Companies should put all AI agents in zero-trust category: Netskope founder

AI agents must operate under strict controls, with enterprises held accountable for their actions, says Netskope CEO Sanjay Beri

All artificial intelligence (AI)-powered autonomous agents should, by default, be placed in the “zero-trust” category by companies and enterprises deploying them, said Sanjay Beri, the founder and chief executive officer (CEO) of Netskope, a US-headquartered cybersecurity company.

 

Netskope, a Nasdaq-listed firm, has a market capitalisation of more than $10 billion.

 

In an interaction with Business Standard during his visit to India, Beri said that ultimately, all enterprises that deploy these AI agents will have to be held responsible for the transgressions, even though another company develops them.

 

“The first thing that most people forget is that an AI agent is not a replacement for a human. An AI agent has no morals, no emotional quotient, no compass of what is right or wrong. You can never trust an (AI) agent or an LLM (large language model),” Beri said.

 

 

He believes that AI agents will do whatever it takes, including “lying and manipulation” of the human or other AI agent in the loop, to achieve their goal, as they are goal-oriented and have just that as their focus.

 

Even though enterprises deploying these agents may remain extremely careful when creating and using AI agents, Beri said they still need controls, monitoring, and override mechanisms at all times.

 

In addition to the enterprises deploying these AI agents, frontier AI companies that develop these LLMs and agents should also be more upfront about their capabilities, so that the right governance standards can be applied, he added.

 

“There is a concept of shared responsibility, where the frontier AI company has some responsibility, but ultimately it is the enterprise that is deploying it that will be held to the standards,” Beri said.

 

The instances of AI agents breaking out of the sandboxes that they are being tested in and going rogue to complete tasks they were not asked to do are examples of bad governance structures and weak testing environments, he said.

 

As enterprises in India and across the globe use AI chatbots and agents more deeply and extensively, companies such as Netskope will need to do more to reduce the human element of cyber risk, Beri said.

 

“So, say an employee uses a personal AI chatbot account to upload sensitive company data in the course of their work. Instead of reprimanding them, we can coach them then and there on why that is not allowed. The vast majority of data exfiltration or data loss to AI is not due to malicious intent,” he said.

 

The advent of an agentic AI architecture has added to the complexity of cybersecurity problems, as bad actors are also deploying shadow AI agents to try to grab the same proprietary data that was earlier under threat due to weak network endpoints or human error, Beri said.

 

In countries like India, Netskope is investing heavily in building new infrastructure and hiring better talent to ensure companies operating there will comply with the latest global standards, including the Digital Personal Data Protection Act, as and when the time comes, he said.

 

The company, Beri said, has invested close to $100 million every year in India over the last few years, and will continue to hire more to add to its current count of 1,300 employees, more than half of which are Netskope’s engineering talent.