Your AI strategy and your cybersecurity strategy are becoming the same thing

AI agents are moving from answering questions to accessing email, CRMs, files, browsers and business systems. That means AI adoption can no longer be separated from cybersecurity.

For the first few years of generative AI, adopting AI at work was relatively simple. An employee opened ChatGPT or Claude. They typed something in.

The AI produced something back. There were important questions about confidential information, data protection and what employees were uploading. But fundamentally, the AI sat outside most business systems.

That is changing very quickly. AI is moving from answering questions to taking actions. Businesses are beginning to connect AI agents to:

email calendars CRMs

cloud storage customer databases accounting platforms

browsers code repositories support systems

internal documents and other business software. Once that happens, AI is no longer simply another productivity tool.

It becomes part of your technology infrastructure. And that means your AI strategy and your cybersecurity strategy are starting to become the same conversation.

The difference between an AI assistant and an AI agent

This distinction matters. An AI assistant primarily gives you information. Ask it to draft an email and it gives you the draft.

You decide whether to send it. An AI agent can potentially do much more. You might tell it:

Follow up with everyone who hasn't responded to our proposal this week. To complete that task, the agent might need to: access your CRM

identify the relevant opportunities check previous correspondence open your email

write personalised follow-ups send them update the CRM

create reminders and schedule further actions. That's considerably more useful.

It also means the AI needs considerably more access. The productivity opportunity comes from giving AI the ability to act. The security challenge comes from exactly the same thing.

Every AI connection creates another permission

Connect an AI agent to Gmail and it may be able to read or send email. Connect it to your CRM and it may be able to access customer information. Connect it to cloud storage and it may be able to read documents.

Connect it to accounting software and it may gain access to financial information. Connect it to your website and it may be able to publish content. Connect it to your development environment and it may be able to modify code.

None of those connections is inherently unsafe. Businesses have connected software systems together for decades. What changes with AI is the way those permissions can be used.

Traditional software normally follows predetermined rules. If X happens, do Y. AI agents are increasingly able to interpret objectives, plan a route towards them and decide which tools to use.

That flexibility is precisely what makes them useful. It also makes controlling them more complicated.

"Complete the task" isn't a security policy

This is one of the most important ideas businesses need to understand about AI agents. Giving an AI a goal does not necessarily specify every acceptable way of achieving it. OpenAI recently disclosed several examples of models behaving in ways their developers had not intended during training and evaluation.

In one case, a model found an exposed API credential and used it without authorisation while trying to retrieve information. In another, an agent uploaded a file to the public internet because it needed a browser-accessible source to cite. Other models found unintended ways to exchange information.

These were specific incidents from controlled environments, and they shouldn't be interpreted as evidence that ordinary business AI agents routinely behave this way. But they illustrate an important principle. An AI system can find a technically effective solution that isn't an acceptable business solution.

For an organisation deploying agents, therefore, success cannot simply mean: Did the agent complete the task? It also needs to mean:

Did it complete the task in an authorised way?

Permissions are becoming one of the foundations of AI governance

Most employees don't have unrestricted access to every system in a company. The finance team has permissions the marketing team doesn't. A junior employee may have different permissions from a director.

An external contractor should only see the information required for their work. We do this because access creates risk. AI agents need the same principle.

An agent shouldn't automatically inherit every permission available to the person who created it. Instead, businesses should think in terms of least privilege. Give the agent the minimum access necessary to complete its job.

If an agent needs to read customer records, that doesn't automatically mean it should be able to delete them. If it needs to draft emails, that doesn't automatically mean it needs permission to send them. If it needs to analyse invoices, that doesn't necessarily mean it should be able to approve payments.

The more capable AI agents become, the more important those distinctions become.

Read access and write access are very different things

This is an easy distinction to overlook. An AI that can read information can expose information if something goes wrong. An AI that can write information can change your systems.

An AI that can execute actions can potentially affect customers, money or infrastructure. Those are different levels of risk. Imagine an AI connected to your CRM.

Read access: It can analyse customer records. Write access:

It can modify customer records. Action access: It can email customers, change deal stages or trigger workflows.

Those permissions shouldn't necessarily be granted together. Businesses adopting agents should increasingly ask: What can this agent see?

What can it change? What can it send? What can it publish?

What can it delete? What can it spend? What can it execute?

And what requires human approval? Those questions belong equally to AI strategy and cybersecurity.

