Artificial Intelligence (AI) is currently playing a significant role in the cyber world, accelerating the threat environment. In order to keep up with this fast-paced landscape, defenders need to have the capability to adapt quickly.
A recent example of this is the U.S. decision regarding Anthropic’s Fabel 5 and Mythos 5 models. Initially, access was restricted due to national security concerns, but it was later restored after Anthropic agreed to implement tighter safeguards and work closely with the government. This situation highlights the challenge that organizations are facing in trying to navigate the use of powerful AI systems that are essential but also present risks that cannot be ignored.
Cyber leaders from the Five Eyes alliance have already warned that advanced AI technology will reshape both offensive and defensive cyber capabilities in a matter of months, rather than years. Models like Mythos, Fabel, and China’s GLM-5.2 demonstrate the potential for complex workflows, vulnerability discovery, and decision-making processes to be significantly expedited through machine-led activities.
Given this rapidly evolving landscape, security leaders need to evaluate whether their current cyber defense strategies are sufficient for the age of AI. They should be asking themselves if their approaches are still effective in today’s environment.
The Impact of AI on the Insider Risk Model
AI has fundamentally changed the traditional insider risk model that organizations have been operating under. Previously, insider risks were primarily attributed to human factors such as negligence, malicious intent, or compromised activities. However, with the integration of AI, these risks can be amplified, and AI itself can become a source of risk when it has the authority to act on behalf of users. This shift has led to a new dimension of risk where AI can unintentionally cause harm to an organization, even with good intentions.
Instances of this are already occurring, as seen in a DTEX investigation where a system administrator used an AI agent to steal data under a colleague’s login. The agent executed the task as instructed but utilized unsafe code from the internet to conceal the theft, ultimately exposing the organization to more risks. This scenario is just one example of the challenges organizations are facing with AI integration and why AI should be considered a part of the insider risk model.
Security teams must gain visibility into the existence of AI agents, their access privileges, and their usage patterns. Implementing solutions that provide oversight and control over these agents, whether authorized or unauthorized, is crucial in mitigating risks.
According to the 2026 Cost of Insider Risks Global Report, a significant number of organizations still lack visibility into AI agent activities, with only a small percentage treating AI agents as equivalent to human insiders.
For Chief Information Security Officers (CISOs), the immediate priority is to update their risk models, strategies, and toolsets to ensure that AI activities are monitored and managed with the same level of scrutiny as human activities.
Transitioning to Agentic Defense
As organizations update their risk models, they must also adapt their tools to align with the changing landscape driven by AI. To effectively combat AI-driven threats, security teams require AI agents that are purpose-built to detect, interpret, and respond to incidents more efficiently and accurately than human analysts alone.
Even before the integration of AI, security teams were overwhelmed by the sheer volume of threats. With AI accelerating the pace of attacks and increasing complexity, there is a heightened need for agentic defense strategies. These strategies involve using AI agents that are defensively trained to help teams cut through the noise, provide context, and enable faster and more effective responses to threats.
One key area where agentic capability can make a significant impact is in triage. In an environment where AI accelerates activities, the cost of delayed triage can quickly escalate. Analysts cannot afford to spend excessive time manually assessing the relevance of alerts. Triage is a suitable task for AI agents due to its repetitive nature, need for context, and time-sensitive nature. Effective triage can help identify critical alerts, provide explanations, and guide analysts in initiating responses. DTEX has observed operational efficiencies in government deployments where agentic capabilities saved over 40 hours per month per analyst in alert review.
Another critical area where agentic defense can be beneficial is in incident investigation. Modern security incidents are complex and often involve multiple systems and endpoints. Agentic capabilities can help reconstruct these incidents rapidly, allowing defenders to act proactively while risks are still evolving. This involves creating timelines, identifying anomalous behavior, and illustrating the relationship between actions and potential impact on the business.
Lastly, the control aspect of agentic defense is essential. Speed alone is not sufficient without proper oversight. Any agentic security solution must have clear permissions, audit trails, explainable reasoning, and human oversight for critical actions. The goal is to enable faster decision-making supported by accurate judgment to prevent breaches or mitigate their impact in real-time.
The Importance of Behavioral Context in Agentic Defense
It is crucial to emphasize that the effectiveness of agentic defense relies heavily on the quality of data and contextual information available. This principle has always been fundamental in security practices, but insider risk experts understand its significance better than most. While alerts capture the event of a risk occurrence, understanding the context and intent behind the event is where the true value lies. This is particularly crucial when dealing with insiders and AI agents.
Understanding intent involves considering whether an activity aligns with a person’s role or an agent’s designated purpose. Behavioral context encompasses details such as who performed an action, what was done, when and where it occurred, and most importantly, why it happened. Without this contextual information, AI solutions will not be able to enhance defense effectively; instead, they may propagate erroneous assumptions at a faster pace.
AI has significantly reduced the timeframe between intent and impact, as evidenced by Ponemon’s 2026 Cost of Insider Risks study, which highlights the financial consequences of delays in incident containment. Incidents resolved within 30 days cost an average of $14.2 million, compared to $21.9 million for incidents that take over 90 days to contain.
Therefore, establishing a robust behavioral context is essential for agentic defense strategies. A reliable behavioral dataset enables AI agents to make accurate decisions swiftly, thereby producing outcomes that security teams can confidently defend.
Looking Towards the Future
Leaders in the Five Eyes alliance have rightly emphasized that addressing AI-related challenges is not just a technical issue but a leadership imperative. Organizations must focus on minimizing unnecessary access, reinforcing identity controls, preparing for incidents, and leveraging AI intentionally to enhance threat detection and response capabilities.
For insider risk programs, this entails mapping out where AI agents operate, their data access privileges, potential actions they can take, and identifying behavioral indicators that could signal misuse or unsafe delegation.
As AI continues to reshape the cybersecurity landscape, organizations must adapt to the evolving risks within the enterprise. It is crucial not to wait for AI risks to mature but to proactively make AI activities observable, transparent, and defensible. This involves integrating AI agents into the insider risk model, providing analysts with the necessary behavioral context to comprehend ongoing activities, and leveraging defensively trained AI agents to intervene before risks escalate into impactful incidents.
Marshall Heilman, the CEO of DTEX, is a seasoned professional with over two decades of experience in the cybersecurity industry. He has a background in incident response and red teaming, having spent 17 years at Mandiant before its acquisition by Google. Marshall is widely recognized as an expert in cybersecurity and frequently speaks on international platforms.
Connect with Marshall Heilman on LinkedIn or visit the DTEX website at https://www.dtex.ai/ for more information.
