Data processing and cookies

We use cookies to personalize content and ads, to provide social media features and to analyze traffic to our website. We also share information about your use of our website with our social media, advertising and analytics partners. Our partners may combine this information with other data that you have provided to them or that they have collected as part of your use of the services. To the privacy policy

Skip to content

Agentic AI 2025: Between hype, reality and security risks

Whether it's customer service, software development or process automation, agentic AI promises a lot. How much of this is hype and what is already working in companies today? In this interview, AI expert Bennet Krause explains where AI agents are already delivering real value, why so many projects fail and what decision-makers need to look out for.

Knowledge
Software, KI, Prozessautomatisierung

What is an agent – and what is just marketing?

Bennet Krause draws a clear line: an agent is more than a chatbot. It plans, uses tools, works in multiple stages and can change the state of the world, for example by adjusting data in a customer account.

Agentic AI is an AI system that not only generates answers, but can also act with a clear goal and a certain degree of autonomy.

How can this be recognised in practice? Bennet cites two minimum criteria: firstly, it must be possible to use at least several tools; secondly, the agent needs the freedom to work until the task is completed – including repeated queries, reformulations and intermediate steps. „Anything that does not use tools and only performs one step – such as searching and summarising once – is not an agent."

What works today: clearly defined, low risk

Produktionsreife Anwendungsfälle gebe es immer noch wenige, meint Bennet. Geeignet seien Aufgaben, die klar abgegrenzt, messbar und mit geringem Risiko verbunden sind. Als Paradebeispiel nennt der AI-Experte Kundenservice Level 1: einfache Anfragen beantworten, den richtigen Self‑Service verlinken, Statusinformationen abrufen – oder eben an einen Menschen weiterleiten. 

The first wave of support, which filters out the worst cases, is relatively easy to implement.

Profound, complex problems involving numerous system integrations and active changes are often still too risky today – the error rates are too high.

However, within a controlled framework, an agent could certainly make changes, e.g. adjust an address in a customer account – provided that a backend automatically checks and approvals are in place. Bennet currently considers broader, deeply integrated changes to be too risky.

Why end-to-end automation is still science fiction

Many dream of "autonomous employees" who could do everything a human being can do without much supervision. Bennet puts the brakes on: „We are still a long way from having autonomous employees."

There is still a long way to go before the system is ready for production. Demos work, but for widespread rollouts, error rates need to be close to zero; "quite good" is simply not good enough for productive use. With hundreds of thousands of users, even a few percent error rate can cause considerable damage.

We are currently in a phase where companies need to examine very carefully which use cases are realistically feasible – both from a technical perspective in terms of the capabilities of the models, but also in relation to security aspects.

  • Production-ready: clearly defined, low-risk tasks (e.g. customer service L1)
  • Limited: ‘changing actions’ only in controlled, tested cases
  • Not ready: complex end-to-end automation without supervision

Orchestration: Strong when simple, risky when complex

Bennet recommends using a small specialised agent with limited scope for action only in areas where classic process automation does not work and the dynamics of LLMs are really needed.

If necessary, RAG (retrieval-augmented generation) can be added for knowledge context. In addition, a router can delegate to specialised mini-agents. He warns against generic multi-agent systems: the more steps, the higher the overall error rate; a supervisor is often unable to verify the results of the sub-agents.

Multi-agent systems sound good, but they quickly become opaque – and errors multiply. The idea itself is very nice, and maybe it will work someday, but at the moment it's science fiction.

Overall, agents still lack the crucial ability to avoid mistakes or recognise errors and correct them independently. „By default, an agent does not learn from its mistakes at all. There are various constructs to simulate this, but so far none of them work really well."

  • Do: single agent + tools (+RAG), clear framework, 5–10 defined tools
  • Do: router → specialised mini-agents for narrowly defined tasks
  • Don't: one "big agent for everything" or non-transparent multi-agent networks

Special case: coding agents – why things move faster here

Bennet sees the greatest short-term advances in software development. Development environments can be simulated; agents can work for hours, generating code, testing it and improving it iteratively – without jeopardising production.

If the code is not good, it simply will not be accepted – this massively reduces the risk.

