Securing Agentic AI Through Existing Cyber Security Governance

Cyber security agencies in the UK, USA, Canada, Australia and New Zealand recently co-authored the guidance that outlines the principal cyber security challenges and risks associated with introducing agentic AI into IT environments, and presents practices for securing agentic AI systems. 

Read the guidance here: Careful Adoption Of Agentic AI Services

A key recommendation is to align agentic AI risks and mitigation strategies with the organisation’s existing security model and risk posture. The guidance advocates a security-led approach: begin with low-risk, non-sensitive tasks, and thoroughly assess any use case involving sensitive data or critical systems. The business risks of AI should be assessed before expanding adoption.

Download the whitepaper: Addressing The Business Risks Of AI

AI security as part of cyber security

AI security should be integrated into the organisation’s broader cyber security and risk management environment, not managed through separate governance arrangements. Even increasingly autonomous AI capabilities depend on the same foundations as other digital services: infrastructure, applications, data, networks and connected systems. Many AI-related risks therefore stem from familiar security challenges already being managed across the technology estate.

Established cyber security frameworks provide a structured foundation for managing these risks by defining governance requirements, control objectives, accountability, and oversight mechanisms. Supporting policy, process and procedural documentation also plays a critical role in translating governance into practice. Together, these elements provide clarity around responsibilities, guide consistent decision-making, and help ensure security controls are implemented and maintained effectively.

As AI becomes further integrated into business operations and essential services, organisations should adapt their existing governance and security practices to address emerging risks and obligations. Security can then be incorporated throughout planning, deployment, operation and ongoing management while reinforcing layered security, controlled access, continuous oversight and effective incident management. Agentic AI requires particular attention because these systems may initiate actions with limited human intervention; clear governance and documented operational practices are therefore essential to maintaining control, transparency and accountability.

Embedding AI risk management within existing cyber security governance arrangements promotes consistency, strengthens organisational oversight, supports regulatory and audit requirements, and enables security practices to evolve alongside advances in technology and organisational maturity.

Does your current policy framework adequately address the risks associated with AI?

The following areas provide a practical starting point for assessing whether existing controls remain effective as AI adoption expands.

Data access and oversharing
AI tools operate using existing user permissions and can surface information from across the organisation.

Identity and access management
As AI becomes more integrated into business processes, strong identity and access controls are increasingly necessary.

Data protection and leakage prevention
Sensitive information needs to be protected through information classification, encryption, and data loss prevention controls.

Third-party integrations and connected systems
AI solutions may interact with HR, CRM, finance, and other business applications - what data is accessible through these connections?

Monitoring, audit, and compliance
Is ongoing monitoring in place to track AI usage, system activity and data risks; demonstrate compliance and accountability; and support investigations following an incident?

How Can PPS Help?

Policy Management as a Service makes it easier to implement and maintain IT policies based on recognised standards that address AI-related risks. To discuss how Protocol Policy Systems can help your organisation establish a secure computing foundation, contact us book a time with one of our consultants.

Heading to the iNetwork Annual Conference? Come and Say Hello

We're looking forward to exhibiting at the iNetwork Annual Conference on 10 November at the Hyatt Regency Manchester and connecting with local government professionals from across the sector. If you're attending, stop by our stand for a chat.