Is agentic AI safe? Does it entail risks?

ISS Türkiye CIO Ceyhan Demir shared his insights on the security and risks associated with Agentic AI.

Demir stated the following:

In theory, Agentic AI is capable of autonomous planning; it determines the method, executes the task, and delivers the result to you. That is excellent. However, there is a crucial issue here: the need to demonstrate exactly how that result was achieved.

This applies to everything from the analysis of internal data to the way services are invoked. The system must be able to explain all the actions it takes by demonstrating the underlying cause-and-effect relationships. Cybersecurity is one aspect of this; the system needs a structure that allows it to explain itself—for instance, by clarifying whether it is accessing the cloud, communicating externally, or utilizing services or data it is not authorized to use.

This is a critical point that must be evaluated not only from a cybersecurity standpoint but also from a risk management perspective regarding Agentic AI. Risks may vary depending on the service sector; for example, in regulated industries like banking and insurance, there is a new European regulation known as “Responsible AI” with which systems must comply.

As I mentioned, while obtaining results very quickly is beneficial, the system must be capable of providing answers when regulators ask, “How did you achieve these business results?” Organizations need to be able to manage these risks.

The potential benefits are immense, but realizing them requires investing in governance to mitigate associated risks. Otherwise, organizations could face severe, unforeseen penalties.