The Insider Who Was Never Hired: The Ultimate Guide to the Agentic Insider

For twenty years, insider risk meant a person. The person is still there. They have just started delegating.

An employee grants an AI agent access to their mailbox, their repository and their drive, then asks it to get something done. The agent works at machine speed, under that employee's identity, with that employee's permissions. Your logs record the employee.

That is an agentic insider: a non-human actor operating inside your trust boundary on human authority. It isn't a person and it isn't malware. It's a delegation — and delegation is the one thing your identity model, your data controls and your case management were never asked to represent.

We wrote a field guide for the practitioners who now have to investigate it. Read The Ultimate Guide to the Agentic Insider →

The numbers moved faster than the programs did

Four figures from the 2026 Verizon DBIR and the Palo Alto Networks Identity Security Landscape frame the whole problem:

• 109:1 machine identities per human identity. 79 of the 109 are AI agents.
• 45% of employees now use AI regularly on corporate devices, up from 15%.
• 67% of that AI use is signed in with a non-corporate account.
• 30% of organizations have immutable audit logging of what agents do.

Read the last two together. Most AI activity inside your organization is happening on an identity you don't control, and most organizations cannot reconstruct what it did.

Five forms, and the one nobody is ready for

The guide breaks the category into five forms of agent, each with a different route to access and a different signature in your telemetry:

1. The delegated agent

2. The shadow agent

3. The agentic browser

4. The promoted service identity

5. The hijacked agent

The last one is where most programs are thinnest. An attacker's instruction, embedded in a document, ticket, email or web page the agent was asked to read. In your telemetry it looks like a trusted employee exfiltrating data. The insider is real. The intent belongs to someone outside.

An agentic insider can be created without the employee ever intending it.

Nothing here requires a new exploit

That's the difficulty. Every layer of the detection stack rests on a premise about how work happens, and delegation invalidates the premise without tripping a single control.

Take UEBA. It was built on the assumption that deviation from an established baseline is a usable proxy for risk. But every agentic action is a deviation. Baseline it in and you go blind. Alert on it and you drown. Deviation was never the same thing as risk.

DLP, IAM and PAM, EDR and SIEM correlation each break in their own specific way. The guide lays out all five assumptions side by side, along with the structural change underneath them: intent moved out of the action and into the instruction. For a human insider, the action carried the intent — the download, the upload, the forward. For an agentic insider, the action is neutral and the intent lives in a prompt, a system message, or a paragraph buried in a file the agent was told to summarize.

Almost no enterprise records that layer. Which is why agentic cases so often end with a timeline nobody can interpret.

Six questions your telemetry should already answer

Here's the one we'd start with, because a no turns a two-hour investigation into a two-week one:

Can you retrieve the instruction that produced a given action, and where that instruction came from?

The guide includes the other five, the three telemetry layers to join (and why the joins are what matter), a full collection checklist for detection engineers, and two moves that need no new tooling but that no agentic case can close without.

And when one lands

There's a five-question sequence for IR and the SOC. Establish:

1. The actor

2. Authorization

3. Instruction

4. Data movement

5. Accountability

Revoke the grant, not the human. Suspending the employee stops the work and leaves the delegation intact.

One point worth carrying in before you read it: the first agentic insider most teams meet is not malicious. It's a competent employee who delegated more access than they realized to a tool that worked faster than anyone expected. Treating that case as an investigation rather than a violation is what keeps the next hundred employees telling you what they've connected.

Read the guide

Twenty minutes, six pages, no gate. The full guide covers the category definition, the five broken assumptions, the instrumentation checklist, the investigation sequence, and where insider risk goes when policy stops being able to describe it in advance.

The Ultimate Guide to the Agentic Insider →

‍