{"id":15372,"date":"2026-09-17T17:51:23","date_gmt":"2026-09-17T12:21:23","guid":{"rendered":"https:\/\/threatcop.com\/blog\/?p=15372"},"modified":"2026-09-17T17:51:25","modified_gmt":"2026-09-17T12:21:25","slug":"implement-ai-agents-securely","status":"publish","type":"post","link":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/","title":{"rendered":"How to Implement AI Agents Securely: Permissions Over Detection"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">To implement AI agents securely, scope each agent&#8217;s tools to its task, run it under its own identity, keep authorization outside the model, and require human approval for high-impact actions. Prompt injection cannot be reliably blocked. Therefore permissions, not detection, decide how much damage an attacker does.<\/p><div id=\"ez-toc-container\" class=\"ez-toc-v2_0_87 ez-toc-wrap-center counter-hierarchy ez-toc-counter ez-toc-light-blue ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #414141;color:#414141\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #414141;color:#414141\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#What_Changes_When_You_Implement_an_Agent_Instead_of_a_Chatbot\" >What Changes When You Implement an Agent Instead of a Chatbot<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#The_Two_Standards_to_Implement_Against\" >The Two Standards to Implement Against<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#Book_a_Free_Demo_Call_with_Our_Expert\" >Book a Free Demo Call with Our Expert<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#Why_Excessive_Agency_Is_Now_the_Third-Biggest_LLM_Risk\" >Why Excessive Agency Is Now the Third-Biggest LLM Risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#Prompt_Injection_Is_the_Delivery_Mechanism_Not_the_Damage\" >Prompt Injection Is the Delivery Mechanism, Not the Damage<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#The_Controls_to_Build_In_Before_Launch\" >The Controls to Build In Before Launch<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#Approval_Fatigue_Will_Break_Your_Human-in-the-Loop_Control\" >Approval Fatigue Will Break Your Human-in-the-Loop Control<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#Whoever_Wires_the_Agent_Up_Is_Making_a_Security_Decision\" >Whoever Wires the Agent Up Is Making a Security Decision<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#The_Pre-Launch_Checklist\" >The Pre-Launch Checklist<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#What_to_Measure_After_Launch\" >What to Measure After Launch<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#Where_to_Start_If_Agents_Are_Already_Running\" >Where to Start If Agents Are Already Running<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#Frequently_Asked_Questions\" >Frequently Asked Questions<\/a><\/li><\/ul><\/nav><\/div>\n\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_Changes_When_You_Implement_an_Agent_Instead_of_a_Chatbot\"><\/span>What Changes When You Implement an Agent Instead of a Chatbot<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A chatbot answers. An agent acts. That single difference reshapes how you implement it, and every control below follows from it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An agent plans a task, calls tools, holds memory between steps, and runs without a human approving each action. It reads a ticket, queries a database, sends an email, and updates a record. Consequently its mistakes are not wrong answers. They are transactions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OWASP drew the line cleanly across its two 2026 standards. The Top 10 for LLM Applications governs what a model says. The Top 10 for Agentic Applications governs what a system does. Crucially, the second extends the first rather than replacing it. Autonomy turns a model-layer weakness into a live one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The practical test is simple. Ask what happens if the system is wrong at 3am with nobody watching. For a chatbot, someone reads a bad answer. For an agent, money moves.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_Two_Standards_to_Implement_Against\"><\/span>The Two Standards to Implement Against<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most guidance on implementing AI agents cites no standard at all. Two now exist, both dated 2026, and both are free to work from.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th><strong>Standard<\/strong><\/th><th><strong>Published<\/strong><\/th><th><strong>Covers<\/strong><\/th><\/tr><\/thead><tbody><tr><td><a href=\"https:\/\/genai.owasp.org\/resource\/owasp-genai-llm-top-10-2026\/\" target=\"_blank\" rel=\"nofollow noopener\">OWASP Top 10 for LLM Applications 2026<\/a><\/td><td>3 August 2026<\/td><td>Model-layer risk: prompt injection, sensitive information disclosure, excessive agency, supply chain, poisoning<\/td><\/tr><tr><td>OWASP Top 10 for Agentic Applications 2026<\/td><td>9 December 2025<\/td><td>System-layer risk: goal hijacking, tool misuse, memory and context poisoning, entries ASI01 to ASI10<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The agentic list came from the OWASP Agentic Security Initiative, with more than 100 contributors and a review board drawn from NIST, Cisco, Microsoft, and AWS. Meanwhile the LLM list arrived alongside a new Agent Control Standard covering runtime enforcement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Both map to NIST, MITRE ATLAS, and CWE. As a result you can trace an agent control back to a framework your auditor already accepts, which is usually the blocker for getting agent work funded.