Artificial intelligence agents could soon become far more numerous than human employees inside organizations, creating a new challenge for cybersecurity teams, according to Mortada Ayad, Vice President of Sales, META at Delinea.

Speaking at the third edition of the FutureSec conference in Dubai on Thursday (September 3, 2026), Ayad said organizations could have 46 AI agents for every human worker within the next six months. He described the shift as a fact, while acknowledging that the exact pace of adoption remains difficult to predict.

The discussion at FutureSec highlighted how quickly the role of AI is changing inside organizations. Shashi Punjabi, who joined Ayad for a fireside chat, said future deployments are likely to include a combination of customized personal assistants and more autonomous systems capable of making decisions.

“Digital transformation is more of a top-to-bottom approach. So, CEOs are involved and then you plan from top to bottom, and it seeps down,” he said. “AI, on the other hand, is different because AI is a bottom-to-top approach. Users are already using it,” Punjabi added.

Vijay Velayutham, Principal Information Security Officer at the UAE Ministry of Energy and Infrastructure, described AI adoption as a progression through five stages: chatbots, copilots, agents, multi-agent systems and, ultimately, autonomous systems. He said organizations are currently at the agent stage of that progression.

Punjabi also pointed to a difference between conventional digital transformation and AI adoption. Digital transformation generally starts with leadership and moves downward through an organization, while AI adoption can happen from the bottom up because employees are already experimenting with and using the technology.

As AI agents gain access to business systems, data, and applications, security teams may need to treat them differently from conventional software tools. Velayutham argued that organizations should approach AI agents much as they would handle high-privilege users. Each agent should have a clearly defined identity, access permissions, authority, and accountability.

“For decades, cybersecurity has been good in protecting the environment in terms of securing the perimeter, hardening the endpoints, making sure the network is monitored, and those are excellent controls, and they continue to be good baseline controls. With the advent of agentic AI, it is forcing us to ask the question: what is more dangerous? Is it an attacker trying to break into the network, or is it a trusted internal user, also called an agent, with access to pretty much all the crown jewels and all systems and data?” said Velayutham.

Also Read: Dubai's DMCC Expands Innovation Push With New Cybersecurity Hub

He recommended the ‘VET AI’ framework, which focuses on four areas: validating the mission, establishing identity and authority, testing the system, and ensuring that monitoring and containment mechanisms are in place.

The shift also changes the traditional cybersecurity equation. Security teams have spent years protecting networks, hardening endpoints, and monitoring infrastructure. With agentic AI, however, a trusted internal system with extensive access could itself become a security concern if its permissions or behavior are not properly controlled.

As companies give software greater autonomy, managing those digital identities and controlling what agents can do could become as important as securing human users.