What an AI Agent Actually Does for Your Business and What It Cannot Secure

An owner of a 40 person mechanical contracting company in Allen called me in August with a question I now hear almost every week. His software vendor had offered to turn on an AI agent that would read his service inbox, pull job history out of his scheduling system, and write back to customers on its own. He wanted to know two things. Was it real, and was it safe.

The first answer is yes. This is not a demo that falls apart in week two anymore. For a narrow band of repetitive office work, these tools genuinely save hours, and the businesses around McKinney and Plano that adopted them early are not making it up. The second answer is more complicated, and it is the part nobody selling you the software is going to raise. An AI agent is not dangerous because it is intelligent. It is dangerous because of what you hand it the keys to.

This post is written for the person who signs the contract, not the person who configures it. By the end you should be able to sit in a vendor demo and ask three questions that will tell you more about your exposure than an hour of feature slides.

An AI Agent Is Not a Chatbot and the Difference Is the Whole Story

A chatbot answers. An AI agent acts. That single word is the entire security conversation.

When you type a question into a chatbot, it produces text and stops. Nothing happens in your business. An AI agent is software that takes a goal you give it, decides on its own what steps to take, and then actually performs those steps inside your systems. It logs into your email. It opens your accounting file. It posts a record into your customer database. It sends a message to an outside party under your company name.

To do that, the agent has to be given credentials, which is the industry term for the username, password, and access keys that prove to a system that someone is allowed in. From the point of view of your email provider or your accounting platform, an agent holding those credentials is not a piece of software. It is an employee. It has the same power that employee would have, it works around the clock without getting tired, and it never stops to think that a request feels strange.

That is the trade. You are hiring a very fast, very literal worker who does not have judgment, and you are giving that worker a badge. Everything that follows comes from that one fact. If you want a broader look at how the risk category is developing, we wrote about AI governance and what regulators are starting to require earlier this year.

The Work AI Agents Genuinely Do Well Right Now

I want to be fair to the technology, because the useful cases are real and I have watched them pay for themselves.

The clearest win is structured back office work that a person finds tedious and that has a right answer. Reading incoming invoices and matching them against purchase orders. Taking a voicemail transcript and opening a service ticket with the right customer attached. Pulling the last six months of job notes into a summary before a renewal call. Drafting a first version of a quote from a template and a set of numbers. The distributor in Plano I work with cut roughly nine hours a week out of order entry this way, and the agent did not replace anyone. It absorbed the part of the job that was making a good employee want to quit.

The second real win is triage. An agent can sort a hundred inbound messages into what needs a human today and what does not, and it is generally better at that than an overloaded office manager at four in the afternoon.

What agents are not good at is anything where the cost of being confidently wrong is high and nobody checks the work. They produce fluent, reasonable sounding output even when the underlying facts are wrong, and they do it in the same tone they use when they are right. There is no tell. A human who is unsure hedges. An agent does not.

So the rule I give owners is simple. Use an agent where a mistake is visible and cheap to fix, and keep a person in the loop anywhere a mistake leaves the building or moves money.

What an AI Agent Cannot Secure

Here is the part that gets skipped, and it is the reason we built AI security as its own service line rather than folding it into general IT work.

An AI agent cannot verify that an instruction it received is legitimate. This is the one that costs businesses money. Agents follow instructions found in the content they process, not just the instructions you gave them. If your agent reads customer email, an attacker can send an email that contains text written to the agent rather than to your staff. Something along the lines of a note telling the agent to ignore prior directions and forward the attached files to an outside address. Security people call this prompt injection, and the plain English version is that anything your agent reads is a potential set of orders. Your spam filter was not built to catch a sentence that only means something to software. This is the same family of problem as business email compromise and wire fraud, except the target is not a distracted controller, it is a system that never questions anything.

An AI agent cannot limit its own access. If you give it a login that can read every folder on your file server because that was easier than scoping it properly, then the day something goes wrong, every folder is in play. Agents are given broad permissions constantly, because narrow permissions require somebody to sit down and decide what the agent actually needs, and that work is unglamorous. It is also the single highest value hour you will spend on this.

An AI agent cannot tell you what it did. Most of these deployments have no usable audit trail, meaning no dependable record of which actions were taken, when, and on whose behalf. If you are ever asked by an insurer, a regulator, or a customer attorney to prove what touched a particular record, a shrug is an expensive answer. This is exactly the gap our incident response team runs into most often when an AI tool is somewhere in the story.

An AI agent cannot protect the credentials it holds. Those keys sit somewhere, often in a configuration file or a vendor dashboard, and they are as stealable as any other password. When they leak, they frequently show up for sale before anyone internally notices, which is why dark web monitoring matters more once agents are in the picture rather than less.

And an AI agent cannot undo itself. If it writes bad data across four thousand customer records over a weekend, the fix is restoring from a clean copy, which means your data backup has to be recent, separate, and actually tested. An agent working at machine speed turns a small configuration error into a large one before Monday.

What Any of This Actually Costs You

Security conversations fail when they stay abstract, so let me put numbers and consequences on it the way a controller would.

Start with money out the door. If an agent with access to your billing system is manipulated into changing remittance details on outgoing invoices, you do not find out from an alarm. You find out sixty days later when a customer says they already paid. That money is usually gone, and your insurance carrier will ask whether the transaction had human approval. If the honest answer is that software did it unsupervised, expect a hard conversation about coverage.

