AI agents can improve cybersecurity only when they are deployed as tightly governed, accountable identities—not as unrestricted users. An agent that can inspect systems, call software tools, retrieve data, or execute commands expands a defender’s ability to find and address vulnerabilities. It also expands the organization’s attack surface. The practical outcome depends on distinct identity, least-privilege authorization, isolation, monitoring, testing, and integration with existing security controls. Simply switching on an agent does not demonstrate a stronger cybersecurity posture.
What an AI agent changes in a security program
A conventional software component may return a result when called. An AI agent can interpret a goal, choose tools, access data, and take actions in an operating environment. That action loop is the reason agents may help defenders work through vulnerabilities faster or handle repetitive security operations, but it is also why an agent must be governed like a privileged software identity.
As an Amazon Associate I earn from qualifying purchases.
NIST’s Cybersecurity and Artificial Intelligence Innovation (CAISI) work distinguishes ordinary software weaknesses from risks created when model output is connected to software functionality. Authentication, memory handling, vulnerable dependencies, and infrastructure remain important. Additional risks appear when an agent consumes hostile content, follows manipulated instructions, or takes an action that technically satisfies a goal while violating the organization’s intent.
- Action surface: the agent may read records, call APIs, modify configurations, create tickets, or run commands rather than merely generate text.
- Authority surface: the agent’s permissions determine which data and systems can be reached and which changes can be made.
- Decision surface: model output can be influenced by indirect prompt injection, poisoned data, or ambiguous objectives.
- Accountability surface: investigators need to know which agent acted, under whose authority, with which credentials, and what happened afterward.
NIST’s May 18, 2026 analysis of responses to its AI-agent security request for information found broad agreement that agents create novel security threats and that those concerns can slow adoption. Respondents also generally agreed that established cybersecurity principles remain useful but must be adapted for agent deployments. This is expert consensus about risk and control needs, not a measured finding that deploying agents improves security.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Where agents can strengthen defensive work
An organization can use an agent to support vulnerability identification and remediation, but the agent should operate inside existing change-management, testing, and approval processes. The following are defensible use patterns; they are capabilities to evaluate, not guaranteed outcomes.
Vulnerability discovery and triage
An agent can gather findings from approved scanners, code repositories, asset inventories, and ticketing systems, then organize them for a human analyst. Its value is greatest when it can explain evidence, identify missing context, and propose a bounded next step instead of silently changing production systems.
Control and configuration checks
Agents may compare configurations or deployment data with organizational requirements and flag deviations. Read-only access, fixed data sources, and a review queue reduce the chance that an erroneous interpretation becomes an outage or weakens a control.
Incident investigation support
An agent can correlate approved logs and case data, summarize a timeline, and suggest investigative queries. Analysts still need to validate conclusions, especially when the underlying records may be incomplete, poisoned, or unavailable.
Remediation assistance
When an agent is allowed to make changes, use a staged workflow: generate a proposed change, test it in an isolated environment, obtain an explicit approval, apply it through the normal deployment path, and record the result. The agent should not receive broad standing authority merely because a task is urgent.
