A new report from Web3 security firm Certik advocates treating artificial intelligence agents as autonomous workforce participants, arguing that organizations must assign them explicit roles, bounded authority, and strict human supervisory accountability.
The shift reflects how agentic AI has evolved from issuing passive threat alerts to executing multi-step reasoning, integrating external APIs, and taking live remediation actions with minimal human intervention. These systems now handle end-to-end incident response, patch generation, and transaction monitoring—functions that were previously manual or semi-automated.
Certik emphasizes that because deploying organizations and managers retain 100% of legal and operational liability, AI agents must operate under explicit escalation protocols and named human oversight. The firm's governance framework comes amid rising machine-speed attacks, a persistent global cybersecurity talent shortage, and surging anti-money laundering penalties, which topped $900 million in the first half of 2025 alone.
Defenders Hold an Advantage
Natalie Newson, senior blockchain investigator at Certik, counters the notion that defenders are perpetually behind attackers. She argues that defenders retain a critical edge: home-field advantage. In Web3 protocols, everything attackers do is recorded on a public ledger, leaving trails that automated systems can detect. Additionally, defenders can review code before deployment and understand normal protocol behavior.
However, Newson warns that periodic defense cannot withstand continuous offense. Security must evolve from static checkpoints into dynamic systems that match incoming threat speed. She notes that while attackers benefit from zero regulatory friction and can deploy instantly, they must still move assets through the blockchain to be paid—a critical choke point where monitoring and circuit breakers can detect and contain exploits automatically.
Real-time transaction monitoring allows automated systems to pause contracts instantly, containing attacks without human intervention and shifting threat economics by forcing attackers to outrun machines rather than humans.
Mandatory AI Audit Requirements
The Certik report concludes that adopting agentic AI without proportional governance introduces complex systemic risks. The firm urges organizations to explicitly delineate agent execution from human oversight in organizational charts and job descriptions. It also advocates making continuous recording and auditing of an AI agent's internal reasoning logs a mandatory compliance discipline.
