I wrote about Cyber Security as the new business operating model back in 2017, ‘Cyber Security – The new Operating Model‘ and it has continued to reinforce itself ever since, growing into an economy grade question which I returned to last year in this piece ‘Is Cybersecurity the New Economic Policy?‘.
I am back again, this time the evidence and impact are going to lack any subtlety or modesty; it will be deafening and will hit your business with velocity, machine speed few are ready for.
Let me start with a reflection, for most of the digital era, cybersecurity has been treated as a function. The business operated, the Chief Information Security officer (CISO) protected it and Agentic AI may finally make that distinction impossible.
McKinsey recently observed that agentic Artificial Intelligence (AI) is not only increasing cybersecurity spending but reallocating it, with more security expenditure appearing outside the traditional CISO organisation as engineering, product and business functions assume greater responsibility for the risks they create. (Securing the agentic enterprise: Opportunities for cybersecurity providers).
Deloitte describes a similar governance gap, 80% of automation leaders intend to accelerate investment in AI agents, while only 21% of organisations report mature agentic AI governance capabilities. (Rethinking the CISO role for an AI-saturated enterprise).
As organisations move from people using software to autonomous systems acting on their behalf, cyber risk will migrate with the authority those systems are given. This means an AI agent reconciling accounts, changing infrastructure, interacting with customers, writing code or procuring services is no longer simply an IT asset, it is participating directly in the operation of the business. That changes the security responsibility and accountability matrix. The old model whereby the business creates, security reviews, was already struggling at cloud speed, at machine speed it becomes structurally inadequate.
Take a CFO deploying autonomous finance agents, this demands controls over their authority, transactions and evidence. Similarly, a COO will need assurance over agents modifying operational processes and the CIO will have to govern machine identities, infrastructure access and AI control planes. HR are also on the hook now, as they will encounter digital workers interacting with human ones. As for Legal and compliance, its back to school boys and gels, they will need to understand not merely what an AI recommended but what it actually did.
Cybersecurity consequently becomes less a departmental activity and more an attribute of EVERY business process, and for the CISO function that was once the top of a career ladder changes the CISO role fundamentally. The CISO becomes the Architect of Authority in a machine speed age.
Microsoft makes the distinction neatly (Observability, governance, and security shape the new frontier), governance defines ownership, accountability and policy; security enforces controls, protects access and detects threats. Neither can operate successfully in isolation, and AI risk increasingly spans legal, compliance, HR, technology and business leadership.
The CISO will not be the person who personally owns every cyber risk, but will be the executive who helps define the enterprise trust model. Defining who or what may act, under what conditions, with which privileges, against which assets and within what limits.
That architecture will have to extend beyond identity. Identity may establish who or what is requesting access, but identity alone says little about whether that entity should be trusted to act.
The harder questions are about authority, including:
- What may this agent do?
- What information may it consume?
- Which decisions may it make independently?
- When must a human intervene?
- Can its authority change dynamically according to context, behaviour or risk?
- And importantly, can the organisation prove afterwards that those boundaries were respected?
This is where cybersecurity converges with something broader, the trustworthiness of operations.
In an increasingly autonomous enterprise, boards will care less about whether individual security controls technically exist and more about whether the business can continue to operate in a way that is dependable, explainable, resilient and governable. This is resilience as you know it but on steroids.
Enter stage left, Trustworthiness therefore becomes an operational property, built from identity, authority, resilience, data integrity, monitoring, evidence and accountability. A trustworthy agentic operation must be able to answer several deceptively simple questions:
- Who acted?
- What authority did they have?
- What did they do?
- What influenced the decision?
- Was the action within policy?
- What happened afterwards?
- Can we prove it?
Yes, these are cybersecurity questions, but they are now equally business questions.
That distinction matters because agentic AI will push security spending beyond the traditional CISO organisation. Product teams will fund embedded controls. Finance will invest in transaction assurance. Operations will require continuous monitoring. Legal and compliance will demand evidence and traceability. Engineering will increasingly build security and trust mechanisms directly into the systems they create. The security budget therefore starts to become distributed because the security responsibility has become distributed.
The CISO does not become less important consequently, arguably the opposite happens. The role evolves from being primarily the defender of systems to being one of the principal architects of how the enterprise is permitted to operate.
Instead of asking only whether systems are secure, the CISO increasingly helps the organisation answer ‘Under what conditions should we trust this operation to proceed?’ That is a very different question which I expect will transform how boards think about cyber investment altogether.
I expect to start hearing boards Instead of asking ‘How much are we spending on cybersecurity?‘ increasingly needing to ask, ‘How much of the way we operate is inherently trustworthy?’nding on cybersecurity?‘
This goes to the heart of the issue, in an agentic enterprise, cybersecurity will no longer sit alongside the operating model. Cybersecurity increasingly becomes the operating model governing wheel itself, the machinery that establishes identity, constrains authority, protects evidence, assures resilience and ultimately determines whether autonomous operations can be trusted, and that may be the defining shift of the agentic era.
The CISO stops being simply the guardian of security and becomes an architect of the organisation’s authority to operate and of the trustworthiness on which that authority depends.
Of course, some organisations will respond by forming a committee, commissioning a 12 month strategy, and appointing another layer of governance to study whether they should move faster. By the time the paper is approved, the agents will already be operating the business. The organisations that fail to adapt may discover the future did not arrive without them, AI simply concluded they were no longer on the critical path, it learned to route around them.
Leave a Reply