Almost every security tool an enterprise owns was built on the same assumption: watch what happens, and raise an alert when something looks wrong. It is a reasonable design when the thing you are watching is a person, because people are slow, and an alert usually reaches a responder while there is still time to act.
Autonomous agents break that assumption completely. An agent does not take one questionable action and pause. It takes thousands, in seconds, and repeats them. By the time an after-the-fact alert has been triaged, the thing you were worried about has already happened, at scale, and moved on. Monitoring built for human tempo cannot govern software that acts at machine tempo.
You cannot alert your way out of an actor that never waits.
This is why we think the centre of gravity in enterprise security is about to move from detection to prevention. Not because detection stops mattering, it always will, but because it can no longer be the primary control. For agents, governance has to happen at the moment of action: what an agent is permitted to do has to be settled before it acts, not reconstructed after it has.
The uncomfortable part for the industry is that this inverts a decade of investment. Most security budgets are pointed at seeing more, more telemetry, more alerts, more dashboards. Seeing more is not the same as controlling more, and with agents the gap between the two becomes the whole problem. You cannot alert your way out of an actor that never waits.
The enterprises that will run agents safely are not the ones that watch them most closely. They are the ones that decided, in advance, what their agents were allowed to do.