AI agents
Securing AI agents before they act for you
Agentic AI works toward a goal and takes steps without being asked each time. The NCSC's advice is to understand how it is used, know what it can reach and keep people in the loop.
Last reviewed against NCSC, Department for Science, Innovation and Technology and OWASP GenAI Security Project. Sources
The shift
From answering to acting
The NCSC calls agentic AI a new class of frontier AI, one able to plan, decide and carry out tasks for a user [3]. A chatbot that answers wrongly is one problem. An agent that sends, buys or changes records is a different one, because the NCSC says the damage grows when model output drives tools or APIs [1].
Controls
Four to apply
Work through these in order:
-
1
Map where agentic tools are used and what they can reach [3]. -
2
Match oversight to the risk, since different tasks warrant different levels of review [3]. -
3
Use safeguards, sandboxing and active human oversight to limit unintended activity [3]. -
4
Adopt in stages, so you understand a tool before widening its use [3].
What a person should approve
OWASP advises human approval for high-risk actions [9]. Define "high risk" for your organisation before an agent goes live: payments, external messages, deletions and changes to access.
Access
The question that matters
The NCSC says organisations should know what access agentic tools have to their systems and data [3]. A related NCSC principle is that when a model processes untrusted input, its privileges should fall to those of the source [1].
Check this first
List each agent with the data it can read, the systems it can write to and the outside content it processes. An agent that does all three needs the most scrutiny [1].
Excessive agency
A named OWASP risk
OWASP's 2025 list includes excessive agency as LLM06 [8]. Treat it as a design review question: could this tool do less and still do its job?
See the prompt injection controls for the attack that makes agents risky, and the practical plan for ordering the work.
Keep reading
Read next
Shadow AI
What shadow AI is and how UK organisations can manage it: the NCSC's advice to understand why staff use unapproved AI tools, with practical steps.
Read the guide
AI for defence
How UK organisations can use AI in cyber defence safely: what the NCSC says suppliers already do, and the checks needed before trusting the output.
Read the guide
Suppliers
Security questions UK buyers should put to AI suppliers: prompt injection claims, supply chain, data handling, access and logging, based on NCSC advice.
Read the guideHow CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
AI security starts with knowing which tools are in use, who owns them and what they can reach. CyPro can help set the governance, accountability and controls around that.