The 90-Day Plan CISOs Didn't Know They Needed: Map the Data Path…

On September 24, 2026, Nol8 CEO Kelly Herrell published a 90-day operational plan for securing data traversed by AI agents in production. The document flips established priorities: not an agent inventory, but the data path. Not perfect data classification, but a deterministic enforcement point in the path that reads every payload. The proposal arrives as the industry logs model attack rates near 92% and a machine-to-human identity ratio of 109:1.

Key Takeaways

Week 1 of the plan focuses exclusively on visibility: map paths between agents, data sources, models, tools, and other agents; measure sensitive data crossing boundaries; establish where policy can be enforced at runtime.
Authentication, authorization, and data governance are three distinct layers: knowing who the agent is and where it can go does not reveal what will actually cross the boundary.
The deterministic enforcement point must sit in the data path, read every payload, and decide based on content — not pre-classified labels.
The plan explicitly defers projects traditionally treated as urgent: massive identity redesign, agent rewrites, perfect data classification, role-based masked replicas.

Why Agent Inventory Is No Longer Enough

Herrell draws the distinction in blunt terms: "I don't ask for the list of agents. I ask for the data path." The reason is that most organizations know which agents are legitimate and what they are authorized to reach, but almost none know what an agent should see, carry forward, or disclose in a specific interaction. Ticketing systems, CRMs, shared drives, and chat histories contain years of sensitive institutional context that agents can correlate in seconds.

The human friction that acted as an implicit control — the time and knowledge required to manually assemble sensitive information from heterogeneous systems — is eliminated by agents, and with it the control. The result is a structural gap between authorization (where the agent can go) and data governance (what actually crosses the boundary).

The Concrete Risk: What Unit 42 Analysis on AWS Shows

Palo Alto Networks Unit 42's investigation of AWS AgentCore Harness documents a configuration that corroborates the data path problem. The shell tool and file_operations module are enabled by default, with the shell running as root inside the harness. Unit 42 demonstrated that the shell tool reaches the same memory space where credentials are resolved in plaintext at runtime. A prompt injection attack can execute arbitrary commands with root privileges without any misconfiguration: it is the out-of-the-box state.

AWS closed the report as "informational" under the shared responsibility model, citing allowedTools scoping and egress filtering as customer-side controls. The cloud provider's position assigns no CVE and prescribes no patch, but confirms that actual enforcement falls on the customer's data architecture.

Week by Week: The 90-Day Operational Plan

Nol8's plan structures the initial quarter in weekly phases. Week 1 is dedicated exclusively to visibility: map paths between agents, data sources, models, tools, and other agents; measure how much sensitive data crosses boundaries; establish where policy can be enforced at runtime. This phase does not presuppose solving the problem, but measuring it.

Subsequent weeks focus on building the deterministic enforcement point. The requirements are four: it must sit in the data path and be non-bypassable; it must read every payload; it must decide based on data content, not pre-classified labels or tags; it must be deterministic — producing the same decision for the same input. Herrell emphasizes that control living in every single agent's code fails at the first team that forgets to call it; enforcement in the data path is not optional because it does not depend on individual developers' memory.

The plan explicitly defers projects organizations tend to treat as prerequisites: massive identity redesign, agent rewrites, perfect data classification, role-based masked replicas, guardrail libraries in every agent's code. The logic is that these projects take months or years, while the data path risk exists now.

Industry Numbers: Low Preparedness, Rising Attacks

Available data paints a picture of widespread exposure. According to the Cisco State of AI Security 2026 report, cited by Help Net Security, only 29% of organizations declare themselves prepared to protect agentic AI deployments. Multi-turn jailbreak attacks have reached 92% success rates in tests on eight open-weight models, according to Cisco research reported by Amy Chang.

The machine-to-human identity ratio stands at 109:1, with AI agents as the primary growth driver, according to the Palo Alto Networks 2026 Identity Security Landscape report cited in CDO Magazine. NeuralTrust reports that 94.4% of AI agents in a 2025 benchmark were vulnerable to hijacking via content read by the agent (indirect prompt injection), with an OWASP/Gravitee estimate of 34% of deployed agents affected by prompt injection.

"An inventory of agents tells me what the organization believes it deployed. The data path tells me what it exposed. The gap between the two is the exposure." — Kelly Herrell, CEO Nol8

What to Do Now

For CISOs with AI agents in production, Nol8's 90-day plan offers an immediate operational sequence. Week 1 requires only visibility: trace every path between agents, enterprise data sources, LLM models, tools, and other agents; measure how much sensitive data crosses boundaries; identify points where policy can be enforced at runtime without modifying agent code.

Weeks 2-4 must focus on a deterministic enforcement point in the data path: a control that reads every payload, decides based on actual data content rather than pre-classified labels, and produces the same decision for the same input. This enforcement must be non-bypassable, positioned so no team can forget or circumvent it.

Projects to defer include: massive identity redesign, agent rewrites, perfect data classification, role-based masked replicas, guardrail libraries in every single agent's code. These interventions remain valid for the medium term, but the plan treats them as secondary to immediate data path control.

The distinction between authentication (who the agent is), authorization (where it can go), and data governance (what crosses the boundary) must become operational in runtime controls. Knowing an agent is authorized to query a CRM does not answer which records that CRM will return in a specific interaction and whether the agent is enabled to correlate them with data from other systems.

Why This Matters

Nol8's proposal places the agentic security problem in the data architecture domain, not the model domain. This shift has consequences for the market: the "AI Data Plane" category emerges as a not-yet-standardized space where runtime enforcement competes with more traditional post-facto governance approaches. For CISOs, the takeaway is that the first 90 days of agentic exposure demand a documented priority inversion, not an extension of existing practices.

The control architecture must follow the data architecture. As long as enforcement remains optional and distributed in individual agents' code, the gap between what the organization believes it deployed and what it actually exposed will continue to be the primary risk vehicle.

Information is based on cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter