Most security leaders believe they have visibility across their environment. After all, today’s security stacks are packed with tools, from EDR and SIEM to XDR and DLP. These tools provide an abundance of security data such as failed and successful login attempts, endpoint process and file‑access events, email and identity‑related alerts and much more. Dashboards are full. Alerts are firing. The data is flowing.
This is now changing, and it’s happening faster than ever thanks to AI agents, which are making what was once visible increasingly murky.
That’s because AI agents don’t behave like traditional applications. Agents are dynamic and execute actions at runtime, interact across systems, and blend seamlessly into legitimate workflows. In the world of AI agents, your security stack may be generating enormous amounts of data, but it’s missing the risks that matter most.
This isn’t hypothetical. In August 2025, ESET researchers documented PromptLock, the first known AI-powered ransomware, which uses a large language model to write its own attack code on the fly and generate a unique variant for every target — a technique built specifically to slip past the signature-based tools most stacks still rely on. Around the same time, security teams began responding to AI-orchestrated intrusion campaigns in which an agent handled the bulk of reconnaissance, lateral movement and data collection with only light human direction.
And speed is compounding the visibility gap — Mandiant has measured the time from initial access to lateral movement which is collapsing from hours to as little as 22 seconds. When an autonomous agent can map your environment and act on it faster than an analyst can read the first alert, “we have the logs” is no longer the same thing as “we are in control.”
What makes AI agents so hard to see?
In the traditional software world, there was one thing we could count on. That’s predictability. The software followed a defined set of rules. It processed inputs and produced expected outputs. AI agents are the complete opposite. They take action, execute workflows and interact with systems and data. Further complicating matters, they adapt their behavior over time. Here’s another way to put it — they don’t just run, they make decisions and act on them.
This creates a critical problem. Specifically, the security tools most organizations are using now were built to detect threats. What they were not designed to do is understand or control autonomous behavior. Here’s where each one falls short.
1. EDR sees activity, not intent: Endpoint detection tools identify known patterns, suspicious behaviors and indicators of compromise. But what happens when AI agents are operating inside legitimate processes, executing expected actions that go unnoticed and don’t trigger known signatures? They don’t look malicious. In fact, they look productive, which is what businesses are banking on, right?
2. SIEM is overwhelmed by noise, not insight: SIEM platforms accumulate logs across the environment but struggle to effectively prioritize context. This is an issue in an environment where AI agents are generating massive volumes of activity, and it all looks completely normal. AI risk doesn’t stand out. It blends in.
3. XDR still relies on detection after the fact: Extended detection and response improve correlation across the stack, but it still must observe behavior, identify anomalies and trigger alerts. But with AI agents, by the time an alert is sounded, the execution has already begun. At this point, it’s too late.
4. Network security tools can’t see encrypted AI traffic: AI tools rely heavily on HTTPS, APIs and encrypted communications, which creates issues. That’s because network security tools treat these as trusted channels. Therefore, if it’s encrypted and expected, it’s effectively invisible to traffic inspection and payload analysis.
5. Data loss prevention (DLP) focuses on data, not behavior: DLP tools inspect content and prevent it from leaving the network. But AI agents typically operate through legitimate channels and may never violate a clear data rule, even when they misuse data in ways that pose serious risk. The problem isn’t just the data leaving. It’s what the AI is doing with it after it’s gone.
6. Identity tools don’t track autonomous behavior: Identity and access management solutions were built for human users, and with that, predictable patterns and static permissions. AI agents break this model entirely. They inherit permissions, act independently and execute at scale. Access is not the same as control.
7. None of these tools operate at the point of execution: This is the root issue. Most security tools observe, analyze and alert. But AI risk occurs in real time, when the agent is taking action. If you can’t control what happens at runtime, what you have is surveillance, not security.
