Navigating the Latest CISA Guidance on Agentic AI

Navigating the Latest CISA Guidance on Agentic AI

The Cybersecurity and Infrastructure Security Agency (CISA), along with the NSA and international partners, recently issued guidance for the Careful Adoption of Agentic Artificial Intelligence (AI) Services.

What is agentic AI?

Unlike traditional AI assistants that typically generate responses or insights, agentic AI can execute tasks, make decisions and influence real world systems. This shift introduces significant new capabilities, but also new risks.

CISA’s guidance emphasizes several core principles for adopting these systems responsibly:

• Security first deployment
• Human oversight and control mechanisms
• Least privilege access to systems and data
• Continuous monitoring and auditing
• Strong governance and accountability frameworks

CISA is encouraging organizations to move forward thoughtfully and deliberately, ensuring protections are in place as these systems gain access to sensitive environments and business critical workflows. Agentic AI introduces a new level of autonomy that can amplify both value and risk.

Why is it important?

AI-enabled business tools are rapidly entering the enterprise market, driven by demand for automation, productivity gains and operational efficiency. At the same time, cybersecurity and compliance concerns are growing just as quickly.

Customer scrutiny is becoming a direct forcing function for how technology companies design, deliver and position AI solutions. As enterprises increasingly demand clarity on access controls, identity management, human oversight, auditability and data protection, AI-driven vendors and partners can no longer treat governance as an add on; it must be embedded into the core architecture.

This shift is driving technology companies to build AI systems that are inherently secure, transparent and controllable, with robust permission models, end-to-end logging and continuous monitoring as standard capabilities. It is also accelerating the adoption of formal governance frameworks that define accountability for autonomous actions and ensure traceability across AI driven workflows.

In effect, customer expectations, amplified by guidance like CISA’s, are redefining AI as an operationally integrated, risk-managed system rather than a standalone tool. Enterprise-grade governance, auditability and security are necessary in the current market.

For vendors and partners, this guidance introduces both new responsibilities and added opportunities in developing AI-enabled platforms, SaaS solutions and automation tools.

Opportunities and Implications

Government entities will expect vendors and partners to build AI systems with security and accountability in mind from the outset. This includes:

• Secure by design development
• Identity and access management
• Transparency and explainability
• Logging and observability

End-users are also developing how they assess technology providers. Increasingly, they will evaluate solutions based on:

• AI security posture
• Compliance readiness
• Audit capabilities
• Human in the loop safeguards

This means that purchasing decisions will extend beyond functionality and performance to include trust, accountability and risk mitigation.

Reseller partners are increasingly becoming strategic advisors as customers navigate AI adoption. Beyond delivering technology, they are expected to help entities understand AI related risks, implement governance frameworks, align with compliance requirements and evaluate security architecture. This shift creates a clear opportunity for partners to move into more consultative roles, offering services such as AI readiness assessments, governance and risk strategy and secure architecture design. Ultimately, customers are not just buying AI capabilities; they are buying confidence that those capabilities can be deployed securely, responsibly, and in alignment with enterprise expectations. IT companies that prioritize trustworthy AI, aligned with guidance like CISA’s, will likely gain trust faster, particularly in enterprise and government markets.

Additionally, the international coordination behind this guidance suggests that global expectations for AI security may become more standardized, reinforcing the need for vendors and partners to prepare early.

CISA’s guidance is an early but important signal of where enterprise AI governance may be heading. While agentic AI adoption is accelerating, security and governance maturity are still catching up.

For organizations, the path forward should focus on:

• Incremental deployment strategies
• Human oversight and control mechanisms
• Strong identity and access controls
• Continuous monitoring and logging
• Integration of AI into broader risk governance frameworks

For technology vendors and reseller partners, several key trends are worth watching:

• Emerging AI security standards and frameworks
• Increasing government procurement scrutiny
• Rising demand for AI transparency and explainability
• Evolving cybersecurity guidance around autonomous systems

To prepare, vendors and partners should begin:

• Educating internal teams on AI governance principles
• Reviewing and strengthening product security controls
• Developing clear, customer facing guidance and best practices
• Positioning themselves as trusted advisors, not just solution providers

To get more TD SYNNEX Public Sector Market Insight content, please visit our Market Intelligence microsite.
 

About the Author:
Tash Elias is a Discovery Rep on the DLT Market Insights team. She graduated from George Mason University and lives in Herndon, VA.