Agentic AI is already running in production without companies knowing what it can touch, a CISO warns

By BankInfoSecurity · September 25, 2026.

Richard Cassidy, international CISO at the data security and resilience firm Rubrik, has laid out an uncomfortable diagnosis in an interview with ISMG (the publishing group that includes BankInfoSecurity) at the FinServ Cyber Security U.K. summit: agentic AI —AI systems capable of acting on their own, chaining steps together and making decisions without a human approving each action— is already deployed in companies' real operations with, in his words, little effective human oversight.

According to Cassidy, the first governance problem is not technical in the sense of "which model to use", but one of basic hygiene: knowing what data an agent can touch and what it is allowed to do with it. And there, he says, organizations are dragging along a structural failure more than 30 years old that agentic AI did not create, but has placed under new pressure: data is the source of truth on which any agent depends, and many companies never finished putting that house in order before connecting to it a system capable of acting autonomously.

The concrete recommendation Cassidy offers has two parts. First, control what enters the data pipeline before putting any model into operation, rather than cleaning up on the fly. Second, restrict the agent's access narrowly and specifically to its task, instead of granting broad permissions "just in case". Cassidy adds that this governance cannot fall to a single executive or department: it requires explicit commitment from the entire C-suite, because the consequences of an out-of-control agent touch data, compliance, reputation and identity all at once.

His most operational argument is traceability as a safety net: "if and when [the agent] goes off the rails, or does something it wasn't designed for, or operates in a way we didn't anticipate, we know exactly what it could touch, not just at the data level, but at the identity level," he explains. That is, the relevant question is not only whether the agent failed, but whether the company can reconstruct which credentials, systems and records it managed to brush against. Cassidy also proposes treating agentic AI incidents with the same discipline as a ransomware attack: identify the last clean recovery point (rollback) and restore from there, instead of investigating the incident with no prior containment plan. He also notes, more briefly, that EMEA regulators maintain stricter AI controls than North America and Asia, and asks whether automation and agentic AI workflows are already solving real business needs today.

As industry context, this diagnosis fits with something we have been observing in enterprise adoption of agents: more and more large companies are scaling them in production, but the impact on profits still is not taking off at the same rate, and both sector analyses and several rounds of layoffs point to the same cause —the bottleneck is not the quality of the model, it is the operating model: who decides, through what process, with what controls—. What Cassidy adds is the most concrete layer of that bottleneck: identity and data, the invisible plumbing that determines whether an agent can do real damage or only within a bounded box.

Our take is that warnings like these do not contradict the underlying case for agentic AI, they mature it. In the short term, the gap between the speed of deployment and the speed of governance is the real risk and it has to be said plainly: companies granting broad permissions "just in case" to systems that act on their own is a recipe for data and identity incidents, not a distant hypothesis. But the solution proposed by a CISO with 26 years of experience (with previous stops at Securonix, Exabeam, Alert Logic, ForeScout and Fortinet, according to his ISMG profile) is not to slow adoption, it is to build the control infrastructure —access mapping, identity traceability, recovery plans— that will allow agent autonomy, in the medium term, to stop being a leap of faith. That boring, unglamorous infrastructure is ultimately what makes it possible for agentic AI to free up human work instead of multiplying risk: the abundance AI promises is only sustainable if companies first solve, at last, a data hygiene problem they have spent three decades putting off.