Firms can’t count their AI agents, let alone switch them off

RSA chief executive Greg Nelson recently asked a room of security chiefs from 20 of RSA’s top enterprise customers if they knew how many artificial intelligence (AI) agents were running inside their organisations.

The CEO of the IT security specialist got no answer. “Not one person could raise their hand,” he said. “Then I asked whether they had a tool to discover them. And again, nobody could say they did.”

Nelson, who has led RSA since September 2025, spoke to Computer Weekly at the World Summit AI conference in Amsterdam, where the supplier presented Agent ID, its platform for discovering and governing AI agents, to a European audience. In his view, the number of agents is growing faster than security teams can keep up. Gartner expects the average global Fortune 500 enterprise to run more than 150,000 agents by 2028, up from fewer than 15 in 2025.

“We had a bank the other day that said, officially, we have zero AI agents – but unofficially, we have 4,000,” said Nelson. And he does not expect it to stop there. “That 4,000 is going to be 8,000 in three months.”

Sprawl outpaces security

For Nelson, those uncounted agents are the biggest security risk that AI brings. “People have no control over the agents,” he said. “Agents are outpacing what security has been able to do.”

In 2024, Gartner predicted that by 2028, 25% of enterprise breaches will be traced back to AI agent abuse, from both external and malicious internal actors. Much of that, Nelson expects, will come from “shadow agents that never got turned off”.

Some organisations already have visibility within a single platform, he said, but most tools stop at its edge, adding: “A lot of the tools in the market can find your cloud–based agents, but they can’t go on-premise, and agents are sprawling everywhere throughout an organisation.”

A bank or government agency runs mainframes alongside AWS and Microsoft, he added, and needs to see all of it.

If an AI agent is doing the work of a full-time employee, it should have an employee ID

Agent ID is RSA’s answer. Around 20 customers are testing it ahead of general availability of its first two modules on 16 November, including banks and governments in Europe. The first thing they run into, said Nelson, is “agents they never knew existed”.

The platform discovers agents, registers each one with a named owner and enforces policy on every call that passes through its AI/MCP gateway, which customers can run themselves or have RSA host.

Hire to retire

Nelson’s central argument is that every agent must be tied to a human. “That person might have 50 agents, and that’s fine,” he said, “but the credential belongs to someone, and from there you can reduce privileges as far as your security policy requires.”

RSA applies that to itself – Nelson’s own agents log in with his credentials and carry his access rights, but cannot go beyond them.

Assigning an owner covers the start of an agent’s life. Nelson sees the bigger problem at the other end. “People start agents, but they never end them,” he said. “They onboard them, they get excited, people forget about them, and six months later that agent causes trouble.”

He compares it to staff who leave. “Would you ever keep an employee you fired in your systems for six months?” That happens a lot, he agrees. “And it’s a huge security risk. It’s the same with agents.” A year from now, Nelson wants to be able to describe RSA as a company of 1,000 employees and 10,000 agents, all onboarded and offboarded the same way.

At Schneider Electric, the thinking goes a step further. Una Madigan Shortt, the energy technology company’s group chief data officer, wants agents in the same hire–to–retire process as staff.

“If an AI agent is doing the work of a full-time employee, it should have an employee ID,” she said on a security panel at World Summit AI. “It’s registered in the system, and it has performance management, just like we’re assessed at the end of the year.”

Schneider is working on this with its HR department, although Madigan Shortt described it as still at the brainstorming stage. Governance should not block innovation, she said, but agents do need to be governed and controlled, and that requires frameworks. “From an HR perspective,” she said, “we need to see them as one of us.”

Not every agent lingers

However, not everyone sees it that way. Rens van Dongen, corporate AI officer at Dutch railway operator NS, spent 10 years in cyber security, including as CISO at four organisations, before moving into AI governance. Asked by Computer Weekly what happens to an agent once nobody uses it anymore, he questioned the assumption behind it. Most agents in an enterprise today are short-lived, he said. “They’re spun up and shut down again, sometimes within a minute or a day.”

Whether an organisation keeps a register of agents and formally retires them therefore depends on the platform and the use case, according to Van Dongen.

“Sometimes that’s relevant, and sometimes the question doesn’t even come up,” he said. “From where I sit, in the second line of defence, it’s not even my problem, although understanding the risks it creates is part of my daily work.”

RSA’s Nelson, too, accepts that not every agent needs a person as its owner, as long as that choice is deliberate. An agent can also answer to a non–human identity with clearly defined permissions. “But you never want something that isn’t assigned to anything,” he said. “At that point, it’s running loose.”

Oversight becomes rubber-stamping

Opinions also differ on human oversight. Agent ID requires a named, authenticated person to approve high-risk actions, and Nelson acknowledges that such approvals easily become a formality.

“It’s tough, and it’s real,” he said. “We’ve all been in the situation where you see 20 approvals, select all and click approve.”

When an agent is involved in moving $20m between banks, that is not good enough, he said. RSA is building machine learning and pattern recognition into the platform to decide which actions need a person’s approval, and where approving a whole batch at once is blocked, so that each request has to be checked individually.

“It’s not humanly possible to expect people to step in and judge all these approvals any more,” said Van Dongen. He called the “human in the loop” metaphor misleading, or dated.

“Agentic systems move at superhuman speed and with superhuman complexity,” he said. Instead, he argues for what he calls a response loop. “That means being alerted and being able to intervene when required.”

He also pointed to the Dutch Data Protection Authority, which has published guidance on meaningful human intervention in algorithmic decision-making, warning that approval cannot be reduced to a symbolic click.

“As a train operator, we’re not letting AI agents drive the trains anytime soon, so you can all rest assured,” Van Dongen joked. His concern lies mainly with IT operations, where agents are already running in loops.

Control starts at home

Who controls an agent is, for Nelson, also a question of where that control sits, which is a theme that ran through the summit.

“Everybody talks about sovereign data and sovereign compute,” he said. “But without sovereign identity, it isn’t really sovereign.”

Demand for that is clearly higher in Europe and the Middle East than in the US, according to Nelson, and RSA customers can keep both software and data within their own country.

Frank Karlitschek, CEO of German open source collaboration company Nextcloud, argued that a European datacentre offers little protection if the provider is American, because the US Cloud Act still obliges it to comply with US law.

“It’s snake oil to say you can choose where your data is,” he said, “just because there are nice European subsidiaries.”

Asked whether that also applies when European customers use the RSA-hosted version of the gateway, Nelson pointed to the option of running everything locally. “You would never have your jurisdiction go back to the US, if that’s your preference,” he said. Nelson expects European demand for that kind of control to keep rising, given the complexity of regulation in the region.

Whatever the deployment model, Nelson said, organisations first need a clear policy on how they expect AI agents to work, and staff trained to use them responsibly. RSA went through that itself. Once the company started working with agents, it drew up a framework for responsible use, and at one point decided to shut off access to its AI models until its security was in better shape.

“We were worried about the security threat, given what we do,” said Nelson. RSA now runs Agent ID internally and has certified every employee in responsible AI use.

The first step for a CIO is simpler still. “Ask your CISO how many agents you have running today,” said Nelson. “If they can’t answer that question, you’ll know what action you need to take.”