Insight
What should a CISO assess before deploying AI agents?
Before an AI agent goes live, a CISO should be able to answer six questions: what the agent can reach, under which identity, which actions it can take without a person, how it was tested against prompt injection and tool misuse, what is logged, and who owns it. If any answer is unknown, the agent is not ready for production data.
The pre-deployment checklist
- Inventory: the agent, its owner, its purpose and every system and data source it touches are recorded
- Identity: it runs on its own scoped, non-human identity with credentials that rotate or expire
- Tool access: only the tools its task needs are allowed, with limits on arguments and destinations
- Data exposure: retrieval respects user entitlements and outputs are checked for sensitive data
- Testing: direct and indirect injection, data-exposure and approval-bypass tests were run, and failures fixed and re-tested
- Human approval: high-impact actions need a named approver, bound to the exact action
- Logging: prompts, tool calls and approvals are logged with sensitive values redacted
- Response: the incident playbook says how to disable the agent and revoke its credentials
Red flags that should pause a launch
- The agent uses a shared service account or a human user's full permissions
- Nobody can list the tools it can call
- It can send data or messages outside the organization without approval
- Testing was limited to normal use, with no adversarial cases
- There is no owner after the project team moves on
For banks and other regulated organizations
- Maker-checker controls must still apply when an agent initiates a payment or a change
- Customer data access must stay session-bound so one customer can never see another's records
- Evidence of testing, approvals and fixes should be retained for audit and examination
AI security and AI governance: who owns what
- Should we use AI for this?: AI governance — Approves the use case and its risk tier. AI security — Advises on threats and required controls.
- Who is accountable?: AI governance — Names the business owner and approvers. AI security — Names the technical control owners.
- What could go wrong?: AI governance — Customer, compliance and reputational impact. AI security — How the system could be attacked or misused.
- Is it still acceptable?: AI governance — Re-reviews on change and on schedule. AI security — Re-tests controls and monitors for abuse.
- Can we prove it?: AI governance — Decision and approval records. AI security — Test results, logs and remediation evidence.
Sources
- OWASP LLM01: Prompt Injection: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- OWASP LLM02: Sensitive Information Disclosure: https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/
- OWASP LLM06: Excessive Agency: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
- NIST AI 600-1: Generative AI Profile: https://doi.org/10.6028/NIST.AI.600-1
Frequently asked questions
- Who should own AI-agent security?
- The CISO owns the security controls and testing; a named business owner owns the agent and its use. Governance decides whether the use is acceptable and how often it is re-reviewed.
- How often should AI agents be re-assessed?
- Whenever the model, instructions, tools, data sources or permissions change, and on a regular schedule for agents with access to sensitive data or high-impact actions.
- Can existing security tools cover AI agents?
- Partly. Identity, logging and data-loss tools still apply, but prompt injection, excessive agency and approval bypass need tests designed for agents.