Q&A: Pointguard AI CMO Willy Leichter On How to Build a Security Strategy When AI Agents Don’t Know 'No'

Enterprise AI is moving from systems that generate answers to agents that take action—and that shift is changing the security equation. AI agents can connect to applications, call tools, access data and communicate with other systems, often at machine speed. They may also inherit more access than users realize.

Unlike a person who is unlikely to explore every resource available to them, an agent pursuing a goal may do exactly that. As Willy Leichter, CMO at PointGuardAI, puts it, “They don't know ‘no,’ and if you haven't explicitly said ‘no,’ they'll do everything they can” to complete their mission.

That reality is pushing AI security beyond visibility and into active control. Organizations need to know which agents, models and MCP servers are operating in their environments, but discovery is only the beginning. They also need granular authorization that determines exactly what an agent can access, controls that evaluate whether it is acting according to its intended purpose, and runtime capabilities that can intervene when its behavior begins to drift. Circuit breakers and kill switches are emerging alongside more familiar concepts such as least privilege, guardrails and defense in depth.

At the same time, AI governance is expanding beyond security. As enterprises push employees to adopt AI and consumption grows, organizations also need to understand what those systems cost and whether they are delivering sufficient value. Yet amid all this change, Leichter argues that the fundamentals of cybersecurity remain remarkably familiar. AI may operate faster and expose weaknesses more quickly, but organizations still need to discover assets, manage access, patch vulnerabilities and understand where their gaps lie.

Leichter explains what security looks like as AI becomes increasingly agentic—from MCP and intent-based authorization to runtime controls, shadow AI, sandboxing and token-cost management—and why securing the agentic enterprise may ultimately require applying proven security principles at an entirely new speed.

Q. Why have AI agents created greater urgency around security than some of the earlier concerns about models and prompt injection?

A. The agent space has really lit a fire with a lot of security people. When we started, we were in application security. We pivoted to expand into AI security a couple years ago. And the threats to models and prompt injection, those things that people are concerned about, weren't quite motivating people enough, other than generalized concern about what people are doing and not having visibility in the models. But now with agents, it's suddenly so easy for anybody to install an MCP server. And in most companies, people have way more access privileges than they know about.

Q. Why does excessive access become more dangerous when an AI agent is involved?

A. People supposedly access three times the amount of stuff they think they're authorized to. I don't go hunting around to see where I can find stuff. But an agent will. They don't know “no,” and if you haven't explicitly said no, they'll do everything they can.

Q. Why has MCP become such an important security control point?

A. Enterprises are going at enterprise speed, but trying to move faster. But MCP has become a clear thing that you've got to, you've got to lock it down and you've got to have authorization, which means you need to have the hooks to control it.

Q. How granular does authorization need to become for agents?

A. The MCP gateway is another control point With MCP is all the stuff you're giving it access to. It’s not enough that I can get to Salesforce and my agent can't. You need to get granular. What exactly can it see? What's the purpose of the agent? Then offer intent-based authorization. Is the agent following its intent, what it's what it's designed to do, and or is it just going completely off the rails and doing something unexpected, which you know which we've seen recently.

Q. Is visibility enough, or do organizations need the ability to actively control agents while they are running so they can intervene before an agent takes an unwanted action?

A. Actually monitoring agents and having some way to stop them if you don't like what they're doing is kind of the next frontier. We can literally intercept actions before they happen. Every action, if it's not what an agent is supposed to be doing, we do cumulative drift scoring. If you set a threshold, it's getting higher and higher. It can trip a circuit breaker, or you can have a kill switch.

Q. Can any single AI security control adequately protect an agentic environment?

A. There’s never one control point or part of a product that just magically does everything. But like in other parts of security; you've got to have multiple checkpoints to fencing downwards.

Q. How does security change when agents begin operating so fast?

A. Suddenly it's at machine speed instead of someone typing speed. So, you have to make those guardrails really fast. We've built a lot. We’ve customized our own small language models, and we can do multi-threaded policy controls so as to be able to check, say, five different policies at once. Like anything else, if you're slowing down the process, if you have huge latency, then it looks good, but it doesn't work.

