Two posts ago, we asked you to know your data. Last week, we asked you to control who and what can reach it. Both of these are critical. But the rising question is even more challenging.
Protecting where sensitive data lives is necessary. It is also only the first question. The harder one is what happens once something gets through, and in 2026 that something is increasingly an AI agent acting on someone’s behalf, or on its own, at 2 a.m. with no one watching.
This blog is about that moment, and about what it takes to secure AI itself.
Access was right. The outcome was not.
Picture an agent that triages support tickets. Its service account is scoped correctly. Every access control passes. Then a ticket arrives with instructions buried in an attachment, telling the agent to send a customer list to an external address. The agent has the permissions to do it, so it does.
Nothing in that chain was misconfigured. The agent did exactly what it was able to do. The failure was in what it chose to do, and no access rule was written to catch that.
This is the new shape of AI risk. Agents read content from many sources, decide what to do next, and act through tools. They can be manipulated through the content they consume, not just through the credentials they hold. Traditional security was built to answer "who is allowed in?" AI security has to also answer "what is it doing now, and should it be doing that?"
Most AI risk starts with AI nobody counted
Ask most organizations how many AI systems are running in their environment, and the answer is usually an undercount. Teams build agents on their own. AI features switch on inside SaaS platforms with a settings toggle. Model endpoints get stood up for a pilot and never shut off. Credentials created for an experiment keep working long after the experiment ends.
You cannot protect what you have not found. The first question in AI security is not about models or prompts. It is an inventory question: what AI is operating here, who owns it, and what can it touch?
Containment should have more than one setting
When an agent misbehaves, most teams face a hard choice: leave it running and hope, or shut down the workflow it supports. Neither is good.
Effective AI security gives teams a range of responses. An agent can be paused while investigators look at what happened. Its tool access can be narrowed. The machine identity it runs on can be revoked without disabling everything else. Each step should be quick, reversible where possible, and recorded. Speed matters, because an agent acting at machine speed can do more damage in minutes than a person could in hours.
"Show us what happened" is now a board question
Regulators and boards are moving past "do you have an AI policy?" toward "show us what your systems did." The EU AI Act and the NIST AI Risk Management Framework both point in this direction: documented, ongoing oversight of AI in use, not a policy binder on a shelf.
That changes what logs are for. Useful records capture what an agent was given, what it decided, what tools it called, and who approved any change to its configuration. They need to be tamper-evident and stored outside the system they describe, so the record survives the very incident it documents.
Governing AI is a connected problem
No single tool sees all of this. Access controls know who can reach a dataset. Identity systems know which machine account an agent uses. Data classification knows what the sensitive fields are. None of them know, on their own, that an agent just pulled a restricted field, combined it with an untrusted input, and tried to send the result somewhere new.
ServiceNow has approached this gap with building an AI governance solution.
Super Intelligence Control Tower and AI Passport
Super Intelligence Control Tower gives AI teams one place to see the AI systems and agents in their environment, the identities and tools they use, and the policies that govern them. It connects those signals so a single agent's behavior can be understood in context, and it supports graduated response and continuous evidence when something goes wrong. The aim is not to replace the controls you already have. It is to connect them, so "what did this agent do, and why was it allowed to?" has an answer you can give quickly. Controls can be risk, cost, security, or performance type. Having them centrally defined, mapped to Ai assets, and configured to be enforced are the critical elements of governance.
AI Passport is a cryptographically signed credential issued to each AI agent through Super Intelligence Control Tower. At runtime, the agent presents its passport, and the passport defines what it is authorized to do. When an agent stays within its passport scope, it can operate freely. When it tries to step outside that scope, the passport is designed to stop it. This is important because a post-incident report cannot undo an action an agent has already taken.
What to do this October
- Inventory every AI system and agent, including AI features embedded in tools you already run.
- Map what each agent can reach, starting with the most sensitive data and the most privileged identities.
- Test for manipulation. Check how agents behave when they read untrusted content such as tickets, emails, and attachments.
- Decide containment before you need it. Define who can pause, restrict, or revoke an agent, and how fast they can do it.
- Make sure agent actions are logged in a form you can reconstruct and export somewhere the agent cannot edit.
- Trigger a review on change, not just on the calendar. A new tool, a new model version, or a new data source should each prompt a fresh look.
The bottom line
Cybersecurity Awareness Month has long asked people to protect their passwords and think before they click. This year, the ask grows. Protect the data. Protect the identities. And protect against the new question: what happens when the thing acting on your behalf or autonomously is an AI, and it can do what it was never meant to?
The organizations that get this right will not be the ones that avoid AI. They will be the ones that can see what their AI is doing, act on it quickly, and prove it to anyone who asks.
For more information
Read ServiceNow's research on what slows security response to AI agents.
