Key takeaways
- Incorporating agentic AI into security is critical for countering attackers operating at machine speed.
- Unlike traditional security processes that follow a fixed decision tree, AI agents adapt to changing conditions and need guardrails to ensure secure usage.
- Using AI agents for security also creates a new attack surface, opening the door to tool misuse, privilege abuse, memory poisoning, and other threats.
- To secure AI agents, organizations must treat them as governed identities, giving them scoped and short-lived credentials, applying runtime guardrails, and ensuring humans approve irreversible decisions.
Organizations are incorporating AI agents into cybersecurity to automate routine security operations center (SOC) operations, find and detect vulnerabilities in architecture and traffic patterns, and test environments against direct threats. These AI agents can dramatically reduce the time spent managing, detecting, and responding to threats, but their use also creates significant risks. AI agents introduce a range of threats, including memory poisoning, prompt injection, cascading agentic failures, and identity drift. Despite the risks, agentic AI is an essential countermeasure to AI-driven adversarial attacks.
The complexity of managing cybersecurity in a digital-first, AI-powered era can’t be overstated. Security teams are safeguarding hybrid multicloud environments, distributed architectures, and complicated AI systems that now interact with apps, APIs, and other models across the estate. Meanwhile, attackers are capitalizing on AI to launch larger, more sophisticated attacks, faster than ever before.
Using agentic AI for security can help fight machine-speed threats, continuously test environments, and autonomously mitigate alert fatigue. AI agents can crawl for undetected vulnerabilities, identify dynamic signature anomalies, and carry out autonomous alert prioritization, enabling teams to reduce the time spent identifying and responding to AI-powered threats.
At the same time, using AI agents within cybersecurity creates new risks. Cybercriminals are using AI to aid with distributed denial-of-service (DDoS) attacks, credential stuffing, and other traditional tactics, along with new attacks like prompt injection, data poisoning, agent goal hijacking, and others.
According to the 2026 F5 State of Application Strategy Report, 98% of organizations surveyed say they are modifying their apps for agentic AI access. Those organizations are already using or actively evaluating an average of seven AI models. As this AI adoption continues to increase, the attack surface will expand.
How does agentic AI work for cybersecurity?
Agentic AI describes AI systems that can autonomously carry out multiple steps in pursuit of a specific goal. The agent is given an objective, access to tools, memory that persists between steps, and an identity with real permissions.
In support of cybersecurity measures, agentic AI has two primary functions: 1) providing a countermeasure to fight AI-driven attacks with AI-enhanced traffic monitoring, signature tracing, and vulnerability discovery, and 2) improving incident response management with risk prioritization and automation.
Under the hood, a security agent runs a loop. Each pass through that loop can produce new information, which the agent can use to optimize the loop.
In a typical loop, the agent might execute all of the following actions:
- Perceive: The agent ingests security signals, such as alerts, logs, telemetry, identity events, and external threat intelligence.
- Reason and plan: The agent then breaks the goal into steps, interleaving reasoning steps with action steps and revising the plan as new information arrives.
- Act: The agent takes action, using the tools necessary to complete each task. The agent might query the security information and event management (SIEM) system, look up an IP reputation, pull an endpoint process tree, isolate a host, or open or close a ticket.
- Observe: The agent reads the tool output and compares it against the goal, then loops back to the reasoning and planning step if necessary.
- Persist: Outputs and findings are written to memory so that later decisions inherit the context of earlier ones.
- Escalate: At defined checkpoints, the agent stops and hands the decision to a human.
The ability to adapt to new information is one of the key attributes that separate AI agents from existing automation tools. This is what enables attackers to move more quickly and why AI-enabled cybersecurity is necessary to uncover vulnerabilities and stress test the estate.
Comparing traditional SecOps and agentic AI
Many security teams have already integrated automated SecOps into essential processes. For example, SOAR (security orchestration, automation, and response) solutions are deterministic tools that execute tasks at machine speed. If condition A exists, the tool runs action B. These solutions are fast and auditable, but they break the moment reality deviates from the existing decision branch.
