Q&A: NuGuard AI CEO Ranjan Goel Discusses the AI Behavior Gap and Why Securing Agents Starts with Defining What They Should—and Shouldn't—Do

As enterprises accelerate their adoption of agentic AI, they face a fundamental security challenge: How do they ensure that AI agents operate within their intended boundaries? Unlike traditional applications, autonomous agents can make decisions and take actions that extend beyond their assigned tasks. And unlike humans, they cannot be expected to recognize unwritten rules or intuitively distinguish appropriate behavior from inappropriate actions.

That challenge is at the heart of what NuGuard AI CEO Ranjan Goel calls the AI behavior gap—the difference between what an AI application is intended to do and how it behaves. Closing that gap requires organizations to explicitly define behavioral policies, establish safeguards and validate agent behavior before deployment. Yet the frameworks and development practices needed to accomplish this are still emerging, even as AI adoption accelerates.

Goel discusses why traditional cybersecurity approaches fall short in the agentic era, how organizations can identify and close behavioral gaps, and why integrating security into AI development is essential to enabling innovation rather than slowing it.

Q. What makes AI agents so difficult to secure, and why aren't traditional cybersecurity tools sufficient?

A. Cybersecurity tools is a $200 billion industry, and those tools all were designed in a pre-AI world. They are completely blind to the AI stack. So, all the things we are now finding out, like the OpenAI attacking Hugging Face, or even Anthropic and Gemini reporting that their models and AI agents broke their own safeguards, traditional cybersecurity tools don't know what AI is. That’s problem number one. The $200 billion market is not applicable essentially to the AI stack. And even the best AI engineers from OpenAI to Meta to Gemini are struggling to safeguard the models they are building.

Now imagine a typical AI developer for a mid-sized or a large enterprise customer, who obviously does not have the same level of expertise that the AI engineers in OpenAI or Anthropic have, or the same tools. That’s a big issue the industry is facing: developers are basically trying to safeguard AI without any clues.

Q. Can organizations leverage their existing cybersecurity investments to secure AI agents?

A. Yes. Very recently, Nikesh Arora, the CEO of Palo Alto Networks, who obviously has invested in the cybersecurity stack because they are the market leaders in cybersecurity, publicly said that this trillion-dollar cybersecurity tool deployment is getting disrupted because these tools are no longer valid for the AI.

Vendors are coming out and saying that there is a big disruption coming in this market, and I think customers will start realizing that they're spending millions of dollars on security tools, and they're not applicable to AI.

Closing the AI Behavior Gap

Q. You’ve spoken of an AI behavior gap. Could you explain what that is and why it creates a new security challenge?

A. The whole concept of a behavior gap is new. In essence, you have an intent behind an AI application or an AI agent, for example, a healthcare app. So when you're building a healthcare app, say for a hospital versus a clinic, both are healthcare apps, but the intent is different. That means their safeguards would be different. You can't build the same safeguard for both—that's what we call behavior gap, which we go over in a whitepaper published last May. The first part of recognizing and closing the behavior gap is to define intent.

Q. How can organizations identify and measure gaps between an AI application's intended behavior and its actual behavior?

A. When you do the validation, you can see how the AI application is behaving in real time compared to that intent. You determine if it is following that intent or not, and that is the gap. If you run thousands of different simulations and tests, and across these tests, you can see that the behavior is changing and that becomes the behavior gap. Nvidia, in a recent announcement called it “behavior drift.”

Q. Why are explicit behavior policies essential for securing AI applications?

A. When we talk about policies, it basically means behavior policy for AI applications. Let me give you an example. A healthcare AI application can basically renew a prescription for you, but it cannot give you a medical prognosis or basically tell you if there is a better prescription. That's a very fine line, and that's the behavior policy I'm talking about. There was a recent example in Australia where somebody was using an AI agent to book a gym appointment, and the agent canceled the appointment for somebody else who was already there. These things are happening because people are finding out that AI does not have any infusion of safeguards, unlike humans who have intuitive safeguards built in.

AI doesn't have that intuition. It has to be told what is good and bad so policies have to be very explicit. Most AI developers are not used to this concept of behavior policies. It’s brand new. No coursework teaches you. There are no best practices. There is no framework. The current software development processes don't say, “Hey, during the software development process, this is the time where you define your behavior policy for your AI app.”

Q. How should behavior policies account for different users, contexts and levels of risk?

A. As developers, we're usually in the positive thinking mindset. For example, if I'm building a healthcare agent, then most likely in my policy I’ll tell it to only talk about healthcare topics. So if there is a political conversation, then stop midway, saying I'm not going to entertain it. Or if there is a financial conversation, stop midway.

But within the healthcare topic, there are a lot of safety-related things. For example, if you're talking to a pre-teen, the way you chat will be different versus when you talk to an adult. And as an AI developer, do I have that understanding that my target users have different personas, and each persona has to be treated differently? With consumer AI, the concept of different personas and needs and behavior policies for each persona are just coming into picture.

Q. What advantages does open source offer AI developers?

A. Open source is very developer friendly. If I'm a developer, I don't have to talk to a sales guy who's selling me a SaaS solution or a tool. I can quickly check—say, if in the middle of the night, I'm looking for a tool, I go to GitHub. I look at the repos and there are like five or 10 tools. I can look at their source code, their documentation. Everything is open, and I can quickly see which tool makes sense for me. Because AI moves at a very rapid pace, even the coding agents can do this process now. They will find a tool automatically then use it during the development process without an actual AI developer trying to figure out what the tools are and how to buy them. That's very developer friendly, very AI friendly, and that's why at NuGuard we started with open source, because we want to be developer friendly.