<\/p>\n\n\n\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<title>Threatcop \u2013 Book a Free Demo<\/title>\n<link href=\"https:\/\/fonts.googleapis.com\/css2?family=Outfit:wght@300;400;500;600;700&#038;display=swap\" rel=\"stylesheet\">\n<style>\n  .tc-wrap , .tc-wrap ::before, .tc-wrap ::after { box-sizing: border-box; margin: 0; padding: 0; }\n  .tc-wrap { font-family: 'Outfit', sans-serif; width: 100%; display: flex; justify-content: center; padding: 20px 10px; }\n  .tc-card { width: 100%; max-width: 820px; background: #fff; border-radius: 20px; overflow: hidden; box-shadow: 0 20px 60px rgba(24,57,148,0.13), 0 4px 16px rgba(24,57,148,0.07); display: flex; flex-direction: row; }\n  .tc-left { background: linear-gradient(160deg, #1e44b0 0%, #183994 40%, #0e2570 100%); width: 320px; flex-shrink: 0; padding: 40px 32px; display: flex; flex-direction: column; justify-content: center; position: relative; overflow: hidden; }\n  .tc-left::before { content: ''; position: absolute; inset: 0; background-image: radial-gradient(rgba(255,255,255,0.08) 1.5px, transparent 1.5px); background-size: 22px 22px; }\n  .tc-left::after { content: ''; position: absolute; bottom: -60px; right: -60px; width: 220px; height: 220px; background: radial-gradient(circle, rgba(99,179,255,0.22) 0%, transparent 65%); border-radius: 50%; pointer-events: none; }\n  .tc-panel-inner { position: relative; z-index: 1; }\n  .tc-badge { display: inline-flex !important; align-items: center !important; gap: 6px; background: rgba(255,255,255,0.1) !important; border: 1px solid rgba(255,255,255,0.18) !important; border-radius: 20px !important; padding: 4px 14px 4px 10px !important; font-size: 12.5px !important; font-weight: 600 !important; letter-spacing: .09em !important; text-transform: uppercase !important; color: rgba(255,255,255,0.85) !important; margin-bottom: 18px !important; font-family: 'Outfit', sans-serif !important; line-height: 1.4 !important; }\n  .tc-badge-dot { width: 6px; height: 6px; background: #5cd9a0; border-radius: 50%; box-shadow: 0 0 6px #5cd9a0; flex-shrink: 0; display: inline-block; }\n  .tc-left h1, .tc-left h2, .tc-left h3, .tc-left h4, .tc-left h5, .tc-left h6 { color: #ffffff !important; font-family: 'Outfit', sans-serif !important; font-size: 28px !important; font-weight: 700 !important; line-height: 1.35 !important; letter-spacing: -0.3px !important; margin: 0 !important; padding: 0 !important; background: none !important; -webkit-text-fill-color: #ffffff !important; }\n  .tc-left h2 em { font-style: normal !important; color: #7ec8ff !important; -webkit-text-fill-color: #7ec8ff !important; }\n  .tc-left p, .tc-left .tc-sub { color: rgba(255,255,255,0.78) !important; -webkit-text-fill-color: rgba(255,255,255,0.78) !important; font-family: 'Outfit', sans-serif !important; font-size: 14px !important; font-weight: 300 !important; line-height: 1.65 !important; margin-top: 12px !important; background: none !important; }\n  .tc-right { flex: 1; padding: 32px 32px 28px; display: flex; flex-direction: column; justify-content: center; }\n  .tc-form-title { font-size: 13px !important; font-weight: 600 !important; letter-spacing: .12em; text-transform: uppercase; color: #8fa4cc !important; margin-bottom: 20px !important; display: flex !important; align-items: center !important; gap: 10px; font-family: 'Outfit', sans-serif !important; }\n  .tc-form-title::after { content: ''; flex: 1; height: 1px; background: #eef1fa; }\n  .tc-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 14px; }\n  .tc-field { display: flex; flex-direction: column; gap: 5px; }\n  .tc-field.full { grid-column: 1 \/ -1; }\n  .tc-field label { font-size: 13px !important; font-weight: 600 !important; color: #3a4f7a !important; letter-spacing: .04em; text-transform: uppercase; font-family: 'Outfit', sans-serif !important; display: block !important; }\n  .tc-input-wrap { position: relative; display: flex; align-items: center; }\n  .tc-input-wrap .tc-fi { position: absolute; right: 12px; width: 15px; height: 15px; stroke: #c0ccdf; stroke-width: 1.8; pointer-events: none; fill: none; }\n  .tc-wrap input[type=\"text\"], .tc-wrap input[type=\"email\"], .tc-wrap input[type=\"number\"] { width: 100% !important; border: 1.5px solid #e2e9f7 !important; border-radius: 10px !important; padding: 9px 34px 9px 13px !important; font-family: 'Outfit', sans-serif !important; font-size: 15px !important; font-weight: 400 !important; color: #1e2d50 !important; background: #f8faff !important; outline: none !important; transition: border-color .2s, background .2s, box-shadow .2s; -moz-appearance: textfield; box-shadow: none !important; -webkit-text-fill-color: #1e2d50 !important; }\n  .tc-wrap input[type=\"number\"]::-webkit-inner-spin-button, .tc-wrap input[type=\"number\"]::-webkit-outer-spin-button { -webkit-appearance: none; }\n  .tc-wrap input::placeholder { color: #c0ccdf !important; -webkit-text-fill-color: #c0ccdf !important; opacity: 1; }\n  .tc-wrap input:focus { border-color: #183994 !important; background: #fff !important; box-shadow: 0 0 0 3.5px rgba(24,57,148,0.1) !important; }\n  .tc-phone-row { display: flex; gap: 8px; }\n  .tc-flag-select { position: relative; flex-shrink: 0; }\n  .tc-flag-select select { appearance: none !important; -webkit-appearance: none !important; border: 1.5px solid #e2e9f7 !important; border-radius: 10px !important; padding: 9px 26px 9px 12px !important; font-family: 'Outfit', sans-serif !important; font-size: 14px !important; font-weight: 500 !important; color: #1e2d50 !important; background: #f8faff !important; outline: none !important; cursor: pointer; width: 100px !important; transition: border-color .2s, box-shadow .2s; }\n  .tc-flag-select select:focus { border-color: #183994 !important; box-shadow: 0 0 0 3.5px rgba(24,57,148,0.1) !important; }\n  .tc-flag-select::after { content: ''; position: absolute; right: 10px; top: 50%; transform: translateY(-50%); width: 0; height: 0; border-left: 4px solid transparent; border-right: 4px solid transparent; border-top: 5px solid #a0b0cc; pointer-events: none; }\n  .tc-phone-row .tc-input-wrap { flex: 1; }\n  .tc-btn-submit { width: 100% !important; margin-top: 18px !important; padding: 11px !important; background: #183994 !important; border: none !important; border-radius: 10px !important; color: #fff !important; -webkit-text-fill-color: #fff !important; font-family: 'Outfit', sans-serif !important; font-size: 15px !important; font-weight: 600 !important; letter-spacing: .05em; cursor: pointer; display: flex !important; align-items: center !important; justify-content: center !important; gap: 9px; transition: background .2s, transform .15s, box-shadow .2s; box-shadow: 0 6px 24px rgba(24,57,148,0.28) !important; text-decoration: none !important; }\n  .tc-btn-submit:hover { background: #1d46b5 !important; transform: translateY(-1px); box-shadow: 0 10px 32px rgba(24,57,148,0.35) !important; color: #fff !important; }\n  .tc-btn-submit:active { transform: translateY(0); }\n  .tc-btn-submit svg { width: 16px; height: 16px; stroke: #fff; stroke-width: 2.2; fill: none; flex-shrink: 0; }\n  .tc-trust { margin-top: 10px !important; display: flex !important; align-items: center !important; justify-content: center !important; gap: 5px; font-size: 13px !important; color: #a0b0cc !important; font-family: 'Outfit', sans-serif !important; }\n  .tc-trust svg { width: 12px; height: 12px; stroke: #a0b0cc; stroke-width: 2; fill: none; flex-shrink: 0; }\n  @media (max-width: 680px) {\n    .tc-card { flex-direction: column !important; }\n    .tc-left { width: 100% !important; padding: 28px 24px 24px !important; }\n    .tc-right { padding: 24px 20px !important; }\n    .tc-grid { grid-template-columns: 1fr !important; }\n    .tc-field.full { grid-column: 1 !important; }\n  }\n<\/style>\n\n<div class=\"tc-wrap\">\n  <div class=\"tc-card\">\n    <div class=\"tc-left\">\n      <div class=\"tc-panel-inner\">\n        <div class=\"tc-badge\">\n          <span class=\"tc-badge-dot\"><\/span>\n          People Security Management\n        <\/div>\n        <h2><span class=\"ez-toc-section\" id=\"Book_a_Free_Demo_Call_with_Our_Expert\"><\/span>Book a Free<br><em>Demo Call<\/em><br>with Our Expert<span class=\"ez-toc-section-end\"><\/span><\/h2>\n        <p class=\"tc-sub\">Discover how Threatcop protects your workforce from modern cyber threats.