Debating the best use cases of AI adoption has never been more popular, but one theme remains constant: users want AI to manage the mundane parts of their job so they can focus on high-level tasks. With automation comes optimization, and in my experience, one of the highest-impact areas of optimization is payment systems.
The advantages are significant. In both consumer and B2B contexts, AI agents can be granted autonomy over financial tasks: negotiating vendor contracts, approving expenses, executing purchases, and in some cases, managing entire procurement workflows. That means 24/7 uptime and price optimization. But unfortunately, that means the cybersecurity risks are equally significant.
Before transitioning to cybersecurity, I worked in the payments space. These two spaces have a lot in common. They both always want to get faster, but in both cases the consequences of sacrificing too much for that speed can be enormous. The more automated your systems become, the more you need tools that can validate what’s happening and why.
According to the World Economic Forum, “While 66% of organizations expect AI to have the most significant impact on cybersecurity… only 37% report having processes in place to assess the security of AI tools before deployment.” That’s a wide gap.
For those of us in the cybersecurity industry, progress has always introduced new risks. That’s fine, as long as the new conveniences outweigh the cost of managing those risks. But it’s crucial to update security tactics in tandem with new technology so we don’t outkick our coverage and have to bring progress to a halt to patch security issues.
That means that as we shift how our transactions are conceived and executed, we need oversight tools designed specifically for these AI-native environments.
Agentic AI in Payments
Large Language Models (LLMs) began their journey as general-purpose conversational tools. Today, that system has given way to the evolution of what’s known as agentic AI: a system composed of multiple specialized agents working together to solve tasks more intelligently than any one agent could on its own.
In a payment context, these agents can take on distinct roles. One might analyze pricing trends, another might negotiate discounts with supplier APIs, while a third reviews a company’s cash flow status. Together, they act as a network of intelligent assistants, capable of making financial decisions in real time with limited human oversight.
Take Amazon’s Nova Act model or OpenAI’s Operator feature for example. It allows AI agents to open a virtual browser, research a product, compare prices, fill a shopping cart, and prepare the checkout process. In a B2B setting, this functionality can be extended into areas like automated invoice processing and contract renewal.
The New Risk Landscape
The benefits of this shift are apparent, but the same operational discretion that makes Agentic AI so efficient also makes it difficult to secure. The decision logic isn’t always interpretable by humans and certainly not in real-time. One rogue agent could be enough to drain an account or misroute a six-figure wire transfer. So, if the business community is going to rely on these agents for operations, the security community must have AI-specific solutions to the inherent visibility problem.
The problem is that most organizations have no reliable way to profile their agents. Who are they interacting with? Are they being manipulated, degraded, or subverted? MITRE’s recent guidelines on adversarial threats to AI give some insight into how LLM-based systems can be probed and manipulated by attackers.
Traditional fraud tools are not designed for this. They raise alarms based on known behaviors and static patterns. However, agentic systems constantly evolve, and their actions may look very different from traditional fraud indicators. As we empower AI to handle money, the margin for error shrinks and the need for visibility grows.
A compromised AI agent could be manipulated to authorize fraudulent transactions, leak sensitive payment data, or abuse legitimate credentials through prompt injections. An adversary could even spoof or deploy an agent that behaves like a legitimate purchasing system. Because these agents are built on a foundation of probabilistic statistics, detection based on static rules or signatures will fail. Behavioral drift can occur gradually, hiding problematic actions within otherwise routine operations.
These systems are also often integrated with third-party services and cloud infrastructure, which means a compromise may come from outside the organization’s direct perimeter. Without visibility and correlation, organizations may not realize an agent has been exploited until financial loss or data exfiltration has already occurred.
Know Your Agent
In finance, “Know Your Customer” (KYC) regulations transformed how institutions verified identity and assessed risk. With agentic AI now taking on more financial authority, we need to develop a similar mindset: Know Your Agent (KYA).
We need systems that can observe AI agents over time, profile dynamic behavior and flag anomalies. In other words, a system that tracks how agents interact with financial infrastructure, APIs, internal data systems, and third-party marketplaces. For the sake of speed, this will require a solution with at least some autonomous components.
What I’m describing here is the evolution of Managed Detection and Response (MDR) in the context of agentic AI. A system like this can effectively distinguish between a legitimate change in a workflow and a compromised agent. And, most importantly, it can feature proactive containment workflows to respond to legitimate threats in real-time.
One thing is for certain: we’re entering uncharted territory with agentic AI payments that will present a new class of threats we haven’t seen before. This doesn’t mean we need to push the panic button. It just means we have to utilize security tools that can natively adapt to our new needs. But the worst thing we could do is sit on our hands and wait for these vulnerabilities to outpace us. Let’s get to it, security pros.