Q. What are the limitations and security risks of open source tools in enterprise environments?

A. To your point, there are drawbacks for sure. One is that most of the open source tools do not have any support. What happens if it doesn't work? Who do you call? Use it as it is. You cannot call an 800-number. You cannot send an email and get it fixed. And what if it has malware? Eventually, when IT gets involved, they will say, "I need a tool that has a vendor behind it that's trusted, and I can call them.” And that's the support side of the house. Feature-wise enterprises need more security, like SSO support, role-based access support, databases, user interfaces, audit logs open source does not have. Generally, these are fundamental for enterprise deployment.

Q. Why is contributing to open source standards and frameworks important for advancing AI security?

A. We launched our open source in May. We have now 50,000 downloads, 50 stars on GitHub. We have a very active community of volunteers who are contributing to the open source. We are trying to make sure this whole concept of AI safety and security basically becomes industrywide, both from a developer perspective and from a cybersecurity community perspective.We are part of Linux Foundation and Open Secure AI Alliance. We are contributing to OWASP AIBOM project, with a goal to advance the mission of making AI safe and secure to use. I'm okay if other vendors use our tool. I don't mind, and they build something upon it while we are also building our own paid version.

Q. Why do organizations need a way to measure and compare risk across their AI applications?

A. Enterprises typically have hundreds of AI applications that are being deployed, like in the finance team, marketing team, legal team, engineering teams. Every team in an organization is now using AI, so if I'm a chief information security officer, I want to see the risk profile of all AI applications in my organization. I want to see a single number—that's where the risk score comes in. Say the number for the sales team shows the risk score of their AI application is 80 out of 100, that means somebody has to fix it. But maybe for the finance team, the risk score is 30, and I can live easily with that, saying, "Hey, they have done everything possible to reduce the risk.”

Q. How should security leaders use AI risk scores?

A. Every week, I can look at this risk score and say, “okay, are people actually fixing things?” The risk score across my whole enterprise should be going down. The trend also is very critical in terms of the risk score. But there’s no industry standard for calculating it. At NuGuard, we built our own mechanism based on all the findings we prove and the business impact of those findings for each application. That determines the severity, whether it's a critical finding or a non-critical finding. All of that basically gets summarized as a risk.

Q. Why is pre-production validation critical for AI applications and agents?

A.What we saw with the OpenAI incident is that thousands of agents escaped their sandbox, attacked Hugging Face and covered their tracks, all on their own. For Security Operations teams, post-incident troubleshooting is becoming more difficult.

That basically means you want to make sure safeguards are in place before AI applications and agents are put in production. You have validated those safeguards so these things will not happen in production. Because once they happen in production, it only takes seconds for AI to go out and do harm then cover its tracks. But it will take months for a human to go and figure out what harm was done.

Q. How mature are AI guardrail technologies, and how widely are organizations deploying them?

A. The technology is there. So that's a good thing. We do have technology where people can put guardrails around AI agents. But that technology is still in its infancy, it’s either version one or version two. It’s not widely deployed across all AI applications. Certain highly secure applications probably are using guardrails. Second, the guardrails are only as good as their configuration. Just because somebody placed a guardian doesn't mean that they are protected. It’s possible that people who get a mandate to safeguard their AI applications and agents do a very minimal job in designing that guardrail.

Q. Are organizations carrying poor security practices from traditional IT into their AI deployments?

A. That depends. Do you care about security or not? If you haven't done basic hygiene because you don't care about it, then you’ll have the same attitude even for AI.

Q. Does building security into AI development have to slow innovation?

A. I detest the idea that security could be a hindrance to innovation. What we are finding is even the best people in this industry think security is a hindrance. But if you have it done correctly, then it's not a slowdown. It's part of your process. If it takes three weeks to get out an application, and as part of those three weeks, one week is for security, then there's no slowdown because it takes three weeks to cook.

Q. Europe is moving forward with regulation for AI and there is some sense that AI regulation here could fall to the states. Are voluntary industry frameworks providing more practical guidance than fragmented regulation?

A. There are agencies even in the U.S. federal government— NIST is such an agency. In the past, for cybersecurity, NIST had a framework for all the companies to follow. The U.S. federal government for their procurement follows the NIST framework. And even though there's no regulation for it, it becomes the blue ribbon standard. Even on a volunteer basis, there is a certain guidance for you right now.

Securing agentic AI requires more than deploying guardrails or relying on traditional cybersecurity tools. Organizations must clearly define what agents are permitted to do, test whether their behavior aligns with those expectations and identify potential failures before they reach production. Without that foundation, even well-intentioned AI applications can introduce unexpected risks.

The challenge extends beyond individual deployments. Security leaders need ways to assess risk across their AI environments, while developers must balance the flexibility of open source tools with enterprise security requirements. Evolving regulations and the lack of consistent industry standards add further complexity.

Ultimately, Goel contends that security should be built into AI development rather than treated as a final checkpoint. The goal stretches beyond creating agents capable of performing tasks to ensuring they behave as intended—and to make that assurance measurable and verifiable.