The age of AI agents has arrived — and it has arrived fast. These autonomous systems are no longer confined to research demonstrations or proof-of-concept projects.

In 2025, autonomous AI agents are no longer experimental tools confined to research labs. They are live in production environments, orchestrating workflows, accessing sensitive data, and making decisions that directly impact business outcomes.

For enterprise security leaders, this rapid proliferation has created an urgent and largely unprecedented challenge.

Securing AI agents has become the defining cybersecurity challenge of 2026, with a Dark Reading poll finding that 48% of cybersecurity professionals now identify agentic AI and autonomous systems as the single most dangerous attack vector.

The good news? Industry leaders are learning fast. Companies like Walmart, Zendesk, and enterprises using platforms built around LinkedIn's ecosystem are developing real-world frameworks that the rest of the business world can adopt. Here's what they've learned — and what your organisation can action today.

Why AI Agent Security Is a Different Beast Entirely

Before diving into what enterprises are doing right, it's worth understanding why AI agent security is fundamentally different from traditional cybersecurity.

AI agent security refers to the specialised practices, controls, and technologies designed to protect autonomous AI systems from unauthorised access, data leakage, adversarial manipulation, and operational abuse. Unlike traditional application security which focuses on pre-defined controls and connections, AI agent security must account for systems that learn, adapt, and make independent decisions in real time.

The financial stakes are just as alarming as the technical risks.

According to IBM's 2025 Cost of a Data Breach Report, shadow AI breaches cost an average of $4.63 million per incident — $670,000 more than a standard breach.

Perhaps most concerning is the gap between executive confidence and operational reality.

82% of executives report confidence that their existing policies protect against unauthorised agent actions. But only 14.4% of organisations send agents to production with full security or IT approval.

Policy documentation and runtime enforcement are emphatically not the same thing.

Walmart: Building Security Into the Foundation

When it comes to AI deployment at scale, few companies face the same complexity as Walmart.

Walmart's EVP and Chief Information Security Officer, Jerry R. Geisler III, has been at the forefront of navigating cybersecurity challenges as AI becomes increasingly autonomous, tackling the security challenges of building Element AI, Walmart's centralised AI platform.

The Element Platform: Centralise to Secure

At the foundation of Walmart's transformation is Element, its proprietary ML platform, and the launch of four super agents — including WIBEY, a developer-focused agent that serves as a unified entry point for intelligent action across Walmart's systems.

Centralisation here is a security strategy as much as an operational one.

Reflecting on the experience gained from developing Element AI, Geisler noted that centralisation not only streamlines AI development but also enhances security governance, facilitating the embedding of security measures from the outset, ensuring that risks are managed effectively and innovation can proceed within a trusted framework.

Walmart has built Element to function as a platform for managing the full lifecycle of intelligent agents — from development and testing to deployment and monitoring — with observability tools that let teams track decision paths, reasoning steps, and performance metrics.

Identity-First, Not Network-First

Walmart's CISO has been direct about one of the most important security pivots in the agentic era.

The adoption of agentic AI introduces entirely new security threats that bypass traditional controls. These risks span data exfiltration, autonomous misuse of APIs, and covert cross-agent collusion. Walmart's strategy is to build robust, proactive security controls using advanced AI Security Posture Management (AI-SPM), ensuring continuous risk monitoring, data protection, regulatory compliance, and operational trust.

On identity architecture specifically,

Walmart is encouraged by the evolution and adoption of protocols like MCP and A2A, as they recognise the security challenges the company faces and are actively working on implementing granular, context-sensitive access controls. These protocols enable real-time access decisions based on identity, data sensitivity, and risk, using short-lived, verifiable credentials — ensuring that every agent, tool, and request is evaluated continuously, embodying the principles of Zero Trust.

Fewer Entry Points, Greater Trust

Walmart also learned a hard lesson about agent sprawl.

By mid-2025, Walmart acknowledged what many enterprises eventually learn: deploying dozens of specialised AI agents doesn't scale. While pilots seemed promising, at enterprise level the system became fragile and fragmented. To fix this, Walmart consolidated its bots into a super agent model, rolling out four domain-level orchestrated agents. The reasoning was straightforward: fewer entry points create more trust.

Zendesk: Adversarial Testing as a Security Culture

Zendesk has taken a notably proactive approach to AI agent security — one built on continuous adversarial testing rather than point-in-time audits.

The "Defensible AI" Framework

Zendesk prioritises security prevention, with a virtuous cycle between product development and AI security.

This isn't marketing language — it's baked into how the company ships product.

Zendesk does repeatable technical stress testing to ensure AI agents will behave securely before they even talk to a customer to minimise liability exposure.

The reason this matters is rooted in the non-deterministic nature of AI.

Significant autonomy is what creates value for agentic service. But without a dedicated evaluation framework, their non-deterministic nature means that the same user intent can yield a helpful answer today and an unsafe outcome tomorrow — especially when an attacker strategically reframes requests, escalates pressure, or exploits ambiguity across many turns.

