Employees are installing AI assistants, autonomous agents, browser extensions and development tools to improve productivity. Often, they're doing so without approval from their IT departments. Such "shadow AI" instances can introduce hidden dependencies, permissions and connections to corporate resources that security teams cannot easily see.
During a recent SC Media webcast, Adrian Sanabria, host of Enterprise Security Weekly, spoke with Alice Nguyen, product marketing specialist at Palo Alto Networks, about why traditional endpoint defenses struggle with agentic AI and how organizations can regain visibility without discouraging innovation.
Why shadow AI creates new security risks
Shadow AI emerges when employees use or implement AI tools without sufficient security or IT oversight. Although the employees' intentions are generally legitimate, these tools can acquire extensive permissions and introduce vulnerabilities through third-party extensions, packages and integrations.
Nguyen emphasized that the danger often comes from capabilities users do not realize they are granting the tools.
"AI is not a bad thing. I use it in my life," Nguyen said. "But it all has these additional accesses and permissions that we may not be aware of."
For example, a developer might install an AI coding extension that connects to a Model Context Protocol (MCP) server with access to internal databases. That extension could expose sensitive resources if compromised.
Other threats include malicious open-source packages, credential-stealing malware and indirect prompt injection, in which attackers manipulate AI agents through external content.
Why traditional EDR and XDR leave blind spots
Endpoint detection and response (EDR) and extended detection and response (XDR) platforms traditionally monitor operating-system activity, executable files and malicious behavior.
However, AI extensions and dependencies frequently operate inside trusted applications, making them harder to identify individually. A browser extension, for example, might appear only as activity associated with the browser itself.
Nguyen explained that conventional endpoint monitoring often lacks visibility into these additional components. Security teams must understand not only which AI tools exist but also their permissions, dependencies, vulnerabilities and relationships with enterprise resources.
"That's why now there's that need to understand what is being downloaded on all these different endpoints that we have today, but also just the context behind it," she said.
How agentic endpoint security closes the gap
Palo Alto Networks' Cortex Agentic Endpoint Security (AES) addresses these challenges through four capabilities: visibility, contextual risk assessment, proactive governance and real-time prevention.
"We want to add in that layer of visibility, context, and detection and response on top of the traditional operating system layer today," explained Nguyen.
AES discovers AI tools and components, evaluates their potential risks and applies configurable security policies. Its safeguards include delaying newly released software packages for 24 to 36 hours while they undergo analysis, helping reduce exposure to malicious updates.
An inline gateway can also prevent unauthorized installations while allowing employees to request exceptions.
Nguyen described the objective as avoiding blanket restrictions on AI adoption. Instead, organizations can evaluate individual applications and approve legitimate business uses.
"We don't want to have almost like a black-and-white approach to AI tools," she said.
AES can operate independently alongside existing endpoint defenses or integrate with Cortex XDR through a shared sensor. The products remain distinct: AES provides agentic-tool visibility and governance, while XDR supports broader threat detection, investigation and response.
Nguyen also clarified that AES is not a data-loss-prevention product. It assesses tools and their risks rather than inspecting the sensitive information users enter.
Securing AI without sacrificing innovation
As AI adoption accelerates, organizations need more than traditional malware detection. They need visibility into agentic components, contextual understanding of their risks and enforceable controls over their installation and use.
Combining AES with XDR offers a layered approach: governing AI tools while maintaining established endpoint protection.
As Nguyen said, the goal is not to stop employees from using AI, but to make all AI use, whether authorized or not, visible, accountable and secure.
