As enterprises put AI agents to work, they face a challenge: How can they give those systems more autonomy while keeping AI agent guardrails in place?
Security and resilience are becoming central considerations as enterprises decide which tasks to delegate to AI agents. Those decisions extend beyond individual actions to the data protection and cyber resilience capabilities that support the business, according to John Scimone (pictured), president and chief security officer of Dell Technologies Inc.
“The good news is, this is the best time to get it right,” Scimone said. “Organizations are today designing agents that are going to be working for years ahead. At that point of design is always the best time to get security done well, to get resilience done well. Security resilience by design for agentic is a huge opportunity.”
Scimone spoke with theCUBE’s Dave Vellante for the AI Cybersecurity and Resilience Summit, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how cyber resilience has replaced traditional disaster recovery, how security leaders brief boards and how much autonomy enterprises should give AI agents. (* Disclosure below.)
Setting AI agent guardrails without slowing the business
Business resilience once meant disaster recovery built around wildfires, hurricanes and grid outages. Today, a widespread cyberattack across an entire digital ecosystem is the more likely scenario, according to Scimone. Agents add a new dependency because work handed to software stops when the software does.
“What happens if these agents aren’t available?” Scimone said. “What happens if the data that the agents are deciding on is not available? A core part of your resilience posture has to contend with the notion that if our agents go down, our work is not happening.”
Companies are still cautious about letting agents act alone. A survey of 25 enterprise technology and security leaders led by theCUBE Research’s Krista Case found that 19 had autonomous agents in production. None allowed those agents to perform high-risk actions without human approval.
“It doesn’t mean doing it willy-nilly and just throwing caution to the wind,” he said. “It means being very thoughtful around where can’t you fail, putting deterministic guardrails in place … and letting the business run. Right now, I’m seeing too much caution in the space on that front.”
Dell applies that discipline internally, giving every agent tight identity and access control, extensive logging and traceability of decisions and actions, Scimone explained. That groundwork matters because only four of the survey’s 25 respondents had tested an AI agent incident scenario. Dell has also expanded its cyber resilience tools and joined OpenAI Group PBC’s call for collective action on cyber defense.
Attackers have used AI for years but haven’t yet deployed it at full scale, according to Scimone. He expects that to change soon.
“We haven’t hit that curve that I do believe is coming, and in the coming quarters, not in the coming years,” he said.
Vellante pointed to one encouraging finding from the survey: Organizations granting agents bounded autonomy showed stronger recovery readiness than those relying solely on human approval. In Scimone’s view, AI agent guardrails designed up front let companies take more risk, not less.
“Organizations that design those governance systems upfront are going to be the ones, ironically, that can move the quickest and can take the most risk because they can do it confidently with the right insights and the right data to know that they’re not overstepping,” Scimone said. “At the same time, they’re not under-leaning.”
Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the AI Cybersecurity and Resilience Summit:
(* Disclosure: Dell Technologies Inc. sponsored this segment of theCUBE. Neither Dell nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)