Complete AI Security Starts with the Agent

AI agents work a lot like people, except they’re faster, teams can create thousands of them in a minute, and they don’t go home at night. That makes them immensely valuable but also a new kind of risk. Security teams are trying to keep up one tool at a time, and it’s costing them: many of the tools are data-blind, and the whole setup is hard to run. Teams end up toggling between solutions without the full picture.

Complete AI security must involve a single control plane that addresses every use case, making it much easier to adapt. That starts with the agents: what they can reach, what they need to accomplish, and what they’re allowed to do. From there, it extends to every place agents operate. And because it’s built to evolve, it’s enhanced as quickly as agentic platforms are, so protection never falls a step behind.

Why scattered doesn’t work for AI security

When we don’t understand something, we do what people always do: we focus on one piece of it. With AI security, that instinct backfires, because the problem is broad and it never stops evolving. Teams get control of the network, and then realize agents are on the endpoint. So they address the endpoint, then discover the work has moved. They invest in tools to help them see AI usage across teams, then discover someone is using an unsanctioned model to get their work done. Glorious whack-a-mole.

Keeping up with AI is like chasing a hurricane. Every hour spent on one piece of it is an hour not spent understanding what the storm is doing and where it’s headed.

AI moves fast, and it surprises faster

Pace makes it worse, and any program that doesn’t account for it will fall behind. Take an enterprise with a thousand applications, none of which had AI in them just a couple of years ago. How long until every single one does? Sooner than most teams expect. The surface to secure isn’t growing gradually. It’s becoming everything.

Agents that act on their own

Then there’s the surprise factor. My team runs coding agents overnight, and we watch them with guardrails we’ve set. One morning, we discovered that the agents had been negotiating with each other. Each had a goal, and together they worked out that they’d collide if they accessed a shared resource at the same time. So what did they do? They built a queue and coordinated who went when. Nobody told them to do this. Nobody. And in our case, they behaved nicely.

It’s a bit like raising a child: as the parent, you’re smarter and more experienced, but you’re still regularly surprised. We think we understand what AI is doing, and we don’t. We can’t control an agent’s thought process, but we can decide which of its actions aren’t worth the risk. That means deciding what risk you’re willing to take and then enforcing it.

That changes how security works. A rule can’t anticipate what an agent will decide to do, so the starting point has to be the agent itself, not just the places it happens to run. Every control follows from that, and each one has to adapt to the model, the task, and the context.

Complete AI security needs to keep pace

In a field this new, complete doesn’t mean just a longer feature list. It means coverage across models, agents, and every place AI creates risk, with shared context between the layers. It means a platform that can match the changes to AI at the same pace — sometimes overnight.

I’m occasionally asked to present our two-year roadmap, and I can only smile. I hardly know what will happen two or three months from now. Even when I think I know, it changes 20 times because AI changes that fast. So complete has to hold up across coverage, the security lifecycle, and the ability to fill gaps that open up daily.

Right now, security teams are treating AI as a series of separate problems. Most start by allowing and blocking sites. Next, they permit an agent inside a tool like ServiceNow, Confluence, or Notion. Then they monitor prompts and responses for sensitive data. Each step matters, but none addresses what an application accesses and decides to do on its own.

Addressing that means understanding what the agent is trying to do and deciding whether you’re comfortable with it. In practice, that takes four layers working together:

• Discover and protect where people use AI: See browser-based AI, including shadow AI and personal accounts, and stop sensitive data from leaving in prompts, uploads, and pastes. Block lists aren’t enough, because the control has to work at the level of the prompt.

• Govern every prompt, token, and tool call from one place: Set guardrails on what goes into and comes out of a model, control which models people and agents can use and what they cost, and decide which tools agents can reach.

• Keep agents to their intent: Each agent has a declared purpose, and every action is checked against it.

• Detect and respond to AI threats: See misuse, compromised identities, and attacks like prompt injection as they happen, and act.

The same principles everywhere

What makes these a unified approach is that each starts from the agent and shares the same patterns and the same context. Agents live everywhere, and they are different from one another. But the foundational things you need to do are the same.

We need Intent-Based Access Control (IBAC) for all forms of agents (even if the implementation is different). We need adaptive policies for everything. We need to red team all forms and all locations. We need a kill switch. Underneath all of it is data. It’s what makes an agent worth having, and it’s where most of the risk comes from.

Unified doesn’t mean a single pipe

Completeness also can’t rely on forcing everything through a single pipe. That rarely works for anything in life, and you end up with a false sense of governance. So why would it work in something as dynamic and wonderful as AI? We don’t govern people by making everyone exactly the same, and we shouldn’t govern AI that way either.

A coding agent, a new HR system, and a new CRM need the same principles, applied differently. Each needs controls matched to its access and purpose. What doesn’t change is where you start: the agent. Unified means one view and one set of principles, not one chokepoint. That’s also how you avoid choosing between adopting AI and protecting the business.

How to test whether your AI security is complete

Start by understanding your company’s agentic workforce and how that workforce is set to grow. The six questions below are a quick way to see where the gaps are.

• Can I see every AI tool in use, sanctioned or not?
• Do I know what sensitive data each agent and model can reach?
• Can I get all the breadcrumbs from the agent to the data it’s using?
• Is policy consistent across the browser, the gateway, and the agent?
• Can I tie every agent action to a real identity and a declared purpose?
• Can I follow one incident across all of it, in one timeline?

Then look for a complete AI security solution. The goal should be to manage excessive agency, so agents can do the work they’re given and nothing beyond it.

How we’re building complete AI security at Varonis

This is the approach we’re taking with Varonis Atlas — and why we’re extending AI Detection and Response (AIDR) to the places where AI is used: the browser and the endpoint; the gateways between agents, models, and tools; and the agents themselves, checking what they do against what they were meant to do.

All of it draws on the same data context. That’s a more complete answer than securing each touchpoint on its own, though given how fast this field moves, it won’t be the final word. Whatever complete looks like a year from now, it should be easier to operationalize, easier to maintain, and easier to evolve. The future belongs to organizations that can trust their agents.