As AI agents transition from experimental toys to autonomous enterprise workers, the attack surface has fundamentally changed. Fortinet's release of FortiOS...
Why agent autonomy rewrites the threat model
AI agents are no longer single-shot chat sessions. They hold credentials, call tools, read files, open network paths, and chain actions across systems without a human in every step. That shifts risk from “someone typed a bad prompt” to “an autonomous process with privileges ran for minutes or hours under incomplete supervision.” The blast radius is larger: one compromised agent session can pivot through APIs, cloud consoles, and internal services the way a scripted attacker would—only faster and with less obvious intent in traditional logs.
Security teams therefore need controls that treat agents as first-class principals: identity, policy, session lifetime, tool allowlists, and egress rules that apply to machine-initiated work the same way they apply to user traffic. FortiOS 8.0’s agentic-security framing is useful here because it puts the network and security fabric in the path of that traffic instead of hoping application-layer logging alone will catch abuse after the fact.
MCP visibility: seeing what agents actually touch
Model Context Protocol (MCP) style integrations give agents structured access to tools and data sources—databases, tickets, code repos, SaaS APIs. Without visibility into those tool calls, defenders see only opaque HTTPS or app traffic and miss the semantic layer: which tool ran, with which parameters, on behalf of which agent, against which resource. That gap is where data exfiltration, privilege abuse, and silent configuration changes hide.
MCP visibility means instrumenting and inspecting the control plane of agent–tool interaction: request/response patterns, destination services, authentication context, and anomalous tool sequences. When that signal feeds the same security stack that already enforces firewall, ZTNA, and segmentation policy, operators can block risky tool paths, quarantine a misbehaving agent identity, and correlate agent activity with classic network events in one investigation timeline.
- Map every agent identity to a least-privilege role and short-lived credentials.
- Allowlist MCP tools and destinations; default-deny anything unreviewed.
- Log tool name, target, actor, and outcome alongside network flow metadata.
- Alert on unusual tool chains (broad read → bulk export → new external host).
Putting FortiOS 8.0-style controls into practice
Start by inventorying where agents run and how they leave the segment: jump hosts, API gateways, browser automation, and MCP servers. Place policy at those choke points so agent egress is explicit, not “same as developer laptops.” Use segmentation so an agent that only needs a ticketing API cannot reach payroll or production data stores. Prefer identity-aware access for agent service accounts so a stolen token is limited by time, scope, and network path—not by hope that the token never leaks.
Operationally, pair prevention with detection. Block known-bad destinations and unsigned or unknown MCP servers; rate-limit high-impact tools (bulk export, shell, admin APIs); and require human approval for irreversible actions where business risk is high. When something looks wrong, the response should be fast and reversible: revoke the agent session, cut the tool channel, and preserve evidence from both the MCP layer and the network path.
What “good” looks like day to day
Success is not a single product toggle. It is a loop: define which agents may exist, constrain how they talk to tools, watch those conversations with enough context to explain intent, and feed incidents back into tighter allowlists. Fortinet’s FortiOS 8.0 emphasis on agentic security and MCP visibility fits that loop by making agent traffic governable inside the security fabric rather than as a side channel outside it. Teams that implement the identity, path, and visibility pieces together will catch and contain autonomous misuse before it becomes a full lateral-movement story.