Autonomous systems that can reason, make their own decisions, and execute actions across an entire data center introduce a category of risk that traditional application-level controls were never designed to contain. Treating that risk as a single problem produces incomplete architectures that leave enterprises exposed to cascading failures, from data leakage to runaway agent loops. Nutanix, in collaboration with Intel and Cisco, is advancing a three-layer defense-in-depth framework for agentic AI that separates responsibilities across infrastructure, network, and control plane layers — each addressing a distinct category of risk rather than duplicating the same controls across the stack.
The Core Problem: Why Application-Level Controls Cannot Contain Agentic AI Risks
When an agentic system is granted execution privileges across the data center, the security posture must scale into a defense-in-depth architecture that spans infrastructure, storage, compute, networking, and a governing control plane. Oscar Wahlberg, senior director of product management at Nutanix, articulates the central dilemma: “The guardrails to catch a malicious prompt won’t stop an agent from hallucinating and doing something it never should have done, like accidentally deleting databases or leaking sensitive data with a credential it was granted but then uses for something entirely different.”
That gap is the fundamental challenge as enterprises move autonomous agents out of experimentation and into production. No single security control or vendor can provide protection on its own. Defense-in-depth depends on layers working together, with each layer carrying a distinct responsibility. By dividing responsibilities across the stack and adhering to zero trust segmentation, organizations can create a secure framework that improves their overall posture. Understanding which risks belong in each layer is what transforms the principle of defense-in-depth into a practical security architecture.
Layer 1: Infrastructure – Establishing a Root of Trust Where AI Agents Run
The infrastructure layer’s foundational responsibility is establishing a root of trust that answers a simple question: who is operating in the environment? That trusted identity becomes the prerequisite for every security control above it. Before an organization can trust what an agent does, it must first trust the integrity of the environment where the agent runs. When an agent requests permission to execute an operation, the system must be able to verify that the request came from the legitimate agent — not something impersonating it.
Delivering that assurance depends on technologies that root trust in the hardware itself, including platform attestation, confidential computing, and secure boot, alongside controls that prevent unauthorized access both within a server and beyond it. For regulated industries such as financial services, this layer provides the ability to isolate AI production workloads so that neither the agent nor the environment can operate outside its assigned scope. That mitigates risks including model and runtime tampering, supply chain compromise, and unauthorized access to sensitive AI workloads.
How Intel Hardware Enables Trust at the Silicon Level
Intel supplies the compute to run agentic workloads and secures the execution environment through hardware-rooted trust and confidential computing, while also driving costs down through AI accelerators. Intel Xeon 6 processors with built-in AMX accelerate AI inference efficiently without relying exclusively on expensive GPUs. The hardware-rooted trust mechanisms, such as Intel Trusted Execution Technology and Software Guard Extensions, create a tamper-proof foundation that can attest the integrity of the platform to external verifiers. This is critical because an agent running on compromised hardware cannot be trusted, no matter how sophisticated the software controls above it.
Layer 2: Network – Governing How AI Agents Communicate
Once agents begin communicating with other agents, APIs, applications, and enterprise systems, they generate a level of concurrency and dynamic communication that traditional static network configurations were never designed to handle. An agent configured to call APIs, query data sources, and spin up additional agents without constraint creates a sprawling web of east-west traffic that becomes very difficult to reason about. That complexity can easily mask lateral movement or data exfiltration when the right network security layers are not in place.
“We should treat AI agents as a new class of network identity, and make sure that an agent can only talk to other agents or data sources where it’s explicitly allowed to do so,” Wahlberg says. “That means moving away from rigid static rules toward dynamic policy enforcement.”
What Is Agent Gateway and How Does It Govern Agent Communication?
Nutanix’s solution for this layer is Agent Gateway, part of the Nutanix Agentic AI solution. It is a unified, governed layer designed to provide cost control and governance capabilities to help manage autonomous agent users. Coupled with agents grounded in zero trust segmentation and using capabilities like Nutanix Flow for micro segmentation and integration with networking vendors — including its integration into the Cisco Secure AI Factory — Agent Gateway helps enterprises govern interactions across agents, models, data sources, and enterprise applications. The network layer governs lateral movement, data exfiltration, and gates the agent’s network interactions. A zero trust framework with access blocked by default and scalable interaction monitoring is essential for agents that can exhibit unreliable behavior. Cisco wraps the environment in a secure fabric that governs communication between agents and enterprise tools, providing the turnkey physical infrastructure — compute, storage, and networking — that the AI factory runs on.
