By Josh Lemos, CISO, at GitLab
GitLab’s latest C-suite research paints a clear picture of software’s imminent future. Among surveyed executives, 89% believe agentic AI will dominate software development practices within three years. Yet this transformation brings unprecedented challenges, as 85% of leaders acknowledge that agentic AI introduces entirely new security risks.
This creates a fundamental tension for security leaders. CISOs must enable AI adoption while simultaneously minimizing its emergent risks. As 91% of executives expect to expand AI investment over the next 18 months, each new AI advancement also exacerbates security challenges.
AI governance isn’t where it needs to be
Most security leaders are painfully aware of the top agentic AI risks cited by respondents: cybersecurity threats (52%), data privacy and security (51%), and maintaining governance (45%). The landscape and even definitions of these risks are evolving and deeply intertwined.
Establishing a governance model for AI is required for organizations to evolve their security strategy alongside emerging AI risks. However, doing so is not straightforward, with AI crossing many technology and security domains from data governance to identity and access management. Nevertheless, almost half of those surveyed admitted their organization has not implemented regulatory-aligned governance (47%) nor internal policies (48%) for AI.
The lag in AI governance stems from legitimate industry-wide challenges, making it difficult for leaders to identify the most effective places to invest their time and effort. The non-deterministic nature of agents causes them to behave in unexpected ways, which has been proven to disrupt existing security boundaries. Furthermore, security complexity is increasing with the introduction of universal protocols, such as Model Context Protocol and Agent2Agent, which simplify data access and enhance interoperability for multi-agent ecosystems.
But these challenges cannot stop security leaders from prioritizing AI governance. If you’re awaiting comprehensive best practices for this dynamic technology, you’ll be playing a perpetual game of catch-up. Any organization that avoids AI adoption altogether will still be exposed to AI risk through vendors and shadow AI usage in their environment.
Three steps towards stronger AI governance
The opportunity for proactive action narrows daily, demanding CISOs to start by establishing AI observability capable of tracking, auditing, and attributing agentic behaviors across environments. Here are a few steps CISOs can take today to reduce AI risk and improve governance:
1. Establish composite identities to attribute agent actions
As AI systems proliferate, tracking and securing these non-human identities becomes just as important as managing human user access. One way to achieve this is through composite identities, which link an AI agent’s identity with that of the human user directing it. So, when an AI agent attempts to access a resource, you can authenticate and authorize the agent and clearly attribute activity to the responsible human user.
2. Build monitoring frameworks to track agent activity
Operations, development, and security teams need ways to monitor the activities of AI agents across multiple workflows, processes, and systems. It’s not enough to know what an agent is doing in your codebase. You also need to be able to monitor its activity in both staging and production environments, as well as in the associated databases and any applications it accesses.
3. Improve AI literacy and upskill teams
A culture of security now requires AI literacy. 43% of survey respondents acknowledged a widening AI skills gap, which is likely to grow unless technical leaders prioritize upskilling teams to understand model behavior, prompt engineering, and how to critically evaluate model inputs and outputs.
Understanding where models are performant versus where their use is suboptimal helps teams avoid unnecessary security risk and technical debt. For example, a model trained on anti-patterns will perform well at detecting those patterns, but will not be effective against logic bugs it has never encountered before. Teams should also recognize that no model can replace human ingenuity. If the model performs suboptimally in an area a security engineer or developer is less familiar with, they will not be able to identify the security gaps the model has left behind.
CISOs should consider dedicating a portion of learning and development budgets to continuous technical education. This fosters AI security expertise in-house, allowing newly minted AI champions to educate their peers and reinforce best practices.
AI can become a strategic security advantage
AI improves security when it’s used in the right ways. The executives surveyed confirm this, with 45% of respondents identifying security as AI’s highest-value contribution to software development. When AI functions as an accelerant rather than a substitute for human expertise, organizations can democratize security knowledge across development teams by automating routine security tasks, producing intelligent coding recommendations, and offering security guidance within developer workflows.
Organizations will gain a competitive advantage when they prioritize AI governance, not avoid the technology altogether. Integrating security into AI strategy from the outset, even if foundational controls are imperfect, allows security to adapt better as the landscape evolves. If the executives surveyed are right, the three-year timeline towards agentic software development has already begun. Prioritizing security now will enable leaders to guide their teams toward the most effective use cases and achieve a competitive advantage.
##
ABOUT THE AUTHOR
Josh Lemos is the Chief Information Security Officer at GitLab Inc., where he brings 20 years of experience leading information security teams to his role. He is responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected, fortifying the Gitlab DevSecOps platform and ensuring the highest level of security for customers.
A talented security practitioner and technology leader, Josh is widely recognized for his strategic vision, his ability to drive growth and innovation, and his passion for building and empowering teams. He believes in technology’s potential to transform the world and the need to secure it against emerging threats. Josh has led security teams at numerous high-growth technology companies including ServiceNow, Cylance, and most recently Block (formerly known as Square).
Josh’s commitment to securing technologies to make a positive impact in the world has been a common thread throughout his career. He serves as a mentor to aspiring information security professionals, and is active in supporting organizations that promote diversity and inclusion in the technology industry. Josh holds a B.S. in Computer and Information Systems Security from the University of San Francisco.
