AI Agents Expand Enterprise Security Attack Surface

Why It Matters

AI agents amplify existing vulnerabilities and introduce new, hard‑to‑monitor attack vectors, making proactive security governance essential for protecting enterprise data and sustaining AI‑driven growth.

Key Takeaways

• AI agents create a multi‑layered attack surface beyond traditional IT.
• Identity management and guardrails are critical for securing AI‑driven processes.
• Prompt‑engineering attacks are simple, but agent nondeterminism limits attacker success.
• Observability gaps hinder detection; new tools needed for AI activity logs.
• Enterprise risk frameworks must treat AI adoption as a fast‑moving security priority.

Summary

The conversation with Nomi Security CEO Emanuel Salmon centers on how AI agents are reshaping the enterprise attack surface. While traditional IT, cloud, and IoT have already expanded threat vectors, AI introduces a multi‑layered frontier that spans infrastructure, identity, and application layers, demanding fresh security thinking. Salmon emphasizes that AI agents act as identities performing privileged tasks, making identity governance, guardrails, and prompt‑engineering defenses essential. Yet attackers will still gravitate toward the weakest link—often legacy systems or poorly protected identities—rather than the novel AI layer, meaning the bulk of threats remain familiar phishing and ransomware tactics. A striking point is the nondeterministic nature of AI agents: a malicious prompt may not reliably execute, and attackers can be as frustrated as end users. Observability is another pain point; current logs rarely capture agent actions, prompting a surge in new tooling focused on AI‑specific visibility and governance. For enterprises, the takeaway is clear: AI adoption must be paired with dedicated security controls, risk‑based governance, and rapid development of observability solutions. Without these, organizations risk both incremental breaches and a potential high‑impact incident that could halt AI initiatives and erode stakeholder confidence.

Original Description

Mike Vizard talks with Emanuel Salmona of Nagomi Security about why AI agents create a broader and more complex enterprise security challenge than previous technology shifts. Salmona explains that agents introduce new identity, governance, observability and guardrail requirements because they can take actions across infrastructure and applications on behalf of users and systems. The conversation also explores why security leaders need to understand business risk, build practical best practices and experiment with AI agents before major incidents or regulators force the issue.