Layer 3: Control Plane – Governing What AI Agents Are Permitted to Do
The control plane is the brain of the operation, providing a central point for managing agent permissions, tool access, resource consumption, and runtime visibility. What matters most is having a single place where policies can be enforced consistently rather than reinvented for every agent, Wahlberg explains. “Agent Gateway acts as a universal endpoint for different models and tools, so an IT team can configure their agents to talk to this single control point.”
The centralized AI gateway enables the admin to observe, audit, and control access to models as well as MCP (Model Context Protocol) tools, protecting data and gating privileged access. This layer is designed to help mitigate risks such as privilege misuse, runaway agents, unauthorized tool usage, data leakage, and the excessive model consumption that can lead to increased token consumption when agents get stuck in runtime loops. It depends on treating governance as a runtime control system rather than a compliance afterthought.
Why the Control Plane Is the Most Underestimated Layer
Of the three layers, enterprises currently underestimate the control plane the most, Wahlberg says. A true control plane extends far beyond initial deployment to simplify Day 2 operations, giving IT teams the continuous observability and strict token governance required to keep autonomous agents secure and cost-effective in production. “Apart from model and tool selection, governing the agent deployments and their access to models and business tools in a tightly integrated full stack platform will be important for the success of AI projects,” he explains, pointing to a near future in which organizations move from a handful of AI use cases to thousands of agents working autonomously to drive the business.
Why One-Size-Fits-All Security Fails Agentic AI Environments
The biggest architectural mistake enterprises make is assuming a single security model can be stretched across every layer of an AI stack. When an organization tries to solve for hardware-level trust with application-level software, or leans on static legacy network rules to manage dynamic agents, it builds an architecture that either blocks the agentic system from doing its job or leaves critical doors wide open. One-size-fits-all thinking tends to produce significant performance penalties and operational friction.
“By failing to assign specific responsibilities to the appropriate layers, enterprises end up with blind spots in governance,” Wahlberg says. “They might secure the model output but miss that there’s data leakage between agents, or they might secure the network but lack the control plane visibility to understand that they’re wildly burning tokens because the agents are stuck in some kind of runtime loop.”
Focusing exclusively on the model leaves the largest gaps of all, because a guardrail that catches a malicious prompt does nothing to stop a hallucinating agent from misusing a legitimate credential. Embedding security across the full stack helps ensure that even when a model-level threat slips past the initial filters, the agent remains constrained by hardware-rooted trust, network isolation, and access controls at the agent layer.
How Intel, Cisco, and Nutanix Build Defense-in-Depth Together
The three-way partnership demonstrates how the layered architecture comes together in practice as a well-governed, enterprise-grade AI Cloud. Intel supplies the compute to run agentic workloads and secures the execution environment through hardware-rooted trust and confidential computing, while also driving costs down through their accelerators. Intel Xeon 6 processors with built-in AMX accelerate AI inference efficiently without relying exclusively on expensive GPUs.
Cisco wraps the environment in a secure fabric that governs communication between agents and enterprise tools, while Nutanix provides the software platform, minimizing architectural silos, and the central control plane that enforces permissions, delivers visibility and cost governance, and ties the architecture together into a defense-in-depth solution that lets enterprises scale agentic AI.
What Are the Risks of Not Having Defense-in-Depth for Agentic AI?
Without a layered approach, organizations expose themselves to a cascade of failures that are difficult to detect and contain. At the infrastructure level, a compromised hypervisor or tampered model runtime can undermine all software-level controls. At the network level, an agent that can freely communicate laterally can exfiltrate data or pivot to other systems. At the control plane level, runaway agents can burn through token budgets, misuse privileged access, or leak sensitive data through unintended tool interactions. A single-layer defense might block one type of attack but leave others completely unguarded. The Nutanix framework addresses each risk at its natural point of control, creating a security posture that is resilient even when individual layers are breached.
Practical Guidance for Technology Leaders Building Agentic AI Systems
Technology leaders should prioritize building a centralized governance layer today that can manage agent identities, tool permissions, and token budgets in real time, because that control point is what builds the operational muscle to scale safely. “You can’t build an AI system without getting into a lot of complex decisions,” Wahlberg explains. “And you need a control plane that talks across multiple vendors and infrastructures to help you solve for those defense-in-depth strategies.”
The next wave of agentic AI will see organizations move from a handful of use cases to thousands of autonomous agents working in concert. Without a defense-in-depth architecture that assigns distinct responsibilities to infrastructure, network, and control plane layers, the complexity will quickly outpace the ability to secure it. The partnership between Intel, Cisco, and Nutanix provides a blueprint for how to build that architecture today — using hardware-rooted trust, dynamic network policy, and a unified control plane that treats governance as a runtime control system rather than an afterthought.
Learn more about the Nutanix Agentic AI solution here.
Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact [email protected].