AI agents are non-deterministic. They don’t follow rigid rules. Instead, they dynamically adjust and adapt to new input. As a result, they are better at handling novel threats. Additionally, AI agents can execute complicated tasks autonomously, with limited or no human input, and they can often provide more comprehensive coverage to deliver faster results than SIEM and SOAR solutions. But because they are dynamic, they require greater governance and necessitate observability.
| Traditional SecOps (SIEM plus SOAR) | Agentic AI security | |
|---|---|---|
Alert handling | These tools conduct rule-based correlation, then put alerts into a human queue. | Agents triage, enrich, and close low-risk alerts, escalating only a prioritized set to analysts. |
Mean time to respond | Speed is determined by analyst availability. It often takes hours or days to complete lower-severity work. | Agents can contain threats at machine speed. Human time is spent on decisions, not lookups. |
Adaptability | Traditional tools work well on known patterns. But a novel attack path with no playbook requires manual investigation. | Agents can address threats nobody has scripted for. They revise their plans as new evidence arrives. |
Coverage of investigation | Depth depends on which integrations a human remembers to check. | Agents can access a full set of tools for every case. |
Operational return | Analyst hours are consumed by repetitive triage and false positives. | Analyst hours are redirected to threat hunting and hardening. Analysts have less fatigue, and organizations experience lower turnover. |
Failure mode | When a playbook breaks, the tool stops running, and that failure is easily visible. | A hijacked or drifting agent keeps acting and looks legitimate while doing it. Teams might be unaware that anything is wrong. |
Governance needed | Teams need to implement change control for playbooks and rules. | Governance must include agent identity management, scoped credentials, runtime guardrails, immutable audit, and human approval. |
Facing faster, agent-driven threats
Implementing AI agents for cybersecurity is no longer optional. Agentic AI security has become a requirement for combating agentic AI threats.
In November 2025, Anthropic disclosed the first publicly documented AI-orchestrated espionage campaign. An agentic framework carried out up to 90% of the tactical work against roughly 30 target organizations. Human operators were involved only at a handful of decision points.
For targeted organizations, the use of AI agents by attackers significantly shortens the timeline for defending against attacks. When reconnaissance, exploit development, and lateral movement are all machine-driven, organizations have only hours between the time a vulnerability becomes public and the time it is exploited. According to M-Trends 2026, the mean time to exploit vulnerabilities has dropped to an estimated -7 days, meaning exploitation can occur before a patch is even released.
A human-centered queue simply can’t close the gap that quickly. Security teams need AI agents to defend against AI agents.
Recognizing agents as targets
To further complicate cybersecurity, the AI agents that organizations incorporate into cybersecurity will also become targets for attackers. After all, these agents are essentially privileged, trusted, automated users with access to the security stack. They are high-value targets.
Cybercriminals have multiple ways to attack AI agents. Hijacking an agent’s goal is one of the most common types of attack. In that case, an attacker rewrites the agent’s objective, usually through indirect prompt injection hidden in a web page, document, or email that the agent reads as part of its work. Attackers might alternatively modify how the agent operates, manipulating the agent into calling APIs, running code, or writing to systems outside of its intended task.
Identity and privilege abuse is another frequent tactic. An attacker might use prompt injection, for example, to trick an agent into running harmful actions using the permissions that the agent has been given.
These and other types of tactics can cause a wide variety of harm. When targeting AI agents used for cybersecurity, attackers could steal sensitive data or suppress enterprise defenses, enabling those cybercriminals to successfully launch even larger, more devastating attacks.
Protecting AI agents
How should organizations protect the agents they use for cybersecurity and other functions? A few best practices can provide a strong foundation for agent security.
- Grant least agency, not just least privilege. Least privilege limits what an agent can reach. Least agency limits how far it can go without checking back. Apply just-in-time, session-bound permissions that expire when a certain task ends.
- Break up workflows. Chunk workflows so no single step holds sensitive data, untrusted input, and an outbound channel at the same time. Doing so limits the damage of a single breach.
