Securing Agentic AI: Managing Risks in ANZ Enterprises

From generative prompts to autonomous execution

Enterprises in Australia and New Zealand have largely moved past the experimental phase of static large language models. The current operational reality involves deploying agentic AI systems capable of planning complex workflows, executing multi-step tasks, and interacting with external APIs without constant human oversight. This architectural shift fundamentally alters the security perimeter because traditional application security models assume a predictable input and output flow. Agentic AI operates in open loops where the agent decides which systems to query, which databases to modify, and which tools to invoke based on dynamic context rather than static code paths.

The risk profile shifts from passive data leakage to active autonomous action. An agent might successfully authenticate to a legacy financial system, execute a high value transaction, or delete critical records if its instructions are misinterpreted or if its environment is poisoned. Security teams must now protect not only the model weights and training data but also the agent's ability to act within strictly defined behavioural boundaries. This requires a move from static perimeter controls to continuous behavioural validation and real time runtime monitoring.

Unique attack vectors for autonomous agents

Standard vulnerability scanning tools are ill suited for agentic architectures because they look for known signatures in code or misconfigurations in infrastructure. These tools do not understand the semantic intent of an agent or the potential for emergent behaviour. The following vectors represent the primary risks for autonomous systems in the ANZ market.

• Prompt injection through tool outputs. Agents often use the output of one tool as input for another in a chain. An attacker can poison a data source that the agent reads, causing the agent to execute a malicious instruction embedded in that data. This creates a multi stage attack chain that bypasses initial input sanitisation at the user interface layer.
• Tool abuse and over provisioning. Agents require permissions to function, and security teams often grant broad access to ensure operational reliability. An attacker who compromises the agent can exploit these broad permissions to achieve lateral movement across cloud environments. The agent effectively acts as a persistent internal threat actor with legitimate credentials.
• State poisoning and memory manipulation. Agentic systems maintain state across interactions to preserve context over long running workflows. Attackers can manipulate this memory to alter the agent's future behaviour or decision logic. This is particularly dangerous in sectors like healthcare or finance where historical context influences critical outcomes.
• Indirect prompt injection. Users or external systems provide data that contains hidden instructions. The agent processes this data without realising it is executing a command. This vector is difficult to detect because the input appears benign to standard content filters, yet it carries the semantic weight of a malicious directive.

Validating agentic security with PentestOps

Traditional penetration testing provides a snapshot of security at a single point in time. Agentic AI evolves rapidly as new models are integrated, tools are updated, and business logic changes. Relying on periodic assessments leaves significant windows of exposure where new vulnerabilities can be exploited. PentestOps addresses this gap by providing continuous security validation for autonomous agents. This platform automates the process of testing how agents interact with their environment by simulating adversarial behaviours to verify that agents respect security boundaries.

The platform tests for common failure modes such as excessive tool access, insecure data handling, and susceptibility to injection attacks. It runs these tests continuously as the agent's code and dependencies change, ensuring that security is baked into the development lifecycle rather than appended at the end. For ANZ organisations regulated under APRA CPS 234 or following the ACSC Essential Eight guidance, this continuous validation is critical for demonstrating due diligence in managing technology risk.

Key validation capabilities

1. Dynamic access control testing. Security engineers verify that agents only request the minimum permissions required. The system tests for privilege escalation scenarios where an agent attempts to access resources outside its designated scope.
2. Tool chain integrity checks. The platform tests the entire workflow of an agent to verify that data passing between tools is sanitised and validated. It checks for injection points in the data pipeline that could compromise the agent's logic.
3. Resilience against adversarial inputs. Continuous tests simulate prompt injection and state poisoning attempts. The system measures the agent's ability to resist these attacks and fall back to safe defaults when anomalies are detected.
4. Behavioural anomaly detection. The platform establishes a baseline of normal agent behaviour. It flags deviations that indicate potential compromise or malfunction, allowing for rapid response to unexpected actions.

