Microsoft admitted that AI agents are a security risk with the launch of Agent 365, a unified control plane for AI agents that promises governance through familiar tools like Entra and Purview.  

This is a necessary first step for securing AI agents, but it’s not the finish line. In fact, Gartner predicts that 40% of organizations will soon abandon their agentic AI projects due to these exact security concerns. Microsoft is attempting to stem the bleeding with Agent365, but it’s complicated: even with Entra IDs assigned to every agent, discovery and lifecycle management remain partial solutions. 

Instead of relying solely on the hyper-scalers, organizations should follow these three best practices to lay the groundwork for secure and efficient adoption and use.  

1. Implement Comprehensive, Holistic Data Governance 

According to research, only 30% of AI-adopting organizations classify and protect data effectively, and IBM has found that 63% of AI-adopting organizations lack an AI governance framework entirely, leading to widespread AI-related breaches across regions and industries. 

True governance requires a framework that manages your entire data estate — from creation to deletion — regardless of the cloud platform your agents are built on. To prevent risks, you need automated data classification and access controls that protect the data itself, not just the agents accessing it. These measures require upfront investment but are still more effective and less costly than the reactive solutions that the hyper-scalers are scrambling to provide. The benefits of holistic data governance also extend beyond agentic AI. With better organized and regulated data, you’ll limit risks, reduce storage costs, and increase efficiency across your entire organization.  

2. Train Your Teams on Agentic AI Governance and Security Best Practices  

AI security and governance frameworks won’t be truly effective until they’ve been socialized throughout an organization, which is why enablement programs are a crucial step to secure agentic AI adoption. This is true of all AI products, but it’s particularly true of agentic AI tools, since agentic AI’s autonomy and decision-making authority create new and novel risks.  

Your first line of defense is an educated workforce that knows your organization’s policies. That’s why organizations should conduct targeted training on technical and ethical risks of agentic AI, organize cross-functional incident response exercises, and provide regular updates on regulations. Ongoing education and hands-on experience make it easier to identify threats and adapt quickly to new compliance requirements, which limits risks in unique and important ways.  

3. Integrate Additional Agent Oversight 

“Native” security often means “locked-in” security. Relying solely on platform-native controls leaves you blind to the fact that most teams are using tools across clouds. With agnostic oversight from a third-party, you ensure your security posture isn’t dictated by a single vendor’s roadmap, allowing you to govern agents consistently whether they live in Azure, AWS, GCP or anywhere else. 

These solutions can often integrate seamlessly with existing security infrastructure and provide transparent reporting, which helps organizations quickly identify and mitigate anomalous agent activities. Unlike the reactive fixes from big vendors, which often lack flexibility and comprehensive coverage, third-party tools can provide more independence and allow you to maintain a consistent, organization-specific security posture across all AI deployments. It’s also critical to establish guardrails for unmanaged agents — not just agents your organization is deliberately publishing — which third-party providers often excel at.  

While the hyper-scalers are used to “moving fast and breaking things” (as Mark Zuckerberg once said) or creating a culture where “everyone is a maker” (as they say at Microsoft), other providers are used to managing the risk that these innovations inadvertently create. That’s another reason why it’s important to integrate additional agent oversight for both managed and unmanaged agents alike. 

Before Turning to a Reactive Solution, Lay the Groundwork for Success 

At the end of the day, agentic AI vendors and organizations that use agentic AI both want the technology to work safely and effectively, but that doesn’t mean that organizations can or should rely on big vendors to fix the problems they’ve created. Instead of rushing to plug gaps with reactive solutions, organizations need to first focus on implementing basic, fundamental controls that limit agentic AI risks.  

For years, cybercriminals relied on scale, luck, and poorly secured systems to make their money. Today, they rely on something far more powerful: AI.

We’ve entered an era where generative tools don’t just accelerate attacks — they change the economics of fraud itself. What once required technical sophistication, organized infrastructure, or specialized social-engineering skill can now be automated, personalized, and deployed at a speed and volume that most institutions’ defenses simply cannot absorb.

This shift is not theoretical. Financial institutions and security teams across every sector are watching the same pattern unfold. Attacks are becoming more adaptive, more human-like, and far more difficult to detect early. And because AI is inexpensive, persistent, and infinitely scalable, adversaries now enjoy an advantage they have never had before — the ability to weaponize context.

As we move into 2026, leaders should assume a simple truth: If your defenses are not learning in real time, they are aging in real time.

