Security in the Age of AI Agents

AI empowers defenders by enabling them to harden systems everywhere simultaneously. Every vendor in the technology stack is racing to ship AI-driven improvements, which means defensive capabilities improve across the entire ecosystem, not just within a single organization.

It means the mission changes from managing people to architecting automated policies. At Lemonade, every security person is an engineer who builds systems, including an internal AI platform with specialized agents on top of it.

Because on a single endpoint there could be running 200 to 10,000 agents, and each one needs to be numbered and governed by policy at the point of action. Identity is the foundation for policy enforcement in agentic systems.

The window of exploitability is the period during which a vulnerability can be exploited before it is patched. AI is narrowing this window because AI-written code gets reviewed, pen-tested, and patched faster than traditional human pipelines.

AI-written code gets reviewed, pen-tested, and patched faster than any human pipeline. As the velocity of resolving bugs increases, the total number of bugs within a particular piece of software becomes finite and manageable, making software far more resilient.

Automation is the only way to deal with the scale of modern threats. Human teams cannot manually process the volume of data, threats, and systems requiring protection, so automated agents and policies are essential.

On a single endpoint, an organization could be running anywhere from 200 to 10,000 agents. Each of these agents needs a unique identity and policy governance at the point of action.

Policy governance in the context of AI agents means establishing rules and controls that are enforced at the point of action for every agent. This requires a much more complex approach than current identity and access management systems provide.

At Lemonade, one agent reads threat intelligence continuously. This allows the security team to stay current on emerging threats without manual monitoring, and the intelligence feeds directly into automated defensive actions.

Jonathan Jaffe's approach is unique because at Lemonade every security person is an engineer. They built their own internal AI platform with specialized agents, including one that reads threat intel and another that checks whether vulnerable methods are actually called in production code.

The future is bright for security professionals. Modern agentic security engineering is rapidly transforming, and we should expect to see significantly hardened systems as a result. Security professionals who embrace engineering and automation will be at the forefront of this transformation.