Continuous Multi-Turn Simulation

Rather than treating security as a one-time audit,

Zendesk's AI security evaluation programme is built on continuous adversarial, multi-turn simulation. Real-world threats rarely happen in a single prompt — a generative "attacker" model is used to regularly simulate complex, multi-turn dialogues as an ongoing stress test of AI agents' resistance to progressive manipulation, including attempts to steer agents into unapproved behaviours, policy bypasses, or unsafe tool usage.

When a test fails, Zendesk doesn't just log it — they improve the system prompts and guardrails (a combination of prompt engineering techniques, code architecture, and traditional security features), then test again until the vulnerability is closed.

Secure by Design, Not by Default

Zendesk has also made a strong statement on AI governance through its Microsoft partnership.

Zendesk is a launch partner for Microsoft Agent 365, a secure and autonomous platform that manages Zendesk AI agents within Microsoft's environment. Using Microsoft security and compliance tools, Agent 365 acts as a control plane, autonomously managing Zendesk tickets, accessing knowledge bases, and maintaining seamless communication for Microsoft 365 users and support teams.

Crucially,

Zendesk allows customers to maintain full visibility and control over how AI agents operate — setting policies, reviewing behaviour, and evaluating every interaction with built-in QA.

The Identity Crisis at the Heart of Enterprise AI Security

One of the most consistent themes across enterprise AI security — visible in the approaches of Walmart, Zendesk, and the broader Microsoft/LinkedIn ecosystem — is the centrality of identity governance.

Research from the Cloud Security Alliance found that non-human identities — a category that includes AI agents, service accounts, API keys, OAuth tokens, and workload identities — outnumber human identities by more than 90 to 1 in many organisations. In the year from 2024 to 2025 alone, non-human identities grew by 44% across measured enterprise environments.

Yet most legacy systems are wildly unprepared.

92% of survey respondents reported that their legacy IAM solutions cannot effectively manage the risks associated with AI and non-human identities, and 78% acknowledged the absence of formally documented policies for creating or removing AI agent identities.

In practice, identity is the mechanism that makes AI scalable, predictable, and safe. Identity guardrails allow organisations to apply just-in-time (JIT) access instead of standing privileges and enforce least privilege for people and agents alike.

The Real-World Threat Landscape You Can't Ignore

The threat isn't theoretical. Real-world attacks have already demonstrated how quickly agentic vulnerabilities can be exploited.

In 2025, a coding assistant committed a backdoor, a model file executed a reverse shell the moment it was loaded, and an agent integration handed more than 700 Salesforce environments to an attacker for ten days without tripping a single alert.

Prompt injection is the number one attack vector targeting AI agents right now. An attacker injects malicious instructions into the agent's input stream in a way that bypasses its safety guardrails.

And the threat doesn't stop there —

unlike other LLM applications, agents can retain memory or context over time, which can enhance usefulness, but also means a greater opportunity for hackers to manipulate the memory.

Practical Tips: What Your Enterprise Can Do Right Now

The lessons from Walmart, Zendesk, and the broader enterprise security community converge on a clear set of actionable steps:

Most organisations do not have an accurate count of their deployed agents. Enterprise AI agent fleets roughly doubled since December 2025, with nearly 38% of organisations now running more than 100 agents.

You cannot secure what you cannot see.

Security teams should govern AI agents that can call tools and APIs by treating each agent as a privileged non-human identity with an owner, a defined purpose, and a measurable access scope.

Agents should be given access to only the tools they need, using Just-in-Time (JIT) permissions granted only for the required duration for a specific task, instead of giving broader system access.

Approval from a human should be required for most important actions, like deleting data, spending money, or changing security settings.

Deploy real-time monitoring and behavioural analytics to detect anomalous agent behaviour before breaches occur.

ISO 42001 provides an international standard for AI management systems, emphasising risk assessment and transparency, while the NIST AI Risk Management Framework provides a structured approach to identifying, assessing, and mitigating AI risks.

Conclusion: The Window for Getting This Right Is Closing

The enterprises that will define the next decade are not simply those that deploy AI the fastest — they are the ones that govern it best. The playbooks from Walmart and Zendesk demonstrate that enterprise-grade AI agent security is achievable, but it requires deliberate architecture, identity-first thinking, continuous adversarial testing, and a willingness to challenge legacy assumptions about how security should work.

The core security challenge has shifted from model safety to identity governance

— and the clock is ticking.

81% of security leaders feel pressure to deploy AI agents quickly, even when security is not fully in place.

Don't let that pressure become a liability.

Is your organisation ready to build AI security with the same rigour as the enterprises leading the charge? Start by auditing your current agent inventory, mapping their access permissions, and establishing a continuous testing programme. The frameworks exist. The lessons have been learned. Now it's time to apply them — before an attacker does it for you.