Anthony Grieco, Cisco’s SVP and chief security and trust officer, did not hesitate when VentureBeat asked whether rogue agent incidents are reaching Cisco’s customer base.
“A hundred percent. We see them regularly,” Grieco told VentureBeat in an exclusive interview at RSAC 2026. “I’ve heard some that I can’t repeat, but they do get to the places of, you know, agents are doing things that they think are the right things to do.”
The incidents Grieco described follow a consistent pattern: authentication passes, identity checks clear. The agent is exactly who it claims to be. Then it accesses data it was never scoped to touch or takes an action nobody authorized at that level of granularity. The failure is not identity; it’s authorization.
“The business is saying things like, we’re gonna have 500 agents per employee,” Grieco told VentureBeat. “The security leaders are really focused on how to make sure that we do that securely.”
Cisco’s State of AI Security 2026 report found that 83% of organizations planned to deploy agentic capabilities, but only 29% felt prepared to secure them. Five vendors shipped agent identity frameworks at RSAC 2026. None closed every gap. That includes Cisco.
VentureBeat mapped four authorization gaps across Grieco’s exclusive interview and five independent sources. The prescriptive matrix at the end of this story is what to do about them.
The authorization gap nobody has closed yet
Grieco came up through Cisco’s engineering and threat research organizations before taking a role that straddles both sides of the company’s security operation: building the products Cisco sells and running the program that defends Cisco itself.
The authorization gap he described is specific and operational.
“This agent here is a finance agent, but even if it’s a finance agent, it shouldn’t access all finance data,” Grieco told VentureBeat. “It should access the expense reports, and not just expense reports, but the individual expense reports at a particular time. Getting that sort of granular control is really one of the biggest things that are gonna help us say yes to a lot of the agentic developments.”
Independent practitioners confirmed the pattern across RSAC 2026. Kayne McGladrey, an IEEE senior member, told VentureBeat that organizations default to cloning human user profiles for agents, and permission sprawl starts on day one. Carter Rees, VP of AI at Reputation, identified the structural reason. The flat authorization plane of an LLM fails to respect user permissions, Rees told VentureBeat. An agent on that flat plane does not need to escalate privileges. It already has them.
“The biggest challenge that we see is knowing what’s going on,” Grieco said. “Being able to have identity and access control maps to those, that’s really crucial.”
Elia Zaitsev, CTO of CrowdStrike, described the visibility dimension in an exclusive VentureBeat interview at RSAC 2026. In most default logging configurations, an agent’s activity is indistinguishable from a human’s. Distinguishing the two requires walking the process tree. Most enterprise logging cannot make that distinction.
Five vendors shipped agent identity frameworks at RSAC, including Cisco’s Duo IAM and MCP gateway controls. None closed every gap VentureBeat identified. The four gaps below are what remains open.
Standards bodies are converging on the same diagnosis
The authorization and identity gaps Grieco described are not just vendor observations. Three independent standards bodies reached parallel conclusions in early 2026. NIST’s NCCoE published a concept paper in February 2026, “Accelerating the Adoption of Software and AI Agent Identity and Authorization,” explicitly calling for demonstration projects on how existing identity standards apply to autonomous agents.
The OWASP Top 10 for Agentic Applications, released in December 2025, identified tool misuse from over-privileged access and unsafe delegation as top-tier risks. And the Cloud Security Alliance launched the CSAI Foundation at RSAC 2026 with a mission of “Securing the Agentic Control Plane,” including a dedicated Agentic AI IAM framework built around decentralized identifiers and zero trust principles. When NIST, OWASP, and CSA all independently flag the same gap class in the same market cycle, the signal is structural, not vendor-specific.
MCP security requires discovery before control
VentureBeat asked Grieco about the paradox of MCP, the Model Context Protocol that every vendor at RSAC 2026 embraced while acknowledging its security gaps. Grieco did not argue that the protocol is safe. He argued that blocking it is no longer realistic.
“There is no saying no to that in today’s day and age as a security leader,” Grieco told VentureBeat. “And so it’s how do we manage that.”
Inside Cisco’s own environment, Grieco’s team added MCP discovery, proxying, and inspection capabilities to AI Defense and Cisco Secure Access. The approach treats MCP servers the way enterprises treat shadow IT: find them before you govern them.
