Zero trust security must shift to real-time for AI agents

Andre Durand, CEO and founder of Ping Identity, has made a stark argument about the urgency of zero trust security in the age of AI agents. He contends that enterprises must treat zero trust—a security model predicated on the principle that no user, device, or system should be automatically trusted—not as a long-term architectural goal but as an immediate operational requirement. The traditional zero trust concept relies on continuous verification before every action, replacing the older model where a single login check granted extended access. However, the emergence of agentic AI has fundamentally compressed the risk timeline. These autonomous agents operate at a pace and scale that human-driven systems do not. Durand illustrates the risk through a concrete mechanism: permission accumulation. Each time an employee approves an AI agent's request for access to a company drive, database, or code repository, the enterprise grants what appears to be a routine, small slice of control. In isolation, each approval is unremarkable. But across thousands of agents making thousands of requests, those individual permissions stack into substantial exposure. Most existing security frameworks were designed to handle and monitor human-driven access patterns, where the volume and frequency of requests are far lower. They are not built to detect or prevent the cumulative risk that emerges when autonomous systems scale. This gap between the speed at which agents operate and the visibility that legacy security tools provide creates a window of vulnerability that Durand argues enterprises can no longer afford to ignore or defer.

Andre Durand's perspective reflects a critical timing shift in enterprise security thinking. Zero trust as a concept is not new, but the advent of agentic AI—systems that autonomously make requests and take actions—has fundamentally altered the calculus. Traditional security models were built around user-centric risk: a human logs in once, is verified, and operates within defined permissions. That model assumes human judgment gates resource access. Agentic systems compress that timeline dramatically. Where a human employee might make a handful of access requests per day, an AI agent can make thousands. Each individual approval looks benign, but the cumulative exposure across an enterprise running many agents is profound. The body emphasizes that existing security frameworks are not equipped to catch this accumulation because they were not designed for this velocity and scale. The shift Durand describes is not merely an upgrade but a category change: zero trust must move from an occasional verification event to a continuous, real-time process embedded in every agent action.

No comments yet. Be the first to share your thoughts!