AI cybersecurity governance starts with the whole system
An AI security review can approve a model and still miss the risk that matters. In a real enterprise, models don’t sit alone: routers may choose among them, workflows can launch agents, and those agents can reach tools and data across cloud services and internal systems. A control that sees one application at a time may not see what the combined system is doing.
That’s the central governance problem. AI adoption is expanding across SaaS applications, generative AI platforms, on-premises infrastructure, and custom agents. Some of that activity is sanctioned and visible; some can remain outside the security team’s line of sight, a blind spot examined in detail in Shadow AI Agents: Enterprise Security Blind Spots and AI Cybersecurity Governance Challenges. Netskope’s report frames shadow AI infrastructure as a challenge for security teams precisely because new AI services and agents can bring data and security risks while remaining under the radar. (Source: Netskope, Cloud and Threat Report: Shadow AI and Agentic AI 2025)
The practical shift is to stop treating “the AI model” as the unit of security. The unit is the working system: models, agents, orchestration, identities, connected tools, and the data moving among them. That’s a broader job, but a more honest one.
What is AI governance?
AI governance is the set of policies, ownership, and controls that determine how AI is selected, used, connected, monitored, and reassessed. It answers questions such as: Which agents are allowed? What tools may they connect to? What data can they access? Who is accountable when their behavior changes?
For cybersecurity, governance has to do more than approve a model at procurement time. Dark Reading describes policies that specify which agents can run and what Model Context Protocol (MCP) servers they can connect to, but notes that component-by-component enforcement can miss what happens when approved components interact. A system can be compliant in its individual parts and still produce risky behavior in combination. (Source: Dark Reading, “The Hidden Risks of Fragmented AI Security”)
This is why AI cybersecurity governance belongs with architecture and identity governance, not just with an AI-use policy. If an agent has a business identity, permissions, and access to connected tools, its effective reach depends on those relationships. An approval that ignores the identity and access path is incomplete.
Why individually safe actions can add up
Imagine an approved agent retrieving information, passing it to another tool, and triggering a workflow. Each step may look ordinary when inspected alone. Yet the combined chain can move information or initiate actions in ways no single endpoint or application-level control recognizes. Dark Reading highlights this gap: a sanctioned model’s task may appear benign even when multiple agents or orchestrators acting across systems create a potentially malicious outcome.
Connections deserve particular scrutiny. Dark Reading discusses agents reaching outside tools and data through external MCP servers, where apparently innocuous text may carry embedded scripts or instructions. The lesson isn’t that every integration is hostile. It’s that input and action boundaries change when a model can call tools, and security teams need to evaluate the route from instruction to execution rather than trusting a model’s built-in guardrails as the final check.
There’s another wrinkle: approval can go stale. A model may change after an update, a new integration, or a shift in how people use it. The original review may not reflect the system that exists today. Reassessment should follow meaningful changes in models, permissions, tools, and workflows—not just the calendar.
Agent sprawl is also identity sprawl
A growing collection of agents is hard to govern if nobody can answer what each one is, who owns it, and what it can reach. Treating agents as identities makes the operational questions sharper, which is the case made for nonhuman identity controls in Agentic AI Is Blurring Identity Lines — Your AI Security Infrastructure Has to Catch Up: Is the identity unique? Are its permissions limited to its task? Can the organization trace actions back to it? Does access end when the workflow or project does?
These are recommendations drawn from the visibility and cross-system gaps described by Dark Reading and Netskope, not a claim that one control solves every AI risk. Start with an inventory that includes sanctioned models, agents, MCP servers, and other AI components. Record owners, business purpose, integrations, data access, and the identity or credentials used. If a team can’t establish those basics, it can’t reliably evaluate the agent’s actual reach.
Then map permissions against the work the agent is meant to perform. Broad, inherited access is convenient; it also makes the consequences of a compromised or misdirected workflow larger. Keep access narrow, make ownership explicit, and review it when the agent’s purpose or connections change. That is identity governance for AI in practical terms—building the controls described in AI Cybersecurity Governance: Before Agents Get System Access, Build Controls Around Identity and Actions and Agents as Identities: The IAM Gap Every Enterprise Is Ignoring: manage the nonhuman actor with the same seriousness as the access it exercises.
Build visibility across the chain
Inventory is a beginning, not a security program. Teams also need to understand how AI components behave across tools and systems. A log from one app may show a single prompt or call; it may not explain the sequence that led from an input to a downstream action. Connect the evidence across identities, model calls, tool use, and workflow execution where the environment allows it.
The Cloud Security Alliance’s enterprise AI agent security report underscores that agent security is an enterprise concern rather than a model-only problem, and discusses capabilities spanning posture management, observability, and detection and response. Those categories point to a useful operating rhythm: assess how agents are configured, observe what they do at runtime, and establish a response path when behavior falls outside expectations. (Source: Cloud Security Alliance, Enterprise AI Agent Security Survey Report)
Security teams should define what an unusual action looks like in their context. A new destination, unexpected data access, a privilege change, or a sequence of tool calls outside the agent’s stated purpose can all be useful review signals. The source material does not prescribe a universal alert threshold; organizations need to set those expectations based on their architecture and risk.
Most important, make the final control external to the model. A model’s refusal behavior or built-in guardrails shouldn’t be the only thing preventing a harmful action. Enforce policy at the identity, integration, workflow, and infrastructure layers, where actions can be restricted or stopped independently of what the model says.
A practical governance loop
A useful program can be built around four recurring questions:
- What exists? Maintain an inventory of models, agents, infrastructure, and connected services, including shadow or locally built components where discoverable.
- What can it reach? Document identities, permissions, data flows, and external connections. Review whether access matches the agent’s stated purpose.
- What is doing? Monitor behavior across the chain rather than relying only on an individual application’s view. Preserve enough context to investigate sequences, not just isolated events.
- What changed? Revisit approvals after model updates, new integrations, changed workflows, or shifts in use. Assign an owner to make sure the review actually happens.
These steps won’t eliminate risk. They do make it less likely that an organization mistakes a collection of approved components for a governed system. Agentic AI can deliver practical value, but the security boundary is no longer a single model or app. It’s the relationships among the model, the agent, its identity, its tools, and the data it can act on. Governance that sees those relationships is the difference between an approval record and real oversight.
Sources
- Dark Reading, “The Hidden Risks of Fragmented AI Security”
- Cloud Security Alliance, Enterprise AI Agent Security Survey Report
- Netskope, Cloud and Threat Report: Shadow AI and Agentic AI 2025
