Research shows that while 69% of security leaders expect AI-driven attacks within the next 12 months, only 40% have a specific strategy to address them. That 29-point gap is where incidents are most likely to land in the next two years.
As set out in the white paper, Securing the Agentic Enterprise, AI agents now act on behalf of people, with the same credentials and access rights as those who deployed them, but without their judgement, training or accountability. The attack surface hasn't just expanded; it has multiplied in scale and speed.
Often, it's people inside the organisation who create the new risk: employees sharing sensitive information with personal AI tools, or developers granting AI coding tools broad access to internal systems without fully understanding the consequences.
The detail behind that gap makes for sobering reading: 98% of organisations have unsanctioned AI tools active in the environment; 47% use personal GenAI accounts for work data; and fewer than one in five (18.5%) of employees know their organisation’s AI use policy.
These numbers expose a threat that isn’t just arriving, but already inside the perimeter.
The burning question for South African security leaders right now isn’t whether their organisation is exposed, but whether they have the visibility to know it.
Same space, different problem
AI agents now occupy the same space as their human counterparts, performing many of the same tasks, which is one of the biggest challenges to securing an organisation in the AI era.
Picture this: an employee opens Slack and sees a message from the CEO, sent at 2am, asking 400 people to review an attached document. The message is indistinguishable from something the CEO typed. It may be genuine. Or it may be an AI agent operating under compromised credentials, running a campaign that has already touched every collaboration channel in the organisation.
The behavioural signal that separates those two scenarios is not the message itself, rather it is everything observable about the context surrounding it.
It’s important to remember that AI agents are human-made tools that act using human access in the same workplace channels we are using. The risks they create are very similar to our own, and are often ones that organisations already manage.
The attack surface hasn't just expanded; it has multiplied in scale and speed.
The hardest problem in agentic AI security is telling legitimate AI activity apart from malicious activity when you only look at the action itself.
An executive who uses an AI agent to send hundreds of Slack messages every day could look exactly like a criminal using their stolen login details to impersonate them. In both cases, security systems see unusually high message activity from a trusted account, but they can’t tell if it’s legitimate or malicious because intent doesn’t show up in system logs.
Fortunately, the controls that govern human behaviour, including access rights, activity monitoring, policy enforcement and anomaly detection, extend naturally to agent behaviour. Organisations with a mature human risk practice are closer to agentic readiness than they may realise, provided those controls can act at machine speed.
Context, at the speed of the threat
The answer lies in behavioural context. Security leaders must rely on baselines that capture what “normal” looks like for a given user, including their known AI usage patterns over time. Any deviations will then produce meaningful signals rather than noise.
This isn’t a new capability, but simply an extension of the behavioural intelligence that human risk management platforms already generate, because they already see the person, the data and the activity together.
The real question is: can you do this at the speed of the threat? When an AI agent goes rogue, the damage won’t accumulate at human speed. It accumulates at API call speed.
Security operations built around an alert-first, investigate-second model are simply not calibrated to this reality.
The emerging model is remediate-first, alert-second, where automated controls can stop the action before human review is possible, with the alert simply serving as a record of what was caught, rather than a request for human intervention.
Organisations making AI security decisions today face an important architectural choice. They either treat AI as a technology problem to be contained, or address it as an extension of the human risk problem they already understand.
The evidence strongly supports the latter. AI agents are created by humans, tethered to human identities, and their risk profile is a direct function of the humans behind them.
Share
