Enterprise security was designed for a world where humans made decisions and software followed rules. That world is gone.

AI agents now draft emails, move data between SaaS tools, auto-respond to customers, and trigger workflows — often without a human reviewing each action. The attack surface didn’t just expand. It changed shape entirely.

Mimecast’s March 12 platform overhaul is one of the first major security vendor responses built explicitly for this new reality.

The Core Thesis: Humans Are the Control Plane

Mimecast’s bet is that as AI agents multiply, the human layer — the person who configured the agent, who the agent acts on behalf of, who receives the agent’s output — becomes the primary security boundary.

This means moving from static, org-wide policies to adaptive, per-user security that adjusts controls based on individual risk profiles:

  • High-risk users (frequent targets, access to sensitive data, new to the org) get tighter controls automatically
  • Low-risk users keep full productivity with lighter-touch monitoring
  • Policies shift in real time as risk signals change

It’s the same concept behind zero-trust networking, applied to the human risk layer. Instead of treating everyone identically, the system continuously evaluates who needs what level of protection.

Mihra Investigation Agent

The most interesting piece is the Mihra Investigation Agent — an AI system that acts as a security analyst:

  • Synthesizes events across email, endpoint, identity, and data protection systems
  • Summarizes findings into actionable intelligence
  • Recommends specific resolution actions
  • Claims 78% faster resolution for reported messages by identifying related campaigns automatically

This is an AI agent securing the enterprise from other AI agents. The recursion is no longer theoretical — it’s a shipping product.

The MCP Gateway

Here’s where it gets relevant for the OpenClaw community: Mimecast built a Model Context Protocol (MCP) gateway that lets security teams connect investigation workflows directly into AI platforms like Claude or Gemini.

MCP is becoming the standard for how AI agents access tools and data. We’ve covered its security implications extensively — from MCP SSRF vulnerabilities to Atlassian RCE exploits. But Mimecast’s approach is different: instead of MCP as an attack vector, they’re using it as a security integration layer.

Security teams don’t want another dashboard. They want their existing AI tools to have security context. The MCP gateway lets Claude or Gemini access Mimecast’s threat intelligence during normal workflows — security insights embedded where work happens, not siloed in a separate portal.

The Numbers That Forced This

Mimecast’s own research (State of Human Risk 2026) reveals the tension driving this overhaul:

  • 98% of organizations now use AI for threat defense
  • 80% remain concerned about sensitive data exposure through generative AI tools
  • 60% lack any strategy to address AI-driven threats
  • Detection rates improve 5%+ quarterly as systems learn from 1.7B+ emails inspected daily

The gap between “we use AI for security” and “we have a strategy for AI security” is massive. Nearly everyone adopted the tools. Most haven’t thought through the implications.

Incydr: The Data Loss Prevention Layer

A quiet but significant addition: Incydr Data Protection specifically prevents sensitive data from reaching unsanctioned AI tools.

This addresses the shadow AI problem directly. Employees paste proprietary code into ChatGPT. Customer data flows into AI summarization tools. Confidential documents get uploaded to AI transcription services. Incydr creates guardrails around which data can reach which AI tools — without requiring employees to change their workflows.

What This Means for OpenClaw Users

The enterprise security industry is waking up to the same risks the OpenClaw community has been discussing for months:

  1. AI agents need per-identity security — one-size-fits-all policies break down when agents act autonomously on behalf of different users with different risk profiles

  2. MCP is becoming infrastructure — when a major security vendor builds an MCP gateway as a core product feature, the protocol has crossed from experimental to enterprise-grade

  3. AI-on-AI security is real — Mihra investigating AI-generated threats is the logical endpoint of agent proliferation. Humans can’t review every AI action; AI systems have to help

  4. Data loss prevention is existential — as agents access more systems and move more data, preventing sensitive information from leaking to unsanctioned tools is no longer optional

For self-hosted OpenClaw users: this is a good reminder to audit your own data boundaries. What systems can your agent access? What data can it read and transmit? Mimecast is solving this at enterprise scale, but the same principles apply to personal agent deployments.

The human layer was always the weakest link in security. Now it’s also the busiest — managing AI agents that make thousands of decisions per day. Adaptive security that treats each human-agent relationship as a unique risk profile isn’t just Mimecast’s strategy. It’s where the entire industry is heading.

Mimecast’s platform enhancements are available now. The MCP gateway for AI platform integration and adaptive security policies are rolling out to existing customers.

Keep Reading