<\/p>\n      <\/div>\n    <\/div>\n    <div class=\"tc-right\">\n      <div class=\"tc-form-title\">Your Details<\/div>\n      <form action=\"https:\/\/threatcop.com\/thankyou-blog\" method=\"get\" target=\"_blank\">\n        <input type=\"hidden\" name=\"BlogForm\" value=\"BlogForm\">\n        <input type=\"hidden\" name=\"PageSource\" id=\"tc-page-source\" value=\"\">\n        <div class=\"tc-grid\">\n          <div class=\"tc-field\">\n            <label>Full Name<\/label>\n            <div class=\"tc-input-wrap\">\n              <input type=\"text\" name=\"FullName\" placeholder=\"Jane Smith\" required=\"\">\n              <svg class=\"tc-fi\" viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><circle cx=\"12\" cy=\"8\" r=\"4\"><\/circle><path d=\"M4 20c0-4 3.58-7 8-7s8 3 8 7\"><\/path><\/svg>\n            <\/div>\n          <\/div>\n          <div class=\"tc-field\">\n            <label>Company Name<\/label>\n            <div class=\"tc-input-wrap\">\n              <input type=\"text\" name=\"CompanyName\" placeholder=\"Acme Corp\" required=\"\">\n              <svg class=\"tc-fi\" viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><rect x=\"3\" y=\"3\" width=\"18\" height=\"18\" rx=\"2\"><\/rect><path d=\"M9 3v18M3 9h6M3 15h6\"><\/path><\/svg>\n            <\/div>\n          <\/div>\n          <div class=\"tc-field full\">\n            <label>Corporate Email<\/label>\n            <div class=\"tc-input-wrap\">\n              <input type=\"email\" name=\"email\" placeholder=\"jane@yourcompany.com\" required=\"\">\n              <svg class=\"tc-fi\" viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><rect x=\"2\" y=\"4\" width=\"20\" height=\"16\" rx=\"2\"><\/rect><polyline points=\"2,4 12,13 22,4\"><\/polyline><\/svg>\n            <\/div>\n          <\/div>\n          <div class=\"tc-field full\">\n            <label>Phone Number<\/label>\n            <div class=\"tc-input-wrap\">\n              <input type=\"number\" name=\"Phone\" placeholder=\"98765 43210\" required=\"\">\n              <svg class=\"tc-fi\" viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><path d=\"M22 16.92v3a2 2 0 01-2.18 2A19.79 19.79 0 013.09 4.18 2 2 0 015.07 2h3a2 2 0 012 1.72c.13.96.36 1.9.71 2.81a2 2 0 01-.45 2.11L9.09 9.91a16 16 0 006 6l1.27-1.27a2 2 0 012.11-.45c.91.35 1.85.58 2.81.71A2 2 0 0122 16.92z\"><\/path><\/svg>\n            <\/div>\n          <\/div>\n        <\/div>\n        <button type=\"submit\" class=\"tc-btn-submit\">\n          <svg viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><path d=\"M22 2L11 13M22 2L15 22l-4-9-9-4 20-7z\"><\/path><\/svg>\n          Book My Free Demo\n        <\/button>\n        <div class=\"tc-trust\">\n          <svg viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><rect x=\"3\" y=\"11\" width=\"18\" height=\"11\" rx=\"2\"><\/rect><path d=\"M7 11V7a5 5 0 0110 0v4\"><\/path><\/svg>\n          Your data is safe &amp; never shared with third parties\n        <\/div>\n      <\/form>\n    <\/div>\n  <\/div>\n<\/div>\n<script>document.getElementById('tc-page-source').value = window.location.href;<\/script>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_Excessive_Agency_Is_Now_the_Third-Biggest_LLM_Risk\"><\/span>Why Excessive Agency Is Now the Third-Biggest LLM Risk<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Excessive agency sat at sixth place in the 2025 LLM Top 10. In the 2026 edition it moved to third. Supply chain and poisoning risks dropped below it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The reason is adoption rather than any new attack. Agents now reach real tools, real APIs, and real work systems. More reach means more impact when the system is manipulated, drifts outside its scope, or simply decides wrongly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OWASP splits excessive agency into three root causes, and the split is worth memorising because it tells you where to look:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Excess functions.<\/strong> The agent can reach tools beyond its task. A support agent with database write access it never needs.<\/li>\n\n\n\n<li><strong>Excessive permissions.<\/strong> The tools it uses run with broader privileges than the task requires. Read-only work performed by an admin credential.<\/li>\n\n\n\n<li><strong>Excessive autonomy.<\/strong> High-impact actions proceed with no human in the loop. Refunds, deletions, and payments executing unreviewed.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Notice that none of these is a model problem. Each one is a decision somebody made during rollout.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Prompt_Injection_Is_the_Delivery_Mechanism_Not_the_Damage\"><\/span>Prompt Injection Is the Delivery Mechanism, Not the Damage<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Prompt injection has held the top OWASP spot for three straight editions. It persists because models read instructions and data through the same channel. The model cannot tell a document&#8217;s contents from a command, so hostile text inside a web page, a PDF, or an email can redirect it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OWASP&#8217;s own work on agentic security found prompt injection maps to six of the ten agentic risk categories. In short, it is the most common delivery mechanism.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the part that changes how you spend money. The resulting damage is almost always mediated by whatever permissions the injected agent happens to hold. Injection gets the attacker in. Permissions decide what they get.