ReadingResearchRadarInvestment frameworkAI Company Primary Sources
Sign in / Sign up
← Back to reading
NewsMaterial3 min readDisconfirmAI Editorial

Rick Vanover, Vice President of Product Strategy at Data Protection Company Veeam: Zero Trust Should Extend to AI Agents, with Recovery Precision Down to the Change Unit

Rick Vanover, Vice President of Product Strategy at data protection company Veeam, writes that once AI agents connect to enterprise data and infrastructure, the risk shifts from the models themselves to the permissions the agents can access; current zero-trust systems centered on people and devices leave monitoring blind spots, and unrecognized security gaps such as 'shadow agents' may expand.

2026-10-29 15:00 GMT+8

AI tools resolved to be introduced last year already feel like outdated technology this year. However, Rick Vanover, Vice President of Product Strategy at Veeam Software, believes the real risk lies not in the models themselves—when an AI agent connects to enterprise data and infrastructure, model issues become data issues, ultimately evolving into a threat to the entire business.

He cites the personal information leak incident at South Korean streaming platform Tving as an example: attackers stole 'developer access keys,' gained unauthorized access to internal systems, and leaked information for approximately 39.54 million accounts.

Vanover points out that if the permission design for AI agents is improper, it may far exceed the scope required for any single employee to complete a task. Agents can publish content, deploy software, update records, and execute workflows across multiple systems. Human oversight remains necessary, but it cannot control machine-speed operations in real time.

More perplexingly, existing zero-trust systems are largely built around people and devices. Automated accounts, APIs, and agents granted permissions operate directly on sensitive data beyond human sight, forming so-called 'shadow agents'; these security gaps unrecognized by enterprises may continue to widen.

The first layer of response he proposes is to make data itself the primary control line: classify which data is sensitive, apply access policies, masking, tokenization, encryption, and data loss prevention rules, thereby limiting what agents can query, send externally, or modify. These controls cannot be bound to specific applications—controls must follow the data as it moves across application, API, and infrastructure boundaries.

Sign in / Sign up
ReadingResearchRadarInvestment frameworkAI Company Primary Sources

The second layer is a shift in recovery strategy. Vanover argues that when AI agents make mistakes, simply rolling back the entire system is insufficient. While major intrusions or large-scale data damage indeed require full recovery, applying the same method to localized errors would erase work completed normally afterward. He proposes 'change-unit recovery': tracking specific configurations or transaction records modified by AI agents and rolling back only the problematic parts to their original state. Implementing this requires fine-grained change logs, information on inter-system dependencies, and protected recovery points that AI agents cannot modify or delete after the fact.

No system can prevent errors with 100% certainty. When excessive permissions, loose security nets, and overly fast processing speeds overlap, even a tiny mistake can instantly balloon into a major incident. Therefore, security planning must begin with the candid premise that 'errors can occur at any time.'

It should be noted that Vanover's arguments are architectural recommendations attributed to his professional judgment, not independently verified industry standards or product test reports. He did not provide quantitative implementation costs for change-unit recovery, specific toolchains, or failure rate comparisons for deployed cases.

Sources

  • etnews.com미래를 보는 창 - 전자신문↗
Continue researching →