IT InfoSec Running Uphill: AMD Enterprise AI Security

THE CONTRADICTION

Security teams are living the same problem twice

Security teams are increasingly living the same duality. Businesses are adopting AI at an unprecedented pace, embedding copilots and autonomous agents into the data, systems, and workflows that run the company. In many organizations, this is moving beyond experimentation and into production. At the same time, adversaries have access to the same AI capabilities, allowing them to move at a rate and scale that traditional, human-driven security processes were never designed to match.

That is the climb. And it gets steeper the longer we pretend it is one problem instead of two. AI security now has two faces: securing the AI we adopt and defending with AI at the pace we are attacked. We have stopped treating those as separate programs run by separate people. They are one discipline with two fronts — and the organizations that internalize this will spend the next few years gaining ground while everyone else may lose.

You can’t slow AI adoption to stay safe — the business will simply route around you.

There is a temptation, especially in security, to answer uncertainty with a moratorium: slow the rollout, form a committee, wait for standards. This approach may not work reliably. Tell the business it should not use AI and it may find a way — one that corporate IT may not see. The goal is not to slow down the climb. It is to change its grade.

THE CLIMB

An uphill risk landscape

Before prescribing anything, it is worth being honest about the terrain. The figures in the landscape below are not ours — they come from IBM’s 2025 Cost of a Data Breach Report, Gartner, and CrowdStrike’s 2026 Global Threat Report — but they map both slopes of the same hill with uncomfortable precision.

On the side of securing what we adopt, governance debt is accumulating faster than anyone is paying it down. One in five breaches now involve shadow AI — sensitive data flowing into tools no one sanctioned. Ninety-seven percent of organizations breached through AI lacked proper AI access controls, and most still have no AI governance technology at all. Gartner expects a third of enterprise applications to be agentic by 2028, which makes over-permissioned, autonomous software the norm rather than the exception.

On the side of defending against it, the adversary has already industrialized. Average breakout time — from first foothold to lateral movement — is down to 29 minutes, with the fastest observed at 27 seconds. Most intrusions now arrive on valid credentials with no malware to detect, invisible to defenses built to catch files. AI-enabled attacks and AI-assisted social engineering are both climbing fast, and it still takes months, on average, to find and contain a breach. The diagram tells the rest.

Ask yourself:  How many AI agents are running across your enterprise right now — and could you name an owner for each one?

If that question makes you uncomfortable, you have found the right place to start.

SECURITY FOR AI

Treat AI agents as first-class principals

Here is the mental-model shift that must happen first: an AI agent is not simply a feature, and it is not a human. It authenticates. It calls APIs. It makes autonomous decisions and acts on your behalf. And a single compromised orchestrator can instruct dozens of sub-agents downstream before anyone notices. That blast radius is a core concern — and it is why agents need their own identity, their own credential lifecycle, and their own access model, rather than borrowing a service account or using a human’s session.

We do not secure agents by bolting a policy onto the end. One effective approach is a layered, zero-trust model across the full agentic stack, where each layer depends on the one beneath it. Miss one layer and the failure may not remain local.

Skip a layer and you don’t just weaken that layer — you invalidate every layer above it.

Read Figure 2 from the bottom up.

Agent Registry — Know what is running: classify each agent by capability, autonomy, and risk before it touches anything, because effective governance depends on what you can enumerate.

Identity & Access — Each agent, human or machine, earns access per request and does not inherit it by default; standing privilege can turn a small compromise into a large one.

Policy Enforcement — Security intent is translated into machine-enforced rules where feasible, operating at agent speed, without waiting for a human in the loop.

Runtime Security — Guardrails designed to limit shared memory, shared filesystem access, and lateral paths between agents.

Observability — A strong audit trail where actions are recorded and explainable, so decisions can be reviewed and defended after the fact. Governance at the bottom, accountability at the top, and enforcement layered in between.

Where does a bad action die?

Executives ask a fair question: What happens when something goes wrong? A well-designed model should define where a risky action is evaluated, logged, and blocked when appropriate.

Agent actions should pass key gates, in order, before reaching enterprise resources — data, systems, or models.

• Registry: Is this agent known and owned?
• Identity: Is it who it claims to be, right now?
• Policy: Is this action allowed?
• Runtime: Is the action itself safe?

Fail any gate and the action is denied and logged — it never reaches the resource, and we keep the evidence that it was stopped.

The distinction that matters technically

Registry and Identity are established once, per agent. Policy and Runtime are evaluated on each action. That is deliberate. Design-time trust — “we vetted this agent when we onboarded it” — is an assumption that can break under agentic workloads, because the agent’s next action may not be the one you reviewed. Enforcement should be inline and continuous. Spanning all four gates is observability, helping make allow/deny decisions recorded, attributable, and reviewable where feasible.

Ask yourself: When an agent acts on your behalf at 3 a.m., can you explain — and defend — exactly what it did?

SECURITY WITH AI

Buy back the speed we lost

Now flip to the other front. If the adversary has industrialized AI, defenders may struggle to answer with more headcount and more dashboards — that math often does not close. One effective approach to meeting machine-speed offense is to put AI where it changes the economics of defense. For us, that means AI applied deliberately, not decoratively:

• An AI-assisted SOC — Can cut alert noise and speeds response, so analysts focus their attention where it matters most.
• Autonomous threat hunting — Can enrich alerts and learn from analyst corrections.
• Exposure intelligence — Can prioritize what is genuinely exploitable rather than what scored high on a scanner.
• AI-driven security platform operations — One AI-driven operating model across the whole security platform estate — making defense more effective and more efficient than siloed, manually managed point tools, where change management stopped scaling long ago.
• Governance that quantifies risk — Helps leadership decisions rely more on measurable risk signals than instinct alone.

But there is a connective principle underneath all of it, and it is the part many “AI for security” pitches skip: the AI stays tunable and accountable. Editable prompts. Audited query logs. Evaluation harnesses that flag when a model’s judgment drifts. Those are not just nice-to-have features — they are a key reason a human can trust, and defend, an AI-assisted decision.

We’re automating the toil — not the accountability.

The failure to avoid is a fast, confident, opaque model that is wrong and offers limited insight into why. Speed without an audit trail can become a liability disguised as a capability.

THE BOTTOM LINE

Change the grade of the climb

Three convictions hold this together, and they cut against some conventional wisdom. First, governance is a prerequisite for autonomy, not a tax on it — teams that inventory their agents early are often better positioned to grant more autonomy later; skipping governance may not make you faster, it may make you blind at speed. Second, enforcement should be inline, on each action, because standing privilege and design-time trust are two assumptions that can break under agentic workloads. Third, defensive AI is only as useful as its audit surface.

If we cannot replay why the AI did what it did, we may have relocated risk instead of reducing it.

So here is the strategy in one breath: govern the AI we adopt as rigorously as we would govern any privileged actor, defend with AI where it can help buy back the speed we have lost, and keep a human accountable on both fronts. Two sides. One discipline. The hill may not get shorter — but we can influence the grade.

SOURCES

IBM Cost of a Data Breach Report 2025 (Ponemon Institute)  ·  Gartner projections for agentic AI in enterprise applications by 2028  ·  CrowdStrike Global Threat Report 2026 (2025 data). This perspective reflects the vision and strategy of the AMD Information Security team.