Q. How is agentic AI changing the endpoint security problem?

A. The other big area increasingly is agentic endpoints, developers that are building agents. In the last couple of years, it's been defined as usage control on AI and application security. Those are now starting to overlap because end users are building agents. There’s a ton of AI now, a ton of agentic that's happening at the workstation. So, we've got browser plugins and other ways to monitor what's happening at the endpoint.

Q. What are the basic governance requirements for employee-built AI assets?

A. Making sure every AI asset has an owner, who has governance over it. That’s basic. And you need guardrails, content guardrails, which we've been doing with models and any prompt and response.

Q. Can the same visibility used to secure AI also help organizations understand and control AI costs?

A.When the bills starte coming in that’s going to slow down AI. That's one of the next things we're developing because we're looking at the traffic as token cost management.

Q. Why is cost visibility becoming increasingly important?

A. Like everything else, if you know the cost then you can make better decisions. I'll ask Claude to go research something and sometimes it'll just pop up and answer. Other times it'll take 10 minutes. I'm like, what? What are you doing? I didn't ask you to go to the Library of Congress. The cost savings, though, could easily fund security projects.

Q. Does AI fundamentally change cybersecurity, or does it amplify problems organizations already have?

A. It doesn't change the fundamentals of security. Why you're going to get hacked is probably a missing password or you know a zero day that's been known about that already patched.

Q. So, what does AI actually change for security teams?

A. From a security standpoint, it's everything moving faster. But you still have to use the same mental approach to figure out where the holes are and what the gaps are. People can only react so fast. In a way, AI helps security teams find the problems faster. We use AI. We use a lot of fine-tuned models. Our DLP is much more powerful than it ever has been in the past, and other guardrails. But I remember the Spy vs. Spy in Mad Magazine. I've always thought that about security.

Q. How is enterprise AI adoption different from the move to the cloud?

A. Ten years ago, there was economic pressure to go to the cloud. But there were conservative compliance people. They wanted to put the brakes on it for good reasons. But now there's so much corporate pressure in almost every company to at least have an AI strategy, even if they’re not showing some cost savings with AI.

Q. Can organizations realistically choose not to adopt AI?

A. There’s so much corporate pressure to use AI to get its benefits, and the benefits are amazing in the right application. They’re so compelling that you can't just stay around for long if you're anti AI.

Q. How can experimentation turn into shadow AI without employees realizing it?

A. It's so natural for people to want to experiment and want to try stuff out. So they may be totally conscientious, but end up with 20 models from Hugging Face in their network that they forgot about. And are they sandboxed? Not really. They’re not in production, but are they sitting around somewhere? Do you really know where they are?

Q. Why does AI security keep coming back to discovery?

A. Discovery equals governance.

Agentic AI is raising the stakes because organizations are now securing autonomous software—not just systems—capable of accessing tools, interacting with enterprise data and taking actions on behalf of users. And because agents operate at machine speed, the time between unexpected behavior and its consequences can be extraordinarily short. That means security controls need to operate fast enough to identify drift and intervene before an unwanted action occurs.

Discovery, then, has become the foundation of effective governance. Organizations cannot govern agents, models or MCP servers they do not know exist. But visibility must lead to control: determining what an agent can access, whether its behavior aligns with its intended purpose and when that behavior warrants intervention. The growing use of open-source models and MCP servers makes that challenge particularly difficult because experimentation can leave organizations with forgotten or poorly governed AI assets scattered throughout the environment.

The same visibility could also help enterprises confront another emerging constraint: cost. AI security, governance and economics are beginning to intersect as organizations seek to understand not only what agents are doing, but how many resources they are consuming. Leichter predicts that “what's going to slow AI down is when the bills start coming in.” Knowing those costs could allow enterprises to make better decisions about where AI provides sufficient value—and potentially use resulting efficiencies to help fund the controls required to secure it.

For all the novelty surrounding agents, however, the underlying security lesson is familiar. AI does not eliminate the need for good security hygiene; it makes neglected weaknesses harder to ignore. As Leichter explains, “it's everything moving faster, but it's still you still have to use the same mental approach to figure out where the holes are and what the gaps are.” The challenge for enterprises is to bring those fundamentals into an environment where agents can discover—and act on—those gaps faster than people ever could.