Enterprise Security in the Agentic AI Era

Securing the Autonomous Future: Trust, Safety, and Reliability of Agentic AI

5 min read

Securing the Autonomous Future: Trust, Safety, and Reliability of Agentic AI

Source: Insight Partners — Securing the autonomous future: Trust, safety, and reliability of agentic AI (2025-10-29). Local copy: .raw/papers/securing-the-autonomous-future.md.

Key Claim

AI agent security is a multi-trillion dollar problem requiring five distinct innovation categories — identity governance, full-stack observability, context-aware integration monitoring, novel-threat protection, and data-centric privacy — none of which are fully addressed by incumbent tools alone.

Methodology

Insight Partners VC market analysis published October 2025. Draws on enterprise CISO conversations, a vendor market-map review, and synthesis of public knowledge about agentic AI architectures. No empirical benchmark; reflects a practitioner/investor perspective from a firm that has invested in a broad portfolio of relevant companies (Sourcegraph, Databricks, Reco, HoneyHive, Fiddler, Delinea, Teleport, CrewAI, Promptfoo, Keyfactor, Skyflow, etc.).

Notable Findings

Five Innovation Categories

The paper identifies five domains where incumbent security tools are insufficient for agentic AI:

  1. AI Agent Identity and Access Management — managing delegated-access (copilot, on-behalf-of user) vs. autonomous-agent (own identity, acts independently) models. Highlights that existing IAM/PAM/NHI tools can adapt but face challenges with ephemeral, sprawling machine identities.

  2. Full-Stack Observability and Monitoring — characterised as the “insider threat problem for AI agents.” Agents must be monitored across identity, data, application, infrastructure, and AI model layers simultaneously. Termed “UEBA for Agents” by enterprise CISOs.

Term provenance — "UEBA for Agents" is an Insight Partners coining

The phrase “UEBA for Agents” originates here (Insight Partners, Oct 2025), attributed to anonymous enterprise CISOs. As of mid-2026 it has not gained traction in academic literature, NIST/ISO/OWASP standards, or other vendor reports — treat it as informal vendor framing rather than an established category.

Conceptual caveat: UEBA originated for stable user/host identities with persistent behavioral baselines, and most UEBA products had merged into SIEM/XDR by 2020. AI agents are often ephemeral, non-deterministic, and lack stable baselines, so the metaphor does not transfer cleanly. The wiki uses “agent behavioral monitoring” or “behavioral baselines for agents” as the architectural primary terms; “UEBA for Agents” is preserved here and in Insight Partners’s entity page as the original coinage. See Peer-Review Readiness — Gaps in the RA + CMM §“UEBA-for-Agents single-source attribution”.

  1. Context-Aware Network and API Monitoring — new protocols (MCP, Agent2Agent/A2A) require agent-specific intelligence overlaid onto traffic monitoring. MCP proxies and policy enforcement become critical. Agent Account Takeover (AATO) is an emerging attack class.

  2. Novel Threats to AI Agents — goal manipulation, command injection, rogue agents in multi-agent systems, MCP server manipulation. Sandboxing is critical to prevent OS-level command execution after other controls fail.

  3. Data-Centric Security and Privacy — PII flows across multi-agent, multi-geography pipelines. Data lineage (tracking user-generated vs. agent-generated content and sensitivity changes) is a new challenge.

Identity Architecture Detail

  • Delegated access model: agent acts on behalf of a user; uses user-scoped token. Common today (copilots, coding assistants).
  • Autonomous agent model: agent has its own identity, authenticates independently. Growing as enterprises become AI-native.
  • SPIFFE/SPIRE identified as the gold standard for workload identity (machine-to-machine), but authentication is only the foundation — an authorization layer is still required.
  • Credential Zero problem: agents must authenticate to a vault/IdP to retrieve tokens; SPIFFE/certificates can solve this bootstrapping step.
  • Action-to-identity tracing: existing protocols (OAuth 2.0) do not adequately capture whether an agent acted under its own agency or in response to a human instruction — a liability gap.

Market Structure

Three layers of vendors exist:

  1. Established security vendors adapting (IAM, PAM, DSPM, SIEM).
  2. First-wave AI security companies extending to agents (AI firewalls, AI guardrails).
  3. New-generation companies focused solely on agent-native architectures.

Portfolio disclosure

Insight Partners has invested in many companies named in the market map: Sourcegraph, Atlan, Databricks, Tavily, Reco, HoneyHive, Fiddler, Trust3 AI, Weights & Biases, Onetrust, Delinea, Teleport, CrewAI, Promptfoo, Keeper, Keyfactor, E2B, Frontegg, Ory, PlainID, Anjuna, Aviatrix, Skyflow, Kiteworks, Docker. Analysis should be read with this conflict of interest in mind.

Enterprise Guidance

  • Start with existing IAM/IGA stack for agent identity governance — only feasible for digitally mature orgs.
  • Prioritize visibility and behavioral monitoring (“UEBA for Agents”) over fully deterministic rulesets, because agents are inherently probabilistic.
  • Engage existing vendors on roadmap gaps before buying point solutions.
  • Regulated environments will require mandatory agent audit/forensics trails.

Startup/ScaleUp Guidance

  • Avoid “we solve all of AI Agent security” messaging — CISOs are skeptical.
  • Identify a specific risk category and how you integrate into the existing stack.
  • Find the right budget owner (security vs. AI innovation budget).

Strengths and Weaknesses

Strengths:

  • Comprehensive five-part taxonomy is well-structured and aligns with practitioner language.
  • Honest about incumbent capability gaps.
  • Useful identity architecture breakdown (delegated vs. autonomous, SPIFFE, Credential Zero).
  • The “UEBA for Agents” framing and action-to-identity tracing gap are practically useful.

Weaknesses:

  • VC market-map perspective; significant portfolio conflict of interest (24 named investees).
  • No empirical evidence, threat modeling, or incident data.
  • Minimal treatment of standards/regulatory alignment (NIST AI RMF, OWASP LLMT10 cited only by link).
  • MCP/A2A protocol security coverage is cursory.

Relations

Graph View

Backlinks