The Next Horizon: Automation Virtual Summit 2026
MCP Server Security: Agentic AI Without the Chaos
Session recap · Serge Lucio and Kieran Taylor
The Bobfather
Bob Schwartz is the CEO of Robert Mark Technologies and has led the company to consistent double-digit growth for the last 10 years. He is an active member of the Workload Automation community and holds a seat on the Broadcom Partner Advisory Committee.
At a Glance:
- Kieran Taylor and Serge Lucio framed two bad options for agentic AI: all-or-nothing access, or potentially hundreds or thousands of MCP servers to run and secure.
- Serge’s third path: expose hardened integrations and jobs from your automation platform to agents through MCP, with auditability and policies intact.
- A test-driven development loop in Serge’s own division ran tens of thousands of tests per iteration, at hundreds of dollars a run, until the workflow took control.
- Business users piping data into AI tools are the bigger risk, plus prompts are now data too.
- Observability and horizontal scalability are the two things still to build with customers, with no dates given.
Session recap · The Next Horizon: Automation Virtual Summit 2026
Speed, Resilience, Trust: Why Automation is the Ultimate Agentic AI Accelerator
Serge Lucio, GM, Agile Operations Division, Broadcom
Interviewer: Kieran Taylor, Head of Marketing, Agile Operations Division, Broadcom
Your CIO wants agentic AI yesterday. Your security team wants to know exactly what those agents can touch. Sound familiar?
Kieran Taylor opened the interview with Serge Lucio, Speed, Resilience, Trust: Why Automation is the Ultimate Agentic AI Accelerator, with that tension. It sits at the heart of MCP server security, and Serge had an answer at The Next Horizon: Automation Virtual Summit 2026, presented by Automation by Broadcom with Google Cloud on September 24.
Tests per loop
Tens of thousands
In Serge’s example, an agent ran this many tests on every iteration
Cost per run
Hundreds of dollars
Each run cost this much because the agent analyzed the results
MCP servers to manage
Hundreds to thousands
Serge’s description of what custom MCP servers could add up to
The MCP server security problem: two bad options
Kieran laid out the dilemma: give agents all-or-nothing access, which Kieran called a disaster, or stand up dozens or more custom MCP servers with a lot of homegrown scripts.
Serge, who was recently at an MIT conference in Boston, described a split. Some organizations will give AI broad access and move fast, while traditional ones hit friction deciding what AI can reach. Where IT and security aren’t negotiating, shadow development fills the gap, like command line interfaces built on APIs with role-based access controls an open question.
MCP servers are the more validated route, Serge said, but built-in role-based access control isn’t a mandate, and it isn’t clear you have to enforce OAuth within one. Then there’s upkeep: potentially hundreds or thousands of servers to run and secure. Serge called it growing chaos.
Your automation platform already did the hard part
For decades, IT and security have negotiated how the automation platform reaches back-end systems. Governance, auditability and traceability are already there, with a central point of control and no server sprawl. That, Serge said, lets classic enterprises innovate at the speed of organizations with fewer controls.
So why rebuild it? Serge described exposing hardened back-end integrations, and specific enterprise jobs, to agents through MCP. The platform becomes “the legs and the arms of these agents” in a very controlled way, with auditability of each agent, plus policies and governance.
The test loop that ran up the bill
Serge’s best story came from Serge’s own division just a few weeks back. Agents doing test-driven development and regression testing touched a critical path, so every loop ran tens of thousands of tests. The agent analyzed the results, so every run cost hundreds of dollars. Now multiply that by dozens or hundreds of people.
The fix? The team defined the steps in Automic, so regression tests run only when the workflow says so, and agents get tasks like analyzing requirements and writing code. Serge’s broader point: the workflow engine should also consume MCP and drive agents, for something more deterministic. (An offer your CFO can’t refuse.) Kieran’s name for taming all this: internally, Broadcom calls it the intelligent control plane.
The bigger risk is on your sales team’s desktop
Funded AI projects have well-understood governance, Serge said. Business users are the bigger problem. Picture a salesperson exporting Salesforce data into an AI tool. Increasingly, tools from Google, OpenAI and Anthropic can log in to Salesforce each morning and drop a filtered Excel file on your desktop, Serge noted. Knowledge workers are building automation, with data reaching LLMs in ways that may not be controlled.
Many organizations lock down exports over PII and security risks. (Could a rep export the whole pipeline and hand it to a competitor?) Serge’s alternative: let these users reach back-end systems through their LLM in a controlled way, via the intelligent control plane.
Data, RAG and prompts
Serge described three facets of data. First, the basics: the right data, and the personal information in it. Second, RAG, the context that specializes an LLM to your business. Tampering is the risk: plant data saying your profit-focused company only cares about revenue growth, and the LLM could process your data completely differently. Systems making decisions need hardened data provenance and chain of custody, Serge said, and enterprise automation is key.
Third, emerging in the last two months: “a prompt is data itself.” Leaders now talk about private AI on open-weight models, in public cloud or the data center, so prompts aren’t used for training. That calls for another control plane: which prompts can go to a public foundation model, and which are IP for a model you control? It’s part of sovereign infrastructure, Serge said, but it goes further, to sovereign IP. Citing Alex Karp, Serge asked you to imagine a model provider that sees every CRM user’s prompts and could potentially enter that market with an unfair advantage.
It’s the automation team’s moment
Serge got a bit provocative here. Automation teams have long run the company from the background, mostly ignored, yet many problems CSOs and IT leaders now face are being solved through enterprise automation platforms. It’s their time, Serge said, to show leadership the role they can play.
Broadcom has done a lot of work on MCP support, as server and client, Serge said. Two things still need building with customers before large-scale deployment (no dates given):
- Observability. Agents spawning other agents create a starburst effect. Become the control plane and you become a key observability point, including for chargeback.
- Horizontal scalability. Vendors, Broadcom included, have focused on vertical scalability. That won’t work for this role, so Serge pointed to investing in containerization of the platform to scale out.
For what has shipped and what’s still roadmap, see our recap of Rajeev Kumar’s roadmap session.
What this means for you
- Bring your scheduler to the AI conversation. Show your AI and security teams what your Automic Automation environment already governs before anyone builds custom MCP servers.
- Keep agents inside a defined workflow. Let the workflow decide when expensive steps run.
- Look for shadow automation. Who’s already piping business data into AI tools?
- Treat prompts like data. Decide what can go to a public model and what stays in-house.
Next up: Caroline Denoon-Slater’s blueprint for AI agent governance. And which of your jobs and integrations are ready for agents? RMT has spent 25 years in workload automation and is happy to help you sort it out. Book a free 30-minute assessment.
Which of your jobs are ready for agents?
RMT can help you sort out which jobs and integrations are ready for agents.
More from the summit
The Next Horizon: Automation Virtual Summit 2026, session by session
- Why AI Projects Fail: Sol Rashidi on the Human Advantage
- MCP Server Security: Agentic AI Without the Chaos (you’re here)
- Intelligent Control Plane in Practice: 4 Automic Automation Use Cases
- Evertec’s VM Rightsizing Automation: From Manual Tickets to One Automic Workflow
- The Orchestration Accountability Gap: Inside the SLA Illusion
- From Black Box to Glass Box: A Blueprint for AI Agent Governance
- The Illusion of Green: Automation Observability Beyond the Return Code
- Broadcom Automation Roadmap: What Shipped and What’s Next