AI Agent Governance:A CISO’s 2026 Checklist

You cannot govern what you cannot see. Zenity’s governance framework identifies this as the single foundational control: without a reliable inventory, no downstream control is enforceable. Inventory each agent’s purpose, identity inheritance, data access paths, owner, environment, and integration surfaces.

The complication: 59% of organizations admit shadow AI operates entirely outside their governance perimeter. Unsanctioned agents — spun up by a development team without security review — are where the real exposure lives. Shadow AI incidents carry an average additional cost of $670,000 over standard breaches, driven by the time it takes to scope what the agent touched.

Non-human identities now outnumber human identities 100-to-1 in the average enterprise. IDC projects 1.3 billion AI agents in operation by 2028. Your IAM quarterly access reviews cover 1% of your actual identity surface if you haven’t extended to agents. Every major vendor at RSAC 2026 shipped agent identity capabilities: Microsoft’s Entra Agent ID, Okta, SailPoint, Palo Alto Cortex AgentiX. Established

The critical principle: each tool call should re-authenticate against current context, not against a token issued at session start. Zero trust was built for human sessions. Agents persist, reuse tokens, and share credentials across multi-step workflows. That’s a different threat model.

The 2026 CISO AI Risk Report found 71% of organizations have AI systems with access to ERP, CRM, and financial systems, while only 16% govern that access effectively. That’s not a governance gap — it’s a governance void. Agent permissions scoped to minimum required access isn’t just good hygiene; it’s the difference between a contained incident and an enterprise-wide breach.

The OWASP Agentic Top 10 ranks “excessive agency” (ASI01) as the highest-impact risk: agents with more permissions than their task requires. Scoping at the tool-call level — not just at provisioning — is where most programs fall short. Established

This is the one I’ve watched organizations skip and immediately regret. 60% of organizations at RSAC 2026 admitted they cannot terminate a misbehaving agent once it’s running. With Mandiant’s M-Trends 2026 showing attacker dwell time at 22 seconds, the inability to instantly revoke an agent isn’t a governance gap — it’s a liability. Established

The question every CISO should answer right now: if an agent starts exfiltrating data at 2 AM, what’s your revocation path, who has authority to execute it, and what’s the documented SLA? If you can’t answer that in under 30 seconds, your answer is effectively “I don’t have one.”

Published December 10, 2025, the OWASP Agentic Top 10 is the most operationally actionable agent-specific security framework currently available. Microsoft open-sourced its Agent Governance Toolkit on April 2, 2026, mapped directly to the same 10 risks. Palo Alto rebuilt Prisma AIRS around the framework. The vocabulary is now standardized. Established

The four risks that deserve immediate attention: ASI01 (Excessive Agency), ASI02 (Prompt Injection), ASI03 (Agentic Supply Chain), and ASI10 (Rogue Agents / Shadow AI). All four live at the execution layer — not the model layer. If your AI governance roadmap starts and ends with prompt filtering, you’ve built a wall in front of a door nobody is using.

The Cloud Security Alliance’s April 2026 research note recommends extending existing SIEM and UEBA architectures to capture AI agent interactions: tool call sequences, external API requests, and data access patterns. The principle is pragmatic: even imperfect coverage is substantially better than none. Anomalous behavior detected after the fact is recoverable; behavior that leaves no log is not. Probable

Agent-to-agent communication is the specific blind spot vendors haven’t solved. VentureBeat’s analysis of five agent identity frameworks at RSAC identified it as one of three gaps none of them solve — alongside self-modification auditing and behavioral monitoring at runtime.

AI agent governance is cross-functional by necessity. CISOs typically sponsor oversight, but operational ownership spans security architecture, legal/compliance, and line-of-business teams. Clear accountability models prevent fragmented supervision — and without them, the same governance gaps get created in three separate departments simultaneously. Probable

The specific failure I’ve seen: M&A activity that introduces unmanaged agents silently. Agents introduced through acquisition can expand operational exposure without review. Your governance committee needs a documented trigger for acquisition due diligence that explicitly includes AI agent inventory and access audit. Who owns that right now? If the answer is “nobody formally,” that’s your answer.

The Model Context Protocol (MCP) has emerged as the de facto protocol controlling how AI agents access tools and data in enterprise environments — and the CISO field is just waking up to its attack surface. The Amazon Q Developer extension incident in July 2025 — where a threat actor submitted a malicious pull request to a public AWS repository to manipulate agent behavior — is now the canonical case study. Established

Prompt injection at the tool layer (not the chat layer) is where real damage happens. The OWASP Agentic Top 10 framework’s ASI02 addresses this specifically. An AI MCP gateway that validates tool calls before execution — similar to a WAF for web apps — is the architectural response. Palo Alto’s Prisma AIRS and several newer entrants (Pragatix among them) have built around this pattern. Probable

The regulatory environment has hardened. EU AI Act enforcement timelines are active. NIST’s AI Risk Management Framework provides the governance backbone, while ISO/IEC 42001 is the certifiable management system for AI security — particularly critical for financial services, healthcare, and government contractors. NIST’s Center for AI Standards and Innovation issued a formal RFI on January 8, 2026 — the first U.S. government step toward agent-specific guidance. Probable

My honest take: ISO 42001’s 12–18 month certification process is genuinely valuable but operationally heavy. The pragmatic path is building capabilities through OWASP and NIST AI RMF first, then mapping to ISO for formal certification. Don’t start with ISO unless an audit deadline forces it.

Agent frameworks have short and unpredictable life cycles — Gartner specifically warns about this. Annual red team exercises made sense when the attack surface changed annually. It doesn’t anymore. Quarterly AI red team exercises specifically designed to test jailbreaking, goal hijacking, and prompt injection against your production agents need to be on the security calendar as a fixed cadence. Probable

The specific threat model to use: MITRE ATLAS for agent-specific adversarial tactics. Data poisoning techniques documented within ATLAS are now surfacing in production environments. Your red team needs the OWASP Agentic Top 10 vocabulary and MITRE ATLAS as their operating framework — not generic penetration test playbooks. Speculative — quarterly cycle standard not yet established industry-wide