Dell's Scimone: AI Agent Guardrails Enable, Rather Than Limit, Enterprise Autonomy

Enterprises deploying AI agents face a fundamental tension: expanding what these systems can do independently while ensuring they remain secure and controllable. According to John Scimone, president and chief security officer of Dell Technologies Inc., the answer lies in establishing robust guardrails during the initial design phase rather than imposing restrictions after deployment.

Cyber resilience and data protection have become primary factors in determining which responsibilities organizations should hand over to AI systems. The scope of these decisions goes beyond individual tasks to encompass the broader security and resilience infrastructure underpinning enterprise operations, Scimone explained during remarks at the AI Cybersecurity and Resilience Summit.

The good news is, this is the best time to get it right. Organizations are today designing agents that are going to be working for years ahead. At that point of design is always the best time to get security done well, to get resilience done well. Security resilience by design for agentic is a huge opportunity.

John Scimone, Dell Technologies

Resilience in an agent-dependent world

The nature of business resilience has shifted dramatically. Where organizations once focused on disaster recovery centered around natural disasters and infrastructure failures, the contemporary threat landscape centers on coordinated cyberattacks that can compromise entire digital ecosystems. Autonomous agents introduce a new vulnerability: when the software stops functioning, so does the work it performs.

What happens if these agents aren't available? What happens if the data that the agents are deciding on is not available? A core part of your resilience posture has to contend with the notion that if our agents go down, our work is not happening.

John Scimone, Dell Technologies

Research conducted by theCUBE Research's Krista Case surveyed 25 enterprise technology and security leaders, finding that 19 organizations had already deployed autonomous agents in production environments. However, none of these companies permitted their agents to execute high-risk operations without explicit human authorization.

Guardrails as enablers, not constraints

Scimone cautioned against excessive caution in agent deployment, arguing that thoughtful governance frameworks actually expand rather than restrict what organizations can safely accomplish. The key distinction lies between reckless delegation and deliberate, structured autonomy grounded in clear boundaries.

It doesn't mean doing it willy-nilly and just throwing caution to the wind. It means being very thoughtful around where can't you fail, putting deterministic guardrails in place … and letting the business run. Right now, I'm seeing too much caution in the space on that front.

John Scimone, Dell Technologies

Dell implements this philosophy internally by enforcing strict identity and access controls for every deployed agent, maintaining comprehensive audit trails of all decisions and actions, and ensuring complete traceability throughout agent operations. This foundational work proves essential given that only four of the 25 survey respondents had conducted incident response testing for AI agent failures.

Dell has also strengthened its cyber resilience capabilities and joined OpenAI Group PBC in advocating for coordinated industry action on cybersecurity defense.

The acceleration of AI-powered attacks

While adversaries have leveraged AI capabilities for years, they have not yet deployed these tools at scale, according to Scimone. He anticipates this trajectory will change substantially in the near term.

We haven't hit that curve that I do believe is coming, and in the coming quarters, not in the coming years.

John Scimone, Dell Technologies

Bounded autonomy drives better outcomes

The survey uncovered a counterintuitive finding: organizations that implemented bounded autonomy frameworks demonstrated superior recovery readiness compared to those relying exclusively on human approval processes. This pattern supports Scimone's thesis that well-designed governance systems enable rather than impede organizational agility.

https://www.youtube.com/embed/7qFS7EzEe60?feature=oembed

Organizations that design those governance systems upfront are going to be the ones, ironically, that can move the quickest and can take the most risk because they can do it confidently with the right insights and the right data to know that they're not overstepping. At the same time, they're not under-leaning.

John Scimone, Dell Technologies