Most large enterprises now run AI agents, but few can say what those agents touch. Reco’s new customer success chief explains where the risk hides and how security teams can catch up.
80 percent of Fortune 500 companies already use AI agents, according to Microsoft. Only 21 percent of enterprises have a mature model for governing them, Deloitte’s 2026 State of AI survey found. Inside that gap sits an uncomfortable question: Who is watching what all these agents can see, touch, and do?
Reco, the New York-based platform provider that discovers, governs, and secures AI agents and the identities behind them, has hired David Tirazona as senior vice president of customer success to help enterprises answer this question. Tirazona brings customer-facing leadership experience from Exabeam, Netskope, Blue Coat, Silver Spring Networks, and Lookout and joins months after Reco closed a $30 million Series B that lifted its total funding to $85 million.
Agents That Act, Not Just Answer
The first thing Tirazona points to is how fast everything is moving. Enterprises have left isolated pilots behind, and AI now writes code, talks to customers, and threads through everyday workflows. Adoption has also slipped loose from central control, spreading through departments and business units faster than any approval process can track — the same pattern behind the surge in unsanctioned “shadow AI” use that security researchers say quadrupled in enterprise breach data last year.
But the shift that worries him most is quieter. AI tools have stopped merely answering questions and started doing things — reading information, invoking tools, updating records, and triggering workflows. “The risk is no longer limited to what an AI system says,” Tirazona says. “It also includes what the AI system can do.”
Where the Risk Hides
The trouble starts with some key questions few organisations can answer — which agents are running in their environment, who introduced them, and which systems they touch. And even the agents they know about rarely stay small. For instance, an agent built for a single narrow task, running on OAuth grants, API keys or service accounts, could expand into broad reach across documents, repositories, and customer data.
Then comes the accountability gap. An agent may be created by one team, connected by another, and used by a third. When no one owns its behaviour, Tirazona warns, companies accumulate “autonomous workflows that sit outside normal responsibility structures.” And because agents rarely stay in one system, a problem that starts in one tool can ripple across everything it connects to.
From Awareness to Action
Tirazona’s fix is to treat agent discovery as a continuous process, not a one-time audit. Map what is active. Separate routine usage from agents tied to sensitive systems, broad permissions, or stale credentials. Then act: Narrow access, assign owners, and build review cycles that keep permissions aligned with purpose. The goal, he explains, is moving customers “from awareness to action, while preserving the productivity gains that brought AI into the organisation in the first place.”
He rejects the idea that governance slows companies down. Good brakes, after all, are what let a driver take the fast road with confidence. When teams know who owns each agent, what access is acceptable, and where the limits sit, they expand AI boldly instead of stalling it in review. Getting there means pulling everyone with a stake into one conversation — security, IT, legal, compliance, procurement and business leaders — because AI now runs through all of their territory.
Start With What You Can’t See
For security leaders staring at sprawl today, his advice is specific. Build an accurate picture of AI activity first, because approval lists rarely tell the full story. Make ownership explicit for every agent — agents outlive projects, and their creators change roles.
Prioritise by business impact: Durable credentials, broad permissions, and sensitive data go to the front of the queue. And keep reviewing what you have already approved. “Approval is a starting point,” Tirazona says, “not a guarantee that every user, agent, integration, and data path remains appropriate over time.”
The endgame is an evidence base — knowing which AI systems are active, who owns them, and how they are governed. For the enterprises racing ahead, that may be the difference between adoption they control and adoption that controls them.
