COMMENTARY: It wasn’t possible to walk the floor at Black Hat USA 2026 this year without hearing someone talk about insider risk.Insider risk affects those across all seniority levels and business units. Agentic insiders–autonomous or semi-autonomous AI agents working on behalf of an employee inside an organization–are a nearly universal concern.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]Enterprises had 28.6 million active AI agents deployed in 2025, a number projected to grow to more than 2.2 billion by 2030. These agents have authorized access to internal systems, sometimes with escalated privileges depending on their intended function. Enterprises have extended trust to both employees running generative tools, and AI agents acting on their own. Maintaining oversight of both humans and their agentic counterparts has emerged as a critical insider risk management challenge. Conversations at our booth this week made one thing clear: insider risk needs a different approach now that AI has become a pervasive force in the enterprise.AI isn't a new insider risk category. It's a forcing function exposing how many programs never had a real answer to the question of why a task was being performed in the first place. Build a functioning insider risk program today, and we’re already building for the AI security problem conference attendees are trying to solve.We hosted Phil Venables, former CISO of Goldman Sachs and Google Cloud, at our Black Hat booth to discuss governing humans and AI agents in the enterprise. Venables proposes an actionable five-stage insider risk maturity model. As teams progress through the stages, the scope of what's monitored expands from raw data to behavior, to the organization as a whole. The underlying logic of identifying risks advances from rigid rule enforcement toward genuine reasoning based on behavioral analysis: Many in our industry simply buy a new tool to solve a security issue. But Venables shows that AI agents don’t require a second, dedicated program. Whether the identity in question belongs to a person or to an agent, the question remains the same: What does it do, and should anyone care?Insider risk requires cross-collaborationDuring a Q&A session on AI agents we heard from Camille Stewart Gloster, the former U.S. Deputy National Cyber Director, about how some security issues require partnerships across IT, legal, and HR. Insider risk has become one of those concerns. An effective insider risk program functions as a cross-functional operation that requires collaboration between the CISO and leaders from HR, legal and employee management.As Gloster pointed out, security leadership has evolved as organizations embrace AI. When it comes to insider risk, expanded monitoring capabilities that analyze human and AI activity to identify risks based on behavioral patterns offer CISOs visibility across the entire organization.Now, CISOs can identify and flag security issues to HR and legal teams, rather than the other way around. Collaboration across business units helps answer the question: what does operational resilience look like now that autonomous AI agents are making decisions alongside people?The hardest problems in our industry are rarely solved by a single vendor or lecture. They are solved when practitioners compare notes, argue over frameworks, and test each other's assumptions in person. They are also solved through strategic technology partnerships and vendor integrations that drive better outcomes for customers. We partner with CrowdStrike to help drive better outcomes for customers in a threat landscape that’s constantly evolving.As Black Hat continues this week and DEFCON kicks off, we’ll continue having conversations that shape the cybersecurity community and help us usher in a more secure, resilient future.Aviv Nahum, co-founder and CEO, Above SecuritySC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
- Stage 1 – Data control: Data control can tell us whether a document is sensitive and headed out the door, but it has no way of knowing who's involved or why.
- Stage 2 – Telemetry and visibility: Telemetry and visibility add more data without adding any real answer, because reasoning remains policy-driven and based on hard rules.
- Stage 3 – Behavioral baselining: Behavioral baselining, the user and entity behavior analytics (UEBA) layer, flags deviations from usual user behavior. It’s the stage at which most programs get stuck, since a deviation isn't the same as risk.
- Stage 4 – Behavioral investigation: The inflection point of the maturity model. At this stage, systems produce a verdict backed by evidence instead of another alert to triage.
- Stage 5 – Organizational risk intelligence: In this final stage of maturity, systems surface structural risk like shared credentials before humans or agents can act. Almost no program operates at this level today.