Etay Maor, VP of threat intelligence at Cato Networks, validated that approach from the adversarial side. At RSAC 2026, Maor demonstrated a Living Off the AI attack chaining Atlassian’s MCP and Jira Service Management. Attackers do not separate trusted tools, services, and models. They chain all three. “We need an HR view of agents,” Maor told VentureBeat. “Onboarding, monitoring, offboarding.”
Nearly half of the critical infrastructure is obsolete and unpatched
Agent authorization failures are harder to detect and contain when the infrastructure underneath has not received a security patch in years — and that gap compounds every other vulnerability in this story. Cisco commissioned UK-based advisory firm WPI Strategy to examine end-of-life technology risk across the US, UK, France, Germany, and Japan. The report found that nearly half of the critical network infrastructure across those geographies is aging or already obsolete. Vendors no longer patch it.
“Almost 50% of the critical infrastructure across these geographies was aging, it was end of life or almost end of life,” Grieco told VentureBeat. “It means vendors are not providing security patches for them anymore.”
Cisco’s Resilient Infrastructure initiative disables unused features by default and phases out legacy protocols on a three-release deprecation schedule. Grieco pushed back on the assumption that secure by default is a static achievement. “One of the things that most people don’t think about is that those are not static points in time,” Grieco told VentureBeat. “It’s not like you do it once and you’re done.”
Agentic enterprise security gap matrix
The four gaps below are what security directors can act on Monday morning. Each row maps from what breaks to why it breaks to what to do about it, cross-validated by five independent sources.
Sources: VentureBeat analysis of Grieco’s exclusive interview at RSAC 2026, cross-validated against independent reporting from McGladrey (IEEE), Rees (Reputation), Maor (Cato Networks), and Zaitsev (CrowdStrike). May 2026.
|
Security Gap |
| What fails and what it costs |
Why your current stack doesn’t catch it |
Where vendor controls stand now |
First action for your team |
|
Infrastructure aging |
Nearly half of critical network assets are end of life or approaching it (WPI Strategy); agents operating on unpatched systems inherit vulnerabilities no vendor will fix |
Annual patching cadence cannot keep pace with threat velocity; EoL systems receive zero security updates and zero vendor support |
Resilient Infrastructure disables insecure defaults, warns on risky configurations, deprecates legacy protocols on a three-release schedule |
Infra team: audit every network asset against vendor EoL dates this quarter. Reclassify EoL replacement from IT upgrade to security investment in next budget cycle |
|
MCP discovery |
MCP servers proliferate across environments without security visibility; developers spin up agent tool connections that bypass existing governance |
Shadow MCP deployments bypass existing discovery tools; no standard inventory mechanism exists; Maor demonstrated attackers chaining MCP + Jira in a Living Off the AI attack |
AI Defense adds MCP discovery, proxying, and inspection; treats MCP servers like shadow IT |
Security ops: run an MCP server inventory across all environments before deploying any agent governance controls. If you cannot enumerate your MCP surface, you cannot secure it |
|
Agent over-permissioning |
Agents inherit broad human-level access on a flat authorization plane; the agent does not need to escalate privileges because it already has them (Rees) |
IAM teams clone human profiles for agents by default (McGladrey); no scoped, time-bound permissions exist for non-human identities |
Duo IAM registers agents as distinct identity objects with granular, time-bound permissions per tool call |
IAM team: stop cloning human accounts for agents immediately. Scope every agent permission to a specific data set, specific action, and specific time window. Grieco’s test: can this finance agent access only the individual expense report it needs at this moment? |
|
Agent behavioral visibility |
Agent actions are indistinguishable from human actions in security logs (Zaitsev); an over-permissioned agent that looks like a human in logs is invisible to the SOC |
Default logging does not capture process tree lineage; no vendor has shipped a complete cross-platform behavioral baseline for agent activity |
SOC telemetry integration with Splunk for agent-specific detection and response |
SOC lead: update logging to capture process tree lineage so agent-initiated actions are distinguishable from human-initiated actions. If your SIEM cannot answer “was this a human or an agent?” for every session, the gap is open |
“Frankly, we must move this quickly and evolve this quickly to keep up with where the adversaries are gonna go,” Grieco told VentureBeat.
The gaps mapped above are not theoretical. Grieco confirmed the incidents are already happening. The controls exist in pieces across multiple vendors. No single vendor has assembled the complete stack.
