Noma Security Deepens Focus on Agentic AI Risks and Governance Frameworks

Noma Security spent the week sharpening its positioning as a specialist in securing autonomous and “agentic” AI environments. Across several research-driven posts, the company warned that many AI agents, Model Context Protocol servers, and agent skills exhibit high-risk characteristics, including the potential for arbitrary code execution.

Noma spotlighted its “Lethal by Design” report, which examines how design choices in extending AI agents expand their attack surface and complicate monitoring and intervention. The firm also promoted its “No Excessive CAP” framework, aimed at governing what agents can do, decide, and access in enterprise environments to reduce operational risk.

In parallel, Noma emphasized what it calls the emerging “Agentic Paradox,” where highly capable agents with browsing, coding, and execution powers may lack the common sense and safeguards needed to prevent rapid production damage. The company cited examples suggesting agents could, in extreme cases, wipe production environments in seconds, underscoring the need for stronger controls and safety nets.

The company’s CISO, Diana Kelley, drew attention to an “inter-agent trust gap,” arguing that many AI agents accept instructions from other agents without robust verification. Noma framed this as a distinct risk category from prompt injection, pointing to new vulnerabilities in AI-heavy orchestration and supply chains that current market tooling may not yet fully address.

Collectively, the week’s activity reinforces Noma Security’s strategy of leading with research and thought leadership in AI and LLM security, rather than broad, generic cybersecurity messaging. If enterprises adopt the governance and verification frameworks Noma is promoting, the firm could see rising demand for tools focused on observability, control, and trust in complex AI deployments.

From an investor perspective, the developments highlight a clear thematic focus but offer limited visibility into immediate commercial traction, as posts did not detail customer wins or revenue impact. Overall, it was a week of intensified thought leadership that may strengthen Noma Security’s long-term positioning in the emerging AI security segment.