Don’t wait for NIST: Secure AI agents now or fall behind

I am glad NIST is paying attention to AI agent security. It matters and it is overdue. It is also a mirror. Because if your organization is waiting for federal guidance to decide whether to treat AI agents as a security priority, you are already behind the curve.

NIST is asking the right questions – ones you should pay attention to if you happen to be behind said curve. They want to know what security risks are unique to agents. They want to know which technical controls actually work. They want to know how mature detection is for agent-related incidents. Those are smart questions. They are also important questions given how early we are in the lifecycle of the AI agent.

Most companies are deploying agents into production workflows with a dangerous combination of confidence and blindness. The problem is not just that agents are new. The problem is that enterprises have almost no visibility into what their agents are doing. Company leaders  cannot answer basic questions:

Without the answers, you are not doing security. You are doing hope.

Agents are not like traditional software. They are closer to semi autonomous operators. They reason, interpret intent, choose sequences of actions, call tools, retrieve data and push changes. They do all of it inside systems designed for humans and service accounts, not probabilistic decision engines. That changes the threat model because the risk is not only access, but also action.

Related reading:

An agent can cause serious damage without being compromised in the traditional sense. It can do damage because you gave it too much power and too few guardrails. It can do damage because it interpreted your request wrong. It can do damage because it hit an edge case and made a reasonable choice that turned out to be catastrophic. When you add in a bad actor, the stakes become a little higher.

Attackers do not need to deploy malware when they can influence the decision engine. They can manipulate inputs, poison content, and sneak instructions into tickets, documents, or tools the agent reads. They can craft payloads that look like normal business context, then they let the agent do the work. If you are thinking about agents as a model problem, you will miss the real risk, as this is more of a workflow and control plane problem.

That brings us to the thing people are currently terrified of and also misunderstanding. Frameworks like Model Context Protocol (MCP) that give agents access to your systems are being treated like a security disaster. People look at MCP and see expanded integration, expanded access, and expanded attack surface. That is true, but it is the wrong conclusion. MCP creates something the enterprise has desperately needed: a governable surface.

For years, agent behavior has been fuzzy, buried inside model output and application glue code. It has been difficult to see what the agent asked for, what it retrieved, what tool it called, what parameters it passed, what system responded, and how the agent used the response. You could not put consistent policy around that because the control points were scattered, leaving you with audits after the fact and vague promises that the agent would behave. MCP changes that because it turns agent activity into inspectable traffic. It turns tool use into a consistent interface, giving you a place to monitor and a place to enforce. That is not a problem. That is a gift.

It is the first time we can treat an agent like a first class security object. You can write a policy for it, enforce least privilege, require approval for high risk actions, block certain tool calls, and restrict sensitive data access. You can log every step and correlate behavior across systems, detecting anomalies that matter. Security people understand traffic. We understand identity. We understand policy. We understand enforcement. MCP makes that possible for agent behavior.

So why are organizations still acting like they need permission to start doing the basics?

Because a lot of people are waiting for guidelines. They want NIST to publish a document so they can turn it into a compliance checklist. That mentality is how you lose in a world where the winners are deploying agents right now in dev pipelines, internal ops, customer support, and business workflows, while the Sarah Connors are wringing their hands waiting for a guideline. The companies that will dominate the next decade are building agent leverage today. They are making teams faster. They are compressing cycles. They are shipping products faster. They are compounding. You can call that reckless, but I call it reality. The right answer is not to freeze adoption, but instead to make adoption secure.

There is another reason this matters beyond your own company. NIST is right that these risks can impact public safety and consumer confidence. One stupid avoidable incident can poison the whole well. One company lets an agent leak customer data or run destructive actions in production, and suddenly the entire industry pays the price in regulation and lost trust. Regulation does not arrive because standards bodies finish their work. It arrives when spectacle forces action. That is why self governance matters. It is also why waiting is dangerous. You are not just betting your company. You are betting the market.

So what does security look like right now?

Start with least privilege. Treat agent tool access like privileged access. Do not hand an agent broad permissions because it makes demos easier.

Put policy enforcement at the tool layer. If the agent can decide actions, your environment must decide what is allowed. Guardrails must be technical, enforceable, and real time.

Build real observability. You should be able to see every tool call, every parameter, every response, and every downstream effect. If you cannot observe it, you cannot secure it.

Update detection. Agent incidents will look like legitimate actions executed for illegitimate reasons. You need detection that understands agent workflows and flags deviations that matter.

Prepare incident response for agent actors. You need to quickly answer what the agent accessed, what it changed, what it exported, and what it can still do.

Innovate or die. That part is true. Just do not be the idiot who kills the golden goose because you could not be bothered to put guardrails on it.