Tag
#ciso
4 posts
-
Six agent-security indicators a CISO can report every quarter without vanity metrics
Report coverage, checked-install share, unknown-artifact rate, time to answer "are we exposed?", canary pass rate and approval-tier mix. Each has a numerator, a denominator and a data source you already own.
-
Before you approve coding agents org-wide: a seven-condition rollout gate for security leaders
Approve an org-wide coding-agent rollout when seven verifiable conditions hold - inventory, managed settings, a deliberate default mode, an artifact policy, egress limits, a decision log and a tested runbook. Most take days, not months.
-
Thirty minutes with the board: briefing directors on AI coding agents without fear-selling or false comfort
Directors give CISOs about 30 minutes and want better AI-risk reporting. Brief them on coding agents with four slides - one exposure number, one incident pattern, one control decision, one ask - each built from a sourced figure.
-
Agent-governance maturity model: five observable stages from 'anything installs' to 'enforced, logged, tested'
A five-stage model for AI coding-agent governance across six dimensions, where every stage is defined by evidence an auditor can inspect. Your stage is your weakest dimension, which makes it hard to game.
