The security industry spent the past two years arguing about what generative AI could write. The argument has quietly shifted to what it can do, and that is a far more unsettling question for anyone responsible for keeping a corporate network intact. Autonomous software agents, the kind that can read a file, call an API, move data between systems and act without a human pressing the button each time, are now landing inside businesses that only months ago were debating whether to let staff use a chatbot at all.
Into that gap steps ThreatLocker, the endpoint security vendor best known for its uncompromising “deny by default” posture. The company has used an interview with CRN Australia to set out how it intends to govern these agents, applying the same logic it has long used to lock down applications and scripts on a machine. The pitch is straightforward enough: if an AI agent is going to behave like a piece of software with hands, then it should be treated like one, allowed to touch only what it has explicitly been permitted to touch, and blocked from everything else by default.
From application control to agent control
ThreatLocker built its reputation on allowlisting and a feature it calls ringfencing, which stops approved programs from doing things they have no business doing, such as a word processor suddenly reaching for PowerShell or trying to open a network connection to an unfamiliar server. The company’s founder and chief executive, Danny Jenkins, has spent years arguing that the dominant model of cybersecurity, which tries to detect and chase bad things after they appear, is the wrong way round. The safer default, in that worldview, is to permit a known list of good behaviour and refuse the rest.
Extending that idea to AI agents is a logical next step, and arguably an overdue one. An agent handed broad credentials and told to “sort out the finance reconciliation” is, from a security standpoint, an unpredictable process running with real permissions. If it is compromised, tricked by a poisoned document, or simply misbehaves, the blast radius is whatever access it was granted. The new controls are designed to constrain that radius, deciding which systems, files and actions an agent can reach rather than trusting it to stay inside the lines on its own.
It is a neat fit for the channel that ThreatLocker sells through. The company reaches much of its market via managed service providers, and agent governance is the sort of capability an MSP can package and sell to clients who have neither the staff nor the appetite to build it themselves.
Two ways to read it
The case for this approach is easy to make. Analysts have been warning through 2025 that agentic AI expands the attack surface in ways traditional tooling was never built to handle, because an agent blurs the old line between a user and an application. Identity, permissions and the ability to audit what an autonomous process actually did become the control points that matter. A model that caps agent privileges by default speaks directly to that anxiety, and it aligns with the broader zero-trust direction that most serious security programs are already heading in.
There is a competing view worth airing, and it is not really about ThreatLocker specifically. Deny-by-default systems live or die on how much friction they create. The entire promise of an AI agent is autonomy and speed, the ability to chain together a dozen steps without a human in the loop. Wrap it in tight enough controls and you risk neutering the very productivity that justified deploying it. Security teams have seen this film before with application allowlisting, where overly aggressive policies generated a flood of approval requests and tempted frustrated staff to find workarounds. The hard part is not blocking agents, it is tuning the controls so they stop the dangerous actions without strangling the useful ones, and that tuning is where real-world deployments tend to get messy.
There is also a crowded field forming behind this idea. Identity providers, cloud platforms and a growing clutch of specialist startups are all racing to own “agent governance”, and the market has not yet settled on whose layer the controls should live in. Buyers will need to work out whether they want this at the endpoint, in the identity stack, or baked into the AI platform itself, and the answer will shape procurement decisions for years.
What it means for Australia
For Australian organisations, the backdrop makes this more than a vendor product note. The country has endured a punishing run of high-profile breaches, and the reputational and regulatory cost of a serious incident is now front of mind in boardrooms from Perth to Parramatta. The Australian Signals Directorate‘s Essential Eight already leans heavily on application control and restricting administrative privileges, so a model that extends those same instincts to AI agents sits comfortably with the maturity frameworks local security teams are measured against.
The practical pressure is real. Australian businesses are enthusiastic adopters of productivity AI, and agentic features are now arriving inside the everyday platforms they already run, often switched on by vendors rather than chosen by customers. That means autonomous agents are likely to appear inside Australian networks faster than governance can keep up, a gap that regulators and the Office of the Australian Information Commissioner will be watching closely as privacy reform continues to work through Canberra. A great deal of this risk will land on the small and medium businesses that lean on managed service providers, which is precisely the slice of the market ThreatLocker’s channel model is built to serve.
Cost and sovereignty add another wrinkle. Local firms are already weighing how much of their security stack should sit with offshore vendors, and agent controls that touch sensitive data flows will invite the usual questions about where logs live and who can see them. Those questions will not slow adoption much, but they will shape how the controls are configured.
What’s next
The signal here is bigger than one launch. The security industry has decided that AI agents are a category of risk in their own right, not just a feature of existing tools, and the vendors are now positioning accordingly. Expect the next year to bring a scramble over standards, over where agent identity should be managed, and over how organisations prove to auditors that an autonomous process stayed within its bounds. For Australian security leaders, the sensible move is to start treating agents as privileged software today, before the agents start treating the network as theirs.
Sources: CRN Australia.