Implementation challenges in ANZ enterprises

Adopting agentic AI in ANZ brings specific operational challenges. Legacy systems often lack the modern APIs required for secure agent interaction. Integration with these systems requires careful engineering to avoid introducing vulnerabilities that could be exploited by an autonomous agent. Security teams must define clear boundaries for agent actions before deployment to prevent uncontrolled execution.

Data sovereignty is another critical consideration. Agents processing sensitive customer data must ensure that information remains within Australian or New Zealand jurisdictions. Cloud providers offer regional compliance certifications, but the configuration of the agent itself must also adhere to these requirements. Misconfigurations can lead to inadvertent data exports, which violates the Privacy Act and the Notifiable Data Breaches scheme. The ACSC's most recent guidance emphasises that sovereignty is a configuration responsibility, not just an infrastructure promise.

Organisational readiness varies across sectors. Financial services have mature security frameworks but struggle with the speed of AI innovation. Healthcare providers face strict privacy requirements under the Privacy Act. Public sector entities must align with the Information Security Manual published by the ASD. Each sector requires a tailored approach to agentic security validation that respects its specific regulatory constraints.

Technical architecture for secure agents

Building secure agentic systems requires a layered security architecture. The model layer should use private inference to keep data contained within enterprise boundaries. This reduces dependency on public cloud providers and enhances data control. Extranet Systems offers dedicated GPU infrastructure to support private AI deployments at scale, allowing organisations to run large models without exposing sensitive data to third party services. This approach provides predictable infrastructure costs and reduces the risk of data leakage through consumption based models.

The tool layer must enforce strict access controls. Each tool should require specific authentication and authorisation, and agents should not share credentials across tools. This limits the impact of a compromise. The orchestration layer should include guardrails that validate agent actions before execution. These guardrails can be rule based or powered by smaller specialised models that verify intent.

Economic and operational implications

Securing agentic AI is not just a technical requirement but an economic one. Breaches involving autonomous systems can cause significant financial and reputational damage. The cost of remediation often exceeds the cost of prevention. Continuous validation helps avoid costly incidents by identifying vulnerabilities early in the development cycle. This approach aligns with the ACSC's recommendation to integrate security into the software development lifecycle.

Operational efficiency improves when agents are secure. Trust in autonomous systems increases when security teams can demonstrate robust validation. This accelerates adoption across the organisation because teams are more willing to delegate tasks to agents when they trust the security controls. This leads to greater productivity gains from AI investment without compromising governance standards.

Regulatory scrutiny is increasing globally. ANZ regulators are likely to update guidance on AI governance in the coming years. Proactive security measures position organisations ahead of regulatory changes. This reduces the risk of fines or operational restrictions. It also enhances customer confidence in AI driven services by demonstrating a commitment to safety and compliance.

Strategic recommendations for CISOs

CISOs in ANZ should prioritise agentic security as part of their AI strategy. This involves updating risk assessments to include autonomous agents. Security teams need new skills to understand agent behaviour and validation techniques. Training and upskilling are essential for effective implementation. Establish a governance framework for agentic AI that defines clear policies for agent development, deployment, and monitoring.

Require security validation for all agents before production release. Use PentestOps to automate this validation and ensure consistency across different agent types. Integrate security metrics into business dashboards to track risk over time. Collaborate with development and operations teams to embed security practices into the development workflow. Security cannot be a bottleneck. Provide tools and training to help developers build secure agents. Foster a culture of shared responsibility for AI security.

The adoption of agentic AI offers significant opportunities for ANZ enterprises. However, it also introduces complex security challenges. Traditional security models are insufficient for autonomous systems. Continuous validation through platforms like PentestOps is essential to manage these risks. By implementing robust security controls and validation processes, organisations can deploy agentic AI with confidence and compliance.

Extranet Systems helps enterprises navigate these complexities through our comprehensive PentestOps and infrastructure solutions.

Contact Extranet Systems to discuss your agentic AI security requirements and schedule a consultation with our specialists.