Why Agent Runtime Security Fails Without Foundational Visibility
Gateway-only security strategies miss critical risks within third-party AI agent ecosystems.
1The Gateway Fallacy
Most agent security pitches promise real-time blocking, yet this only works if traffic passes through an enterprise-owned gateway. Many modern agents operate entirely within third-party platforms like Salesforce or Slack. Relying solely on gateways creates a dangerous blind spot, as these tools cannot inspect actions occurring inside external trust boundaries.
2The Unreachable Skill Gap
The OWASP Agentic Skills Top 10 identifies the unreachable skill scenario as a major governance failure. When agents execute tasks inside platforms like Microsoft 365 or Workday, they utilize internal application features and data. External scanners cannot reach these environments, rendering traditional perimeter-based security controls ineffective against unauthorized agent behavior.
3Contextual Decision Making
Runtime decisions require more than just observing an action. A support agent pulling customer data might be performing legitimate work or exfiltrating sensitive information. Without understanding the agent's identity, permissions, and the full delegation chain, security systems cannot distinguish between normal activity and a compromise, leading to ineffective, binary blocking.
4The Chain Reaction Risk
Security enforcement often evaluates only the final hop of an agent's request. This approach misses the fact that authority may have arrived through an unapproved chain of events. Judging the entire causal path is essential, but this requires a pre-existing map of identity, connectivity, and data sensitivity that gateways lack.
5Lessons from LiteLLM
In March 2026, attackers compromised the open-source gateway LiteLLM, exposing over 2,500 organizations. This incident proves that shared security components can become primary attack vectors. Treating a single gateway as the entire strategy concentrates risk, as the failure of that component results in a shared failure across the enterprise.
6Graduated Enforcement Models
Mature security requires a graduated response rather than simple blocking. Systems should allow known-good actions, warn users when justification is plausible, and redact data when necessary. High-stakes actions should be routed to humans, while kill switches must be available to revoke grants and preserve audit trails for compromised agents.
7The Four-Level Maturity Test
Enterprises can assess their posture using a four-level test: Blind, Inventoried, Governed, and Instrumented. Most organizations currently remain at the blind stage, lacking answers to basic questions about agent population and accountability. Moving to an instrumented state requires placing enforcement directly where agents run, rather than at a single point.
8Strategic Visibility Requirements
Effective agent security depends on building a map of identity, permissions, and activity before attempting enforcement. Tools like the Reco Graph demonstrate that analyzing reach rather than configuration is the superior unit of analysis. Organizations must prioritize discovery and posture management to ensure that future enforcement points snap into a known environment.
Original article: The Hacker News — Why Agent Runtime Security Fails Without Foundational Visibility