--- title: The Agents Are Already in Production description: Field notes from Ai4, Black Hat, and DEF CON: enterprises now run hundreds of AI agents in production and embed them in every SaaS product, while security practice lags behind. url: https://ziosec.com/blog/the-agents-are-already-in-production category: Blog publishedAt: 2026-08-11 author: Aaron Walls authorRole: Co-Founder & CEO tags: ai-agents, enterprise-security, third-party-risk, field-notes --- *Field notes from Ai4, Black Hat, and DEF CON.* Enterprise AI is past the prototype phase. Most of the companies we met across Ai4, Black Hat, and DEF CON are running hundreds of agents in production, connected to databases, internal tools, and customer data. Security practice has not kept pace. That gap was the real story of our week in Las Vegas. ## The dominant pattern is "chat plus" Ask an enterprise what their agents actually look like and the answers are strikingly consistent: powered-up deployments of Microsoft Copilot wired into databases and internal tools, with many of them built on Claude. Very few teams are building on developer-focused frameworks like LangChain or n8n, and fewer still on Bedrock. That tells us where the market is heading. The dominant enterprise use case is not fleets of autonomous agents running unattended workflows. It is "chat plus": a conversational interface with real credentials and real reach into production systems. A human stays in the loop, but the model holds the keys. From a security standpoint, "chat plus" is not the safe version of AI adoption. It is a language model with database access, tool access, and access to whatever a clever or malicious prompt can talk it into. The blast radius is defined by the connections, not by how agentic the architecture diagram looks. ## Every SaaS product is quietly becoming an agent The second pattern was just as consistent: nearly every SaaS company is building agents directly into their products. Each embedded agent changes the vulnerability structure of the product it lives in. It adds a new input surface in natural language, new privileges through tool and data access, and new failure modes like manipulated reasoning and data leakage through injected instructions. The product your vendor shipped last year and the product they ship today are different systems, even if the logo has not changed. Two practical consequences follow. First, third-party risk assessments need an update. A questionnaire written for static software does not ask the right questions about a vendor whose product now includes a reasoning system with access to your data. If your TPRM program has not changed in the last year, it is assessing software that no longer exists. Second, these agents need continuous pentesting, not an annual point-in-time exercise. Agent behavior shifts with every model update, prompt change, and newly connected tool. The only way to know an agent is doing what you expect with customer data is to keep testing it the way an attacker would, continuously. Regulation will get here too. HIPAA has not caught up to embedded agents handling patient data yet, but it will, and healthcare will not be the last vertical. Organizations that build continuous agent testing into their programs now will be compliant by default when the rules land. Protect yourself before you are told to. ## Black Hat: AI sprinkled on top Black Hat has become the conference where legacy security companies sell to legacy software vendors, now with a little AI sprinkled on top. The dominant motion is dropping an AI assistant into the existing SOC to speed up triage and analysis. That is useful. It is also incremental. What was rare on the show floor: companies that are AI-first, built to solve the new problems AI itself creates. Agent manipulation, prompt injection at machine speed, agentic supply chain risk. Most of the industry is using AI to do old jobs faster. Very few are securing the new jobs AI is already doing. ## DEF CON: authentic as ever, and early on the frontier DEF CON is a party. It is fun, it is authentic, and it remains the most genuine gathering in security. The AI sessions, though, are still largely at the surface relative to the next wave coming out of the frontier labs. That is not a knock on the researchers. Most of the market is still figuring out how AI folds into their organizations, and very few teams have had the opportunity to live on the bleeding edge of it every day. We have spent the last two years building offensive AI security, and the distance between what we see daily and what is being presented publicly is still wide. The talks reinforced how early this market really is, and how few companies are operating at the frontier. ## The gap is the story Put the three conferences together and the picture is clear. Deployment is sprinting: hundreds of agents per enterprise, agents embedded in every SaaS product, models holding real credentials. Security practice is walking: AI features bolted onto legacy tooling, TPRM programs built for a software world that has already changed, and regulation still a step behind. If you are deploying agents or buying software that embeds them, three moves matter now. Update your third-party risk assessments for embedded agents. Continuously pentest the agents you run and the agents your vendors ship. And get ahead of the compliance wave instead of waiting for it. This is the work we do at ZioSec every day. If your agents are already in production, so is your exposure. [Let's talk](/demo).