Ivan Mans, SecurityBridge Co-Founder, builds SAP cybersecurity software to keep critical business systems secure.
For most of its history, application security has assumed a clean line between the user and the application. A person makes a request, and the application validates and authorizes it before acting. We built our controls, authentication, input validation and change management around that boundary.
Agentic AI erases it. Autonomous agents now write code, call APIs and take actions on a user’s behalf with minimal human oversight. Rather than sitting at the perimeter waiting to be let in, they operate within trusted workflows, often with credentials and privileges granted for legitimate purposes.
That changes the security question entirely. The issue is no longer whether you can keep an attacker out. It’s whether you can account for what an agent already inside your systems is allowed to do—and prove it afterward.
Nowhere is this more consequential than in SAP, which runs the financials, payroll, supply chain and master data of most large enterprises. As SAP itself becomes an AI platform, with products such as Joule and embedded agents in S/4HANA and BTP, every new agent is a new privileged actor operating directly against the most valuable data a company holds.
The risk of an agent behaving unexpectedly inside a production ERP system isn’t theoretical. According to an April 2026 Cloud Security Alliance study, 53% of surveyed organizations said AI agents had exceeded their intended permissions.
Why The Perimeter Mindset Fails Here
Agentic systems introduce a class of risk that traditional perimeter defenses were never designed to handle. Three patterns stand out.
1. Injection moves inside the trust boundary. Prompt injection is becoming the new SQL injection. A malicious instruction smuggled into data an agent reads can redirect what that agent does from within a workflow your controls already trust.
2. Privilege escalation becomes ambient. An agent chaining API calls can assemble an effective level of access no single human was ever granted without any individual step looking abnormal.
3. The software supply chain extends into AI-generated artifacts. When agents write and configure code, your composition analysis must reason about components no human author ever reviewed.
The Hacker News noted in April 2026 that compromised SAP-related npm packages planted malicious configuration files that hijack AI coding agents. The report cited StepSecurity research that described this as “one of the first supply chain attacks to target AI coding agent configurations as a persistence and propagation vector.”
This isn’t the first time SAP’s move into AI has widened the attack surface. In 2024, Wiz researchers disclosed a set of flaws in SAP AI Core that let them execute arbitrary code, move laterally and reach customer data and cloud credentials.
None of these threats announce themselves at the network edge. Rather, they originate inside trusted workflows, which is precisely why application security—not network security—is the layer that matters most for agentic risk.
AppSec Controls Must Evolve
The good news is we’re not starting from zero. The disciplines we need already exist; they must be pointed at a new kind of actor.
Runtime application self-protection must monitor agent-initiated actions, not only human-driven sessions, and treat an autonomous caller as a first-class subject for real-time scrutiny. API security needs to assume that the most prolific, fastest and least predictable client is now an agent and apply least-privilege and behavioral baselining rules accordingly.
Software composition analysis must extend its reach to AI-generated and AI-configured code, closing the gap between what a human committed and what an agent produced. The organizations that come through this well wrap rigorous AppSec controls around their agents rather than relying on model guardrails.
That last point deserves emphasis. Model guardrails are necessary, but they constrain what an agent is told to do rather than what a compromised agent can access. VentureBeat cited research showing those guardrails can be bypassed in a majority of attempts under the right conditions, and any control an attacker can talk their way past isn’t a control you can take to an auditor.
Durable assurance comes from the surrounding application architecture: what data an agent can reach, what it’s permitted to change and whether every action it takes is observable and reversible.
Keep A Human In The Lead
This is where I’d push the industry’s favorite phrase a step further. “Human in the loop” has come to mean a person watching a process—present but passive. For any agentic AI touching production systems, watching alone isn’t enough. A human must be in the lead.
What does this look like operationally? The agent recommends and prepares, but a person authorizes consequential actions. That authorization is bound to the specific action approved, and a named human signs the audit trail. The agent does the work. Ultimately, the accountability stays human.
Pair that with a second principle: Let customers bring their own AI. The model should belong to the enterprise, the data should stay inside the enterprise’s perimeter and the customer should choose their provider. An agent you can’t inspect, running on data you’ve handed to someone else’s cloud, is the opposite of a defensible position. Sovereignty over the model and data is the foundation that makes everything auditable.
The Question To Ask Before You Deploy
Another thing: Boards have been asking the wrong question.
Board members who ask whether the organization is using AI tell you nothing about your exposure. The salient question is: Which decisions are we letting AI make in production, and who signs for them? If the answer is “We’re not sure” or “Everything,” the deployment isn’t ready.
Agentic AI is one of the most significant shifts enterprise software has seen, and its upside is significant. However, the layer that determines whether that upside is safe to capture is application security applied with discipline, extended to a new kind of actor and led by a human.
Treat your agents with the same rigor you’d demand of any privileged user, and you’ll be positioned to move fast without handing the keys to the workflow.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
