What Conventional Security Got Right (and Where It Stops)

There is a temptation in agentic security writing to position conventional security as the thing being replaced. The old model is broken; the new model fixes it; out with the old, in with the new.

This framing is wrong. It also leads to bad architecture decisions.

Conventional security is not broken. It is partial. The investment your organisation has made in identity, access management, supply chain, network segmentation, vulnerability management, and incident response is load-bearing in the agentic operation. None of it should be discarded. Most of it should be extended.

The honest framing: conventional security is half the discipline. Agentic security is the other half. Both are necessary; neither is sufficient. The CISO who treats agentic security as a replacement for conventional security will lose the foundation. The CISO who treats it as an addition to conventional security will keep the foundation and add the layer that agents specifically require.

What Conventional Security Got Right

Decades of conventional security work produced disciplines that are directly load-bearing for agents:

Identity and access management. The discipline of binding actors to verifiable identities, granting access through structured authorisation, and revoking it cleanly when the binding ends. Workload identity for agents (SPIFFE, federated tokens, attested workload binding) is a direct extension of this discipline.

Supply chain attestation. The discipline of verifying that the components running in your environment are the components you authorised — verified provenance, signed artifacts, build-time attestations. Agent supply chain (model provenance, framework provenance, runtime provenance) extends this directly. SLSA, in-toto, sigstore — all conventional supply-chain primitives that work for agents.

Network segmentation and least privilege. The discipline of bounding what any actor can reach in the environment, defaulting to deny, granting access through justified exceptions. Agent action scoping, mandate-based authority, bounded tool access — all extensions of this.

Vulnerability management. The discipline of inventorying components, tracking known weaknesses, patching ahead of exploitation. Model versions, framework versions, runtime versions — all subject to the same discipline.

Incident response. The discipline of detecting, containing, eradicating, and recovering from compromise. Agent-specific incident patterns are new; the response discipline that handles them is well-established.

Audit and compliance. The discipline of producing evidence that controls operate as designed, surviving regulatory scrutiny, demonstrating due diligence. The forensic ledger and attestation chain extend this directly to per-action evidence.

Each of these disciplines is necessary for agentic security. None of them needs to be reinvented. The work is to extend them — apply them to agents, with agent-specific instrumentation, in the per-action shape that agentic operations require.

Where Conventional Security Stops

Conventional security is adversary-relative: it asks can the system resist compromise? It is built around the question of whether bad actors can get in, do harm, exfiltrate data, persist on the system. The discipline is excellent at this question.

For agents, several questions sit outside the adversary-relative frame:

1. Acting for the wrong purpose. An authorised agent — perfectly authenticated, supply-chain attested, behaviourally consistent — can take an action that is technically within its identity-bound scope but pursues a purpose the entrusting party never intended. The action is not adversarial; the intent is misaligned. Conventional security has no instrument for this; it sees the action’s authentication as the answer to “is this legitimate.”

2. Recovering from internal failure. A sensor reads wrong. A calculation overflows. A model produces an unexpected output. The system has not been attacked; it has failed internally. Conventional security barely addresses non-adversarial internal failure. The agent operation, where models can produce arbitrary outputs from valid inputs, encounters internal failure as a continuous condition.

3. Capability under sustained load. An agent can be perfectly secure at low load and behave catastrophically at high load — not because attacked, but because the engineering doesn’t hold under stress. Conventional security has performance disciplines but doesn’t treat capability under load as a safety question.

4. Useful engagement vs. refusal-as-default. Conventional security has no opinion about whether a system is useful. It opines about whether the system is compromised. An agent can be perfectly secure and useless — refusing every ambiguous case, never engaging, never delivering value. This is a safety failure that conventional security is structurally blind to.

These four are outside the adversary-relative frame. They require a different discipline: agentic safety engineering, which addresses alignment, resilience to internal failure, and capable engagement at consequential scale.

