AI agents are unleashing a more chaotic era of enterprise cybersecurity, one in which identities are transitory, actions are autonomous and governance struggles to keep pace. But what if the growing threat to data security is also creating the industry’s next big opportunity?

RSAC day four opened with those themes in focus, but none felt more urgent than the idea that ephemeral AI agents are breaking traditional identity and access models. These agents spin up, complete tasks, spawn new agents and deprecate themselves — a pattern that demands an entirely new approach to trust and governance, according to Zeus Kerravala (pictured, left), founder and principal analyst at ZK Research LLC.

“It’s unlike anything the security industry’s ever had to deal with before,” Kerravala said, reflecting on the new urgency facing security suppliers in the wake of Nvidia GTC. “How you manage identities and how you onboard access and how you delegate trust and governance, all that’s going to change. Our attack surface has gone from something that was unmanageable to begin with to completely chaotic.”

Kerravala spoke with theCUBE’s Dave Vellante (right) and Christophe Bertrand (center) at the RSAC 2026 Conference as part of a day four industry analysis, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how AI agents are reshaping data security, identity governance and the economics of the cybersecurity industry. (* Disclosure below.)

Data security meets the agentic identity crisis

The data security challenge is compounding as enterprises adopt agents faster than they can govern them. Without proper baselines for normal agent behavior, detecting anomalies remains an open problem, Kerravala explained. But the irony is that AI vs. AI may be the only model that scales effectively enough in an agent-driven security environment.

“You need AI to secure AI,” Kerravala said. “If you’re a security team today and you’re not on board with AI, you are going to fall behind very quickly. There’s no stopping the train here.”

Meanwhile, the underlying data itself remains the core asset at risk. Organizations are building AI systems on data that is neither adequately protected nor properly managed, creating compounding exposure, Bertrand noted.

“Data is still everything,” he said. “Right now, data is not being protected enough. It’s not being managed enough. We’re sort of building the plane as we’re flying it.”

The question of what data security even means in the agentic era may be the hardest one to answer, Bertrand added. As cyber resilience, identity management and agent governance converge, pricing models and product boundaries are in flux.

“What is security anymore? Is it recoverability? Is it about identity management? Is it about managing agents? Is it about managing the data and making it secure?” Bertrand asked. “I think once we see a little more consolidation and see where the chips fall, that will drive a lot of how the pricing is done.”

But the opportunity is not just financial — it’s reputational. AI could give security teams a chance to stop being seen as blockers and start being valued as enablers of speed, Kerravala explained. 

“The security industry has an opportunity to change its narrative,” he said. “Instead of being the ‘Department of No’, [it can] be the underlying governance and security foundation that lets a company come out of the blocks running. No longer are you a business inhibitor — you’re a business accelerator.” 

Here’s the complete keynote, part of SiliconANGLE’s and theCUBE’s coverage of the RSAC 2026 Conference:

(* Disclosure: TheCUBE is a paid media partner for the RSAC 2026 Conference. Sponsors of theCUBE’s event coverage do not have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE