How to use agents to stop insider threats
Bill Reid
Security Advisor, Office of the CISO
Sri Gourisetti
Technical member, Google Cloud FDE
Get original CISO insights in your inbox
The latest on security from Google Cloud's Office of the CISO, twice a month.
SubscribeTrust and verifiable security are needed everywhere in the agentic era — with customers, suppliers, and crucially, with your own employees. While new employee background checks have long been a standard practice across employers, security teams are now evaluating employee actions that could represent an insider threat.
Defending against insider threats where the employee is no longer working in alignment with or to the benefit of their employer often relies on a combination of tools and processes that include granular identity and access management (IAM), Zero Trust, fault tolerance, micro-segmentation, data loss prevention, monitoring and detection, deterrence and training, and user behavior analytics.
Even with these systems in place, companies struggle to contain and manage this insider risk. The average time to contain an insider incident is 67 days, according to the 2026 Ponemon Cost of Insider Risks report. While this is an improvement from previous years, when it could take 85 days or more to contain an incident, it’s still much slower than the response time for many external automated attacks.
And what happens when the worker is not human?
In the short story Runaround, author Isaac Asimov introduced the three laws of robotics:
-
A robot may not injure a human being or, through inaction, allow a human being to come to harm;
-
A robot must obey the orders given it by human beings except where such orders would conflict with the first law;
-
A robot must protect its own existence as long as such protection does not conflict with the first or second law.
Let's apply Asimov’s framework to agents. Digital agents represent the robot that Asimov envisioned in the 1940s. They are designed to work alongside or in place of human workers. They may be used to operate equipment, write a legal brief, or evaluate a drug compound.
The corollary today is clear. As agents find their place across business enterprises and factory floors alike, we want to be sure they neither become an insider threat nor enable people to become one.
Agents are force-multipliers for humans: They can reason, plan, build, process, and act. However, agents lack human-level cognition, and in their pursuit to solve a problem, agents may lack a fundamental means to know when they do something wrong.
In the agent-enabled workplace, insider threats can take shape in at least four ways — and there are actions you can take to stop them.
That risk, combined with often-poorly configured agentic architectures, can widen your attack surface. The risk is further exacerbated if the agent can’t distinguish between trusted and untrusted instructions. Excessive agency combined with an inability to detect and stop unauthorized or manipulated agent actions is a recipe for disaster.
In this new agent-enabled workplace, insider threats can take shape in at least four ways:
-
Malicious human and malicious agent: The human has a bad intent (such as financial gain, grievance, ideology, espionage); the agent is misaligned or uncontrolled.
-
Non-malicious human and malicious agent: The agent is adversarial by design (such as model and training data poisoning) while the human counterpart bears no malice.
-
Non-malicious human and non-malicious agent: Both human and agent operate with unintentionality; the human is negligent and the agent inadvertently goes rogue to fulfil a task.
-
Malicious human and non-malicious agent: The human uses the agent to equip them to execute a malicious action, like finding a vulnerability or surveilling systems.
Much of the current debate about rogue agents has been about model alignment — making autonomous systems behave in a particular desired way through fine tuning and reinforcement learning with human feedback (RLHF). If we make the model better aligned, the reasoning goes, it is likely to behave more appropriately.
Safety experts now argue that model alignment is only one element needed. It requires additional system-level AI control and layered defenses, such as those built into Gemini 4 Argon.
What companies implementing agentic systems need are a combination of model controls and traditional security methods like surface area hardening, detection and response. Because agent-human partners or solo agents move quickly, they need similar machine-speed response capabilities.
Security is intrinsic to Gemini, with out-of-the-box of security controls at model, agent, and network layers. It allows businesses to track and trace all agents and actions in an auditable manner. Here are our recommendations for minimizing insider risk with low-code agents using Agent Studio and high-code agents using Agent Development Kit:
-
Agent identity and access: Define granular access controls for agents, following the principle of least privilege. Determine the agent’s identity type (dedicated or delegated) and use Agent Identity. Grant the narrowest role on the narrowest resource, bound to the agent's own identity, never a shared account.
-
Agent governance: Follow the principle of least agency and adopt Byzantine fault tolerance to mitigate single point failures and collusion, maintain modularity, and limit the blast radius. Use Agent Gateway and Semantic Governance Policies to govern agentic interactions and tool calls.
-
Agent artifact registry: Map agent actions to agent IDs and data lineage processes. Ensure an auditable trace of agentic actions to detect agent anomalies any policy violations. Use Agent Registry to maintain an inventory of all agents, tools, skills, and endpoints.
-
Attack surface management: Mitigate inadvertent external exposure using Private Service Connect and Private Ingress (private URLs) with Agent Gateway.
-
Request authorization: For high code agents, use REQUEST-AUTHZ with Identity Aware Proxy (IAP) to intercept agent invocations and inspect HTTP headers.
-
Content authorization: Achieve data loss prevention, enforce content level guardrails and data sanitization using Model Armor and CONTENT_AUTHZ for high code agents.
-
Threat detection: Use Agent Platform Threat Detection to alert on semantic attack detections (such as prompt injection, and jailbreaking) and trigger automated response to isolate compromised agent runtimes. For high-code agents, use deterministic rules using BeforeToolCallback and AfterToolCallback to stop prompt injection and validate outputs.
-
Intent and capability constraints: Achieve defense-in-depth with model-level controls (input sanitization, data minimization, scope isolation) to constrain intent and agent-level controls (goal bounding, human-in-the-loop, least privilege IAM) to constrain capability.
-
Network security: Pair VPC-SC with Principal Access Boundary for a holistic network defense for your agentic environments.
-
Multi-tenant context mapping: Bind upstream tenant context (such as X-Tenant-ID) to the user's verified directory entitlements at the Agent Gateway. Strip untrusted raw headers and mint a downstream cryptographically signed JWT to block compromised or injected runtimes from spoofing tenant parameters and executing lateral data-escalation attacks (confused-deputy).
If we want to live with agents (or robots like Asimov envisioned), we need well-aligned models, paired with strong model controls and supported by traditional security practices. These model controls and practices work even when the models are misaligned.
This all suggests a future where insider risk programs don’t distinguish between humans or agents; perhaps even agents are recruited into insider risk management. To learn more, check out our CISO Insights Hub.
