Not long ago, the idea of software making decisions on our behalf still felt like science fiction. But following a few years of rapid AI innovation, organisations are now actively exploring how AI can be used to investigate incidents, manage workflows, interact with business systems independently, and make context-based decisions without human involvement. In what feels like a matter of months, businesses have gone from asking, ‘What can AI do?’ to ‘What can we trust it with?’
The agentic AI boom is changing things for all industries, and security leaders are no exception. Faced with growing workloads, expanding attack surfaces and persistent talent shortages, many now see AI as an opportunity to aid teams suffering from ‘alert fatigue’ by only surfacing the threats and incidents that truly warrant their attention. However, despite the excitement surrounding the technology, AI autonomy is a very different proposition to AI automation, which is why many security teams are still approaching it with a healthy dose of scepticism.
Splunk’s latest CISO research found that nearly seven in ten security leaders are prioritising AI investment, yet only 6% have deployed agentic AI in an operational capacity. At the same time, regions that have embraced AI particularly enthusiastically continue to move carefully when it comes to large-scale deployment. In the Middle East, for example, organisations reported ‘fast’ or ‘very fast’ AI adoption by late 2024, yet only 14-28% had implemented AI across business functions, suggesting that the enthusiasm for AI is outpacing actual deployment.
It’s tempting to interpret this gap between ambition and deployment as a lack of confidence in the technology itself, but that explanation misses what security teams are actually wrestling with. Most organisations aren’t questioning whether AI can deliver value, but are instead trying to determine whether they can trust autonomous systems to operate safely inside environments that contain sensitive data, critical infrastructure and business processes that can’t afford mistakes. It turns out, AI capability was never the hard part – trust has always been the real challenge.
Most organisations still don’t know what ‘agentic AI’ actually means
Part of the problem is that the industry still hasn’t settled on a consistent definition of agentic AI. The term is appearing everywhere, attached to product launches, conference presentations and vendor messaging, yet many of the technologies being described as ‘agents’ would have been considered ‘assistants’ only a short time ago. Ask them a question and they’ll provide an answer, give them a task and they’ll generate a recommendation, and some can even orchestrate workflows across multiple applications. Useful as these capabilities may be, they still rely on a human to review the output and decide what happens next – they’re still in ‘assistant’ territory.
True agentic AI operates with far greater autonomy. Rather than simply responding to prompts, agents are designed to pursue objectives, interact with systems, make decisions based on changing conditions, and execute actions with limited human involvement. From a security perspective, this changes everything. Recommending that a firewall rule should be modified is one thing, but identifying the rule, evaluating the potential impact of a change, and implementing it automatically is something else entirely. Until organisations see those differences play out in real environments, some degree of scepticism is actually a reasonable response to a market that is still trying to define where assistance ends and autonomy begins.
Enterprise infrastructure was built for humans, not machines
Even if the industry arrived at a universally accepted definition of agentic AI tomorrow, many organisations would still face one of the biggest challenges when it comes to deployment – modern enterprise environments were built for humans, not machines. The systems that govern access, permissions, accountability and security all assume that there is a person somewhere in the process, whether that’s an employee accessing an application, an administrator making a change, or a contractor connecting to a corporate network. Over time, organisations have developed governance models, approval workflows and audit processes that make sense in a world where people are the primary actors.
Agentic AI throws something new into the mix. An autonomous agent may be capable of accessing multiple systems, consuming data from numerous sources, making decisions and initiating actions without waiting for human approval, but many organisations still lack a clear way to define what that agent actually is within their environment. Is it simply another application? A service account? Should it be treated as a ‘digital employee’? This is a critical question because, as any security leader will tell you, identity has always been the foundation of trust in enterprise systems. Before organisations can become comfortable allowing agents to act independently, they first need confidence that those agents can be identified, governed and held accountable with the same rigour that would be expected of any human user.
Forget intelligence, we need to talk about identity
Organisations have spent decades refining the ways they identify users, control access and establish trust across increasingly complex digital environments. Every successful login, application request and system interaction relies on some mechanism for verifying who or what is attempting to connect. Agentic AI doesn’t eliminate that requirement – in fact, it makes it even more important.
The real issue is that there is currently no universally accepted framework for identifying and governing AI agents at scale. A security team can inspect an employee account, trace its ownership, review its permissions and establish accountability when something goes wrong. Performing the same exercise with an autonomous agent is often far more difficult, particularly when that agent operates across multiple platforms, cloud environments and third-party services. As agents begin interacting with one another, exchanging information, invoking external tools and carrying out tasks on behalf of organisations, the ability to verify where they originated, whether they are legitimate and what they are authorised to do becomes increasingly important. Without the ability to do that consistently, every interaction introduces a degree of uncertainty that security teams have spent years trying to eliminate from the rest of their environments. If security teams want anything, it’s certainty.
This isn’t a new problem. The internet itself faced a similar challenge as it expanded beyond a small community of trusted participants into a global ecosystem where identity could no longer be assumed. Blind trust was never an option, so solutions emerged around identity verification. Before agentic AI can reach its full potential, it will need to follow a similar path.
Organisations are already sitting on the solution
Fortunately, organisations don’t need to invent an entirely new trust model for agentic AI. Much of the infrastructure required to establish trust between digital entities already exists, and one of the most widely deployed examples is DNS. While most people still think of DNS as the system that translates domain names into IP addresses, it has become a critical security control point where organisations can verify destinations, enforce policy and identify suspicious activity before connections are established. In an agentic world, that same capability could help answer one of the most important questions facing security teams today: ‘How do you verify that an autonomous agent is who it claims to be before it begins taking action?’
This is where emerging concepts such as DNS-based Agent Identity (DNS-AID) are beginning to attract attention. By associating agents with verifiable domains, DNS-AID offers a potential framework for establishing identity and trust before instructions are executed, giving organisations greater confidence in the systems acting on their behalf. The ecosystem is still developing, but that shouldn’t be mistaken for a weakness. The most important conversations around agentic AI are no longer about what these systems can do, but about how they can be identified, governed and trusted. Until those questions are answered, scepticism is simply a sign that security teams are focusing on what matters most.