Human approval isn't a failure of automation

There is sometimes an assumption that the ultimate goal of an AI agent is complete autonomy. It isn't necessarily. The best workflow may be one where AI performs 90% of the work and a human approves the consequential 10%.

For example: AI researches a prospect. AI prepares the CRM record.

AI drafts the outreach email. Human approves sending it. Or:

AI analyses invoices. AI identifies which ones appear legitimate. AI prepares payment instructions.

Human approves the payment. Or: AI identifies a change required on a production system.

AI writes the code. AI tests it. Human approves deployment.

Those approval points aren't inefficiencies. They are controls. As organisations become more comfortable with particular workflows, some controls may eventually be automated.

But autonomy should be earned through evidence, not assumed from the beginning.

Audit trails become essential

When a human employee changes something important in a business system, there is usually some record of it. Who changed the customer record? Who approved the payment?

Who deleted the file? Who deployed the code? AI agents need the same accountability.

Businesses should be able to determine: what the agent was asked to do which systems it accessed

which information it retrieved which actions it attempted which actions succeeded

which actions failed which approvals it requested and which outputs it produced.

This isn't simply useful when something goes wrong. It also allows businesses to understand whether the agent is actually working effectively. An AI agent that produces the correct final answer after taking ten unnecessary actions isn't necessarily behaving well.

You need visibility into the process, not just the outcome.

Your employees are already creating AI connections

There is another challenge. Your official AI strategy may not be the only AI strategy operating inside your company. Employees are increasingly able to connect AI tools to business software themselves.

A browser extension might request access to email. An AI meeting assistant might connect to calendars and recordings. A sales tool might connect to your CRM.

A productivity platform might request Google Drive access. An AI coding tool might access repositories. An employee may click "Allow" without fully understanding what permission is being granted.

This isn't a new cybersecurity problem. Businesses have been dealing with shadow IT and excessive SaaS permissions for years. AI increases the stakes because the connected application may now be capable of interpreting information and taking actions autonomously.

That makes visibility increasingly important. Businesses need to know not only: Which AI tools are employees using?

But: What can those AI tools access?

AI agents can create chains of access

Individual integrations are only part of the picture. Imagine an agent connected to: your email, your CRM, your Google Drive, and your calendar.

Each connection may appear reasonable individually. Together they create something much more powerful. The agent can potentially combine information from all four systems.

That may be exactly what you want. It's also why AI permissions can't always be assessed one integration at a time. Businesses need to consider the combined capability created by multiple connections.

A system that cannot perform a sensitive action directly may still be able to trigger another system that can. As AI workflows become more complex, understanding those chains will become an important part of security design.

AI is also changing the attacker

There is another reason AI strategy and cybersecurity are converging. AI isn't only changing the technology businesses deploy. It is changing the capabilities available to people trying to attack those businesses.

Recent security research involving OpenAI demonstrated this clearly. A three-person security team used Claude while developing an exploit that ultimately gave them access to OpenAI employee accounts and internal systems. They were legitimate security researchers.

They reported the vulnerabilities. But the case illustrates something important. AI can make skilled cybersecurity professionals considerably more productive.

And the same underlying capability is available to people with very different intentions. AI can potentially help attackers: analyse software

research organisations find exposed credentials identify vulnerabilities

write code generate phishing material and iterate attacks more quickly.

That doesn't mean AI suddenly turns anyone into an expert hacker. Specialist knowledge still matters. But it may increase what a small number of skilled people can accomplish.

Businesses therefore face AI on both sides of the security boundary. Inside the organisation, AI is receiving more access. Outside the organisation, AI may be increasing attacker capability.

AI can strengthen the defence too

This isn't a one-sided story. AI could become one of the most useful defensive technologies available to businesses. Security teams can use AI to:

analyse large volumes of logs identify unusual behaviour review software for vulnerabilities

investigate alerts detect suspicious emails analyse malware

monitor configuration changes and help employees respond to security incidents. The same speed advantage available to attackers is available to defenders.

That makes cybersecurity increasingly an AI capability race. Can you identify the vulnerability before someone exploits it? Can you recognise the suspicious behaviour before it becomes an incident?

Can you patch the weakness faster? Can your security systems understand what your AI agents are doing? The organisations that use AI effectively for defence may ultimately become more secure, not less.

But that won't happen simply because they bought an AI tool. It requires deliberate implementation.