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Accordingly, chasing perfect injection defence is a losing investment. Detection classifiers help and they will never be complete. Scoping the agent&#8217;s authority is bounded, testable work you can finish. Governance questions of this kind are explored in <a href=\"https:\/\/threatcop.com\/blog\/anand-thangaraju-on-ai-automation-and-the-governance-layer\/\">AI automation and the governance layer<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_Controls_to_Build_In_Before_Launch\"><\/span>The Controls to Build In Before Launch<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">OWASP&#8217;s advised fixes are specific, which is unusual for AI guidance. Build them in during rollout, because retrofitting permissions onto a live agent means breaking workflows people already depend on. Work through them in this order, because each one shrinks what the next has to cover.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, none of these controls tries to make the model safer. Each one limits what happens when the model is already wrong. That is the whole design principle, and it is why agent security looks like privilege management far more than content filtering. Data-protection framing for the same problem appears in <a href=\"https:\/\/threatcop.com\/blog\/the-role-of-psm-in-data-privacy\/\">the role of PSM in data privacy<\/a>.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th><strong>Control<\/strong><\/th><th><strong>What it means<\/strong><\/th><\/tr><\/thead><tbody><tr><td>Scope tools to the task<\/td><td>The agent gets exactly the functions its job needs, and nothing adjacent<\/td><\/tr><tr><td>Run in the user&#8217;s security context<\/td><td>Never a generic high-privileged service identity shared across agents<\/td><\/tr><tr><td>Authorize outside the model<\/td><td>External systems make access decisions; the LLM is never the gatekeeper<\/td><\/tr><tr><td>Require approval for high-impact actions<\/td><td>Payments, deletions, external sends, and permission changes stop for a human<\/td><\/tr><tr><td>Give each agent its own identity<\/td><td>Distinct credentials, so logs attribute actions and revocation is surgical<\/td><\/tr><tr><td>Separate prompts from data<\/td><td>System prompts and settings never sit in a store the agent can write to<\/td><\/tr><tr><td>Log every tool call<\/td><td>Inputs, outputs, and the identity used, retained for review<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The sixth row deserves weight. When system prompts live alongside the data an agent queries, a single injection or injection-adjacent flaw lets an attacker rewrite the guardrails themselves. Guardrails stored where the agent can reach them are not guardrails.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Approval_Fatigue_Will_Break_Your_Human-in-the-Loop_Control\"><\/span>Approval Fatigue Will Break Your Human-in-the-Loop Control<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Human approval is the control most agent designs lean on hardest. It is also the one most likely to fail quietly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The failure mode is familiar. MFA push fatigue works because people approve prompts they no longer read. Agent approvals fail the same way. An analyst clearing forty agent actions an hour is not reviewing them. They are clicking.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So the design question is not whether to require approval. It is how few approvals you can ask for.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three rules help. Set thresholds so routine actions run alone and only consequential ones stop. Show the approver what changes, not that something changed. And measure approval latency, because approvals granted in under two seconds were not read. Human-layer failures of this shape are covered in <a href=\"https:\/\/threatcop.com\/blog\/how-to-reduce-human-error-in-cybersecurity\/\">how to reduce human error in cybersecurity<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Whoever_Wires_the_Agent_Up_Is_Making_a_Security_Decision\"><\/span>Whoever Wires the Agent Up Is Making a Security Decision<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An agent&#8217;s permissions come from somewhere. Usually a person granted them, often in a hurry, frequently by accepting a default scope during setup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That makes agent security a workforce habit before it is an architecture problem. The employee who connects an agent to a mailbox, approves an OAuth scope, or pastes an API key into a config file is making a security decision. Few of them know it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three habits matter most. People should read the scope before granting it, rather than accepting the defaults an integration proposes. They should treat a standing connection as permanent until revoked, because it is. And they should report an agent behaving oddly, instead of assuming it is a bug someone else has noticed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Threatcop&#8217;s TLMS delivers this as role-specific content, so the developers wiring agents and the operations staff approving their actions get different material rather than one shared AI module. Building that layer is the subject of <a href=\"https:\/\/threatcop.com\/blog\/human-risk-is-the-biggest-attack-surface\/\">human risk as the biggest attack surface<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_Pre-Launch_Checklist\"><\/span>The Pre-Launch Checklist<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Run this before an AI agent touches production, as the last gate of any secure rollout. Each item maps to an OWASP control above. Above all, treat it as a gate rather than a form.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Write down what the agent may do<\/strong>, in business terms, and check the granted tools match that list exactly.<\/li>\n\n\n\n<li><strong>Inventory every credential it holds<\/strong>, including inherited ones, and cut each to the minimum.<\/li>\n\n\n\n<li><strong>Confirm authorization happens outside the model<\/strong>, with no path where the LLM decides its own access.<\/li>\n\n\n\n<li><strong>Name the high-impact actions<\/strong> that require approval, and set the threshold on purpose.<\/li>\n\n\n\n<li><strong>Verify prompt and settings storage<\/strong> sits outside anything the agent can write to.<\/li>\n\n\n\n<li><strong>Test with hostile input<\/strong>, including content hidden in documents, pages, and email the agent will read.