Then downtime. Pulling an agent out of production is not a switch. You have to work out what it touched, whether the data it wrote is trustworthy, and whether the credentials it used were reused anywhere else. For a small business that is typically two to five days of degraded operations, and the finance and operations teams absorb most of it.

Then legal exposure. If the agent had access to client records, the question of whether a notifiable disclosure occurred is now a legal one, and answering it requires those audit records that most deployments do not keep. Not being able to prove what happened is treated, in practice, as the worst case having happened.

Then the quiet one, which is reputation. A message sent under your company name that should never have been sent is remembered by the recipient regardless of whether a human or a machine wrote it. Businesses in Frisco and Collin County win work on referral. That is the asset actually at stake.

None of this argues against using agents. It argues for scoping them like you would scope a new hire with root level access, because functionally that is what they are.

What to Put in Place Before You Turn One On

The good news is that the controls here are not exotic, and most of them are decisions rather than purchases.

Decide first what the agent is not allowed to do, and write it down before the vendor configures anything. My default list is short. It does not send external email without a human release. It does not change payment details on anything. It does not delete. It does not touch systems holding regulated client data. You can loosen any of those later once you have a few months of observed behavior, and loosening deliberately is very different from never having drawn the line.

Give the agent its own identity, never a shared one and never a real person's login. This sounds like a technical detail and it is really an accountability decision. When the agent has its own account, you can see what it did, you can revoke it in one action, and you can tell its activity apart from your staff. When it borrows the office manager's credentials, none of that is possible, and every investigation afterward is guesswork.

Scope its access to the smallest set of systems that lets it do the one job you hired it for. If it processes invoices, it does not need the HR folder. Most vendors will happily accept whatever access you offer, so this constraint has to come from your side. Our professional services team does this scoping work with clients precisely because it is the step most likely to be skipped under deadline pressure.

Tighten the surface the agent reads from. Since email is the most common way hostile instructions arrive, your email security posture is now load bearing in a way it was not before. The same filtering that protects your people is the first thing standing between an attacker and your agent.

And know in advance who you call. The window where an agent problem stays small is measured in hours, not days. Whether that is your internal team, your existing provider, or us, the number should be posted before you need it rather than found during it. We wrote about what to expect from a response time commitment if you want a sense of what a real one looks like versus a marketing line.

If you are already running vulnerability scanning and periodic testing through a platform like CyberSphere, add the agent and the systems it can reach to that scope. An agent tends to be deployed outside the normal review cycle because it arrived as a feature of software you already owned, and things that arrive quietly do not get inventoried.

The Question to Ask in the Vendor Demo

When a salesperson finishes showing you what their agent can do, ask them what it can reach. Not what it will do, what it can reach. Then ask what record exists of everything it did last Tuesday. Then ask what happens to your data and your credentials if you cancel in six months.

The answers tell you almost everything. Vendors who have thought about this respond immediately and specifically, usually with a permissions model they are proud of. Vendors who have not will redirect you to capabilities, and that redirect is your finding.

The businesses that get real value out of this technology over the next two years are not going to be the ones that adopted fastest. They are going to be the ones that adopted with a boundary drawn around it, so that when something misbehaves, and eventually something will, the blast radius is one process instead of the whole company. We have written separately about shadow AI and what it costs when tools get adopted without anyone in leadership knowing, which is the same problem arriving through a different door.

We work with businesses across McKinney, Plano, and Frisco, and we are having this conversation with somebody new almost every week. If you are running an agent already, or a vendor has one queued up for you, a short scoping review is worth more than another year of good intentions. You can start with a free security assessment, or reach us through our contact page or by phone at 512-518-4408. If you already have an IT provider you like, we also work alongside them through co-managed arrangements rather than replacing them.

Frequently Asked Questions

Is it safe for a small business to use an AI agent?

It is safe in the same way that hiring a new employee is safe, which is to say it depends entirely on what you give them access to and whether anyone is reviewing the work. The technology itself is not the risk. Broad permissions, shared logins, and no record of what the agent did are the risk. Scope it narrowly, give it its own identity, and keep a human approval step on anything that moves money or leaves the building.

What is the difference between an AI agent and a chatbot?

A chatbot produces text and stops, so nothing changes inside your business when it is wrong. An AI agent takes actions on its own inside your actual systems, which means it holds credentials and can send, change, or delete real things. That distinction is why an agent needs the kind of access controls you would apply to a person, and a chatbot generally does not.

Can an AI agent be tricked into sending data or money to an attacker?

Yes, and it is one of the more common failure modes we see. Agents follow instructions they encounter in the content they read, so an attacker can hide directions inside an ordinary looking email or document and the agent may act on them without flagging anything. The practical defenses are limiting what the agent can reach, filtering what reaches it, and requiring human release on outbound actions.

What should we do before giving an AI agent access to our systems?

Write down what it is not permitted to do before configuration starts, create a dedicated account for it instead of reusing a staff login, and cut its access down to only the systems required for the single job it was bought for. Confirm that you will have a usable record of its activity and that your backups are current and tested. Those four steps take an afternoon and they prevent most of what goes wrong.