# Agentic AI Didn't Repeal the Cybersecurity Fundamentals

![TERESEC's mascot onboarding an AI agent while discarded zero-trust and least-privilege signs sit in a bin behind them](agentic-ai-onboarding.png)

AI specialists have appeared on LinkedIn at a remarkable rate — AI and machine learning topped skill additions for the third year running with 114 million entries, and "prompt engineering" was added to profiles 43 million times in fourteen months. Much of that is genuine and welcome reskilling. What concerns us is what the noise drowns out: the fundamental controls we already have — zero trust, least privilege, role-based access — are precisely the ones that prevent abuse of agentic AI, and they barely rate a mention.

The commentary has split into two camps. One says AI changes everything and the old rules no longer apply. The other says AI is an uncontrollable risk and should be kept out of the business. Both camps make the same mistake: they treat the technology as unprecedented.

## We Have Panicked Before

In 1995, astronomer Clifford Stoll wrote in *Newsweek* that online commerce was "baloney" and that "no online database will replace your daily newspaper." Twelve years later, Microsoft's CEO looked at the iPhone and declared: "There's no chance that the iPhone is going to get any significant market share. No chance." Both predictions are now genre classics.

But here is the part usually left out of the retelling: Stoll's underlying worries — fraud, trust, security — were entirely legitimate. Early e-commerce really was plagued by exactly those problems. The industry's answer was not to abandon the internet. It was controls: encryption, authentication, payment standards.

Email tells the same story from the other side. It became — and remains — one of the most abused attack vectors in existence, and nobody responded by banning email. We built SPF, DKIM and DMARC, layered filtering on top, and trained people. The technology stayed; the fundamentals caught up. Demonising agentic AI today reads a lot like demonising email in 2005 — memorable, satisfying, and no substitute for doing the work.

## The Risks Are Real — Read Them Carefully

None of this means the risk talk is empty. Gartner predicts that by 2028, 25% of enterprise breaches will be traced back to AI agent abuse, by both external attackers and insiders. Agents bring genuinely new attack surface — prompt injection, tool misuse, memory poisoning — which is why the OWASP GenAI Security Project exists and why the Australian Signals Directorate has published guidance on engaging with AI.

But the most useful number in the research is a quieter one. Gartner also assesses that through 2028, at least 80% of unauthorised AI agent transactions will stem from internal policy violations — oversharing, unacceptable use, misconfigured behaviour — rather than from malicious attacks.

Read that again. Four out of five incidents are expected to be governance failures, not exotic new attacks. That is not a demon. That is an onboarding problem.

## Your Agent Is a New Starter

Strip away the novelty and an agentic AI system is a new member of staff: it needs access to do a job, it acts on your systems, and it can be manipulated, over-privileged, or quietly left with credentials long after the job ended. Every organisation already has a process for exactly this — it is called onboarding, and the fundamentals behind it did not get repealed.

| Control | New employee | AI agent |
| --- | --- | --- |
| Identity | Unique account, no shared logins | Unique non-human identity, no shared API keys |
| RBAC | Role scoped to the job description | Role scoped to the task definition |
| Least privilege | Access granted as needed, not "just in case" | Tool and data access limited to what the workflow requires |
| Zero trust | Every request verified, nothing implicit | Every action verified — NIST SP 800-207 does not have a carve-out for agents |
| Monitoring | Activity logged and reviewed | Actions logged, bounded, and reviewable |
| Offboarding | Access revoked on day of departure | Credentials revoked when the agent or task is retired |

If you would not give a week-one intern domain admin rights and zero supervision, do not give them to an agent. If your joiner-mover-leaver process would catch a contractor keeping VPN access after their engagement ends, it should catch an agent keeping an API key after its pilot ends. The questions are not new. What is new is only who — or what — you are asking them about.

## The Opportunity Side of the Ledger

The same leverage attackers get, defenders get. Agents that triage alerts, correlate vulnerabilities, and draft remediation tickets are already changing the economics of security operations. The organisations that will capture that value fastest are not the ones that adopted quickest or refused hardest — they are the ones whose fundamentals were strong enough to make adoption boring. Good cyber hygiene is not the brake on AI adoption. It is the licence for it.

The practical starting point is the same exercise we recommend for [any security capability](/blog/2026-08-14-procured-not-operated-vulnerability-lifecycle): map what the agent needs, name who owns it, define what it may touch, and decide what evidence its activity leaves behind. Then onboard it like you would anyone else you were trusting with your systems.

## Sources

- LinkedIn Skills on the Rise 2026 — [CIO Dive summary](https://www.ciodive.com/news/linkedin-top-skills-AI-engineering/813595/) and [CNBC: fastest-growing skills](https://www.cnbc.com/2026/02/24/the-fastest-growing-skills-in-the-us-according-to-linkedin-theyre-career-currency.html)
- Gartner, October 2024 — [by 2028, 25% of enterprise breaches will be traced back to AI agent abuse](https://www.gartner.com/en/newsroom/press-releases/2024-10-22-gartner-unveils-top-predictions-for-it-organizations-and-users-in-2025-and-beyond) ([summary](https://www.globalsecuritymag.com/gartner-by-2028-a-quarter-of-enterprise-breaches-will-be-traced-back-to-ai-hgs.html))
- Gartner Market Guide for Guardian Agents, February 2026 — 80% of unauthorised agent transactions from internal policy violations ([analysis](https://www.opsinsecurity.com/blog/gartner-market-guide-guardian-agents))
- Clifford Stoll, "The Internet? Bah!", *Newsweek*, 1995 — [archived at Elon University](https://www.elon.edu/u/imagining/expert_predictions/the-internet-bah-why-cyberspace-isnt-and-never-will-be-nirvana-2/)
- Steve Ballmer, USA Today CEO Forum, April 2007 — [Cult of Mac retrospective](https://www.cultofmac.com/apple-history/apple-history-steve-ballmer-iphone-freakout)
- [NIST SP 800-207 — Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)
- [OWASP GenAI Security Project](https://genai.owasp.org/) · [ASD: Engaging with Artificial Intelligence](https://www.cyber.gov.au/resources-business-and-government/governance-and-user-education/governance/engaging-with-artificial-intelligence)

## Engaging Us

If your organisation is piloting agentic AI and wants the fundamentals — identity, least privilege, RBAC, monitoring — designed in before the pilot becomes production, we are available to help.

[Contact us](/contact) to discuss your requirements.