<\/li>\n\n\n\n<li><strong>Check the logs attribute actions to this agent<\/strong>, not to a shared service account.<\/li>\n\n\n\n<li><strong>Decide who revokes it<\/strong>, and confirm that person can do so within the hour.<\/li>\n\n\n\n<li><strong>Brief the humans in the loop<\/strong> on what they are approving and what a bad approval costs.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Step 6 is the one teams skip. Test with the input an attacker would actually send, not with the prompts your developers thought of.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_to_Measure_After_Launch\"><\/span>What to Measure After Launch<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Alert counts tell you about the monitoring. These six tell you about the AI agent itself. Similarly, they measure decisions people made rather than traffic the system saw.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Tools granted versus tools actually called in 30 days, which exposes unused functions<\/li>\n\n\n\n<li>Standing credentials held by agents, reviewed quarterly<\/li>\n\n\n\n<li>Approval latency distribution, where a cluster under two seconds signals rubber-stamping<\/li>\n\n\n\n<li>Actions taken under a shared identity rather than a distinct agent identity<\/li>\n\n\n\n<li>Time from an agent misbehaving to a human reporting it<\/li>\n\n\n\n<li>Percentage of agent tool calls with complete logs<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Start with the first one. Agents often hold tools nobody has called since launch. Removing them costs nothing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Where_to_Start_If_Agents_Are_Already_Running\"><\/span>Where to Start If Agents Are Already Running<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pick one agent running in your systems today. List the tools it can call. Then list the ones it has actually called this month.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That gap is your excess functions. You can close it this week without a new product, a new vendor, or a new budget line. Do that before you buy anything designed to stop prompt injection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then look at who granted those permissions and whether they understood the scope. <a href=\"https:\/\/threatcop.com\/threatcop-learning-management-system\">Train the people wiring agents together<\/a> on what a standing connection actually means, because the build is only as tight as the last default somebody accepted.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span>Frequently Asked Questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\t\t<div class=\"sp-easy-accordion-block sp-eab-regular-accordion alignwide\"\n\t\t\t\t>\n\t\t\t<div class=\"sp-eab-wrapper sp-eab-vertical-accordion sp-eab-bc177cdc3d17\">\n\t\t\t\t\t\t\t\t<div class='sp-eab-accordion sp-eab-mode-vertical sp-eab-vertical-one sp-d-flex' data-accordion-settings=\"{&quot;mode&quot;:&quot;vertical&quot;,&quot;activeEvent&quot;:&quot;click&quot;,&quot;defaultAccordionOpen&quot;:&quot;first-item&quot;,&quot;selectedItemOpen&quot;:0,&quot;openMultiItemAtaTime&quot;:false,&quot;scrollToTopOnLoad&quot;:false,&quot;scrollToTopOnClick&quot;:false,&quot;accordionItemToUrl&quot;:false,&quot;animationEffect&quot;:false,&quot;applyAccessibility&quot;:true}\">\n        \t    \t\n\t\t\t<div\n\t\t\t\tid =\"sp-eab-item-689a68f0e16a\"\n\t\t\t\tclass=\"sp-eab-accordion-item eab-item-dc3d17\"\n\t\t\t\t\t\t\t>\n\t\t\t\t<div class=\"sp-eab-accordion-item-wrapper\">\n\t\t\t\t\t\t\t\t<h3 class='sp-eab-accordion-heading sp-d-flex sp-align-center eab-heading-dc3d17'\n\t\t\t\t\t\t>\n\t\t\t\t<span class='sp-eab-accordion-header-wrapper sp-d-flex sp-align-center eab-icon-position-end'>\n\t\t\t\t\t<span class='sp-eab-accordion-header-start sp-d-flex sp-justify-left sp-align-center'>\n\t\t\t\t\t\t<span class='sp-eab-title-subtitle-wrapper sp-d-flex'>\n\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-wrapper sp-d-flex sp-align-center'>\n\t\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-text'>\n\t\t\t\t\t\t\t\t\tWhat are the best practices for implementing AI agents?\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<span class='sp-eab-accordion-header-end eab-icon-animated'>\n\t\t\t\t\t\t\t\t\t\t\t\t<span class='sp-eab-expand-collapse-icon sp-d-block'>\n\t\t\t\t\t\t\t<i class='sp-eab-expand-icon eab-icon-angle-down-solid'><\/i>\n\t\t\t\t\t\t\t<i class='sp-eab-collapse-icon eab-icon-angle-up-solid'><\/i>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\t\t\t\t\t<!-- accordion body -->\n\t\t\t\t\t<div class='sp-eab-accordion-content eab-content-dc3d17'>\n\t\t\t\t\t\t\t\t\t\t\t\t<div class='sp-eab-accordion-content-wrapper'>\n\t\t\t\t\t\t\t<div class='sp-eab-accordion-body'>\n\t\t\t    \t\t\t\t\n\n<p class=\"wp-block-paragraph\">Scope each agent&#8217;s tools to its task and nothing adjacent. Run it under its own identity rather than a shared high-privilege account. Keep authorization in external systems, never delegated to the model. Require human approval for high-impact actions such as payments and deletions. Store prompts and settings outside anything the agent can write to. Finally, log every tool call with the identity used.<\/p>\n\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\n\n\t\t\t<div\n\t\t\t\tid =\"sp-eab-item-c7be3abe2e5f\"\n\t\t\t\tclass=\"sp-eab-accordion-item eab-item-dc3d17\"\n\t\t\t\t\t\t\t>\n\t\t\t\t<div class=\"sp-eab-accordion-item-wrapper\">\n\t\t\t\t\t\t\t\t<h3 class='sp-eab-accordion-heading sp-d-flex sp-align-center eab-heading-dc3d17'\n\t\t\t\t\t\t>\n\t\t\t\t<span class='sp-eab-accordion-header-wrapper sp-d-flex sp-align-center eab-icon-position-end'>\n\t\t\t\t\t<span class='sp-eab-accordion-header-start sp-d-flex sp-justify-left sp-align-center'>\n\t\t\t\t\t\t<span class='sp-eab-title-subtitle-wrapper sp-d-flex'>\n\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-wrapper sp-d-flex sp-align-center'>\n\t\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-text'>\n\t\t\t\t\t\t\t\t\tHow do you implement AI agents securely without slowing delivery?\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<span class='sp-eab-accordion-header-end eab-icon-animated'>\n\t\t\t\t\t\t\t\t\t\t\t\t<span class='sp-eab-expand-collapse-icon sp-d-block'>\n\t\t\t\t\t\t\t<i class='sp-eab-expand-icon eab-icon-angle-down-solid'><\/i>\n\t\t\t\t\t\t\t<i class='sp-eab-collapse-icon eab-icon-angle-up-solid'><\/i>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\t\t\t\t\t<!