Agentic AI at the Edge: The Security Frontier Worth Owning
Australian CYBERCON 2026, THINK TANK
The engineering has outpaced the frameworks.
Software that reasons, plans and acts now runs on robots, vehicles and sensors, far from any data centre.
Most security thinking still assumes a server behind a perimeter. At CyberCon in Melbourne this October, I presented at a Think Tank on that gap. This is the short version.
🚗 Machines that think, then act
Three terms sit at the foundation of this discussion, and one machine represents all three: the autonomous vehicle. Edge AI runs models on the device, where the data is made. Physical AI senses, interprets and responds with a real-world action. Texas Instruments call it "local inference, turned into action". Agentic AI plans towards a goal, with no person approving each step.
Watch what the vehicle does. Recognising a pedestrian is edge AI. Braking is physical AI. Taking the roundabout unaided is agentic.
Edge AI thinks. Physical AI acts. Agentic AI decides.
📈 The size of the bet
Precedence Research puts the edge AI market at about USD 31.05bn in 2025 and USD 165.05bn by 2035. By 2030, IDC forecasts edge systems to make up 89% of the systems sold worldwide. The edge becomes the default.
The limit is not only silicon. The Economist reports that a general-purpose humanoid may need on the order of 100m hours of demonstration data, more than 11,000 years of it. China is manufacturing that experience in training centres, with people piloting robots to generate it. Deployment will not wait for the controls.
🔁 Where the problem moves
The instinct is to split a system into components and secure each one. For these machines, that fails. McKinsey describe end-to-end driving systems in which a single deep-learning model turns raw sensor input into control. There is no seam to guard.
The answer, from exein, is to model the loop. Every physical AI device cycles through perception, reasoning and action, and each stage is its own attack surface. A crafted sign enters through perception, hijacks the goal in reasoning, and misuses a legitimate tool in action. Nothing in that chain gives a signature anything to catch.
Two more surfaces are attached to the loop. They decide whether one compromised device stays a single fault or becomes a fleet-wide one. I kept those for the room.
Secure the loop, not the box.
🛠 For builders
This is a design problem, not a risk to be managed after the fact. The organisations that own this frontier will set the terms before the deployment sets them instead.
I am building in this space with Azaro, a venture working on how autonomous agents at the edge earn trust. azaro-infra, holds three repositories: two demonstrations, one built around a vision-language-action model, all on the NVIDIA stack. They are hands-on, a way to get a feel for agents at the edge. Security for those agents is what Azaro is being built for, and the repos are where that work begins.
If you run robotics or operational technology at the edge, I would like to compare notes. If you would like the full session for your team or forum, write to vmagee@azaro.io
📎 The deck
My presentation from the session is available below. The conversation is better in person.
