This is Part 2 of a 2-part series. Read Part 1: Your AI Agent Doesn’t Care About Your Controls
If AI agents change how execution happens, they also expose a fundamental limitation in how most security controls operate. Many control models assume there is sufficient time to detect, assess, and respond to events before they result in material impact.
That assumption no longer holds.
Traditional detection models follow a sequence in which an event occurs, is logged, analysed, and then acted upon. This approach works at human speed, where actions are spaced out and intervention is possible. In automated environments, particularly those involving AI agents, that sequence is compressed to the point where response often occurs after the outcome has already been realised.
AI agents operate at a pace that removes the window for meaningful intervention. They do not pause between actions or wait for approval cycles. Once triggered, they execute tasks rapidly across systems, often chaining multiple actions together in a single flow.
By the time an alert is generated, the action has already completed. By the time it is reviewed, the downstream effects may already be in place. This fundamentally changes the role of detection. It becomes a mechanism for understanding what has happened, rather than preventing it.
The Illusion of Monitoring
In response to increasing complexity, many organisations invest in expanding their monitoring capability. More logs are collected, more alerts are generated, and dashboards become more detailed. However, this increase in visibility does not automatically translate into improved control.
Without context, prioritisation, and validation, monitoring becomes a record of activity rather than a means of assurance. Security operations teams are often left dealing with high volumes of alerts that are difficult to interpret in real time. AI agents amplify this problem by increasing both the frequency and the speed of events.
The result is a growing gap between what can be seen and what can be meaningfully controlled.
Evidence and Its Limitations
Control assurance depends on evidence, but evidence is only useful if it reflects the current state of the environment. In slower operational models, evidence can remain valid for extended periods. In highly automated environments, that validity window shortens significantly.
Access models change, configurations drift, and behaviour evolves rapidly. Evidence that was accurate recently may no longer represent reality. This creates a challenge for organisations that rely on periodic validation or static reporting to demonstrate control effectiveness.
In this context, evidence must be continuously refreshed and validated against actual behaviour, not assumed based on design.
What Needs to Change
Addressing this challenge does not require abandoning existing frameworks, but it does require changing how they are applied.
The first shift is from access control to execution control. It is no longer sufficient to confirm that an identity has access to a system. Organisations must understand what actions are being executed, in what sequence, and under what conditions.
The second shift is the reintroduction of accountability. Every action performed by an AI agent should be attributable, traceable, and explainable. Without that, it is difficult to demonstrate that controls are operating effectively.
The third shift is towards validating real behaviour. Policies, architectures, and intended workflows provide useful context, but they do not prove how systems behave in practice. Validation must be based on observed activity in production environments.
Finally, independent assurance becomes increasingly important. Second-line validation provides a mechanism to challenge assumptions, review evidence, and confirm that controls operate as intended under real conditions. Without this, there is a risk that assurance becomes self-declared rather than evidence-based.
Final Thought
AI agents are efficient and highly capable. They execute exactly what they are designed to do, often with greater speed and consistency than human operators.
The risk lies not in the technology itself, but in the assumption that existing control models still provide meaningful assurance. As execution changes, so must the way control effectiveness is measured and validated.
The key question is no longer whether controls exist, but whether their effectiveness can be demonstrated in the context in which they are now operating.