-- accordion body -->\n\t\t\t\t\t<div class='sp-eab-accordion-content eab-content-dc3d17'>\n\t\t\t\t\t\t\t\t\t\t\t\t<div class='sp-eab-accordion-content-wrapper'>\n\t\t\t\t\t\t\t<div class='sp-eab-accordion-body'>\n\t\t\t    \t\t\t\t\n\n<p class=\"wp-block-paragraph\">Set the permissions during the build rather than after it. Retrofitting scope onto a live agent means breaking workflows teams already rely on, which is what makes security feel like a blocker. Start each agent with the narrowest tool set that completes its job, then widen deliberately when a gap appears. Consequently the default is safe and every expansion is a decision somebody records.<\/p>\n\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\n\n\t\t\t<div\n\t\t\t\tid =\"sp-eab-item-01dc95a600cb\"\n\t\t\t\tclass=\"sp-eab-accordion-item eab-item-dc3d17\"\n\t\t\t\t\t\t\t>\n\t\t\t\t<div class=\"sp-eab-accordion-item-wrapper\">\n\t\t\t\t\t\t\t\t<h3 class='sp-eab-accordion-heading sp-d-flex sp-align-center eab-heading-dc3d17'\n\t\t\t\t\t\t>\n\t\t\t\t<span class='sp-eab-accordion-header-wrapper sp-d-flex sp-align-center eab-icon-position-end'>\n\t\t\t\t\t<span class='sp-eab-accordion-header-start sp-d-flex sp-justify-left sp-align-center'>\n\t\t\t\t\t\t<span class='sp-eab-title-subtitle-wrapper sp-d-flex'>\n\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-wrapper sp-d-flex sp-align-center'>\n\t\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-text'>\n\t\t\t\t\t\t\t\t\tWhat is excessive agency in the OWASP Top 10?\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<span class='sp-eab-accordion-header-end eab-icon-animated'>\n\t\t\t\t\t\t\t\t\t\t\t\t<span class='sp-eab-expand-collapse-icon sp-d-block'>\n\t\t\t\t\t\t\t<i class='sp-eab-expand-icon eab-icon-angle-down-solid'><\/i>\n\t\t\t\t\t\t\t<i class='sp-eab-collapse-icon eab-icon-angle-up-solid'><\/i>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\t\t\t\t\t<!-- accordion body -->\n\t\t\t\t\t<div class='sp-eab-accordion-content eab-content-dc3d17'>\n\t\t\t\t\t\t\t\t\t\t\t\t<div class='sp-eab-accordion-content-wrapper'>\n\t\t\t\t\t\t\t<div class='sp-eab-accordion-body'>\n\t\t\t    \t\t\t\t\n\n<p class=\"wp-block-paragraph\">Excessive agency is LLM03 in the OWASP Top 10 for LLM Applications 2026, up from sixth place in 2025. OWASP names three root causes: excess functions, where an agent reaches tools beyond its task; excessive permissions, where those tools run with more privilege than needed; and excessive autonomy, where high-impact actions proceed without human approval.<\/p>\n\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\n\n\t\t\t<div\n\t\t\t\tid =\"sp-eab-item-d17f996519f5\"\n\t\t\t\tclass=\"sp-eab-accordion-item eab-item-dc3d17\"\n\t\t\t\t\t\t\t>\n\t\t\t\t<div class=\"sp-eab-accordion-item-wrapper\">\n\t\t\t\t\t\t\t\t<h3 class='sp-eab-accordion-heading sp-d-flex sp-align-center eab-heading-dc3d17'\n\t\t\t\t\t\t>\n\t\t\t\t<span class='sp-eab-accordion-header-wrapper sp-d-flex sp-align-center eab-icon-position-end'>\n\t\t\t\t\t<span class='sp-eab-accordion-header-start sp-d-flex sp-justify-left sp-align-center'>\n\t\t\t\t\t\t<span class='sp-eab-title-subtitle-wrapper sp-d-flex'>\n\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-wrapper sp-d-flex sp-align-center'>\n\t\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-text'>\n\t\t\t\t\t\t\t\t\tCan prompt injection be prevented?\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<span class='sp-eab-accordion-header-end eab-icon-animated'>\n\t\t\t\t\t\t\t\t\t\t\t\t<span class='sp-eab-expand-collapse-icon sp-d-block'>\n\t\t\t\t\t\t\t<i class='sp-eab-expand-icon eab-icon-angle-down-solid'><\/i>\n\t\t\t\t\t\t\t<i class='sp-eab-collapse-icon eab-icon-angle-up-solid'><\/i>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\t\t\t\t\t<!-- accordion body -->\n\t\t\t\t\t<div class='sp-eab-accordion-content eab-content-dc3d17'>\n\t\t\t\t\t\t\t\t\t\t\t\t<div class='sp-eab-accordion-content-wrapper'>\n\t\t\t\t\t\t\t<div class='sp-eab-accordion-body'>\n\t\t\t    \t\t\t\t\n\n<p class=\"wp-block-paragraph\">Not reliably. Models process instructions and data through the same channel, so they cannot tell apart a command from content. Detection classifiers and input filtering reduce the rate without closing the gap. Because damage depends on the permissions the agent holds, limiting authority and requiring approval for high-impact actions gives a better return than pursuing complete injection defence.<\/p>\n\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\n\n\t\t\t<div\n\t\t\t\tid =\"sp-eab-item-e764f9bb4158\"\n\t\t\t\tclass=\"sp-eab-accordion-item eab-item-dc3d17\"\n\t\t\t\t\t\t\t>\n\t\t\t\t<div class=\"sp-eab-accordion-item-wrapper\">\n\t\t\t\t\t\t\t\t<h3 class='sp-eab-accordion-heading sp-d-flex sp-align-center eab-heading-dc3d17'\n\t\t\t\t\t\t>\n\t\t\t\t<span class='sp-eab-accordion-header-wrapper sp-d-flex sp-align-center eab-icon-position-end'>\n\t\t\t\t\t<span class='sp-eab-accordion-header-start sp-d-flex sp-justify-left sp-align-center'>\n\t\t\t\t\t\t<span class='sp-eab-title-subtitle-wrapper sp-d-flex'>\n\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-wrapper sp-d-flex sp-align-center'>\n\t\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-text'>\n\t\t\t\t\t\t\t\t\tShould AI agents have their own identities?\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<span class='sp-eab-accordion-header-end eab-icon-animated'>\n\t\t\t\t\t\t\t\t\t\t\t\t<span class='sp-eab-expand-collapse-icon sp-d-block'>\n\t\t\t\t\t\t\t<i class='sp-eab-expand-icon eab-icon-angle-down-solid'><\/i>\n\t\t\t\t\t\t\t<i class='sp-eab-collapse-icon eab-icon-angle-up-solid'><\/i>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\t\t\t\t\t<!-- accordion body -->\n\t\t\t\t\t<div class='sp-eab-accordion-content eab-content-dc3d17'>\n\t\t\t\t\t\t\t\t\t\t\t\t<div class='sp-eab-accordion-content-wrapper'>\n\t\t\t\t\t\t\t<div class='sp-eab-accordion-body'>\n\t\t\t    \t\t\t\t\n\n<p class=\"wp-block-paragraph\">Yes. OWASP recommends running agent extensions in the user&#8217;s security context rather than under generic high-privileged identities. Distinct identities make logs attributable, let you revoke one agent without disrupting others, and stop a single compromised credential from granting access across every automated workflow.