Agentic AI Security: Deciding What to Buy, What to Build and What to Ignore

Every analyst chart gets a second life as a procurement document. Straiker, a security supplier, has published its reading of the inaugural agentic AI curve from Gartner, and an artefact like that arrives in a CISO's inbox, then arrives in a budget conversation roughly three weeks later. This article is written for the second of those two meetings.

One disclosure before anything else, because it governs how much weight the paragraphs below deserve. Gartner's own report is paywalled and we do not have it. Everything attributed here comes either from that supplier's public account or from Gartner remarks that reached the press through other outlets, and each paragraph states which. The aim is narrow: separate the things worth purchasing from the things your own engineers should be building, and name what can wait.

Reading a Maturity Curve Without Over-reading It

These curves trace a technology from early excitement, through disappointment, to a settled plateau. The supplier's summary, which is one vendor's reading and partial by nature, puts the agentic security entry at a high benefit rating with a plateau somewhere between two and five years out. The same post observes that agentic AI featured only as an innovation entry on the equivalent generative AI curve twelve months earlier, and that Straiker appears among the named example suppliers for the entry.

Both details repay a slow read. Inclusion as an example supplier is not an endorsement of anything. And a plateau that distant means the category remains unsettled: entrants will merge, narrow their claims, or quietly stop selling. Whatever architecture you commit to needs to outlast them.

One line of advice that summary ascribes to the analyst is "enforcing zero trust and least privilege for agents", which we were unable to check against the source report.

Consider the shape of that sentence. It prescribes a design posture; it does not describe something you can order. The same post relays the analyst flagging workflows that are not deterministic, execution that carries state, and coordination among multiple agents as the central difficulties. Each of those is a property of how a system got built. Procurement does not remove any of them. At best, procurement watches them.

Why the Category Formed So Quickly

A security category crystallises fast whenever a fresh attack surface appears with budget behind it. Agents qualify: they carry credentials, they invoke tools, and they consume prose written by strangers. Suppliers arrived with discovery tooling, runtime protection, adversarial testing services and identity products, often making claims that overlap at the edges in ways a feature grid conceals.

Demand-side inflation is better documented than supply-side inflation, and more useful to a buyer. Gartner predicted in mid-2025 that upwards of 40% of agentic AI projects would be abandoned by the close of 2027, pointing at expense, benefits nobody could demonstrate, and immature risk management. Its analyst Anushree Verma characterised most current efforts as early experiments running largely on enthusiasm. The same coverage carries an estimate that something like 130 of the many thousands of suppliers describing themselves as agentic are the real thing, and describes the habit of reissuing chatbots and process automation under an agentic label.

Security spending absorbs both distortions simultaneously. You may be buying protection for initiatives that never ship, from a supplier whose product is last cycle's product with fresh naming.

Build This Layer First, Because It Survives Any Supplier

The summary reports advice covering zero trust and minimal privilege for agents, human authorisation on consequential actions, and tool access held to what a task actually requires. None of those three arrives through a purchase order. They are decisions your engineers make in a design review.

• One identity per agent, holding scoped credentials with short lifetimes. The modelling problem is covered in our piece on least privilege for agents.
• Tool allowlists defined against a task rather than against an agent, so reach matches the job in hand instead of the job description.
• Authorisation gates on anything irreversible, constructed so the reviewer reads genuine parameters. Our oversight guide covers how fatigue defeats exactly this control.

Put this layer down before evaluating a single product. Nothing you can license rescues an agent carrying a master credential, and every demonstration you sit through will read more clearly against a stack that already has these in place.

Where Purchasing Genuinely Wins: Finding the Agents

Discovery is the one area where buying usually beats building. Locating everything constructed inside low-code platforms, embedded within SaaS products, or running on an engineer's laptop is slow, unglamorous work, and suppliers have put real effort into it. Insist on evidence from your own estate rather than a reference customer's: what did it surface that you held no record of, and which signal found each one?

Probe the coverage claim specifically. A great many agents live inside platforms where somebody else owns the runtime entirely, so ask what the product observes in those environments, and read a vague answer as a no.

Rent the Adversary, Keep the Regression Suite

External adversarial testing buys thinking that is genuinely difficult to sustain in-house, where familiarity dulls everyone. Your regression suite is what retains the lessons once the engagement closes. Use a specialist to surface the issues, then encode every finding as a repeatable check that lives in your pipeline and belongs to you. The contract ends. The checks should not.

Treat Detection Numbers as Unproven Until You Replay Your Own Traffic

Runtime protection is the busiest claim in the category and the hardest to judge from documentation. Accuracy figures originate in supplier benchmarks, and your traffic looks nothing like a benchmark. Run a comparison using your own sanitised traces, deliberately include behaviour that is strange but entirely legitimate, and measure wrong alerts as rigorously as correct ones. A control that interrupts real work gets switched off inside a month, which leaves you holding the licence and none of the protection.

