Vairavan Subramanian, VP of Product Management | Aurascape
August 17th, 2026 | 🕐 4 minute read

Introduction

Ask any CISO whether agentic AI increases risk and you will get a fast yes. That debate is over. What I do still see is the assumption that security controls already in place have the problem covered.

On paper, the assumption looks reasonable. The larger SSE platforms promise comprehensive AI security. Your SWG and CASB watch sanctioned applications. Maybe an MCP gateway inspects tool traffic. Traffic policies govern what leaves the network. Each of these does its part, seeing some segment of AI activity. The problem is that agent risk does not live in a segment. It lives across the workflow: what the user asked, what the agent accessed, which tools it called, what data moved, which tenant was in play, what action was attempted, and whether policy held at each stage.

A control that sees one segment of that sequence can be working exactly as designed. Meanwhile, an incident accumulates in the gaps between each segment.

Why Point Coverage Fails for Agents

Three properties of agents break the segment-by-segment model.

First, agents spread across environments. Some run locally on laptops. Some are embedded inside applications your teams already use. Some are hosted in the cloud. Each demands a different discovery method and different controls to govern it. No single mechanism covers all three.

Second, every agent communicates on two legs at once: one to the model, one to its tools and external systems. Watch only the model leg and you miss what the agent did. Watch only the tool leg and you miss why. A coding agent pulls a configuration file from a repository through one MCP tool call, then sends content out through a consumer messaging channel on a second call. Each call looks routine on its own. The leak sits in the context that connects them. Inspect the calls separately and you will log two normal events and miss one serious incident.

Third, agents multiply. One agent spawns sub-agents, and each sub-agent inherits access, instructions, and risk of its own. An inventory taken on Monday is out-of-date by Friday.

The traditional stack still has a job. But the unit of analysis has changed. The question is no longer whether a given tool call should be allowed. It is whether the whole sequence of an agent’s behavior should have been allowed, and whether you can prove what happened afterward.

A Blueprint That Matches the Problem

The strategy we will walk through on August 25 rests on three pillars that apply to both the agents your teams build and the agents your employees use. 

Visibility comes first. Know every agent, every MCP server, and every tool, including the sub-agents and the shadow deployments nobody registered. Then go deeper than an inventory. Understand each agent’s identity, its owner, what it can reach, and what it is doing at the level of prompts, responses, and tool calls. That reach is the agent’s blast radius, and most teams have never seen it. 

Governance turns visibility into control. This can look like least-privilege access to approved models, tools, and MCP servers, clear ownership for each agent, and a tamper-proof audit trail on every action. Enforcement has to hold even when an agent calls a tool that never touched the approved path, which is why we built a gateway architecture agents cannot route around. 

Data and threat protection must be consistent across the entire agent workflow. On the way out, that means inspecting and classifying each exchange as it happens and stopping sensitive data before it leaves. On the way in, it means catching prompt injection, tool poisoning, and malicious packages before they land. Out-of-band observability does not cut it here. For regulated industries and agents with a large blast radius, inline enforcement is vital. 

What You Will See on August 25

Frameworks are cheap when they stay abstract, so we are not keeping this one abstract. In the webinar, Moinul Khan, our CEO and Co-Founder, and Vairavan Subramanian, our VP of Product Management, will apply the blueprint to live scenarios: a secret exfiltrated across two ordinary-looking tool calls and stopped in flight, a sub-agent identified the moment it first speaks, a destructive command held for human confirmation, and a typosquatted package blocked mid-install.

They will also map two incidents you may already know, the Replit database deletion and the Air Canada chatbot ruling, onto the framework, because incidents like these trace back to a missing pillar.

Lee L’Archevesque, CISO of Digital Currency Group, will join them for a candid discussion of how DCG scales AI adoption across their teams, enables developers to use AI coding assistants and agentic tools, and evaluates AI security solutions against real gaps.

If you are responsible for how your organization adopts or builds AI agents, this session will give you a concrete plan matched to action items.

Security at the Speed of Agentic AI airs live on Tuesday, August 25 at 10am PT | 1pm ET.

Save your seat. If you cannot make it live, register anyway and we will send you the recording.