<\/p>\n\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\n\n\t\t\t<div\n\t\t\t\tid =\"sp-eab-item-fdd56dc6f4bb\"\n\t\t\t\tclass=\"sp-eab-accordion-item eab-item-dc3d17\"\n\t\t\t\t\t\t\t>\n\t\t\t\t<div class=\"sp-eab-accordion-item-wrapper\">\n\t\t\t\t\t\t\t\t<h3 class='sp-eab-accordion-heading sp-d-flex sp-align-center eab-heading-dc3d17'\n\t\t\t\t\t\t>\n\t\t\t\t<span class='sp-eab-accordion-header-wrapper sp-d-flex sp-align-center eab-icon-position-end'>\n\t\t\t\t\t<span class='sp-eab-accordion-header-start sp-d-flex sp-justify-left sp-align-center'>\n\t\t\t\t\t\t<span class='sp-eab-title-subtitle-wrapper sp-d-flex'>\n\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-wrapper sp-d-flex sp-align-center'>\n\t\t\t\t\t\t\t\t<span class='sp-eab-accordion-title-text'>\n\t\t\t\t\t\t\t\t\tWhat is the OWASP Top 10 for Agentic Applications?\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<span class='sp-eab-accordion-header-end eab-icon-animated'>\n\t\t\t\t\t\t\t\t\t\t\t\t<span class='sp-eab-expand-collapse-icon sp-d-block'>\n\t\t\t\t\t\t\t<i class='sp-eab-expand-icon eab-icon-angle-down-solid'><\/i>\n\t\t\t\t\t\t\t<i class='sp-eab-collapse-icon eab-icon-angle-up-solid'><\/i>\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t<\/span>\n\t\t\t<\/h3>\n\t\t\t\t\t\t\t<!-- accordion body -->\n\t\t\t\t\t<div class='sp-eab-accordion-content eab-content-dc3d17'>\n\t\t\t\t\t\t\t\t\t\t\t\t<div class='sp-eab-accordion-content-wrapper'>\n\t\t\t\t\t\t\t<div class='sp-eab-accordion-body'>\n\t\t\t    \t\t\t\t\n\n<p class=\"wp-block-paragraph\">The OWASP Top 10 for Agentic Applications is a ranked list of the ten most critical risks in AI systems that plan, use tools, retain memory, and act autonomously. The OWASP Agentic Security Initiative published it on 9 December 2025. Entries run ASI01 to ASI10 and cover goal hijacking, tool misuse, and memory poisoning. It extends the LLM Top 10 rather than replacing it.<\/p>\n\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Implement AI agents securely by scoping tools, isolating identity, and keeping authorization outside the model. Permissions decide the damage, not detection.<\/p>\n","protected":false},"author":28,"featured_media":15387,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[424],"tags":[],"class_list":["post-15372","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-cybersecurity"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Implement AI Agents Securely: Pre-Launch Guide<\/title>\n<meta name=\"description\" content=\"Implementing AI agents securely comes down to permissions, not injection defence. See the OWASP controls, the pre-launch checklist, and what to measure.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Implement AI Agents Securely: Pre-Launch Guide\" \/>\n<meta property=\"og:description\" content=\"Implementing AI agents securely comes down to permissions, not injection defence. See the OWASP controls, the pre-launch checklist, and what to measure.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/\" \/>\n<meta property=\"og:site_name\" content=\"Threatcop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/people\/Threatcop\/100083109892339\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-17T12:21:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-17T12:21:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/09\/Implementing-AI-Agents-Securely-blog-banner.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Sushant Sharma\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatcop\" \/>\n<meta name=\"twitter:site\" content=\"@threatcop\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sushant Sharma\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/\"},\"author\":{\"name\":\"Sushant Sharma\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/person\\\/1dcc018f2b81f296caf1a9e6cdd7c355\"},\"headline\":\"How to Implement AI Agents Securely: Permissions Over Detection\",\"datePublished\":\"2026-09-17T12:21:23+00:00\",\"dateModified\":\"2026-09-17T12:21:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/\"},\"wordCount\":2028,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Implementing-AI-Agents-Securely-blog-banner.png\",\"articleSection\":[\"AI &amp; Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/\",\"name\":\"How to Implement AI Agents Securely: Pre-Launch Guide\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Implementing-AI-Agents-Securely-blog-banner.png\",\"datePublished\":\"2026-09-17T12:21:23+00:00\",\"dateModified\":\"2026-09-17T12:21:25+00:00\",\"description\":\"Implementing AI agents securely comes down to permissions, not injection defence. See the OWASP controls, the pre-launch checklist, and what to measure.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/#primaryimage\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Implementing-AI-Agents-Securely-blog-banner.png\",\"contentUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Implementing-AI-Agents-Securely-blog-banner.png\",\"width\":1280,\"height\":720,\"caption\":\"Threatcop blog banner reading Implementing AI Agents Securely, Permissions Over Detection, over an abstract network graph on a dark navy background\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/implement-ai-agents-securely\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Implement AI Agents Securely: Permissions Over Detection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/\",\"name\":\"Threatcop\",\"description\":\"Cybersecurity Blogs, News, Updates, and Articles\",\"publisher\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#organization\",\"name\":\"Threatcop\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/threatcop-logo-black-1.png\",\"contentUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/threatcop-logo-black-1.png\",\"width\":432,\"height\":102,\"caption\":\"Threatcop\"},\"image\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/people\\\/Threatcop\\\/100083109892339\\\/\",\"https:\\\/\\\/x.com\\\/threatcop\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/threatcop\\\/\",\"https:\\\/\\\/www.instagram.com\\\/threatcop_official\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/person\\\/1dcc018f2b81f296caf1a9e6cdd7c355\",\"name\":\"Sushant Sharma\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/avatar_user_28_1789477775-96x96.png\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/avatar_user_28_1789477775-96x96.png\",\"contentUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/avatar_user_28_1789477775-96x96.png\",\"caption\":\"Sushant Sharma\"},\"description\":\"Sushant Kumar is the AVP \u2013 Technology at Threatcop, bringing over a decade of experience in technology leadership and product development. He has worked across technology-driven organizations, including Paytm, and focuses on building scalable solutions that address evolving business and cybersecurity challenges. His areas of interest include cybersecurity technology, AI-driven security, product innovation, and enterprise technology. He is passionate about using technology to solve complex security challenges.