Cybersecurity Agent Collisions Are Coming And Could Be ‘Very Ugly’: Netskope CISO

As AI agents are increasingly deployed across security operations teams, a coming challenge could be around keeping them from taking overlapping or competing actions, Netskope CISO James Robinson tells CRN.

While cybersecurity teams are all-too-familiar with the issue of tool sprawl, an emerging new version of this challenge could come in the form of widely deployed AI agents that are difficult to keep coordinated, according to Netskope CISO James Robinson.

The issue of agent sprawl—an overabundance of agentic systems that are authorized to help security analysts with tasks and investigations—could mean numerous AI agents all trying to respond to the same incident at once, Robinson said in a recent interview with CRN.

In the increasingly likely scenario that every Security Operations Center (SOC) analyst has multiple agents running, “what happens when we have six agents responding to a security incident at the same time?” he said.

This could occur, for instance, in the event that an employee reports a potential phishing email, Robinson noted.

“Then we have six different agents reaching out to [the analyst] to try to help them,” he said. “That’s going to be really, really messy and confusing.”

That possibility has already been coming up as a concern for security leaders who are making decisions about how to deploy agentic AI, Robinson said.

In particular, some major considerations have been raised around whether to specifically instruct AI agents to watch out for other agents, he said.

Security teams may need to take a collision detection approach—similar to what was utilized in early Ethernet networking—for agent-generated messages and actions, Robinson said. There will likely need to be a way for one agent to recognize that another has already claimed an incident and asked for evidence, or has started a response.

Otherwise, “if everyone’s agents are automatically processing and responding [at the same time], that’s going to be very ugly,” Robinson said.

Replicating Human Models

Fortunately, many organizations won’t need to invent a new operating model from scratch, given that many SOC teams already encounter overlap when multiple people begin working on a single case, according to Harpreet Sidhu, global cybersecurity lead at Accenture, No. 1 on CRN’s Solution Provider 500 for 2026.

“Sometimes, you get two people working on the same issue,” Sidhu said. “And the way to deconflict that is through the control plane. That’s how we do it.”

In other words, the system that already oversees human-led processes can govern the processes now being driven by agents, he said.

“There’s governance to break the tie on what the investigative agent found, what the supervisory agent found and who checks what—and at the end of the day, who gets primacy on the actions going forward,” Sidhu said.

The bottom line is that “we can learn a lot from how we’ve handled it in the model where humans used to run the SOC entirely,” he said.

Go Granular

At Shieldient, a Dallas-based solution provider focused on AI and security, avoidance of overlapping agents has been a top priority as the company has built an agentic framework for its security services, according to Khiro Mishra, founder and CEO of Shieldient.

One approach is to narrow the scope of each agent’s tasks, rather than assigning many jobs—alerting, triage, detection, investigation and threat hunting—to a single, broad SOC agent, Mishra said.

Instead, Shieldient has been creating “smaller” agents with more narrowly defined roles, he said.

A key answer to the issue, according to Mishra: “Go as granular as you can—in terms of defining the function of the agent—to avoid the overlap.”