Intent-Based Security Takes Center Stage as AI Agents Reshape Enterprise Risk

The conversation at this week's Proofpoint Protect event has shifted decisively. Rather than arguing whether companies should deploy AI agents, attendees focused on how to control them once they're running. Attackers have begun leveraging AI to craft convincing phishing messages and execute attack chains at machine speed. Inside enterprises, the agents themselves pose a distinct challenge: they operate with insider privileges, accessing sensitive data, systems and communications.

Intent will define the next era of security. Defense teams are constructing knowledge graphs and intent-driven models capable of assessing whether a human or an agent is behaving as expected. Governance rules written in policy documents are being converted into automated, real-time enforcement. Frontier research labs have accelerated this shift, with Anthropic expanding Project Glasswing to distribute its Mythos Preview vulnerability-detection model to more security defenders.

The large enterprises that are competing, they look at the transformation edge that they're trying to get as the competitive edge. So their game is speed. They know that if they can beat the competition with better products and better outcomes, they win. Now, the risk is the security piece.

John Furrier, executive analyst for theCUBE Research

Executives and researchers from Proofpoint and Anthropic shared their perspectives during the San Diego event, with coverage provided by theCUBE + NYSE Wired. Discussions centered on agentic threats, knowledge graphs, consolidation of security platforms and the paradox of AI agents representing both tremendous opportunity and significant risk.

Eight key takeaways from Proofpoint Protect

1. Security teams shift from blocking AI to enabling safer adoption

Organizations are approaching agentic AI with measured confidence. Security teams face pressure to move away from blocking initiatives and toward facilitating responsible AI deployment. Determining agent or human intent has become paramount, since an agent pursuing its assigned objective can optimize toward unintended outcomes, according to Molly McLain Sterling, senior director of cybersecurity strategy at Proofpoint.

2. Intent becomes the foundation for two new agentic security systems

Proofpoint unveiled two fresh agentic systems designed for collaboration security and data and AI security, each anchored in a knowledge graph mapping how people and AI interact and retrieve data. Since comprehensive vulnerability patching is impossible, enterprises require compensating controls that evaluate the intent behind every human and agent action, according to Sumit Dhawan, chief executive officer of Proofpoint.

3. Tiered intent models target attacks that appear legitimate

Attackers increasingly compromise legitimate supplier communication chains without deploying malware. Proofpoint has integrated intent-based models into its Nexus detection suite, available across Flash, Extended-Thinking and Deep-Thinking tiers. A new Community Hyperloop distributes each detection across the entire customer base at machine speed, explained Tom Corn, executive vice president and general manager of the Threat Protection Group at Proofpoint.

4. AI agents emerge as insider risks concentrated on enterprise endpoints

Proofpoint's monitoring shows that roughly 99% of agentic activity operates on standard endpoints rather than cloud infrastructure, making its tens of millions of endpoint sensors critical for agent security. Policies originally written for human behavior must be transformed into real-time controls that agents can interpret, emphasized Ryan Kalember, chief strategy officer of Proofpoint.

5. Anthropic urges enterprises to engineer for trust before scaling agents

Anthropic delayed the general release of its Mythos Preview model to establish safeguards and prioritize access for defenders, recognizing that emerging models can combine minor vulnerabilities into critical exploits. Organizations should establish policy frameworks, implement sandboxing and monitoring capabilities, and begin with limited deployments where blast radius is clearly understood, advised Robert Bair, head of national security partnerships at Anthropic.

6. Proofpoint nears $2.5B in annual recurring revenue as customers consolidate

Proofpoint's annual recurring revenue approaches $2.5 billion and is expanding at nearly 20%, inclusive of Hornetsecurity, having doubled since Thoma Bravo LP acquired the company in 2021. Security leaders are consolidating vendor relationships to redirect budget toward AI initiatives, including a Canadian financial institution that eliminated four vendors through a $25 million, five-year agreement, shared Remi Thomas, chief financial officer of Proofpoint.

7. AI divides cyberattackers into increasingly skilled and sloppy camps

Sophisticated threat actors are using AI to accelerate malware creation and translate phishing content into as many as 16 languages, while less capable actors are becoming increasingly careless. Static detection methods are losing effectiveness rapidly, requiring defenders to develop dynamic approaches that anticipate attacker behavior, highlighted Selena Larson, principal threat researcher at Proofpoint.

8. Knowledge graphs become the control layer for human and AI access

As humans and AI agents gain direct data access, enterprises require visibility into both the reasons for access and the permissions each actor should possess. Proofpoint is developing a knowledge graph connecting actors, actions and data assets, establishing a contextual foundation for governance, detection and response as AI systems operate continuously, according to Mayank "MC" Choudhary, EVP and GM of the Data Security and Governance Group at Proofpoint.