- Implement sandbox execution. Run tool calls and generated code in ephemeral, locked-down containers so that a compromise has a bounded blast radius.
- Enforce guardrails at runtime, on every loop. A single check at the front door is not enough when the agent decides its own next step. Inspect prompts, tool invocations, memory reads and writes, and outputs for every pass through the loop.
- Give every AI agent its own identity. Avoid shared service accounts and hardcoded API keys. When every agent has its own identity, teams can determine which agent took a particular action.
- Keep logs and maintain human gates. Keep immutable logs of the agent’s reasoning, tool calls, and payloads, including what triggered each run. Require out-of-band human approval before production writes, financial movement, or anything else you cannot undo.
How F5 approaches agentic AI cybersecurity
At F5, we understand that AI agents play multiple roles in cybersecurity. They provide the speed to keep up with AI-powered threats, enabling organizations to detect and respond to attacks much faster than humans could alone. Additionally, they are the tools that enable teams to streamline tasks, significantly reducing the complexity of management. Finally, AI agents are frequent targets of attacks and must be defended, not surprisingly, with AI agents.
F5 can turn external threat intel and internal logs into real-time, prioritized insight with the F5 Application Delivery and Security Platform (ADSP). Teams see a ranked set of important issues instead of an undifferentiated alert queue.
At the same time, the F5 AI Security Platform helps secure the AI agents augmenting cybersecurity and assisting with other functions. This platform gives security leaders continuous visibility, governance, and protection across AI applications, models, agents, and APIs. Using tools such as F5 Workforce AI Security, F5 AI Red Team, F5 AI Guardrails, and F5 AI Gateway, teams can discover, govern, test, protect, and continuously observe AI environments as threats evolve.
To learn more about AI-enhanced threats and AI-powered solutions, see F5 Labs threat research and F5 AI security solutions.
Frequently asked questions
How does an AI agent work in cybersecurity?
A security team gives an agent a goal. The agent then runs a multi-step process to achieve the goal. The loop typically includes steps such as perceiving threats, creating a plan, acting on the plan, observing results, capturing findings, making adjustments to steps based on the results, and checking in with humans at certain steps.
What is the difference between traditional SOAR automation and agentic AI?
SOAR (security orchestration, automation, and response) solutions follow a fixed if/then script. AI agents are given a goal and then work out the sequence of tasks themselves, revising that sequence as evidence arrives. Because agents can adapt to new information, they are better at handling novel threats. However, they do require more guardrails.
How do you protect agentic AI agents from threats?
A few best practices can help defend AI agents from a growing array of threats. For example, restricting what an agent can do without human input, breaking up workflows into discrete tasks, executing tasks in locked-down containers, and enforcing guardrails at runtime can improve AI agent security.
Explore F5 AI security solutions.
About the Author
Louise Scully is a Senior Manager in Product Marketing for AI Security and Threat Intelligence at F5. Her career has spanned product marketing, product management, go-to-market strategy, communications, thought leadership, and category development across AI security and enterprise technology. Prior to joining F5, Louise led marketing at both CalypsoAI and Artomatix, helping bring AI technology and research to market.
More blogs by Louise ScullyRelated Blog Posts
When patching can't keep pace and protection can't wait
Because security threats move faster than app development and deployment cycles, protection must operate independently. Here’s how modern WAAP steps up.
Securing the new control points in the AI journey
AI architecture is fundamentally different than traditional IT environments and requires a different security strategy to protect critical AI workloads.
The patch window has closed. Here is how F5 is built for what comes next.
As AI models have changed software security, the industry needs to adapt.
Best practices for optimizing AI infrastructure at scale
Optimizing AI infrastructure isn’t about chasing peak performance benchmarks. It’s about designing for stability, resiliency, security, and operational clarity
Datos Insights: Securing APIs and multicloud in financial services
New threat analysis from Datos Insights highlights actionable recommendations for API and web application security in the financial services sector
How AI inference changes application delivery
Learn how AI inference reshapes application delivery by redefining performance, availability, and reliability, and why traditional approaches no longer suffice.