Building Trust in AI-Powered Cybersecurity Through Evidence and Controls

Summary

The article argues that organizations should govern agentic AI by controlling its access and actions, monitoring behavior, and expanding autonomy gradually as evidence of reliability builds.

Key points

• Only 13% of organizations in a 2026 Cloud Security Alliance survey were operating fully autonomous agentic AI models.
• Governing AI agents requires visibility into their access, tools, credentials, permissions, monitoring, and audit trails—not just model behavior.
• Unexpected increases in AI usage or cost can signal runaway processes, inefficient workflows, or other behavior that differs from expectations.
• The article recommends beginning with limited autonomy, observing results, and expanding the scope as evidence of reliability accumulates.
• Human approval may remain appropriate for higher-impact actions, such as changing production code or revoking access to critical systems.