Category
Governance and leadership
10 posts
-
Six agent-security indicators a CISO can report every quarter without vanity metrics
Report coverage, checked-install share, unknown-artifact rate, time to answer "are we exposed?", canary pass rate and approval-tier mix. Each has a numerator, a denominator and a data source you already own.
-
Shadow AI's $670,000: how to read IBM's breach-cost figure before it goes into your budget request
The $670,000 is an average cost gap between breached organisations with high and low shadow-AI use, from a 600-organisation study of 2024-25 breaches. It supports prioritisation, not a savings claim, and a newer edition is out.
-
Treat the developer laptop as a privileged workstation: what agent tokens and stealers changed
Microsoft's device model puts general developers in the enterprise tier, where users install their own software. Agent credentials, MCP configs and stealers aimed at developers make that the wrong tier. Includes a tier test.
-
Two-thirds of AI users at work use personal accounts: moving coding agents to managed tenancy without a ban
DBIR 2026, via CRI, says 67% of AI users reach AI through non-corporate accounts on work devices. For coding agents that means no org policy on tools that run commands. Make the managed path easier, then enforce it on the device.
-
Before you approve coding agents org-wide: a seven-condition rollout gate for security leaders
Approve an org-wide coding-agent rollout when seven verifiable conditions hold - inventory, managed settings, a deliberate default mode, an artifact policy, egress limits, a decision log and a tested runbook. Most take days, not months.
-
Are built-in agent protections enough? What auto mode, MCP allowlists, store scanning and skill scanning cover
Native agent controls are real, and each covers its own surface: one client, one store, one upload path. The residual risk sits across vendors, across registries and after approval. A coverage map with the blank cells left blank.
-
Thirty minutes with the board: briefing directors on AI coding agents without fear-selling or false comfort
Directors give CISOs about 30 minutes and want better AI-risk reporting. Brief them on coding agents with four slides - one exposure number, one incident pattern, one control decision, one ask - each built from a sourced figure.
-
When an agent causes the loss and there's no attacker: the cyber-insurance trigger gap and what to ask your broker at renewal
Cyber policies usually respond to attacks and breaches. An authorised agent that deletes data or sends it to the wrong place may fit neither. Ask your broker, in writing, which clause would respond.
-
Agent-governance maturity model: five observable stages from 'anything installs' to 'enforced, logged, tested'
A five-stage model for AI coding-agent governance across six dimensions, where every stage is defined by evidence an auditor can inspect. Your stage is your weakest dimension, which makes it hard to game.
-
The agent decision log: what auditors, insurers and incident responders will ask your coding agents to prove
After an agent incident, everyone asks what was installed or fetched, under which policy, and who approved it. A minimum log schema, mapped to hook and telemetry fields, lets you answer with a query.
