Tag
#governance
8 posts
-
Six agent-security indicators a CISO can report every quarter without vanity metrics
Report coverage, checked-install share, unknown-artifact rate, time to answer "are we exposed?", canary pass rate and approval-tier mix. Each has a numerator, a denominator and a data source you already own.
-
OWASP's two agent Top 10s, ASI and AST, mapped to controls you can actually test
OWASP's Agentic Applications list (ASI) and its incubating Agentic Skills list (AST) overlap on supply chain, drift and privilege. This crosswalk pairs each AST item with ASI risks, a test, and an honest tooling status.
-
Two-thirds of AI users at work use personal accounts: moving coding agents to managed tenancy without a ban
DBIR 2026, via CRI, says 67% of AI users reach AI through non-corporate accounts on work devices. For coding agents that means no org policy on tools that run commands. Make the managed path easier, then enforce it on the device.
-
Before you approve coding agents org-wide: a seven-condition rollout gate for security leaders
Approve an org-wide coding-agent rollout when seven verifiable conditions hold - inventory, managed settings, a deliberate default mode, an artifact policy, egress limits, a decision log and a tested runbook. Most take days, not months.
-
ClawHavoc was a registry-governance failure: what 341 malicious skills say about skill stores and takedowns
ClawHavoc is retold as a malware story. The useful reading is governance: an open store let a few publishers ship hundreds of look-alike skills. Publisher limits, instruction review and cross-store matching matter more than the payload.
-
Thirty minutes with the board: briefing directors on AI coding agents without fear-selling or false comfort
Directors give CISOs about 30 minutes and want better AI-risk reporting. Brief them on coding agents with four slides - one exposure number, one incident pattern, one control decision, one ask - each built from a sourced figure.
-
When agent-skill scanners disagree: what conflicting verdicts on the same skill mean for your install policy
In one census, auditors gave the same skill HIGH or CRITICAL and LOW or SAFE ratings on 1,233 listings, and 87.8% of listings had no audit at all. Treat conflict and absence of audit as separate policy states, not as a pass.
-
Agent-governance maturity model: five observable stages from 'anything installs' to 'enforced, logged, tested'
A five-stage model for AI coding-agent governance across six dimensions, where every stage is defined by evidence an auditor can inspect. Your stage is your weakest dimension, which makes it hard to game.
