Rubrik Zero Labs<\/a> that current AI security guidance is too theoretical to act on, and 81% expect AI agents to outpace existing security controls within 12 months. The core finding is blunt: most organizations lack full visibility into which AI agents are running inside their own environments, because teams across departments are spinning up tools, custom agents, and third-party integrations without central oversight. Frameworks exist; operational grounding does not.<\/p>\nWhat this means for your business<\/h2>\n
The distinguishing variable here isn’t company size or sector. It’s the gap between how fast AI is being adopted at the team level and how slowly security infrastructure catches up to that footprint. If your organization has meaningful departmental autonomy, and most do, your security team is almost certainly governing a partial map. The question isn’t whether your AI governance framework is good on paper. It’s whether your team can actually enumerate what it’s governing.<\/p>\n
The argument Rubrik Zero Labs makes, writing from a position where their own data-resilience products benefit from exactly this framing, is that observability has to precede policy. That’s correct, and the vendor incentive doesn’t undermine it. You can’t enforce access controls on agents you haven’t catalogued, any more than you can audit a building whose floor plan you’ve never seen. The five-question test they propose for any AI-driven action (what did the agent do, why, what did it touch, did it complete safely, and where did it fail) is a practical audit checklist that works regardless of which vendor’s tooling you’re running on.<\/p>\n
The framing that matters most is the shift from prevention to recovery speed. Security thinking anchored in prevention assumes bounded, visible systems. Agentic AI, where software takes real actions autonomously across connected systems, breaks that assumption by design. The CISO who builds their 2025 program around detecting and stopping every bad action is already behind. The one who also optimizes for how fast they can contain and restore after an agent does something unexpected has the right mental model for the environment that’s actually arriving.<\/p>\n
The leading indicator to watch is whether your organization has runtime governance, meaning real-time monitoring of agent behavior with the ability to intervene mid-action, or whether your controls only operate before deployment and after the fact. That gap is where incidents will compound. If your next vendor renewal or architecture review doesn’t surface that question explicitly, the budget you’re defending for AI security is probably protecting yesterday’s threat surface, not tomorrow’s.<\/p>\n
Based on reporting from AI Security Guidance Exists. The Real Problem Is That It Doesn’t Reflect Reality<\/a>, originally published 2026-07-30 04:51:00.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"Share with your CISO Eighty percent of IT and security leaders across Asia Pacific told Rubrik Zero Labs that current AI security guidance is too theoretical to act on, and 81% expect AI agents to outpace existing security controls within 12 months. The core finding is blunt: most organizations lack full visibility into which AI […]<\/p>\n","protected":false},"author":1,"featured_media":7128,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[143],"tags":[238],"tmauthors":[],"class_list":["post-7127","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ai-security","tag-ciso"],"_links":{"self":[{"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/posts\/7127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/comments?post=7127"}],"version-history":[{"count":0,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/posts\/7127\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/media\/7128"}],"wp:attachment":[{"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/media?parent=7127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/categories?post=7127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/tags?post=7127"},{"taxonomy":"tmauthors","embeddable":true,"href":"https:\/\/workai.tv\/news\/wp-json\/wp\/v2\/tmauthors?post=7127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}