\",\"sameAs\":[\"https:\\\/\\\/threatcop.com\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Implement AI Agents Securely: Pre-Launch Guide","description":"Implementing AI agents securely comes down to permissions, not injection defence. See the OWASP controls, the pre-launch checklist, and what to measure.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/","og_locale":"en_US","og_type":"article","og_title":"How to Implement AI Agents Securely: Pre-Launch Guide","og_description":"Implementing AI agents securely comes down to permissions, not injection defence. See the OWASP controls, the pre-launch checklist, and what to measure.","og_url":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/","og_site_name":"Threatcop","article_publisher":"https:\/\/www.facebook.com\/people\/Threatcop\/100083109892339\/","article_published_time":"2026-09-17T12:21:23+00:00","article_modified_time":"2026-09-17T12:21:25+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/09\/Implementing-AI-Agents-Securely-blog-banner.png","type":"image\/png"}],"author":"Sushant Sharma","twitter_card":"summary_large_image","twitter_creator":"@threatcop","twitter_site":"@threatcop","twitter_misc":{"Written by":"Sushant Sharma","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#article","isPartOf":{"@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/"},"author":{"name":"Sushant Sharma","@id":"https:\/\/threatcop.com\/blog\/#\/schema\/person\/1dcc018f2b81f296caf1a9e6cdd7c355"},"headline":"How to Implement AI Agents Securely: Permissions Over Detection","datePublished":"2026-09-17T12:21:23+00:00","dateModified":"2026-09-17T12:21:25+00:00","mainEntityOfPage":{"@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/"},"wordCount":2028,"commentCount":0,"publisher":{"@id":"https:\/\/threatcop.com\/blog\/#organization"},"image":{"@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#primaryimage"},"thumbnailUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/09\/Implementing-AI-Agents-Securely-blog-banner.png","articleSection":["AI &amp; Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/","url":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/","name":"How to Implement AI Agents Securely: Pre-Launch Guide","isPartOf":{"@id":"https:\/\/threatcop.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#primaryimage"},"image":{"@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#primaryimage"},"thumbnailUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/09\/Implementing-AI-Agents-Securely-blog-banner.png","datePublished":"2026-09-17T12:21:23+00:00","dateModified":"2026-09-17T12:21:25+00:00","description":"Implementing AI agents securely comes down to permissions, not injection defence. See the OWASP controls, the pre-launch checklist, and what to measure.","breadcrumb":{"@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#primaryimage","url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/09\/Implementing-AI-Agents-Securely-blog-banner.png","contentUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/09\/Implementing-AI-Agents-Securely-blog-banner.png","width":1280,"height":720,"caption":"Threatcop blog banner reading Implementing AI Agents Securely, Permissions Over Detection, over an abstract network graph on a dark navy background"},{"@type":"BreadcrumbList","@id":"https:\/\/threatcop.com\/blog\/implement-ai-agents-securely\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/threatcop.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Implement AI Agents Securely: Permissions Over Detection"}]},{"@type":"WebSite","@id":"https:\/\/threatcop.com\/blog\/#website","url":"https:\/\/threatcop.com\/blog\/","name":"Threatcop","description":"Cybersecurity Blogs, News, Updates, and Articles","publisher":{"@id":"https:\/\/threatcop.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/threatcop.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/threatcop.com\/blog\/#organization","name":"Threatcop","url":"https:\/\/threatcop.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/threatcop.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/08\/threatcop-logo-black-1.png","contentUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/08\/threatcop-logo-black-1.png","width":432,"height":102,"caption":"Threatcop"},"image":{"@id":"https:\/\/threatcop.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/people\/Threatcop\/100083109892339\/","https:\/\/x.com\/threatcop","https:\/\/www.linkedin.com\/company\/threatcop\/","https:\/\/www.instagram.com\/threatcop_official\/"]},{"@type":"Person","@id":"https:\/\/threatcop.com\/blog\/#\/schema\/person\/1dcc018f2b81f296caf1a9e6cdd7c355","name":"Sushant Sharma","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/09\/avatar_user_28_1789477775-96x96.png","url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/09\/avatar_user_28_1789477775-96x96.png","contentUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/09\/avatar_user_28_1789477775-96x96.png","caption":"Sushant Sharma"},"description":"Sushant Kumar is the AVP \u2013 Technology at Threatcop, bringing over a decade of experience in technology leadership and product development. He has worked across technology-driven organizations, including Paytm, and focuses on building scalable solutions that address evolving business and cybersecurity challenges. His areas of interest include cybersecurity technology, AI-driven security, product innovation, and enterprise technology. He is passionate about using technology to solve complex security challenges.","sameAs":["https:\/\/threatcop.com\/"]}]}},"_links":{"self":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts\/15372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/comments?post=15372"}],"version-history":[{"count":3,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts\/15372\/revisions"}],"predecessor-version":[{"id":15397,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts\/15372\/revisions\/15397"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/media\/15387"}],"wp:attachment":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/media?parent=15372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/categories?post=15372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/tags?post=15372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}