For generic office tasks, he sees research progress in "computer operation" through models (browser, mouse, keyboard control). This could enable end-to-end tasks – from research to documentation to sending emails – but it is not a general solution and remains inferior to textual interfaces in most cases. Furthermore, there is still a long way to go and research in this area is only just beginning.

Security first: least privilege, kill switches, human approvals

Bennet formulates clear principles for safe use: least privilege access, logging, kill switches and human approval for high-risk actions. An agent must never have higher privileges than the person with whom they are interacting.

Agents may only access data that the respective user is also permitted to view.

Prompt injections – manipulated content in tickets, emails or documents that trick agents into performing unwanted actions – are particularly critical. Filters help, but they are never perfect. According to Bennet, robust protection lies in the architecture: restricting tools so that they are technically unable to perform critical actions.

Vulnerability: When a single email is already sufficient

Bennet describes a case from a security report: a generically built agent with overly broad rights was manipulated via a simple email and began sending CRM data to an unknown address. His conclusion: severely restrict rights, whitelist recipients, and only allow sensitive tools to be used with human approval.

The agent should never have been able to use arbitrary recipient addresses.

  • Least privilege: strictly limit rights to user level
  • Four eyes for risky actions (human approval)
  • Logging & kill switches: be able to track and stop actions
  • Reduce attack opportunities: make dangerous actions technically impossible

Failure with prior notice: Where AI projects get stuck

Bennet sees security concerns as one of the reasons for the failure of AI projects. Many projects are not even started due to fears of compliance risks. According to various studies, a large proportion of AI initiatives are currently being abandoned; many POCs end before production. Bennet also sees management errors here: the corresponding POCs are developed without considering the strategy for operation, budget and responsibilities from the outset.

Many proof of concepts are developed without a clear vision of how they can eventually create real value. Without this vision and a budget for further development into a production-ready system, operation, responsible parties and clear KPIs, the bridge to reality is missing.

Why it's still worth starting now

Despite this rather sobering assessment, Bennet advocates experimenting with AI in companies – but in a focused manner. Experience gained from real-world applications provides clarity about the processes, gives insight into the scope and quality of the data required, and prepares the systems to interact with agents in the future. It is important to tailor projects in such a way that the benefits are demonstrable – instead of reflexively integrating AI everywhere. This experience is enormously valuable. And:

One successful application can finance many failed experiments.

Outlook for the coming year: stabilisation rather than miracles

Bennet is realistic about the coming year:

I don't expect a radical breakthrough – rather, that it will become clear what really brings value.

Fundamental limitations will not disappear for the time being, but many things will gradually improve. He anticipates longer context windows and better memory functions, enabling agents to reliably process longer task chains. Level 2 could be achieved in the area of customer service. Coding agents, on the other hand, could soon take over entire tickets. Overall, however, Bennet believes that the hype could give way to more cautious use. Instead of "co-pilots everywhere", he expects more sober deployment where it makes sense.

TLDR

Questions decision-makers should be asking now

  • Maturity: What are we lacking in terms of AI maturity (governance, ownership, KPIs, data quality)?
  • Security: How do we address prompt injections? Do we have sufficient logging and monitoring?
  • Use case maturity: Which low-risk use cases work and deliver measurable value within six months?
  • Failure: How do we secure the business case, operating budget and clear responsibilities?
  • Regulation: Which obligations relating to the AI Act and compliance do we address, and in what order?

Regular updates: LinkedIn newsletter "Enterprise AI"

In his monthly LinkedIn Newsletter, holistic expert and AI specialist Bennet Krause highlights how companies can successfully utilise artificial intelligence – pragmatically, thoroughly, and without hype.

Subscribe now to the LinkedIn newsletter

Author

Kali Richter

Text-savvy word acrobat who loves the balancing act between creative ideas and pragmatic solutions. She therefore enjoys working in the marketing team.

About us

Holisticon in 90 Words

Holisticon is the boutique among the IT consultancies for digital transformation. Integrated and customized: we consistently combine technology, strategy, and organization. With our Strategize approach, we also bridge the gap between strategy and implementation. In this way, we create the basis for future-proof, innovative business models in the digital world.

Over 70 employees at our locations in Hamburg, Hanover, and Munich successfully guide companies from a wide range of industries through the transformation process.

Holisticon is a partner to leading technology brands and a member of the international Nexer Group.  

Discover Holisticon Holisticon as an employer