Beyond the Weakest Link: Governing Agentic AI and Mitigating Algorithmic Values Drift in Cybersecurity Ecosystems

Recent reports from the World Economic Forum and the International Monetary Fund suggest that Agentic AI is reshaping cybersecurity risk by accelerating both defensive capabilities and the sophistication of autonomous attacks. As organizations increasingly deploy AI-enabled systems capable of independent decision-making, traditional cybersecurity governance models rooted in static compliance controls and “human-as-weakest-link” assumptions are becoming insufficient to manage emerging organizational risks. In agentic environments, cybersecurity threats no longer originate solely from external actors or isolated human error but also from interactions among autonomous systems, operational incentives, organizational workflows, and institutional oversight structures. This conceptual governance paper synthesizes emerging literature in cybersecurity, socio-technical systems (STS), and AI governance to examine how autonomous AI systems destabilize traditional cybersecurity assumptions. Grounded in STS theory, the paper introduces a Socio-Technical Triad framework comprising the Person, the Interface, and the Institutional Infrastructure to evaluate how organizational security failures emerge within interconnected human and technical environments. We argue that autonomous AI systems accelerate “Values Drift,” defined as the gradual misalignment between an organization’s stated security commitments and the operational behaviors incentivized by AI-enabled systems. As AI systems optimize for speed, efficiency, and predictive performance, governance structures often fail to keep pace with that operational velocity, producing accountability gaps, oversight asymmetries, and increased systemic vulnerability. To address these risks, the paper proposes adaptive governance mechanisms designed to preserve organizational accountability in high-velocity AI environments. Specifically, we introduce Decision Disruption Protocols as structured governance interventions that establish mandatory human-review checkpoints, escalation controls, role-clarity procedures, and authorization boundaries for high-risk autonomous actions. We further examine AI Terminology Governance as an operational mechanism to clarify decision ownership and reduce ambiguity between human and machine authority within cybersecurity workflows. Together, these mechanisms shift cybersecurity governance away from static compliance enforcement toward adaptive oversight models that respond to dynamic organizational and environmental conditions. The paper contributes to the behavioral MIS and cybersecurity governance literature by reframing cybersecurity risk as an emergent socio-technical governance challenge rather than solely a perimeter-defense problem. Implications are discussed for CIOs, CISOs, compliance leaders, and AI governance teams seeking to implement accountable oversight structures for autonomous AI systems while maintaining organizational trust, operational resilience, and human authorization authority over critical security decisions. An actionable cybersecurity governance framework is proposed to help ensure organizational responsiveness and vitality in agentic environments.