Agentic AI in Cybersecurity Raises Governance and Resilience Issues

Security teams and criminal groups are increasingly deploying autonomous artificial intelligence systems that can both speed defense and scale attacks, raising urgent questions about risk, governance and how organizations should invest in cyber resilience. Over the past year, researchers, government-sponsored exercises and security companies have demonstrated that so-called agentic AI agents can discover vulnerabilities, chain automated attack steps and in some cases carry out reconnaissance and data theft, while defenders are adopting generative and agentic tools to triage alerts, prioritize fixes and automate remediation.

Industry testing and competitions this summer and autumn showed dramatic increases in automated vulnerability discovery and exploitation. Large-scale exercises found dozens of new weaknesses in hours of compute, and independent teams reported submitting thousands of vulnerability findings after automating scanning processes. Security responders also documented malware that used large language models to generate commands for reconnaissance and data exfiltration, and threat actors have used agentic models to construct and sell ransomware with evasion and...