Why CISOs Keep Asking The Same Question About AI Agents

InnovationWhy CISOs Keep Asking The Same Question About AI AgentsByDavid Goldschlag,Forbes Councils Member.for Forbes Technology CouncilCOUNCIL POSTExpertise from Forbes Councils members, operated under license. Opinions expressed are those of the author. | Membership (fee-based)May 14, 2026, 06:15am EDTDavid Goldschlag is co-founder and CEO of Aembit, an identity and access management platform for agentic AI and workloads. gettyOver the years, after presenting to CISOs, more than one has pulled me aside for a private chat.I've spent my career watching security problems evolve, from mobile devices to zero trust networking to the software workloads that now run most of the enterprise. When the room clears and an infosec leader asks for a candid moment, I usually know what's coming.The conversation is rarely about the product they just saw. In most cases, it's about the tension between progress and control and how to move forward without weakening what they're responsible for protecting.One CISO recently told me that their company was all in on agents and was moving forward with them. The CISO wasn't trying to block the move but just needed to know that they weren't signing up for something they couldn't control.Put another way: "Help me say yes to AI."This CISO's concern is understandable. Their job is to prevent exposure and maintain accountability. In the era of autonomous AI, when an agent, for example, reads data from a collaboration tool, updates CRM records or queries a data warehouse, someone has to answer for those actions.What access does it have? How is that access limited or taken away? When something breaks, can anyone trace what happened? Those questions and responsibilities ultimately land on one desk—the CISO's.In our 2026 research report with the Cloud Security Alliance covering more than 200 enterprises, 67% of respondents said they already use task automation agents in production. Nearly half al...