We've all seen what happens when someone's email gets compromised. Now ask a newer question: what happens when someone's personal ChatGPT or Claude account, the one connected to company email, files, and calendars, gets compromised?
AI adoption doesn't look like past technology waves. With earlier innovations, the headlines were about restricting the new thing. With AI, everyone has an opinion, and connecting it to other systems is so easy that non-technical family members are doing it at home. My own parents talk about AI the way we used to say "Google it."
Organizations are adopting it just as fast, under real pressure to stretch staff capacity. In practice, that means building everyone their own assistant. An assistant that reads your email, builds your reports, and summarizes your threads has credentials, permissions, and access. It's an identity, and it deserves the same scrutiny as any employee or contractor.
Fortinet put it plainly at its [SASE Summit 2026](https://www.fortinet.com/blog/unified-sase/3-key-takeaways-from-fortinet-sase-summit-2026): organizations "must therefore secure a growing population of non-human identities as carefully as they secure employees, contractors, and devices." That line stuck with me, because most organizations aren't there yet.
We already had an account problem
Non-human identities aren't new. Service accounts, roles, API keys, and access tokens have run in our environments for years. What's new is how fast they're multiplying, and who is creating them.
We used to create a service account for a specific integration, with a human involved in every connection. Today, anyone can connect company systems to a personal AI account in a few clicks. We already had an account management problem. Now we've handed account creation to AI agents, and those agents act on someone's behalf, at machine speed, across many systems.
The [OWASP Non-Human Identities Top 10](https://owasp.org/www-project-non-human-identities-top-10/) is a good reality check. It cites Okta's support system breach in 2023. An employee saved a service account's credentials to their personal Google account while signed in on a company-managed device. When that personal account was compromised, attackers used those credentials to access Okta's customer support system, including files from 134 customers that contained session tokens.
Swap "Google account" for "personal AI account" and that's the risk most organizations are carrying right now. Four risks from the OWASP list matter most for AI integrations:
Overprivileged NHIs:** broad access granted to hit a deadline, never tightened.
Long-lived secrets:** keys and tokens that never expire.
NHI reuse:** one credential across many systems, so one compromise means all of them.
Improper offboarding:** the integration someone tested once and forgot.
Zero-trust principles still apply: verify the identity, grant least privilege, inspect the traffic, and log what it did. The hard part is the last one.
Sprawl is where visibility goes to die
Since 2019, I've watched the same pattern play out, and it's accelerating. A new requirement shows up, and organizations look at the market before they look at their own tooling.
The "best" product in any category changes often. So environments end up with several products that each solve one specific problem, with overlapping capabilities that never needed to be there. Each one brings its own policies, agents, logs, and workflows. Every addition makes the whole harder to run and takes more staff time to maintain.
Fortinet's summit made the same point: "organizations cannot address every new requirement with yet another standalone product." I'd go further. The cost isn't only licensing and staff hours. It's the gaps between products, where no single tool sees the whole picture.
That gap was already a problem for human users. AI agents make it worse.
Your firewall sees the chat, not the agent
Put the two problems together. One agent's request might touch an endpoint client, a web gateway, a CASB, a ZTNA broker, and an SD-WAN edge, each logging it differently in its own console. Reconstructing what that agent did means stitching those stories together by hand. If you can't answer "what did this agent touch?" in one place, it's hard to say it's secured.
There's a second problem, and I didn't fully appreciate it until I dug into how agents connect. Agents use MCP (Model Context Protocol) to reach tools and data, and A2A (Agent-to-Agent) to talk to other agents. Where the MCP client runs decides whether your firewall ever sees what the agent does.
Three paths an AI agent's traffic can take
Only the first path puts the agent's actions on your network. The third is the one most people miss: when someone connects a personal AI account to company M365 or Google Drive, the MCP client runs in the AI vendor's cloud. The agent's calls go server to server with the OAuth token the user granted. Your firewall sees someone chatting with an AI app, not the agent reading their mail.
And a user working from home isn't behind your FortiGate at all.
What real unification looks like
The answer isn't another standalone product. It's using what you already have, configured properly, and knowing where its visibility ends.
Unification has to go deeper than separate products behind one login. It means one policy, one endpoint agent, and one log trail across networking, security, and identity, so you can follow a communication end to end, human or non-human. Here's how that maps to the three paths:
On your network (path 1):** [FortiOS 8.0](https://docs.fortinet.com/document/fortigate/8.0.0/new-features/845410) application control can now detect MCP and A2A traffic and show it in FortiView AI Applications: which agent, which tool, which function, and what arguments it passed. That's real visibility in tooling many organizations already own. The catch is deep inspection. Without SSL inspection on the policy, the detailed AI log fields don't populate, and broad deep inspection is one of the most commonly skipped controls I see, usually because of certificate rollout, broken apps, or exceptions that never get revisited.
Off your network:** remote and home users need the same inspection wherever they work. That's the job of SASE, where FortiSASE extends the same policies and logging to users who never touch the office firewall.
Cloud to cloud (path 3):** no network device sees these calls. The control point is identity: audit the OAuth app grants in your M365 and Google Workspace tenants, limit who can consent to third-party apps, and know how to revoke a grant quickly.
On the device (path 2):** local MCP servers live on the endpoint, so this is an endpoint and software inventory question, not a firewall one.
What to do this week
None of this requires a new purchase to start.
Inventory your non-human identities and AI integrations.** Service accounts, API keys, and every AI app with access to company data. Note who created each one and when.
Audit OAuth app grants** in your M365 and Google Workspace tenants. Remove what nobody owns, and restrict who can consent to new apps.
turn on an application control sensor** with the Generative AI category set to Monitor, apply it with deep inspection, and check FortiView AI Applications. You'll learn what's already running.
Map overlapping tools before buying the next one.** Check what your current licensing already covers.
Write down how to disconnect an AI integration fast.** If a personal AI account tied to company systems is compromised, you want a revoke procedure, not a search for the right admin console.
The question to answer
Your AI agents are users now. The question isn't whether you have a tool that could see them. It's whether you can answer, in one place, what they did.
If you're not sure, that's where AMIS can help. We'll review what your Fortinet environment can already see, where the gaps are, and which tools overlap, before you buy anything new. Reach out at [a-mis.net](https://a-mis.net).
Sources
3 Key Takeaways from the Fortinet SASE Summit 2026 (https://www.fortinet.com/blog/unified-sase/3-key-takeaways-from-fortinet-sase-summit-2026), Fortinet, October 8, 2026
OWASP Non-Human Identities Top 10 (https://owasp.org/www-project-non-human-identities-top-10/)
FortiOS 8.0: Detecting agentic AI protocols (https://docs.fortinet.com/document/fortigate/8.0.0/new-features/845410), Fortinet Docs
MCP architecture overview (https://modelcontextprotocol.io/docs/learn/architecture), Model Context Protocol
SOURCE / FORTINET ANNOUNCEMENT
This is AMIS’s independent perspective, not a Fortinet datasheet or a performance guarantee. Validate specifications, availability, and licensing before making a purchasing decision.