AI Agents Are Moving Faster Than Corporate Security Can Track. That's a Problem.

AI agents can now take a thousand actions in five minutes. Most corporate security systems were built to catch a bad actor over hours or days. That mismatch is the core problem laid out by Andre Durand, CEO and founder of Ping Identity, in comments reported by VentureBeat.

Zero trust architecture assumes no user, device, or system gets automatic trust. Every action gets verified, not just the login. That model has been the stated goal for enterprise security for years. Durand's point is blunter: goal isn't good enough anymore. "A human compromise might be measured in minutes or hours, sometimes days. At agentic speed, a thousand actions could happen in five minutes," Durand told VentureBeat.

The exposure builds this way. An employee approves an AI agent's request to touch a company drive, a database, a code repository. Looks routine. One approval, no big deal. But multiply that across thousands of agents making thousands of requests, and the accumulated access is something most security architectures were never built to measure, according to VentureBeat's reporting.

Durand's fix is a principle he summarizes as "just enough, just in time." Narrow every agent's access to the minimum required, and re-check that access continuously instead of once at login. That's a real shift in how identity systems work. The old model treated "logged in" as the finish line. The new model treats every next action as a fresh decision.

That has a practical consequence for how companies deploy agents right now: don't let an AI agent operate under a cloned human login or a shared service account. "Each agent should have its own identity," Durand said. "It should not be impersonating the human. It can act on behalf of the human, we could explicitly delegate authority to an agent, but we don't want to blur the lines between the human taking action and the agent taking action." Shared API keys embedded directly in source code are a related risk Durand flagged, since they're easy to leak and hard to revoke cleanly.

The honest admission: nobody's finished the basics yet

Enterprises haven't even finished zero trust for humans yet. Chris Hughes, writing on Resilient Cyber, points out this gap. Hughes spent years working on Zero Trust implementation in the U.S. public sector, including with the Department of Defense.

The CISA Zero Trust Maturity Model lays out four stages across five pillars. Per Hughes, years after that model's publication, most organizations are still stuck somewhere between "Traditional" and "Initial," the two lowest rungs. NSA guidance calls for data flow mapping, network segmentation, and granular access controls, capabilities Hughes says most large enterprises still can't operationalize at scale.

Why the stall? Hughes points to decades of technical debt, legacy systems that can't support modern identity federation, flat networks never designed for segmentation, and internal politics that slow everything down. Hughes was writing about Anthropic's newly published Zero Trust for AI Agents framework, arguing that even the foundational principles—verify explicitly, enforce least privilege, assume breach—demand something fundamentally different when the entity you're securing isn't a human at a laptop but a non-deterministic system reasoning and acting on its own.

If companies can't secure human access after a decade of trying, betting that they'll nail agent-speed zero trust on a faster timeline is optimistic at best. The infrastructure gap is real, documented by CISA's own maturity model, not a hypothetical raised by critics.

Data governance is the other half of the problem

Security permissions are one layer. What the agent can actually see and act on is another. Pure Storage's blog on its Everpure Data Stream product frames the risk this way: a chatbot that hallucinates creates an awkward moment, but an AI agent that reasons across sensitive data, calls tools, and chains those calls together turns a single compromised agent into what the company calls a "blast radius."

Pure Storage says feedback from beta participants of its Data Stream product shifted quickly from model experimentation to data readiness, meaning: is the underlying data governed, trusted, and properly walled off before an agent ever touches it. The company reports security teams increasingly get pulled into deployment planning earlier rather than validating decisions after the fact.

Pure Storage is selling the data pipeline product it's describing. But the underlying claim, that ungoverned data plus autonomous agents equals bigger blast radius than a chatbot mistake, lines up with the access-control concerns raised separately by Durand and Hughes.

None of this is regulated territory yet. No federal agency has issued binding rules requiring agent-specific identities or real-time permission revalidation for private enterprises. Anthropic's framework and CISA's maturity model are guidance, not law. Whether enterprises actually rebuild identity architecture around individual agent identities, or just bolt agents onto existing human accounts and hope for the best, remains an open question with no regulatory deadline forcing the answer.