As featured on BusinessMirror: Prepping the workforce for autonomous security
As security becomes automated, agents are taking on more intelligence-driven tasks, especially in the security operations center (SOC), but also in other parts of the cyber domain, including compliance, risk and identity management. In this context, what is the role of security professionals? What are the future skills of the cybersecurity workforce? Let us explore first
how agents and automation are transforming the cyber function.
The rise of agents
Agents are making decisions and scanning the multitude of alerts that reach an incident desk, at a pace SOC analysts cannot match. As non-human identities proliferate — including machine credentials, service accounts, and digital agents capable of creating and deleting other agents — autonomous security will play a critical role in identifying and monitoring their activity. AI
and automation can accelerate the onboarding process, which now takes place primarily in the cloud. Traditional on-premises data centers cannot cope with such large data volumes.
To exploit vulnerabilities, cyber attackers are increasingly targeting and exploiting machine credentials through non-human identities, often via third parties such as hyperscalers and software as-a-service (SaaS) providers. This puts intense pressure on cybersecurity teams to identify a rapidly growing body of agents, monitor access permissions, and record their presence in inventories.
Robust cloud and data governance are crucial for implementation of AI systems — and deployment of agents by other agents — to ensure that data is securely stored and managed, and that AI systems are compliant with regulatory requirements. However, many organizations are dependent on a single hyperscaler, which leaves them vulnerable to any service disruption. Banks, retailers, telecommunications networks, government departments and other entities have all suffered due to temporary cloud provider shutdowns, leaving service account identities (SAIs) unable to access their services.
Building resilience with technology
CISOs are adopting a dynamic risk management approach to autonomous AI, using accepted principles of zero trust, clear policies, and access controls. Security teams are partnering with AI specialists and data science teams, and building safeguards, to demonstrate resilience to internal audit and external regulators.
With new agents emerging continually, CISOs are concerned that they are unable to identify and catalog these agents, or to determine which ones are vulnerable. ‘Shadow agents’ (autonomous or semi-autonomous AI agents) are popping up everywhere, from SaaS providers to existing agents that are even creating their own agents.
This requires robust safeguards and policies to establish AI security posture management (AI-SPM), supported by continuous monitoring and improvement of AI models, data, and infrastructure. Although still nascent, AI-SPM focuses on identifying vulnerabilities and unauthorized access in line with AI security policies. As AI solutions proliferate, CISOs should establish red-teaming of these solutions, to build in AI security.
A new role for humans
As agents become ever more autonomous, organizations and the security function will need to retrain and reposition their workforce to carry out more meaningful tasks — such as advanced threat analysis, strategic cyber decision-making, and AI integration. New roles may include AI agent managers — to oversee agent activity — and data governance specialists.
This is no longer a niche technical concern. In a tech report conducted by KPMG, 92 percent of technology executives say that managing AI agents will become an essential skill within the next five years, highlighting a broader shift toward human oversight, governance, and intervention in autonomous systems. CISOs may also have to find ways to attract engineers to work in the internal audit function, to satisfy demand for greater AI capabilities.
Agentic-led cybersecurity presents a big opportunity to gain greater visibility and control over an organization’s digital assets. Supported by a strong security data lake, such an approach can shift cybersecurity from manual to automated and restore the balance of power to CISOs and their teams.
In the Philippine Context
The Philippines is likewise experiencing the growing impact of cybersecurity threats amid the rapid adoption of artificial intelligence (AI) and accelerating digital transformation across industries. As AI increasingly influences decision-making, platform operations, and digital interactions, the need for a workforce equipped to manage emerging cyber risks, oversee AI systems, and strengthen cyber resilience is becoming more pronounced.
Recognizing these challenges, the Philippine government continues to strengthen its cybersecurity initiatives through programs focused on advanced threat assessment, workforce capability building, and improving national cyber resilience. Among these efforts is the implementation of the National Cybersecurity Plan and the recent partnership with the South Korean government to establish the National Cybersecurity Center (NCSC).
In the private sector, organizations are also recognizing that cybersecurity is no longer solely a technology function. The CEO, CFO and CISO must operate as a cohesive triad. Each contributes a unique perspective—strategy, value creation, and protection—but only through collaboration can digital and AI investments generate measurable business outcomes while managing risk effectively.
As organizations continue to adopt AI and automation, the future of cybersecurity will depend as much on people as it does on technology. Building a future-ready cyber workforce, strengthening governance, and fostering collaboration across sectors will be essential to ensuring that innovation is accompanied by resilience, trust, and long-term security.
This article draws on insights from the KPMG Thought Leadership publication “Cybersecurity Considerations 2026: Building trust and enabling innovation in a dynamic world”.
© 2026 R.G. Manabat & Co., a Philippine partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
For more information, you may reach out through ph-kpmgmla@kpmg.com, social media or visit www.home.kpmg/ph.
This article is for general information purposes only and should not be considered as professional advice to a specific issue or entity. The views and opinions expressed herein are those of the author and do not necessarily represent KPMG International or R.G. Manabat & Co.