Require Each Purchase to Answer a Threat You Named First

Ahead of the first demonstration, write the three threats that genuinely concern you about your own deployment. Planted instructions resulting in data leaving the company. Credentials far broader than any task needs. Agents in production that nobody approved. Then score every candidate against those three sentences rather than against a grid a supplier assembled. Our pre-deployment checklist is a workable source of candidate threats where the list is hard to start.

Assume Consolidation, and Ask What Leaving Looks Like

With a plateau years away, treat consolidation as the expected outcome rather than a tail risk. Require logs and policy exportable in open formats, keep detections in a system of record you control, and put the exit question to every supplier during evaluation. One that cannot answer it has told you something worth knowing.

The Free Material Is Better Procurement Input

If the chart is behind a paywall and a supplier's reading of it is what reaches your inbox, the practical answer is to score candidates against something public instead. Two documents do that job better than a maturity curve, and both are downloadable.

The first is NIST's Control Overlays for Securing AI Systems project, which is building overlays that apply the SP 800-53 control catalogue to AI systems. Its project page, created in July 2025 and last updated on 8 January 2026, lists five proposed use cases, two of which are the ones a buyer in this category cares about: using AI agent systems with a single agent, and using them with multiple agents. The concept paper went out for comment on 14 August 2025. Read the page before your next vendor call, because what it does not contain is the most useful thing on it, and we come back to that below.

The second gives you the framing to open an evaluation with. Singapore's Cyber Security Agency published Securing Agentic AI, a discussion paper written with FAR.AI and dated 24 October 2025, which works through how planning, tool use and agent-to-agent delegation widen the attack surface, surveys the frameworks that already exist, and sets out the open problems. Its central judgement is the sentence to carry into a demonstration: conventional controls are necessary but not sufficient here. A supplier whose pitch implies the first half without the second is describing a web application firewall with new labels on the dashboard, and a supplier who only argues the second half is asking you to abandon controls that still work.

Buy Discovery, Not Assurance: The Standard Is Unwritten

Here is the absence worth building a purchasing rule on. Of the five overlays that NIST has proposed, the predictive AI one already has an annotated outline, posted in January 2026 with feedback due the following month. The two that cover agent systems are listed as proposed with no outline, no draft and no date against either of them. That is the honest state of this field in one line: the body that writes the control catalogue American federal systems are assessed against has not yet written the agentic control set.

Our call follows directly. Buy the things whose value does not depend on a control set existing, and refuse the things whose value does. Discovery qualifies, because its claim is checkable today: it either found the agent nobody had recorded or it did not, and you can verify that against your own estate in an afternoon. Adversarial testing qualifies on the same basis. What does not qualify is any product whose pitch rests on coverage, compliance readiness or mapping to a standard for agentic systems, because the mapping is to something unpublished and the claim cannot be falsified. That is not an accusation of bad faith on any supplier's part. It is a statement about what is possible to demonstrate right now.

The trigger for changing course is unusually easy to monitor, which is why we prefer it to a plateau estimate. When the single-agent and multi-agent overlays reach initial public draft, assurance claims become checkable, and the question at the table changes from whether a product has coverage to a control-by-control walk through a document both sides can read. Put the project page on a quarterly check and let the analyst calendar look after itself. Until then, treat the design layer as the purchase that cannot be deferred and the licensed layer as a subscription you expect to cancel.

Before Anything Gets Signed

Where agents operate near regulated records or financial actions, involve qualified security and compliance professionals before relying on a supplier's claims. Read this as analysis rather than a replacement for an audit or a legal review.

Our position: these curves map where suppliers are spending attention, and that correlates only loosely with where your exposure actually sits. Spend first on the design controls the reported advice itself points toward, and treat the licensed layer as something you expect to replace, because on this timeline you will.

Questions about buying agentic security tooling

What does the agentic AI curve from Gartner actually say?

The report places agentic technologies along a maturity path. Per the supplier summary available publicly, its security entry carries a high benefit rating and a two to five year plateau. The report itself is paywalled and we have not read it.

Does appearing as an example supplier mean a product is endorsed?

No. It means the supplier was cited as an instance of the category. Evaluation against your own traffic and your own written threats is the only thing that substitutes for an endorsement.

Which parts should a team build rather than license?

Identity design, per-task tool scoping, authorisation gates and your own regression checks. Those are architectural commitments, and no supplier is positioned to make them for you.

What do analysts mean by agent washing?

Per press coverage of Gartner's commentary, it describes suppliers relabelling existing assistants, chatbots or process automation as agentic without the underlying capability being present.