Securing Agentic AI: Identity Governance, Risk & Real-Time Protection

At SailPoint Navigate in Sydney, Chris Cubbage speaks with SailPoint Chief Product Officer Levent Besik about securing the growing number of AI agents in the workplace.

At SailPoint Navigate in Sydney, Chris Cubbage speaks with SailPoint Chief Product Officer Levent Besik about securing the growing number of AI agents in the workplace. Bessick describes three key challenges: the scale of non-human identities, the complexity of agents acting with human credentials and access, and the speed at which risks can unfold.

They discuss why sandboxing alone isn’t enough, the importance of assigning clear ownership to every agent, and a three-stage approach to agent governance: discover, govern, and protect. The conversation also covers real-time authorization, preventing sensitive data uploads, integrating with existing security tools, and setting guardrails around high-impact or irreversible actions.

Chapters

00:00 Welcome to SailPoint Navigate Sydney
00:56 The scale, complexity, and speed of agentic AI
02:52 Why traditional IAM and PAM approaches may fall short
05:19 Sandboxing, exposed credentials, and security hygiene
06:24 Agent ownership and accountability
08:05 Discovering and governing agents
11:08 Protecting agents and the enterprise in real time
14:42 Integrating with existing identity and security tools
15:47 User experience and permission controls
17:01 What agents should—and shouldn’t—be allowed to do
19:06 Takeaways from SailPoint Navigate in Australia

#AgenticAI #IdentitySecurity #IdentityGovernance #Cybersecurity #SailPoint #Navigate

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts