Intro
I sat down with Bryan Altimas, Founder and CEO of Riverside Court Consulting, to talk about what changes when an organisation moves from generative AI to agents that act on their own. Bryan spent 17 years at KPMG across technology risk and cyber before setting up his own practice in cyber security, data protection and AI risk management. He has watched several waves of enterprise technology arrive with the same optimism and the same blind spots.
His framing came early and it reset the whole conversation: an agent is a user of your systems, so treat it like one.
"We need to treat it as a human user of our systems."
Everything else we discussed follows from that single shift.
1. Generative AI produces. Agentic AI acts. Security has to follow the difference
"Generative AI produces information. Agentic AI is designed to decide and act. It plans tasks, it makes decisions, it interacts with systems using APIs, databases and other tools, and it executes actions with limited or no human input."
That difference breaks the habit most security teams have built up over twenty years. Traditional assurance work has a fixed object to point at.
"With traditional systems we're securing code, we're securing access rights. With agentic AI we're trying to secure what is almost a human brain. It's thinking for itself. It's acting for itself."
Bryan's analogy for what that feels like in practice is the enthusiastic new joiner who has energy, initiative and no map of where the edges are.
"Treat them as an enthusiastic graduate who may exceed their levels of authority occasionally. But with a human we can explain to them that they have exceeded their level of authority. With an agentic AI model, that's far more difficult."
So the security work becomes roles, responsibilities, boundaries and continuous validation of what the agent is allowed to reach. Familiar disciplines, applied to a very unfamiliar kind of colleague.
2. Autonomy is being granted before authority is defined
Four years into the generative wave and roughly two into agents, Bryan assesses organisations’ enterprise readiness:
"They have the fear of missing out and jumping on the bandwagon. They're not really looking at what they want to achieve with AI, and especially agentic AI. They know they can automate, but they're not producing a business case and then looking at the strategy of what the risks are and how to mitigate those risks."
The specific failure he sees most often has a neat shape to it.
"They're granting autonomy before defining what authority the agent has."
The consequence is an agent holding far more access than its original objective ever required, taking decisions inside a space nobody drew, with no obligation to hand the final call back to a person. Bryan's view is that decisions should be validated by a human, and that the threshold for which decisions need that validation has to be set before deployment rather than discovered afterwards.
3. Context bleeding is the failure mode nobody budgets for
We moved on to the two risks I hear raised most often, and Bryan started with the quieter one.
"Context bleeding is when information unintentionally flows across boundaries."
Inside a company, that shows up in three recognisable ways: sensitive data appearing in unrelated workflows, internal decisions being influenced by external or untrusted inputs, and data passing between tools with no visibility or control over the handover.
The consequences stack. There is the obvious data loss exposure, with the EU AI Act and GDPR sitting behind it. Then there is the more corrosive effect on the humans who are supposed to be providing oversight.
"It leads to corrupted decision making. When the humans are providing the oversight, they are having corrupted inputs into their decision making. And that leads overall to a loss of trust in the agentic AI model."
That last point deserves attention from anyone building a business case. An agent that leaks context does not simply create a compliance problem. It quietly degrades the judgement of every person downstream of it, and then it loses the organisation's confidence, which is expensive to win back.
4. Prompt injection is social engineering, aimed at your agent
The louder risk is prompt injection, and Bryan's comparison is the most useful mental model I have heard for it.
"A prompt injection attack is a bit like a social engineering attack on an agentic AI. In traditional social engineering, the attacker is trying to trick the human user into doing something. Here the attacker is trying to trick the agent into doing something they want it to do, by manipulating the prompts it is responding to."
The mechanics are often crude. Malicious instructions get embedded in emails, documents and web pages that the agent reads as part of its work. White text on a white background is enough, because the agent has no reason to distinguish between the words a person can see and the words a person cannot.
