Ask ten security vendors whether they provide AI security and almost all of them will say yes. Ask what they actually secure and the answers quickly become very different. Some focus on protecting large language models (LLMs) from prompt injection or data leakage. Others monitor how AI generates code or responds to users. All of those capabilities matter of course, but they describe only one part of the challenge organisations now face.
The arrival of AI agents has fundamentally changed what AI systems are capable of doing. We have moved beyond tools that simply answer questions or generate content. Today’s agents can access enterprise applications, invoke APIs, retrieve sensitive information, create tickets, update records, provision infrastructure and complete business processes without direct human involvement. This means that security teams are now no longer just protecting conversations with AI. They are also protecting actions carried out by AI.
It’s an important distinction to make because many organisations are still approaching AI through the lens of LLMs. They are asking whether models can be manipulated, whether prompts are safe and whether outputs can be trusted. Those remain important questions, but they don’t tell the whole story. Once an AI system is given the authority to interact with enterprise systems, an entirely new attack surface appears.
The brain is only part of the picture
One of the easiest ways to understand the difference is to think of an AI agent as having both a brain and a body. The LLM acts as the brain. It reasons, interprets instructions and decides what should happen next. Most AI security solutions concentrate their efforts here by trying to prevent prompt injection, jailbreaks or harmful responses.
The body consists of everything that allows the agent to act on those decisions. APIs connect it to business systems. MCP servers provide access to tools. Credentials allow it to authenticate. Permissions determine what it can access. Enterprise applications become the environment in which those decisions are carried out. Protecting the brain without understanding the body is a little like securing the steering wheel of a car while leaving the keys in the ignition.
This is where the industry is beginning to separate AI security from agentic security. Traditional AI security asks whether the model behaved correctly. Agentic security asks whether the actions taken afterwards were appropriate, authorised and safe.
The real risk lives behind the prompt
Consider a customer service agent helping someone request a refund. The prompt itself may appear completely harmless. The customer simply explains they were charged twice and asks for their money back.
Behind the scenes, however, the AI agent may retrieve account information, check payment history, call billing APIs, update financial systems and authorise the refund automatically. Every one of those actions depends on APIs, permissions and connected systems. If any part of that chain is abused, over-permissioned or manipulated, the organisation has a security problem that has very little to do with the original prompt.
This illustrates why looking only at user interactions provides an incomplete picture. Security teams also need visibility into how AI systems make decisions, which tools they invoke, what data they access and which actions they execute. The conversation is only the beginning of the story.
AI changes the speed and scale of security
Traditional cybersecurity has largely been built around human behaviour. Humans work at predictable speeds. They make mistakes, pause to think and generally perform one task at a time. AI agents behave very differently.
An agent can authenticate to dozens of systems within seconds, chain together hundreds of API calls, retrieve information from multiple sources and make autonomous decisions continuously throughout the day. Future generations of agents may also create specialist sub-agents to complete individual tasks before combining the results. This level of autonomy introduces complexity that conventional security monitoring was never designed to understand.
The challenge becomes even greater because most of this activity takes place using legitimate credentials. Our ownresearch found that 99% of API attacks now originate from authenticated sources, demonstrating that attackers increasingly prefer abusing trusted identities rather than attempting to bypass authentication altogether. AI agents naturally operate in this authenticated world, making behavioural visibility far more important than simply determining whether access was granted.
Following the sequence of intent
For many years, API security focused on understanding business logic. Attackers were no longer limited to exploiting software vulnerabilities. They increasingly abused legitimate functionality in ways developers never intended. Agentic AI extends that challenge.
Security teams now need to understand the complete sequence of intent. A prompt leads to reasoning. Reasoning selects tools. Tools invoke APIs. APIs retrieve data or trigger business processes. Those actions produce real-world outcomes. Every stage introduces opportunities for misuse, excessive privilege or unexpected behaviour.
A perfectly reasonable prompt can therefore produce an undesirable outcome if the surrounding infrastructure has not been designed with appropriate governance. Likewise, a prompt that appears suspicious may ultimately result in no meaningful action if the agent lacks sufficient permissions. Understanding that entire chain is becoming just as important as analysing the prompt itself.
We have seen this pattern before
The cybersecurity industry has experienced similar transitions before. Twenty years ago, virtualisation fundamentally changed where workloads ran. Organisations embraced the flexibility almost immediately, while security teams realised their traditional controls were no longer observing the most important traffic. Communication between virtual machines often bypassed the visibility that perimeter security relied upon.
Cloud computing followed a similar pattern. Applications became distributed, identities replaced network boundaries and security gradually shifted towards protecting workloads rather than simply defending the perimeter. Entire categories of cloud security emerged because existing approaches no longer reflected how technology was being used.
Agentic AI represents another architectural shift. The important activity is moving into the connections between language models, APIs, enterprise applications and agent infrastructure. Organisations that continue viewing AI purely as a model problem risk overlooking where many of the most significant security decisions are actually taking place.
The industry Is already recognising the difference
Governments are beginning to acknowledge that AI agents introduce risks beyond those associated with traditional AI systems. Recent international guidance from organisations including CISA, the UK’s National Cyber Security Centre and the NSA highlights the unique challenges created by agentic AI, including excessive privilege, tool misuse, accountability, indirect prompt injection and autonomous decision making.
Those recommendations place considerable emphasis on governance rather than simply model safety. Organisations are encouraged to understand what agents are authorised to do, how their actions are monitored, which permissions they hold and how their behaviour can be audited. These concerns extend well beyond the language model itself.
Security needs to follow capability
As organisations deploy more AI agents, security conversations need to mature alongside them. Questions about prompt filtering, hallucinations and model safety will remain relevant, but they should be accompanied by equally important discussions around permissions, API governance, runtime visibility and behavioural monitoring.
Security leaders should know which APIs every agent can access, what systems those APIs expose, how permissions are delegated, which MCP servers are connected and whether autonomous actions remain within acceptable business boundaries. They should be able to reconstruct every decision an agent made and understand why that decision resulted in a particular outcome. Without that visibility, organisations may understand what their agents are saying while remaining largely unaware of what their agents are actually capable of doing.
Every major technology shift has eventually created its own security discipline. Virtualisation did. Cloud computing did. Containers did. Agentic AI appears to be following the same path. The organisations that recognise this early will build governance around the full execution layer of AI, rather than focusing solely on the models that drive it. In doing so, they will be far better prepared for a future where software doesn’t just respond to instructions, but actively carries them out.
Roey Eliyahu
Roey Eliyahu is the co-founder and CEO of Salt Security, the leader in agentic and API security. He founded the company in 2016 and has expanded its mission to the agentic layer, where AI agents now act autonomously across enterprise infrastructure.
