Guerassim Nikolov explains why autonomous systems are becoming the new insider threat

Opinions expressed by Digital Journal contributors are their own.

For decades, the insider threat conversation has focused on employees, malicious actors with privileged access, or well-meaning staff who make costly mistakes. That conversation now needs to expand to include entities that are not human at all. As enterprises deploy autonomous AI agents capable of accessing databases, executing API calls, managing workflows, and making decisions at machine speed, they are introducing a new class of privileged actor, one that operates continuously, without fatigue, and at a scale no human team can match.

“Autonomous agents change the threat model in a fundamental way,” says Guerassim Nikolov, an enterprise security advisor with more than twenty years in cybersecurity strategy. “A human insider with bad intentions still operates at human speed. An AI agent with compromised instructions operates at machine speed, and by the time behavioral monitoring catches it, the damage is already done. You have to apply IAM principles to these systems before they’re deployed, not after an incident forces your hand.”

The risk was illustrated clearly by a landmark ruling in Canada. In February 2024, the British Columbia Civil Resolution Tribunal ruled in Moffatt v. Air Canada (2024 BCCRT 149) that Air Canada was fully liable for misinformation provided by its customer service chatbot. The chatbot had incorrectly told a customer that bereavement fares could be claimed retroactively, the opposite of the airline’s actual policy. When Air Canada argued that its chatbot was ‘a separate legal entity responsible for its own actions,’ the tribunal rejected this outright, ruling that any AI system integrated into a company’s operations is the company’s full legal responsibility. Air Canada was ordered to pay damages.

That case involved a relatively simple chatbot. The stakes escalate significantly when the AI system in question has privileged access to financial systems, customer records, or operational infrastructure. The OWASP Top 10 for Large Language Model Applications specifically identifies prompt injection, where malicious input manipulates an AI agent into taking unintended actions, as a primary attack vector. An attacker who successfully injects a malicious prompt into an AI agent with database write access could cause damage that takes hours or days to detect and remediate.

The operating speed of autonomous agents compounds the problem. A human employee with unauthorized access might extract data over days or weeks – time during which behavioral anomalies might trigger alerts. An AI agent executing the same action does so in milliseconds. According to Palo Alto Networks’ 2026 predictions, autonomous agents now outnumber human employees at an 82-to-1 ratio in many enterprise environments, making manual oversight of individual agent behavior operationally impossible.

Nikolov identifies the Air Canada ruling as a watershed moment. “If a simple chatbot can create full corporate liability, the stakes around agentic systems with privileged access are an order of magnitude higher. Organizations need governance frameworks that match the risk profile, not frameworks designed for the previous generation of enterprise software.”

The solution framework mirrors what identity and access management principles have long applied to human users: least-privilege access, so agents hold only the permissions necessary for their immediate task; behavioral monitoring tuned for machine-speed activity; defined approval thresholds, so high-risk actions require human sign-off before execution; and full audit trails, so every agent action is logged and attributable.

The enterprises that will manage this risk best are those that build AI governance into deployment architecture from the start, not as a compliance checkbox, but as an operational control. The question for every AI agent is not just ‘what can it do?’ but ‘what should it be allowed to do, and who verifies that it stays within those boundaries?’