Whilst businesses have traditionally focused on insider threats arising from human judgement and behaviour, they must now also prepare for autonomous tools acting outside their intended boundaries. With how quickly they are developing, it can be difficult not only to understand their expanding capabilities, but also to assess the implications for organisational security.
This concern is becoming more prominent as AI becomes embedded in operations. 42% of employees use generative AI at work, and around a third keep it secret from their employer. To combat these new insider threats, security teams must ensure they have the right safeguards and response plans in place in case agents cause damage by acting outside of their intended boundaries.
When permissions go too far
As AI agents gain greater access to information within organisations, businesses need to reassess their approach to insider threats. These agents can create serious consequences when they operate beyond their intended parameters.
Mark Molyneux, Field CTO at Commvault, explains: “Insider threats are spreading beyond the human domain and into the autonomous one. In a relatively short time, AI agents have evolved from productivity tools into systems with authorised access and greater decision-making capabilities. Recent incidents have shown the consequences, with agents bypassing controls designed to contain them in pursuit of their goals.”
When permissions go too far
However, the concern is not that autonomous agents set out with malicious objectives, but that they are operating with more permissions than they need. Bertijn Eldering, associate sales engineer at HackerOne, notes: “The insider risk in enterprise AI is rarely about intent and more so about inherited access. An assistant does not simply decide to leak data, it answers the question it was asked using whatever it can access.”
The gap between purpose and granted permissions becomes more difficult to manage when employees adopt AI tools outside formal governance processes. In these situations, security teams may have limited visibility into what information is being shared or how it is being handled.
“One example of this is a case with Samsung where the organisation reportedly restricted internal use of generative AI tools after employees were suspected of sharing sensitive material with a public chatbot. With a majority of employees now using these tools in their daily work, often outside formal governance processes, shadow AI has become a more relevant concern than traditional shadow IT,” Eldering adds.
This makes it more difficult to differentiate between legitimate use and activity that creates exposure, whether the tool is a public chatbot or connected to internal systems. This could involve an employee using a public chatbot to summarise an internal document or a company-approved AI agent taking actions beyond what it was authorised to do. The first creates risk through external data sharing, and the other creates risk through excessive permissions or unexpected behaviour.
Security teams therefore need clear oversight of how these tools are used and what they are permitted to access so they can be aware of unusual activity before it results in a breach.
Failing to prepare is preparing for a breach
Addressing this growing form of insider threat requires businesses to put safeguards in place before autonomous tools are given permissions that could expose sensitive data or disrupt operations. This means that organisations must be clear about who or what is requesting access to sensitive information, especially as autonomous tools become more capable.
Controlling who, or what, can access sensitive systems is more important than ever, stresses Neil Jenkins, Chief Product Officer at Fastmail.
“It’s striking that your email account can now be protected by stronger authentication than your bank account. Passkeys are resistant to phishing and credential theft, yet many banks still rely on passwords and traditional two-factor authentication. Strong authentication is a fundamental part of managing insider risk, but it’s only the first line of defence. Businesses need to apply the principle of least privilege, giving employees access only to what they need and making it easy to flag suspicious activity. Increasingly, that same thinking needs to apply to AI agents.”
The other part of the solution is ensuring that agents are restricted and their activity is monitored. He continues: “Agents need tightly defined permissions, clear boundaries and appropriate monitoring so that an unexpected route to completing a task doesn’t become a security vulnerability.”
Even with preventative measures are in place, no organisation can entirely eliminate an insider breach from occurring. Commvault’s Molyneux emphasises: “AI is unpredictable by design, so businesses should operate on the assumption that controls may fail and prepare accordingly to minimise downtime and reputational damage. With 90% of businesses saying they need identity management improvements to address AI-related risks, a ResOps model that brings identity, security and recovery together, whilst monitoring for unexpected activity, is essential.”
“Organisations should also maintain a recovery environment isolated from live systems, so that critical data and the backups required to restore it remain protected,” he adds. “Adopting this approach and preparing in advance allows businesses to respond quickly if an incident does occur.”
Offline storage provides a clear way to create this separation. Carlos Sandoval Castro, IBM Worldwide Tape Offering Manager for the LTO Program, explains: “Tape storage is particularly well suited to this because data stored on offline tape is physically separated from connected infrastructure.
“Once a tape cartridge has been removed from the drive and securely stored, an insider – whether a compromised account, malicious employee or autonomous system – cannot remotely access, alter, or delete the data. Access requires someone to be physically present and able to retrieve and load the media.”
Agentic AI is expanding the traditional definition of an insider threat and creating a new source of risk for organisations to manage. Businesses must put the right protections in place to determine how much trust to place in these systems, particularly when AI can access sensitive information and act at a speed that is hard to monitor.
As agents become more deeply embedded in everyday operations, businesses will need to look beyond the permissions granted to them and consider whether they can understand and control their behaviour when something goes wrong.
