Darktrace CEO: AI Agents Are the New ‘Insider Threat’

Darktrace CEO Ed Jennings warned that autonomous AI agents with access to corporate data and infrastructure are creating a new insider-threat risk. The company is launching tools to monitor shadow AI, agent identities and behavior as cybersecurity controls lag rapid enterprise AI adoption. Behavioral monitoring could mitigate unauthorized agent activity while allowing companies to capture AI productivity benefits.

Analysis

Enterprise AI deployment is creating a new security-control plane: machine identities, agent permissions, tool-call logs, and behavioral baselines. The spend opportunity is likely to accrue first to incumbent identity and endpoint/security-platform vendors—PANW, CRWD, MSFT, OKTA and CYBR—because customers will prefer extending existing telemetry and policy stacks rather than adding a standalone monitoring console. Darktrace’s positioning is directionally credible, but its financial upside depends on whether agent monitoring becomes a budgeted category versus a feature bundled into broader SIEM, identity, and cloud-security platforms.

Near term (next 1-3 months), this is more likely a security-budget reallocation narrative than incremental IT spending: vendors with identity governance, privileged-access management, and security-data moats should outperform point solutions. PANW can monetize through platform consolidation; CRWD through endpoint/identity telemetry and Charlotte AI; CYBR has the cleanest direct exposure to privileged machine credentials. The second-order loser is unmanaged SaaS and workflow-automation vendors whose products are adopted outside central IT, as procurement may impose auditability and least-privilege requirements that slow seat growth.

Contrarian view: market enthusiasm around "agentic AI security" may be premature absent a high-profile, attributable enterprise incident or regulatory mandate. Security buyers already face tool sprawl, and generic behavioral analytics claims will not command new budget unless vendors demonstrate reduced false positives, measurable policy enforcement, and integration with identity systems. A material breach involving an autonomous agent could rapidly pull forward spending over 6-18 months, but it would also favor scaled incumbents and compress valuation multiples for smaller single-product vendors.

Key Decisions for Investors

• Prefer a 6-12 month basket long in PANW, CRWD and CYBR over speculative pure-play AI-security exposure; use a roughly equal-weight construction, with CYBR as the highest-beta identity/privilege expression. Thesis fails if billings/RPO commentary shows AI-security demand is merely displacing existing modules without net retention or platform expansion.
• Pair trade for the next 1-3 months: long CYBR / short OKTA. CYBR has stronger exposure to privileged machine and agent credentials, while OKTA remains more exposed to competitive pricing and execution risk in workforce identity. Exit if OKTA demonstrates sustained large-customer expansion and operating-margin improvement that closes the relative-growth gap.
• Do not underwrite a standalone Darktrace-style category winner until evidence emerges in enterprise procurement data: attach rates, ACV uplift, and renewals tied specifically to agent governance. Set an alert for a disclosed agent-driven breach or new SEC/NIST-style control guidance; either could be the catalyst to upgrade sector spending estimates.
• For broader software exposure, avoid chasing an immediate cybersecurity multiple expansion on this theme. Add only on sector pullbacks or after earnings confirmation that AI-security modules raise net retention; the key observable metric is incremental subscription ARR rather than management commentary on AI adoption.