What to do first when you get 90 days to secure AI agent data
Nol8's CEO says teams should map AI agent data paths and enforce runtime limits within 90 days.
In a Help Net Security interview, Nol8 CEO Kelly Herrell argues the first check for production AI agents is the data path: reachable sources, context inputs, tools, inter-agent communication, and where results go. He highlights ticketing systems, CRMs, shared drives, and chat history as overlooked stores that agents can correlate instantly, including tickets that may contain live credentials. His 90-day advice is to map flows and enforce policy on the highest-risk paths first, postponing full classification and per-agent rewrites. He recommends a deterministic in-path control, called an AI Data Plane, that inspects payloads rather than relying on labels.
- Inventory of agents is not the same as exposed data paths.
- Ticketing systems can hold credentials, customer data, and incident detail.
- Week one should map flows and measure sensitive data movement.
- Enforce redaction per agent and role instead of blocking whole systems.
- Vendors
- Nol8
- Products
- AI Data Plane
- Organizations
- Nol8Help Net Security
From the original article
5 min read at helpnetsecurity.com
In this interview with Help Net Security, Kelly Herrell, CEO at Nol8, explains where AI agents create exposure inside organizations. The first thing to examine is the data path: what an agent can reach, what enters its context, and where results go. Ticketing systems, CRM platforms and shared drives hold years of sensitive context that agents can pull together in seconds.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.