileges.
Additionally, CISOs should not attempt to secure every agent interaction at once. Start with the flows capable of producing the greatest business impact: those involving sensitive data, external communications, financial transactions or changes to critical systems. Basic guardrails, including static classifiers, regular expressions and similarity-based controls, can then provide predictable boundaries around inputs and outputs, detect prompt injection attempts, enforce topic restrictions, and apply data loss prevention.
These controls should sit within a broader programme of operational discipline. Agent installations must be hardened according to vendor guidance and included in patching processes. Static secrets should never be stored within an agent’s context. Access through MCP, agent-to-agent connections and APIs should instead be restricted to approved endpoints and granted only when needed.
Finally, CISOs need comprehensive audit trails covering agent activity before and after execution, alongside backups of any system an agent is authorised to access, to mitigate the risk of data loss from unintended autonomous actions. Corporate policies must clearly define where agents may be used, what information they may access and who can approve them.
Secure the action, not just the agent
The promise of agents securing agents is likely to remain attractive as agentic AI adoption accelerates. But adding more autonomy cannot compensate for weak foundations. Without clear identities, constrained access, protected tools, and enforceable runtime policies, another agent simply adds another layer of uncertainty.
CISOs should therefore resist the temptation to prioritise only autonomous defence as a shortcut, while disregarding cybersecurity fundamentals. The priority today is to know which agents are operating, limit what they can access and place deterministic controls around the actions that could create material harm. AI can then be layered in where its ability to interpret complex or ambiguous behaviour adds genuine value.
The future of agentic security will likely involve agents watching agents. For now, however, the safest agent is not the one monitored by the smartest model. It is the one whose authority has been deliberately limited from the start.
Gartner analysts will further explore the evolving economics of AI agents, including strategies for value realisation, governance and cost optimisation at the Gartner IT Symposium/Xpo in Barcelona, from 9–12 November 2026.
Craig Porter is director analyst at Gartner.
