Why every AI agent should be treated like an insider threat

Every AI agent inside your environment is an insider threat. Defending against that takes more than another large language model. It takes deterministic architecture, specialized AI matched to the problem, and an overlay that can govern the security tools you already bought.

That's the core pitch from DigitalNet.ai, a startup that has launched Atlas, a system built on a few core premises.

• AI agents are insider threats and should be treated as high-risk accounts.
• You can't run all of your security operations inside a large language model wrapper.
• Deterministic roles and specialized AI play a big role in cybersecurity.
• Humans always need to be in the loop.

I caught up with Dr. Allen Badeau Jr., Chief AI Officer at DigitalNet.ai, to talk about securing AI agents, optimizing AI for cybersecurity and the architecture behind Atlas, the company's AI-driven security system.

Every AI agent should be treated as an insider threat. The core thesis behind DigitalNet.ai's Atlas system, which launched in December, is that the more agents you add, the more attack surface you create. Badeau said:

"The more AI that gets integrated into your environment, the more dangerous and open that environment actually becomes. And the reason is, because you know you've got agents that become attached to credentials that shouldn't be there. You've got agents that are on those credentials accessing systems that those original credentials haven't accessed in years."

The mental model has to shift, Badeau said. Agents are not neutral helpers. They inherit credentials, they quietly accumulate access, and they have to be modeled, monitored and constrained like high-risk insider accounts.

What the Mythos moment missed. Badeau acknowledged Anthropic's Mythos moment for cybersecurity vendors, but argued the real eye-opener is that Mythos mostly put a spotlight on long-standing weaknesses in outdated and poorly maintained environments.

Badeau said:

"I don't think it's really a moment because they're, from my perspective, they're getting into systems, especially on the government side, that are old, that are outdated, that are not up to date, that don't have AI, and there were holes in those systems long ago that other tools pointed out. I think it's just a lot of folks forgot about them."

Platformization vs. overlay. Badeau said DigitalNet.ai's Atlas platform isn't designed to replace the cybersecurity systems already installed. "Atlas is designed to overlay and orchestrate what you have," he said.

"With Atlas we can identify what the gaps are in someone's zero trust architecture and then we can leverage our agents to monitor those gaps. We're also watching other agents at the same time to make sure they're not taking advantage of those gaps," added Badeau.

Math instead of guessing. Atlas leans heavily on deterministic methods and specialized AI (including quantum) instead of using LLMs as the “brain of everything.” Badeau put a number on the difference:

"With the original version of Mythos, it was $3,000 for us to run it for about two-and-a-half hours for what we were doing with it. Atlas ran for $58 doing the same thing because we're not embedding every single thing inside an LLM to solve. We're resolving the problems using math as opposed to probabilistically guessing at it. We apply different modes of AI to solve the problems. We don't pass it to an LLM and let the LLM do it probabilistically."

The claim is that a deterministic, multi-engine approach cuts token costs, makes behavior predictable and matches the method to the problem. Buyers will want to run that comparison against their own workloads.

How Atlas is designed. Atlas’s agents are designed as distinct entities with roles, quantitative personalities, constitutions (allowed vs. forbidden actions), and a human‑like memory hierarchy. "Our agents have personalities to start, and so the reason we give them personalities is because one, they're not static, so our agents are time dependent. We can control their risk profiles. We can control how they're using those tools based on those risk profiles," said Badeau.

Those traits are calculated, not written into a prompt. "Each agent has a constitution. Their constitution does a couple of things. It tells them exactly what tools they can use, tells exactly what they are allowed to do, but it also says exactly what they're not allowed to do," he said. “The design goal is an agent constructed as a specialized team member, with its job description, clearance level and memory built in at the architecture level rather than layered onto a generic LLM wrapper."

Deployment. Badeau said Atlas' onboarding process includes launching a set of "hunting agents." He said:

"When we onboard a new system, the very first thing that we do is launch our hunting agents, and they're hunting for issues, anomalies, whatever they can dig up. They're breaking down what is actually inside of that MCP signal to see. There's a whole bunch of other embedded data in there that we don't want in this MCP server, we're going to block that.”

"We're also baselining the system for compliance. So, we're scanning. We're automatically creating our backlog of compliance issues and then it's automatically generating those artifacts, locking down the systems as it needs to.”

"From there, we're looking for rogue agents. If agents are not expected it gets elevated up to Atlas where it can squash it or say 'hey human, here's an issue. Do you want us to accept it or swarm and crush it?'"

Humans in the loop. That last line is the tell. Atlas is built to move at machine speed and then stop at a person, which is the bargain every security team is now trying to strike with its own agents.