Businesses today face new security challenges as they integrate inherited agents into their enterprise applications. These agents, when combined with features like Email-to-Case and Web-to-Case, create potential vulnerabilities within platforms such as Salesforce and ServiceNow. The seamless path from public internet inputs to agent actions highlights a security gap that enterprises must address.
The Vulnerabilities of Inherited Agents
Inherited agents become entwined in enterprise systems through application features rather than internal models. This poses risks, as shown in recent research from August 2026, where external inputs can infiltrate an agent’s process. Systems often lack reevaluation of enabled features, triggers, and object exposures, leading to potential data breaches. Traditional vendor risk assessments overlook these issues as agents are introduced post-procurement.
Understanding and Mitigating Risks
To secure these agents, a deep understanding of the host application is essential. The City-Forum campaign exemplifies the risks posed by the disconnect between platform features and actual configurations. As platforms simplify agent creation, agents can proliferate unchecked, carrying the permissions of their creators and multiplying potential access points.
Governance models struggle to keep pace, often relying on outdated documents rather than real-time insights into agent activity and ownership. The OWASP Agentic Skills Top 10 reflects this gap, emphasizing the need for visibility into third-party platform deployments.
Implementing Effective Governance
A bottom-up approach to governance is crucial, starting with continuous discovery of agents across configurations and networks. Effective governance demands operational tests at each layer, from identifying agents to understanding their usage and ensuring appropriate controls. The EU AI Act’s significant penalties for non-compliance underline the importance of dynamic, evidence-based governance practices.
Platforms like Reco offer solutions by discovering agents across various touchpoints and assigning risk profiles before policy implementation. This proactive approach helps organizations maintain compliance and secure their systems effectively.
The integration of inherited agents is not inherently exploitative; rather, it requires diligent configuration management. As enterprises navigate this evolving landscape, robust governance practices will be essential to mitigate risks and ensure security.
