What Is Agentic Security?

Agentic security is the practice of keeping AI agents safe to run. An AI agent is software that uses a language model to plan steps and then act: it calls tools, reads data and talks to other systems. Agentic security covers three questions. Can someone manipulate the agent? What is the agent allowed to do? Can you see and stop what it does? This is our working definition, and each standard below covers part of it. For a short definition, see the glossary entry on AI agents.

The key word is action. OWASP describes agency as the ability to invoke functions or interface with other systems. Its Excessive Agency entry (2025 edition) warns about "damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM". A chat assistant that only writes text can be wrong. An agent that can send email, change records or run code can be wrong and act on it.

A chatbot answers. An agent decides what to do next. The OWASP guide Agentic AI, Threats and Mitigations starts its decision path with one question: "Does the AI agent independently determine the steps needed to achieve its goals?" If the answer is yes, you are in agentic territory and the risks grow.

Three differences matter most.

• Instructions and data blur. The OWASP Top 10 for Agentic Applications 2026 says agents "cannot reliably distinguish instructions from related content". A web page, a file or a message can steer the agent. Read more in prompt injection in AI agents.
• Harm spreads across steps. The same document says its first risk, Agent Goal Hijack, covers the wider impact where manipulated inputs redirect goals, planning and multi-step behavior, not only a single response.
• The attack surface grows. NIST AI 600-1, the Generative AI Profile, notes that generative AI expands the attack surface because it is itself vulnerable to attacks such as prompt injection and data poisoning. The UK NCSC says in its 2025 assessment that integrating AI "almost certainly presents an increased attack surface".

The OWASP agentic document also introduces "Least-Agency": avoid unnecessary autonomy, because deploying agentic behavior where it is not needed expands the attack surface without adding value. It is the agent version of least privilege.

No single standard covers everything. These are the ones worth knowing, and the other articles in this section use them.

OWASP also publishes an LLM Top 10. The 2025 edition runs from LLM01:2025 Prompt Injection to LLM10:2025 Unbounded Consumption. A newer 2026 edition was published on 3 August 2026, so label any LLM identifier with its year. The agent-specific list is the better starting point for agents. We map it to MITRE ATLAS in top threats to AI agents. Agents that talk to other agents add risks of their own, covered in securing multi-agent systems and agent-to-agent communication.

For governance, NIST AI RMF 1.0 (NIST.AI.100-1, January 2023) is built around four functions: Govern, Map, Measure and Manage. NIST says the document is under revision, so check the NIST page for the current status. For the tool layer, see securing MCP servers and tool access.

Start small. The UK NCSC blog Thinking carefully before adopting agentic AI (May 2026) advises teams to use agents only for low-risk tasks at first and to apply established cyber security controls from the outset. It suggests tightly bounded pilots with clearly defined tasks. Its test is blunt: "If you cannot understand, monitor or contain an agent's actions, it is not ready for deployment."

The NCSC also says people stay responsible for deployment decisions, access permissions, safeguards and consequences. The agent does not carry that responsibility. NCSC advice includes least privilege, limited scope, temporary credentials, threat modeling and an incident response plan.

Treat agent identities like other non-human identities, and apply zero trust thinking: check each request instead of trusting the agent because it is inside your network.

Some products already follow these patterns. Odin, the Brandefense agentic analyst, works within the access of the person asking, shows each step and lists its sources, and anything that changes something waits for a person. That is a design choice to look for in any agent you buy or build.

Use this list before the first agent goes near real data.

Then read the rest of this section: human in the loop and least agency for design, and the AI agent governance policy template for the written rules. If your agents work in security operations, read agents in the SOC and threat intelligence, done safely.