Agentic AI Security: The New Math of Risk

The RAISE Summit, held this week, brought into sharp focus the urgent need to redefine enterprise security in an era of rapidly evolving agentic AI. As AI models gain economic agency and operate autonomously within enterprise environments, the foundational principles of cybersecurity are undergoing a radical transformation.

The Shift to Autonomous Agents

Rubric Chief Transformation Officer Kavitha Maria Pan delivered a stark assessment: the security industry’s 40-year premise of 'catching bad intent' is obsolete. Three years ago, AI pilots ran in sandboxes. Today, agents with wallets act, transact, and trigger autonomously within our systems.

This shift is compounded by the plummeting cost of AI. GPT-level performance, once $20 per million tokens in late 2022, now costs 40 cents. This 9x to 900x annual price drop democratizes AI access for both innovators and threat actors alike.

AI-Driven Attacks Exploit Model Geometry

Pan emphasized that traditional defenses are outmatched. AI attackers no longer rely on tricking humans; instead, they exploit the mathematical structure of large language models. A malicious string of characters, appearing as 'noise' to human classifiers or firewalls, can compute specific outputs, bypassing existing detection layers.

Threat actors are logging in with valid credentials, not breaking in, and conducting reconnaissance for months. Rubric Zero Labs reports 90% of leaders experienced a cyberattack in the last year, with over 53% being AI-related. Alarmingly, 74% have seen their backup technologies compromised, leading to recoveries from already contaminated states.

The asymmetry is profound: offenders face no bosses, audits, or technical debt, enabling faster weaponization of cheap AI. Pan highlighted that for every human identity, there are now 109 machine identities, a figure that was 82:1 just two months prior.

Redefining Defense for the Agentic World

Given this landscape, Pan urged a new mindset: assume breach and assume agentic overreach. Security must embed resilience and recovery into its core strategy. This includes:

• Inventorying all human and non-human identities.
• Understanding dev and production environments for recovery proof.
• Making recovery a known priority in development and security strategies.

The question is no longer if a breach will occur, but how quickly an organization can recover to a known good state and protect critical data assets.

The Economic Reality of AI Deployment

Arvind, CEO of Glean, spoke earlier at the RAISE Summit, addressing the CFOs Confront New AI Economics. He noted that many businesses spend significantly on AI without seeing measurable value, with annual budgets consumed in months. Glean's strategy focuses on departmental use cases with clear, measurable business processes, like customer service or RFP completion, to demonstrate immediate ROI.

Arvind also championed the return of the Forward Deployed Engineer AI strategy, acknowledging that customers need hands-on help to extract business value from AI technologies. While Glean uses FDEs for strategic learning, their long-term strategy involves partnering with consulting companies for scalable service delivery.

Regarding the competitive landscape, Arvind positioned Glean as a neutral orchestrator of intelligence, integrating models from OpenAI, Anthropic, Google, and open-source providers. He emphasized Glean's expertise in building a deep enterprise knowledge graph to integrate intelligence with enterprise context, security, and governance.

His rapid-fire session offered strong endorsements for FDEs and open-source AI, predicting a majority of enterprise AI workloads will shift to open-source models in the next two years. He expressed a cautious 'thumbs up' for MCP, acknowledging its role in opening systems but warning against over-reliance due to inefficiency and potential for 'lazy' deployment.

The insights from both Pan and Arvind underscore a critical juncture: the promise of agentic AI is immense, but its secure and valuable deployment demands a fundamental rethinking of both security paradigms and economic strategies.