In cybersecurity, the model is the easy part: agents' competitive edge lies in MCP, skills and permissions

By iTWire · November 2, 2026.

An article by Kirsten Doyle in iTWire argues that, in AI agents for cybersecurity, the language model is "the easy part" and increasingly the least differentiated. The hard part is getting the agent to work safely and consistently with the tools the team already uses.

The piece distinguishes two reusable components. An MCP server (Model Context Protocol, an open standard for connecting AI applications to tools and data) exposes a tool, such as a vulnerability scanner, through a common interface. A "skill" is the set of instructions that tells the agent how to do a job, for example prioritizing vulnerabilities. According to the article, if the team switches scanners, it keeps the skill and only swaps the server.

As an example, the article cites Black Hat USA 2026. There, participants built MCP servers on top of existing tools and turned common tasks into skills. The winning project, Chokepoint Finder, ranks fixes rather than findings. It groups vulnerabilities by the action that resolves them and calculates the shortest ordered list that removes the most weighted risk. It was released in four forms: agent, MCP server, skill and playbook. We attribute these details to the article, which offers no performance metrics for the project.

The piece also warns that open source allows inspection but is not the same as security. It recommends least privilege, human approval for changes in production and logs of what the agent did. It distinguishes between a server that only reads data and one that can change configurations or launch remediations.

**Our take.** The article's thesis is sound and fits a pattern we see in other fields: as frontier models converge in capability, the advantage shifts to the "plumbing." The winners are those who control integrations, standards and reusable workflows, not just the smartest model. That the MCP layer is vendor-neutral is also good news for small teams. They can reuse others' work without being locked into a single vendor.

But here is the nuance that matters. Sharing skills and MCP servers creates a new software supply chain, and each component brings permissions, dependencies and access to other systems. In general, an agent that combines pieces from different authors expands the attack surface: a malicious or poorly designed MCP server, or a skill with poisoned instructions, is a risk vector. The article mentions provenance and permissions but does not dig into this scenario, and it is worth stating clearly.

That leads to a practical consequence. Trust cannot reside in the model or in the repository's reputation, but in external layers: minimal permissions, human approval for high-impact actions and full traceability. Each layer adds cost and a new point of failure that must also be audited. It is the same layered-oversight logic we see in agents generally.

The short term, therefore, calls for discipline more than enthusiasm: defenders will adopt these components faster than the practices for verifying them will mature. In the longer term, the collective defense model, with shared detections, threat intelligence and now agentic processes, is the kind of cooperation that can tip the balance toward defenders. That favorable asymmetry is what we will need when attackers also automate their work, and it is a good example of how openness, well governed, is a democratizing force and not just a risk.