Threats that must be designed out or contained
| Risk | How it appears in an agent deployment | Practical control direction |
|---|---|---|
| Credential sharing | An agent uses a person’s username, password, session, or token. | Issue a distinct agent identity and credentials tied to the user or system operating it; prohibit shared human credentials. |
| Static credentials stored locally | Long-lived secrets are embedded in files, images, or a local runtime. | Use managed credential issuance, rotation, revocation, and secret-access logging. |
| Overbroad permissions | The agent can reach unrelated systems or perform actions beyond its task. | Scope entitlements to the smallest task, separate read and write rights, and make authority revocable. |
| Indirect prompt injection | Instructions hidden in a document, web page, email, ticket, or retrieved record influence the agent. | Separate untrusted content from control instructions, constrain tools, validate high-impact parameters, and require approval for consequential actions. |
| Data poisoning | Manipulated training, retrieval, or operational data steers the agent toward an unsafe conclusion. | Track provenance, validate critical inputs, monitor for anomalous content, and avoid treating retrieved text as trusted policy. |
| Specification gaming or misaligned objectives | The agent satisfies a metric or literal instruction while defeating the security purpose. | Define safety constraints, test realistic edge cases, and evaluate outcomes rather than task completion alone. |
| Harmful action without an attack | A normal model error causes deletion, exposure, outage, or an unsafe configuration. | Use sandboxing, transaction limits, previews, approvals, rollback, and continuous monitoring. |
| Weak non-repudiation | Logs show a human account acted, but not which agent made the decision or command. | Record agent identity, authorizing principal, tool call, inputs, outputs, approval, and resulting change. |
NIST’s CAISI announcement describes these risks as a combination of familiar software problems and agent-specific effects. Constraining and monitoring access is therefore a central mitigation area, not an optional add-on.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Give every agent an accountable identity
NIST’s identity guidance recommends distinct identifiers, credentials, and entitlements for agents, bound to the user or system operating them. An agent should never inherit a person’s unrestricted account simply because it is acting on that person’s behalf. Shared credentials create accountability gaps; acting with a user’s full authority can also undermine non-repudiation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Bill Fisher, a security engineer at NIST’s National Cybersecurity Center of Excellence, and Ryan Galluzzo, NIST digital identity program lead, wrote: “Agents running commands with user authorization undermines non-repudiation and exposes the organization to potential downstream consequences when an agent performs actions without the full understanding or consent of the user.”
Implementation sequence
- Register the agent. Assign a unique, durable identifier and record its owner, purpose, model or service version, environment, and responsible business system.
- Bind authority. Associate the agent with the user, service, or workflow that authorizes it. Keep the authorizing principal visible in every audit event.
- Issue separate credentials. Use managed credentials that can be rotated and revoked independently of human accounts. Do not place static secrets in source code or local files.
- Define entitlements. Specify exact APIs, data sets, commands, environments, and time windows. Separate read, propose, approve, and execute permissions.
- Make delegation explicit. Record when a human or system delegates a task, what limits apply, and when that delegation expires.
- Test revocation. Confirm that disabling the agent, its credential, or its delegated authority stops access promptly across every connected tool.
- Review lifecycle events. Reassess identity and permissions when the model, tools, prompts, data sources, owner, or deployment environment changes.
NIST identifies SPIFFE and OAuth 2.0 as potentially useful patterns for delegated access in enterprise deployments. Neither protocol by itself solves prompt injection, authorization drift, agent lifecycle management, or multi-agent delegation; those problems still require policy, implementation, and monitoring.
Constrain access instead of trusting the model
Authorization should be enforced outside the model. A policy gateway, tool broker, or equivalent control can check the agent’s identity, requested operation, target resource, and current delegation before allowing a call. High-impact actions should require a separate approval or a second control path.
- Start with read-only access and expand only when a demonstrated task requires it.
- Use separate identities for development, testing, and production.
- Allow-list tools and destinations rather than exposing a general shell or unrestricted network.
- Limit query size, transaction value, file scope, execution time, and number of chained actions.
- Run untrusted document processing in an isolated environment.
- Log denied requests as well as successful calls so attempted privilege expansion is visible.
- Provide a rapid kill switch and a tested rollback path for changes the agent makes.
NIST notes that infrastructure affects identity and authorization. A cloud environment may provide segmented architectures or hardware roots of trust, while a local deployment may offer different control over networking, data residency, and administration. Neither location is categorically safer. Compare the controls the actual environment can enforce.
