Large enterprises are increasingly adopting Zero Trust for AI Agents to mitigate high-gravity risks. A Forrester survey found that 86% of enterprises have deployed AI agents, while McKinsey reported that 40% of large organizations with revenue of more than $1 billion are scaling their AI agents across business functions.

As AI agents gain privileges and access to systems and accounts to make autonomous decisions, trust becomes a key issue. The Forrester survey found that 77% of organizations in a state of “agentic chaos” are moving into production anyway, exposing themselves to an average of $2.1 million in compliance fines, lost customers, operational downtime, and rework costs. Zero Trust, a basic cybersecurity principle, emerges as a top cost-effective solution.

In this report, experts from Microsoft, Feedzai, 0rcus, and Altorney, explain why large enterprises can’t afford to ignore Zero Trust, and how to build Zero Trust into agentic AI tech stacks.

Why Large Companies Cannot Ignore Zero Trust for AI Agents

While there are no official reports showing how much money AI agents move, with over 80% of Fortune 500 companies deploying AI agents, estimates value the total at millions of dollars and rising.

Besides moving money, AI agents are reallocating supply chain inventories, coding software, and working in almost every business-critical department, and forcing companies to rethink cybersecurity . Left unsupervised and without behaviour constraints or security guardrails, the consequences for large enterprises are significantly serious.

OpenAI, Meta, and Anthropic have all disclosed incidents where AI agents acting autonomously in cybersecurity tests hacked companies, tried to cover their tracks, exploited vulnerabilities, manipulated cloud infrastructure, and accessed credentials, showing what can happen when agents get it wrong. The lack of agentic security guardrails is also exploited by a highly active threat landscape that relentlessly targets large firms.

Sophos research found that 71% of organizations suffered at least one identity breach in the past year. Weak management of non-human identities (static credentials, API keys stored in code, orphaned service accounts) was the root cause of 41% of successful identity-related breaches. Only 1 in 3 organizations regularly rotate or audit service accounts and non-human identities, and just 11% do so continuously.

“If an agent is compromised, an attacker may gain access to several attack surfaces and exploit further vulnerabilities,” Vijaya Lakshmi Nukala , product manager at Microsoft and Zero Trust industry expert on AI agents, speaking in a personal capacity, told me.

New AI agent cyberattacks involve prompt injection, memory exploitation, overly broad permissions for tools or data, credential theft, or sending results to the wrong audience, Nukala said.

“Unmonitored and overprivileged agents can become attractive targets for attackers,” said Nukala. When this risk is multiplied across an enterprise, it becomes an enterprise-scale security problem.

“AI agents are fundamentally different from the traditional systems enterprises are used to securing,” Diogo Guerra, SVP of Engineering at Feedzai , a global finance trust firm using AI to detect and prevent financial crime, fraud, and money laundering, across more than one billion consumers and $9 trillion in payment volume from the world’s top banks and payment networks, told me.

Traditional enterprise systems are designed to follow the code developers have written, but agents do something different. “They are typically given an objective and have a degree of autonomy in deciding how to achieve it,” said Guerra.

“For large enterprises, the risk becomes particularly significant when agents have access to sensitive information and the ability to take actions across multiple systems,” said Guerra.

From a compliance and legal perspective, the lack of Zero Trust in AI agents can rapidly become a big problem. “Big enterprises can’t afford to ignore zero trust for AI agents,” Shimmy Messing, CEO of Altorney , a legal tech company, told me.

“Autonomous systems can access sensitive data, they can make decisions, they can take actions across critical business systems, and that creates significant risk to privacy, security, and liability exposure,” said Messing.

Large companies need to be careful, across their entire organization, to ensure nothing leaks and nothing gets into the wrong hands that can be used either against them or that becomes a PR nightmare, said Messing.

How to Build Zero Trust for AI Agents Across Tech Stacks

Treating AI agents just like workers, from a cybersecurity and compliance perspective, is what experts recommend, from onboarding to offboarding.

“Just as employees join a company, gain access to data, tools, and licenses, and eventually leave the company, agents should also be managed through a complete lifecycle right from creation and access to retirement,” said Nukala from Microsoft, speaking in a personal capacity.

“There should be accountability for their actions by assigning a responsible human owner to each agent,” said Nukala.

Enterprise security teams should be able to apply time-bound, action-bound, network-bound, and resource-bound access controls at the enterprise, organization, and team levels, with a decentralized approval process empowering people closer to the business problem to approve access before an agent is allowed to use those resources, Nukala explained.

When an AI agent’s purpose is fulfilled, or the agent becomes orphaned, the appropriate human owner should manage its end of cycle just as if it were an employee leaving the company; this includes returning files, transferring licenses, reviewing logs, and other processes.

“These controls become even more important when agents can access and modify, or delete sensitive information, such as credentials, passwords, payment details, or government documents,” said Nukala.

Even after preventive policies and controls have been applied, a breach can still occur. In the event of an attack, enterprises should have strong observability and auditability.

