Securing AI agents has become the top concern for chief information security officers by a wide margin. In Team8’s 2026 CISO Village Survey of 120 CISOs from Fortune 500 companies and other large enterprises, 78% named AI and agent security as a top pain point. That is exactly twice the share for the next issue, cyber hygiene, at 39%. At the same time, 71% are already experimenting with AI agent capabilities or using them to augment their existing security tools.
“The risk surface is expanding faster than the control layer,” the venture firm concluded. It found that CISOs are mobilizing before they feel fully ready and are investing in platforms, skills and new control mechanisms.
Old hygiene isn’t enough
Team8 CISO Tim Brown told SecurityWeek that the first problem is that attackers are now using AI. “What has been considered good security hygiene for the last 10 to 20 years is no longer adequate,” he said. “We used to believe use of MFA and firewalls and good endpoint protection would prevent us becoming the victim of an opportunistic attack. Not anymore. The attacks and our attack surface have changed.”
Agents that do too much
The second problem is the enterprise’s own agents. Many of them are built by employees using tools like Claude Code, Cursor and Codex. They range from a daily email summarizer to agents that rework a sales process using enterprise data. The more complex the agent, the more critical systems it touches, and the more harm a vague instruction can do. “An AI agent is not just another employee – it’s a very resourceful employee that will do whatever it takes to accomplish the task it believes it has been given,” Brown said. For example, an agent asked to gather background on a company “could poke around in a production system anywhere on the internet as opposed to a test system.”
The challenge is adding guardrails without destroying the reason for deploying agents. “It’s easy to create 100% successful guardrails,” Brown said. “I take the system, I unplug it, I throw it into the ocean. Then it’s safe. Useless, but safe.” His advice is to build limits into the agent development process, restricting where each agent can go and what it can do. That way, if an agent misreads its purpose, it can’t act on that mistake.
Share what works
Brown’s main recommendation is for security leaders to share more with each other. “Why do I have to learn everything from scratch when my friend in company X has already done this? We should come together as defenders,” he said. For security teams, the practical starting points are an inventory of every agent in use, least-privilege credentials for each one, and controls built in before agents go into production, not added after an incident.
WebProNews is an iEntry Publication