AI Has Lowered the Barrier to Entry for Sophisticated Attacks

The most dangerous outcome of generative AI isn’t deepfake voice cloning or hyper-realistic phishing templates — though both are now trivial to produce. It’s that attackers can dynamically adapt these artifacts on the fly, shaping them to the victim’s behaviors, institution, tone, and vulnerabilities. AI turns what used to be guesswork into precision-guided social engineering.

Fraud rings can now:

• Generate individualized phishing narratives trained on a target’s digital footprint.
• Deploy “automated fraud workflows” that probe defenses continuously.
• Script malware variants that mutate faster than traditional signature-based tools can keep up.
• Mimic legitimate login patterns, session behavior, or device characteristics well enough to evade rules-based controls.

This is not a linear step forward. This is a rewiring of the attack surface. The same technologies that enable personalization, automation, and intelligence for legitimate businesses can now be reversed to accelerate financial loss, identity takeover, and reputational harm.

Perimeter Defenses No Longer Match the Threat

Many organizations still rely on a perimeter-centric security model built around static rules, traffic inspection, or isolated threat signals. But the perimeter is no longer where the threat shows itself. AI blurs the line between authentic and malicious behavior, and modern fraud rarely looks like a clean intrusion attempt. Instead, it emerges through small deviations: a shift in device posture, unusual session movement, mismatched behavioral timing, or micro-anomalies across transactions.

Legacy controls struggle here because they are:

• Static: Rules must be rewritten constantly as fraud patterns evolve.
• Siloed: Signals across channels — login, device, payments, identity — rarely inform each other.
• Reactive: They identify fraud after the transaction or loss event has occurred.

When attacks evolve faster than controls can be updated, institutions fall into a cycle of reactive mitigation, overwhelming manual review queues, and unnecessary friction for legitimate users. Security becomes both less effective and more expensive.

2026 Requires a Real-Time, Behavior-Driven Detection Model

The organizations best positioned to defend against AI-enabled adversaries share a common principle: they have moved from rule-based defenses to learning-based defenses.

A modern fraud posture in 2026 must include:

1. Continuous Behavioral Understanding

Instead of focusing solely on credentials or devices, security teams must understand how legitimate users behave. AI models trained on session movement, interaction patterns, timing, and historical behavior can identify account takeover long before a transaction occurs.

2. Real-Time Signal Orchestration

Threat intelligence must be unified across login, session, device, identity and transaction layers. When these signals converge — and when models can reason across them — institutions gain the ability to detect early risk with higher precision and far fewer false positives.

3. Active, Real-Time Interdiction

Stopping fraud at the moment of action is no longer optional. Whether by stepped-up authentication, policy-based controls, or automated holds for high-risk payment flows, organizations need the ability to intervene instantly without disrupting the experience of legitimate users.

4. Continuous Learning From Outcomes

Every false positive, every confirmed fraud, every user decision is an opportunity to strengthen the model. The AI advantage criminals enjoy can be matched — and surpassed — when institutions use their own data exhaust to sharpen future detection.

5. Governance and Explainability

As models make more decisions, regulatory expectations will rise. Leaders must adopt a model risk management posture that treats transparency not as a burden, but as part of the security architecture itself.

What CIOs and CISOs Should Prioritize in 2026

The mandate for 2026 is not simply to buy more tools — it’s to modernize the operating model. Leaders should prioritize:

• Moving from channel-specific risk engines to enterprise-wide orchestration.
• Reducing manual review by applying AI to triage, summarize and decision lower-risk cases.
• Accelerating cross-functional collaboration between fraud, cybersecurity, payments and digital teams.
• Investing in identity-centric defense, not perimeter-centric defense.
• Preparing for real-time payments fraud, where the window to intervene is measured in milliseconds, not hours.

Most importantly, CIOs and CISOs must acknowledge that the threat landscape is now asymmetric. Attackers don’t need scale to succeed — they need only a moment of misalignment between a user, a system, and a signal. Our job is to close that gap.

The Path Forward

AI isn’t going away. In fact, its offensive capabilities will continue to mature faster than defensive tools unless organizations rethink their architecture, their telemetry, and their decisioning strategy.

The winners in this next era of cybersecurity will be those who recognize fraud as both a data problem and a real-time intelligence problem — one that demands continuous learning, unified signals, active interdiction, and a platform mindset.

AI has rewritten the rules of engagement. In 2026, our defenses must do the same.