“Enterprises should be able to identify the affected agent and quickly revoke its access so that attackers cannot continue exploiting systems with compromised credentials,” said Nukala, highlighting that logs should clearly show what resources were accessed, what actions were taken, and who was involved.

“They should also help determine whether an agent acted independently or whether a person used the agent to exploit the system,” said Nukala.

The first step to building Zero Trust is to elevate AI agents to first-class citizens within the enterprise security model, said Guerra from Feedzai.

Enterprises have always had to manage the possibility of an employee acting maliciously, making a mistake, abusing legitimate access or having their credentials compromised, Guerra explained. “Agents introduce many of the same fundamental risks, but potentially with much greater speed, scale and probability of unexpected behavior,” said Guerra.

“That is why Zero Trust principles translate so well to agents,” said Guerra.

Organizations should apply least privilege, give agents access only to the data and tools required for their task, separate read permissions from permissions to take action, continuously monitor behavior and require additional authorization or human approval for high-impact actions, Guerra explained.

Critically, permissions should also take context into account. “The question shouldn’t simply be whether an agent has access to a system, but whether this specific agent should be allowed to perform this specific action, on this specific resource, at this particular moment,” Guerra added.

“For organizations that already have mature Zero Trust architecture, this should be an evolution rather than a reinvention,” said Guerra.

Machines Outnumber Workers by 109:1: To Build Zero Trust for AI Agents, Treat All AI Agents as Employees

IBM warned that the volume of the decisions that AI agents can make is such that no human governance can realistically supervise them. Inside companies, machines are outnumbering human workers.

Nic Adams , cofounder and CEO of 0rcus , an AI cyberkinetics company, told me that the identity count inside large companies has already inverted. Palo Alto Networks surveyed 2,930 security decision-makers and found that machine identities, including AI agents, now outnumber human identities 109:1. “Seventy-nine of those 109 are AI agents,” Adams explained.

“Most of what authenticates into enterprise systems today is software, and very little of it went through the review a new hire would,” said Adams. “Every agent in a stack is another standing authorization that rarely gets reviewed after it is granted,” said Adams.

A Seven Sequenced Control Framework for Agentic Zero Trust

Going into technical specifics, Adams shared seven sequenced-ordered controls that large companies can use to build Zero Trust:

  1. Give every agent its own identity: Shared service accounts and borrowed human credentials make attribution impossible. “If you cannot name the agent that took an action, you cannot govern it,” said Adams.
  2. Scope credentials to a single task: Mint them for one job with a declared purpose and expire them when the job finishes. Standing permission is what gets exploited.
  3. Separate the instruction channel from the data channel: Anything an agent retrieves stays all the way through, with commands accepted only from the channel you control. “This is the architectural answer to prompt injection,” said Adams. “Output filtering leaves the underlying design intact.”
  4. Put ceilings on consequence: Set transaction limits and rate limits, with human approval required above a threshold. Agentic payments make this urgent, since an agent with a card and no ceiling carries unbounded liability, Adams explained.
  5. Allowlist egress: Agents should reach a named set of destinations and nothing beyond it. “The Salesforce agent case this year ran through a five-dollar expired domain, which an allowlist would have stopped at the first request,” said Adams.
  6. Log the reasoning trace alongside the API call: Auditors and regulators will ask why an agent did something. ”Keep enough of the decision record to reconstruct how the action was reached,” said Adams.
  7. Red team the deployed agent with its real permissions: Model evaluations describe what a system will say. An adversary cares about what it can reach, so the testing has to run against the live configuration, Adams explained.

Zero Trust for AI Agents in Critical Services: IT-OT Agentic Security

For large companies operating physical infrastructure, such as critical services, energy, water, transportation, and manufacturing, securing AI agents is a national security issue.

“Enterprise leaders should think through what happens as agents move closer to physical infrastructure,” said Adams. Agent security is funded today as a data problem, and that framing expires the moment an agent sits upstream of a plant controller.

An AI agent mis-scoped token in environments like energy grids or transportation infrastructure can reach equipment, where the consequence of a mistake is mechanical, said Nic, talking about IT-OT agentic security.

“Enterprises that build agent identity as a safety control will hold up better as this capability reaches the physical layer,” said Nic. “That shift is underway now, and it is moving faster than the governance written to hold it.”

Final Thoughts on Zero Trust for AI Agents

“Zero Trust for AI can sound like an entirely new security discipline, but I don’t think enterprises should treat it that way,” said Guerra from Feedzai.

The principles are already well understood: verify explicitly, enforce least privilege, assume compromise, monitor continuously and limit the blast radius when something goes wrong, said Guerra.

What changes with AI agents is the entity those principles are being applied to.

“They don’t need to invent an entirely new security model for AI; they need to ensure that agents are brought inside the security model they already have,” Guerra said. The organisations best positioned for agentic AI will therefore probably be those that have already invested heavily in Zero Trust for AI agents, said Guerra.