Securing the enterprise in the age of AI agents

AI is transforming how enterprises work—and how attackers operate. Identity systems, AI agents, and cloud services are now prime targets, and traditional defenses like passwords and SMS codes are no longer enough. To stay secure, security and business leaders need to understand how modern threats actually work and which defenses still matter in the AI era.

What threat intelligence means in the AI era

Threat intelligence is the discipline of studying how attackers operate so defenders can stay one step ahead. Instead of just looking at isolated incidents, threat intelligence teams track adversaries, their tools, and their behaviors over time.

These behaviors are often grouped as TTPs: tactics, techniques, and procedures. Tactics describe the overall goal (for example, getting into an account), techniques describe how they try to achieve it (like phishing), and procedures are the specific playbooks they use in real attacks.

By mapping out TTPs, security teams can design defenses that specifically block the ways attackers break into systems. That might mean tightening access controls, changing authentication methods, or updating detection rules when new attack patterns appear.

What counts as a threat today?

Modern enterprise threats go far beyond simple password theft. They now include:

Account takeover: Attacks aimed at gaining control of user accounts, especially those tied to identity providers or admin consoles. Once inside, attackers can move laterally, escalate privileges, or enroll their own devices as trusted factors.

Initial access into systems: Gaining a first foothold in an organization, often through phishing, malware, or exploiting weak configurations. From there, attackers pivot deeper into infrastructure and data.

Abuse of AI services: Using AI platforms and agents for malicious purposes, often by hiding behind free trials, stolen sessions, or compromised API keys.

Identity and access management sits at the center of all of this. If attackers can bypass or abuse identity controls, they can often bypass most other protections as well. For a broader view of how identity, tools, and agents fit together, see this guide to enterprise AI security.

From phishing to vishing: social engineering grows up

Phishing is still one of the dominant threats to enterprises, but it has become more polished and convincing. Attackers don’t just send crude emails anymore—they combine multiple channels and psychological tricks to get users to approve access.

One growing trend is vishing (voice phishing). Instead of only sending a fake email, attackers call victims directly and pretend to be from IT support or the help desk.

A typical vishing playbook looks like this:

1. The attacker calls an employee, claims to be from the help desk, and mentions “suspicious activity” on their account.

2. They direct the employee to a login page that looks identical to the real corporate sign-in page—but it’s a phishing site.

3. The employee enters their username and password. If the account uses push notifications or SMS as a second factor, the attacker prompts them to “approve the security check” or “read back the code.”

4. Once the attacker is in, they often immediately enroll their own device or factor, so they can keep access even if the user becomes suspicious later.

Because the interaction feels personal and urgent, many users comply, especially new employees or those under time pressure.

Why push, SMS, and OTP are now “weak factors”

Methods like SMS codes, one-time passwords (OTP), and push approvals were once viewed as strong multi-factor authentication. In a world of advanced social engineering and vishing, they are now considered weaker assurance factors.

The core problem is that these factors can be verbally or visually shared. If an attacker can get someone on the phone, they can simply say:

“Read me the SMS code you just got.”

or

“You’ll see a push notification—just tap approve so I can secure your account.”

As long as a human can be tricked into sharing or approving the factor, attackers can bypass it. That’s why many security teams are pushing toward phishing-resistant authentication.

Passkeys and WebAuthn: phishing-resistant authentication

Phishing-resistant authentication methods are designed so that users literally cannot hand over their secrets to attackers, even if they want to. The two key technologies here are passkeys and WebAuthn (FIDO2).

Passkeys are cryptographic credentials bound to a specific website or app. When you sign in, your device uses a private key to sign a challenge from the legitimate site. That private key never leaves the device and cannot be typed, read aloud, or pasted into a phishing page.

In practice, this looks like:

• The user goes to the real login page.

• They confirm their identity with biometrics (face or fingerprint) or a device PIN.

• The device signs the challenge, and the user is in—without ever seeing or handling a code.

Because the key is cryptographically tied to the legitimate domain, a phishing site at a different URL cannot use it, even if it looks identical to the real login page. This makes passkeys and WebAuthn-based methods dramatically more resistant to phishing and vishing.

Simple user habits that still matter

Technology alone is not enough. Some basic user behaviors still make a big difference, especially in the context of vishing and social engineering:

Verify unexpected calls: If someone calls claiming to be from IT or support and asks you to log in, approve a push, or read a code, hang up and call your official IT number instead.

Understand official policies: Organizations should clearly state that IT will never ask for passwords, codes, or push approvals over the phone. New hires should hear this early and often.

Slow down under pressure: Many scams rely on urgency (“your account will be locked in 5 minutes”). Training people to pause and verify can break that spell.

How attackers are using AI to scale their operations

AI is not just a defensive tool—it is actively used by attackers to increase the scale and speed of their campaigns. Common uses include:

Reconnaissance: Using AI to gather information about organizations, employees, and tech stacks. For example, generating lists of employees, roles, and phone numbers to target in vishing campaigns.

Identifying weak configurations: Analyzing public information, code, or documentation to find insecure settings, exposed API keys, or misconfigured services.

Generating phishing infrastructure: Quickly creating convincing phishing pages, login flows, or scripts that mimic real enterprise portals almost perfectly.

Because AI can automate large parts of the attacker workflow, defenders are facing more attacks, from more actors, at higher speed. This is one reason many enterprises are now investing in AI-powered defense as well, including AI-driven monitoring of access patterns and agent behavior. If you’re thinking about how to operationalize this, it’s worth reading how to manage AI agents at scale in the enterprise.

