Forbes Council Warns Businesses To Secure AI Agents

Joel Burleson-Davis, CTO at Imprivata, writes in a Forbes Councils post that the industry is moving into an era of agentic AI, where models can initiate workflows and execute actions rather than only surfacing analysis. The article cites McKinsey's 2025 State of AI survey finding that 62% of respondents are at least experimenting with AI agents and 23% are scaling them in at least one function. The post calls out heightened operational risk in sectors such as healthcare and critical infrastructure, and frames the shift as a change in the basic question from what AI can do to what AI should be allowed to do.

Agentic AI expands the attack surface because agents execute state changes across services, not just return text. Industry-pattern observations: comparable autonomous systems introduce new control vectors, including credential delegation, unattended API access, and decision-automation pathways. These patterns increase the importance of robust identity and access management, fine-grained policy enforcement, and verifiable auditing trails. For teams that already run orchestration or CI/CD automation, the operational controls are similar in concept but must be adapted for AI-driven decision loops and probabilistic behavior.

Companies adopting autonomous agents change risk priorities from model accuracy only to operational safety, traceability, and governance. Industry observers have repeatedly highlighted that deployments with action capabilities elevate regulatory and compliance exposure, especially where incorrect actions produce physical or clinical harm. Bessemer Venture Partners named securing AI agents the defining cybersecurity challenge of 2026, noting that the same autonomy that makes agents valuable makes them dangerous when compromised. For practitioners, this means security and ML/ops must coordinate earlier in the lifecycle to align threat models with control design.

• •Adoption signals: broader movement from experimental pilots to scaled, production agent deployments.
• •Controls maturation: standardization of delegation patterns, credential brokering, and agent identity.
• •Auditability: emergence of tamper-evident logs and signed decision artifacts for regulatory evidence.
• •Incident taxonomy: classification of agent-caused incidents to inform mitigation playbooks.

Prioritize mapping where agents are permitted to act, instrumenting actions with immutable logs, and integrating human approval gates where the cost of error is high. The Forbes Councils post does not prescribe a single technical architecture, but frames securing agentic AI as an operational imperative businesses must confront as deployments scale.