In the age of AI agents, cybersecurity is shifting from focusing on identity to addressing agency. Autonomous agents, which act and reason like humans but operate at machine speed, are being created on the fly. Traditional identity management tools—like user directories and group policies—are ill-equipped to handle these ephemeral, unpredictable entities that can take action and disappear before a human can even react.
CyberArk’s SVP and Head of AI, Data & Research, Avihay Nathan, describes this as an unprecedented challenge. His team is tackling it with a three-part framework:
Secure from AI: Defending against new AI-driven threats.
Secure with AI: Using AI to augment human defenders and reduce alert fatigue.
Secure of AI: Protecting organizations from the AI systems they themselves are deploying.
Many companies are overwhelmed by the rapid adoption of agents without understanding what data or systems these agents can access. This creates a trust crisis, and they are now looking to security vendors for solutions.
CyberArk is mapping out a new agent lifecycle, from discovery (how many agents spun up?) to observability, access control, behavior monitoring, and governance. The key insight is that securing these agents requires understanding their context: what data they touch, what tasks they perform, and why they act in a certain way. An agent's behavior is often "zero-shot," meaning it can act without a history, so context is the only way to anchor and secure its actions.
To build this new vision, CyberArk underwent its own transformation, shifting from a traditional company to an AI-native startup mindset. This involved creating a centralized AI and data group with full ownership and educating the entire organization on the importance of data.