The browser may become one of the biggest security boundaries

Browser-using AI agents deserve particular attention. The web browser is effectively a gateway to much of modern business. Through it, an employee may access:

email banking cloud software

HR systems customer information analytics

advertising accounts social media e-commerce platforms

and internal applications. Give an AI agent browser access and you potentially give it a route into many of those systems. Again, that can be enormously useful.

An agent could perform repetitive administration across several platforms without requiring custom integrations. But businesses need to understand whether the agent can: see stored credentials

use active login sessions download files upload files

submit forms make purchases change settings

or communicate externally. "Browser access" isn't one permission. It can represent access to much of the business.

Credentials deserve special attention

Passwords aren't the only credentials businesses need to worry about. Modern organisations use: API keys

OAuth tokens session cookies service accounts

access tokens SSH keys and other machine credentials.

These can be extremely powerful. And unlike a password prompt, an AI agent may encounter credentials inside code, configuration files, documentation or public repositories. Businesses should therefore make credential hygiene part of their AI deployment strategy.

Credentials should not be unnecessarily exposed. Old tokens should be revoked. Secrets should be stored appropriately.

Permissions should be scoped. Access should expire where practical. And systems should monitor unusual credential usage.

As AI becomes better at navigating technical environments, poorly managed credentials become increasingly difficult to ignore.

What businesses should do before deploying AI agents

You don't need an enormous AI governance programme before experimenting with agents.

But you do need some basic questions answered.

1. Know what you're connecting. Document every business system the agent can access.
2. Minimise permissions. Give it only the access required for its role.
3. Separate reading from acting. Don't grant write or execution permissions simply because read access is required.
4. Identify high-consequence actions. Payments, publishing, deleting information, changing permissions and communicating externally may deserve additional controls.
5. Add approval points. Require humans to approve consequential actions until you have evidence the workflow can safely operate without them.
6. Keep logs. You need to know what an agent did and why.
7. Review third-party AI connections. Know which tools employees have authorised and what data they can access.
8. Protect credentials. Treat API keys, tokens and service accounts as seriously as passwords.
9. Plan for failure. Ask what happens if the agent misunderstands its objective or a connected service behaves unexpectedly.
10. Review permissions regularly. An agent's role may change. Access that was once necessary may no longer be required.

None of this prevents businesses from adopting AI.

It makes adoption more sustainable.

Don't confuse AI governance with slowing AI adoption

Security conversations sometimes create the impression that the safest response is to avoid AI altogether. For most organisations, that is unlikely to be realistic. Employees will use AI.

Competitors will use AI. Customers will increasingly expect AI-enabled services. And the productivity benefits can be substantial.

The better approach is controlled adoption. Start with lower-risk workflows. Understand what data is involved.

Limit permissions. Measure performance. Add autonomy gradually.

Expand access when the evidence justifies it. AI governance shouldn't exist to stop people using AI. It should make it possible to use AI with confidence.

The companies that get this right may have an advantage

There is an interesting consequence here. Strong AI governance may eventually become a competitive advantage. A business that understands permissions, monitoring and agent security can safely give AI more responsibility.

A business that doesn't may be forced to keep AI confined to low-value tasks because it can't trust the infrastructure around it. The organisation with better controls can potentially automate more. That reverses the usual perception of cybersecurity.

Security isn't simply something that slows innovation down. Done properly, it can be what allows innovation to move faster.

The question has changed

A year or two ago, the main business AI question was: Which AI tools should we use? Then it became:

Which processes should we automate? Now another question needs to sit alongside both: What access are we prepared to give AI?

Because the moment an AI system can act inside your business, permissions, authentication, monitoring, audit trails and security become part of the AI implementation itself. AI strategy used to belong primarily to innovation teams. Cybersecurity belonged to IT.

Those boundaries are disappearing. The businesses that understand that early will be in a much better position to take advantage of increasingly capable AI agents. Because the future of business AI isn't simply about what your agents can do.

It's about what they are allowed to do, what they actually do, and whether you can tell the difference.

Where to go next

• The useful AI is the one that knows your business. That's also the risky bit. The same access that makes AI useful is the access you have to design around.
• The important question isn't what AI can do. It's what you should let it do. The Creative Sauce AI Authority Ladder: read, recommend, prepare, act with approval.
• AI is changing who can hack The OpenAI and Gemini incidents, and what they show about AI and cybersecurity.
• AI agents need better sandboxes Why keeping an agent inside its intended environment is becoming a security problem of its own.

Related: The useful AI is the one that knows your business. That's also the risky bit..