Recommended Free Tools
Use cybersecurity frameworks as a deployment baseline
NIST’s Cybersecurity Overlay Services and Systems (COSAiS) project uses SP 800-53 controls as a foundation and develops overlays for agent scenarios. Overlays allow an organization to select, modify, or supplement baseline controls for a specific technology, mission, environment, or requirement. COSAiS describes both single-agent and multi-agent use cases and is intended to build on institutional cybersecurity processes already in place.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
COSAiS remains an active project. Its materials should be treated as developing guidance rather than a final, universal agent-security recipe. A useful implementation approach is to map each agent capability to existing controls for access, configuration management, audit, incident response, system integrity, and contingency planning, then add agent-specific requirements for delegation, tool use, prompt handling, and behavioral evaluation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Evaluate the deployed system, not just the model
A model benchmark cannot establish that an agent is secure. Assessment must include the scaffolding around the model, connected tools, deployment environment, data access, authorization logic, and observed behavior.
Before deployment
- Inventory every tool, data source, credential, network route, and external service.
- Define prohibited actions and conditions that require human approval.
- Test indirect prompt injection, poisoned records, malformed tool responses, and conflicting instructions.
- Measure whether the agent stays within scope when a task is ambiguous or an input is hostile.
- Verify that logs contain enough detail to reconstruct decisions and actions.
During operation
- Monitor tool calls, privilege changes, unusual data access, failed authorization, and action chains.
- Alert when the agent attempts an unapproved destination, command, or credential use.
- Sample successful actions for human review; a lack of errors does not prove safe behavior.
- Re-evaluate after model updates, prompt changes, new tools, data-source changes, or architecture migrations.
After an incident or near miss
- Preserve the agent’s inputs, outputs, tool requests, approvals, and resulting system state.
- Revoke or narrow authority before debugging the underlying cause.
- Determine whether the failure came from identity, authorization, data, model behavior, tool implementation, or monitoring.
- Update tests and controls so the same path is blocked or escalated in the future.
NIST frames secure development, deployment, risk anticipation, measurement, and access constraints as continuing areas of work. That emphasis supports a recurring evaluation program rather than a one-time certification.
Compare deployment options by control capability
| Decision axis | Questions for a local deployment | Questions for a cloud or hosted deployment |
|---|---|---|
| Identity accountability | Can the organization issue unique agent identities and centrally manage their credentials? | Can the provider integrate agent identity with the organization’s identity and authorization systems? |
| Permission scope | Can network, filesystem, process, and API access be segmented and revoked? | Can tenant, service, API, and data permissions be narrowly scoped and monitored? |
| Audit and non-repudiation | Are agent, user, tool, command, approval, and result recorded in tamper-resistant logs? | Are equivalent provider and customer logs available, retained, and correlated? |
| Isolation | Can execution use containers, separate hosts, or restricted networks? | Does the service provide segmented architecture or hardware-backed protections, and can the customer verify their use? |
| Evaluation | Can the organization replay tests against the exact deployed tools and data? | Can the organization test provider updates, model changes, and service dependencies before production use? |
The correct choice is the environment in which the required controls can be demonstrated and operated. Architecture alone is not a security verdict.
A practical governance checklist
- Name an accountable owner for each agent and each connected tool.
- Document the agent’s purpose, allowed actions, prohibited actions, data classes, and escalation rules.
- Keep production authority separate from experimentation.
- Require human approval for irreversible, external-facing, financial, safety-critical, or high-impact changes.
- Review delegated authority on a schedule and whenever the workflow changes.
- Include agent identities and credentials in incident-response plans.
- Train analysts to treat agent output as an input to a decision, not proof that a decision is correct.
What NIST’s 2026 work establishes—and what it does not
NIST announced the CAISI RFI on January 12, 2026; its comment period closed March 9. An NIST March 2026 update presentation reported approximately 400 submissions. That count describes participation, not security effectiveness, incident reduction, or return on investment.
NIST announced an NCCoE concept paper on software-agent identity and authority on February 5, 2026, with comments due April 2. Its detailed identity article was published August 27, 2026. NIST published its RFI response analysis on May 18, 2026, while COSAiS remains active and its use-case page was updated January 8, 2026.
No validated quantitative estimate in these materials shows how much deploying AI agents improves an organization’s cybersecurity posture. The defensible conclusion is conditional: agents can extend defensive capacity when their authority is narrow, observable, revocable, and evaluated in the environment where they operate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