"The security posture should focus on what the agent can and cannot do. Defining the boundaries, having approval gates for high risk actions, and continuous monitoring for abnormal behaviour. If the agentic AI is responding to a prompt injection attack, it's going to start behaving abnormally. If we're monitoring the behaviour of it, we will pick up when it starts to behave abnormally."
5. Zero trust survives, but accountability is the part organisations keep missing
I put the obvious tension to Bryan. Security wants everything compartmentalised and separated. Agents want to be connected to everything, because breadth of context is where their value comes from. Does zero trust still hold?
"Zero trust still has a role to play in AI. It needs to evolve as well, because we're dealing with something new, and that is changing the threat."
What evolution looks like, in his description, is a set of very human ideas ported into the architecture: ethical boundaries, escalation paths, and a plan for drift, whether that drift is malicious or simply the result of a model nobody maintained. The test is what the agent does when it hits a wall.
"When the agentic AI comes up against something it can't do, it just goes off and finds a way to get the admin access rights and do what it wants to do. It should respond saying, sorry, I'm an agentic AI user, I don't have that access to systems."
And for the case where all of that fails, he wants a kill switch. He is candid that this is not yet standard practice, only good practice.
In practice the security team is usually first to see an agent drifting off track, then escalates to the business owner and the C-suite, much as they would with any other incident. Shadow AI complicates this, and Bryan sees it across both generative and agentic use.
"We define to our teams that this is the AI suite we're allowed to use, but then users think, it's not really doing what I want it to do, nobody's going to know if I just download my favourite model. Of course that creates all sorts of different risks of where's that data going."
His answer there is unglamorous and correct: use the cyber security tooling you already have to spot what has been added to the tech stack.
6. Build it in before you build it out
The old line about building security in rather than bolting it on carries more weight with agents than it ever did with software, because there is much less to bolt onto.
"Retrofitting cyber security to an agent is even more difficult, because it's not like going back to code and fitting the cyber security around that. You're dealing with an agent that is thinking for itself. Setting boundaries and roles and access rights retrospectively to an agentic AI is a nightmare."
Which means security belongs in the design phase, at the point where objectives are set, access is scoped, and boundaries are drawn.
Two constraints make this harder than it sounds. The first is people.
"There's definitely not enough specialists yet in how to secure an agentic AI."
The second is geography.
"The agentic AI doesn't recognise geographic boundaries."
The EU is taking a risk based approach to regulating AI while the US is leading with innovation and leaving regulation for later, and an agent operating across both has no concept of the difference. Bryan points to ISO 42001 and the NIST AI Risk Management Framework as credible starting points, with a caveat that anyone who has implemented a standard will recognise.
"All these frameworks are quite generic, because they want to be both industry and geography agnostic. But they do provide a starting point, and then it is up to us in our individual companies to tailor those generic frameworks to our individual cases."
Three things to lock down before you go live
I asked Bryan what a transformation leader six months out from their first enterprise agent should have settled before launch. He gave three.
- The authority and access model. What can the agent access, what can it do, and most importantly what can it not do.
- The decision control framework. Which decisions are autonomous, which require human oversight and approval, and what thresholds trigger escalation.
- Audit and monitoring capability. Full visibility of actions and decisions, real time monitoring for anomalies, and the ability to stop and contain behaviour.
That third one carries an explainability requirement that is easy to underestimate.
"We can't go back to the days when ERPs were originally introduced, when the auditor treated it as a black box and looked at the inputs and the outputs and made sure that they were aligned. That's impossible with an agentic AI. We need to be able to explain the decisions that it's making, and make sure that things like bias are not included in that decision."
Takeaway
"The biggest gap is that we're not deploying a traditional IT tool. We're deploying autonomous actors. From a human point of view, that's a complete change of mindset. I think it is beginning to close, but it's taking us quite a while to get our mindset around that gap."
The technology is moving faster than the mindset, and most of the failures he described trace back to that lag rather than to any missing tool. The organisations that close it first will be the ones that treat their agents the way they treat their people: given a role, given boundaries, held accountable, and supervised by someone whose name is on it.