Fraudulent AI usage and free trial abuse

As AI models and tokens become more expensive, attackers are looking for ways to use them without paying—or without being traced. One emerging ecosystem centers on fraudulent registration and discount AI access gateways.

Here’s how it typically works:

1. Attackers create large numbers of fake accounts with AI providers, taking advantage of free trial credits.

2. They plug these accounts into their own gateway services, built on tools like OpenRouter or Open WebUI.

3. They advertise “90% cheaper access” to popular models like Claude, ChatGPT, or other cloud AI services.

4. Customers of these shady services send prompts to the gateway, which forwards them to the real AI providers using stolen or fraudulently obtained trial credits.

For the AI provider, this is a terms-of-service violation and a fraud problem. For enterprises, it’s also a signal: if your platform offers free trials or self-service sign-up, you need controls to detect and block large-scale fake registrations and abuse.

Session hijacking and stolen tokens

One of the most worrying trends in the AI age is the rise of session hijacking or token hijacking. Even if a user logs in with strong multi-factor authentication, attackers can sometimes bypass it by stealing the session token that keeps them logged in.

When you sign in to a web service, the system issues a session token, usually stored in your browser. That token tells the service, “this user is already authenticated,” so you don’t have to log in again on every page.

If malware—often called info-stealer malware—infects a device, it can search browsers and configuration files for:

• Session tokens

• Login credentials

• API keys

Once an attacker has a valid session token, they can import it into their own browser and instantly become that user, without ever knowing the password or MFA code. They keep that access until the token expires or is revoked.

How common are stolen AI sessions?

Stolen tokens and API keys are widely traded in underground markets and even semi-open channels like Telegram. Security researchers who examined data from info-stealer malware found:

• Large volumes of AI-related session tokens and API keys available for free or for sale.

• Many of these tokens were still unexpired, meaning they could be used immediately to take over accounts.

• Attackers could simply import these tokens into a browser and access AI services or linked billing accounts as if they were the legitimate user.

This is especially dangerous when AI services are tied to payment cards or when they have access to sensitive internal data through plugins, connectors, or agents.

Defenses against session and token hijacking

Defending against token theft requires both technical controls and good hygiene around where and how tokens are stored.

Device-bound session credentials: A promising emerging standard is device-bound session credentials. Similar in spirit to passkeys, this approach cryptographically ties a session token to the device or browser where it was issued. If an attacker steals the token and tries to use it on another device, it simply won’t work.

This standard is still early and not widely deployed, but it points toward a future where stealing raw tokens from browsers is much less useful to attackers.

Service-side protections: AI providers and SaaS platforms can also reduce risk by:

• Detecting unusual access patterns and forcing re-authentication.

• Logging users out after suspicious activity.

• Removing stored payment methods if they suspect account compromise.

For example, some AI providers have proactively logged users out and removed payment cards from accounts to prevent attackers from burning through tokens and racking up large bills on stolen sessions.

Protecting configuration files and API keys: Tokens are not just in browsers. AI agents and tools often store API keys in configuration files or environment variables. Info-stealer malware actively looks for these too. Enterprises should:

• Avoid hardcoding API keys in plain text files.

• Use secret managers and vaults where possible.

• Regularly rotate keys and monitor for unusual usage.

AI agents as both helpers and attack tools

2026 is shaping up to be the year of the AI agent: systems that can take actions on behalf of users, connect to tools, and orchestrate workflows. While powerful, these agents also introduce new security challenges.

Key risks include:

Over-permissioned agents: Agents that have more access than they need—to data, tools, or systems—become high-value targets. If an attacker compromises an agent, they can use its permissions to exfiltrate data or perform actions at scale.

Agent misuse by attackers: If attackers gain a foothold in an environment, they may use existing agents as automation tools to search for sensitive data, move it, or interact with internal systems faster than a human could.

Leaked credentials through agents: Poorly configured agents may log or expose credentials, tokens, or sensitive prompts in ways that can be harvested later.

Enterprises need a clear strategy for agent governance: what agents can do, what they can access, and how their behavior is monitored.

Security fundamentals that still matter

Despite all the AI-driven change, core security principles remain as important as ever—arguably more so.

Principle of least privilege: Systems, users, and agents should only have the minimum access they need to do their jobs. This limits the blast radius if any one account or agent is compromised.

Strong identity and access management: Attackers—and AI-assisted attack tools—will continue to look for weak identity controls: reused passwords, shared accounts, static API keys, and legacy MFA methods. Investing in modern identity security is now a prerequisite for safe AI adoption.

Secure AI agent management: Treat agents like powerful service accounts. Define clear scopes, regularly review permissions, and monitor their actions. Assume that if attackers breach your environment, they will try to repurpose your agents for their own objectives.

What CISOs and tech leaders should tell the board

For business and technology executives, the conversation with the board over the next 12–24 months should focus on a few key points:

1. AI is amplifying both sides. Attackers are using AI to scale phishing, reconnaissance, and exploitation. Defenders must also use AI for detection, response, and identity protection to keep pace.

2. Identity is the new perimeter. Securing identities, sessions, and agents is central to protecting AI initiatives and cloud environments. This includes moving to phishing-resistant authentication and improving session security.

3. Fundamentals still apply. Principles like least privilege, secure key management, and rigorous access reviews are not outdated—they are the foundation for safe AI deployment.

4. Agent governance is emerging as a board-level topic. As AI agents gain more capabilities, boards will want assurance that there is a clear framework for what agents can do, how they are monitored, and how abuse is detected and contained.

Ultimately, the organizations that thrive in the AI age will be those that treat security and identity as strategic enablers—not afterthoughts—of their AI and automation roadmap.