The Inversion (Briefly)

Conventional security covers part of the resilience facet of safety — specifically, the resilience-against-attack. It does not cover alignment. It does not cover utility. It barely covers non-adversarial resilience.

This means safety, structurally, is bigger than security. Safety ⊃ Security. The kitchen analogy: a kitchen can be locked perfectly (security) and still produce harm if the cook is misled, mistaken, or unable to use the equipment (safety).

The agentic-systems community is not the first to encounter this. Process safety engineering — the discipline that engineers chemical plants, aerospace systems, automotive controls — has held this position for decades. Security against attack is not the same as safety in operation. Both are necessary; the broader discipline is safety.

For agentic operations, the same inversion holds. Conventional security is preserved as the resilience-against-attack contribution. Agentic safety adds alignment, non-adversarial resilience, and utility-under-load. The composition is multiplicative — both required, neither sufficient alone.

What This Means for Architecture

The architecture that follows from this framing has specific properties:

1. The conventional investment stays. Identity systems, supply-chain infrastructure, network segmentation, vulnerability management, incident response, audit machinery — all of this remains in place. The agentic layer is built on top of this foundation, not as a replacement for it.

2. The agentic layer adds, doesn’t replace. Mandate validation, intent verification, bounded execution, output attestation, forensic ledger, capability-and-consequentiality awareness — these are additional surfaces, integrated with conventional security, not parallel to it.

3. The integration is at the per-action layer. Conventional security operates at deployment-time and at coarse-grained authority levels. The agentic layer operates at per-action level. The integration is: for every action, the conventional security checks fire (identity, supply chain, network, etc.) AND the agentic checks fire (mandate, intent, bound, attestation). Both must pass.

4. The teams must compose. The security org that runs conventional infrastructure and the team building agentic safety surface are not separate. They are operating one architecture. The conventional security team’s expertise is essential; the agentic security work extends it.

A team that builds the agentic layer parallel to the conventional security investment ends up with two architectures that don’t compose. Actions go through one or the other but not both, and the gaps are where the failures land.

A team that builds the agentic layer integrated with the conventional investment ends up with one architecture, where every action gets both layers’ verdicts, and the composition is what produces the per-action evidence-based result.

What This Means for the CISO Role

For the CISO conversation, this clarifies the work:

• The conventional security organisation is the foundation of the agentic security operation. Not legacy; not deprecated; not “the old way.” The current foundation that the new layer is built on.
• The agentic security work is an extension of the CISO’s existing remit, not a parallel discipline. It uses the same skills, the same instincts, the same evidence-orientation — applied to a new substrate that requires per-action and per-mandate granularity that conventional infrastructure doesn’t natively support.
• The roadmap is additive: keep the conventional investment, add the agentic surfaces, integrate them at the per-action layer. The CISO who frames the work as replacement will lose the foundation. The CISO who frames it as extension will keep both.

This also matters for the budget conversation: the agentic security investment is not replacing the conventional security budget. It is adding to it, because the conventional security work is the foundation that the new work depends on. Treating it as replacement leads to under-investing in the foundation; treating it as extension funds both.

The Disposition

Conventional security got most of what matters right, for the question it was asking. The question it was asking is not the only question. Agents introduce additional questions — alignment, non-adversarial resilience, useful engagement — that the conventional discipline doesn’t address.

The honest framing: conventional security is necessary but not sufficient. Agentic security is what we add when the operation has actors that act with autonomous authority, in open input spaces, with consequential actions.

Both layers are required. The composition is multiplicative. Either alone leaves gaps. Together, they produce the architecture that agent operations actually need.

For the CISO who has spent twenty years building the conventional layer: that work is not behind you. It is the foundation of the next decade’s work. The new layer extends it. The integration is what defines the operation. The budget is additive, not substitutional.

A discipline as broad as Zero Trust for agentic systems doesn’t replace what came before. It receives it, builds on it, extends it where the substrate requires extension, and acknowledges what it inherited. That is the standing posture for technical work that lasts.