Security by design for agentic AI: How CISOs stay in control of autonomous systems
summary
SolarWinds infects ~18,000 customers and Echo Leak becomes a tracked CVE, reframing risk from code provenance to agents that read, reason, and act. Enterprise patterns put identity first: per-agent identities with short-lived credentials, scoped permissions and audit trails; supervision via a validation loop for high-risk or irreversible actions; and observability tied into existing tooling for monitoring and postmortem. OWASP Agentic Top 10 and Cloud Security Alliance Maestro provide threat models, and the practical test is the “twin” case where human approval gates and strict tool/content whitelists determine whether the approach actually works.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:31What is a CISO and third-party risks
- 2:39Echo Leak and AI supply chain attacks
- 5:07AI twins and autonomic systems
- 7:18Autonomic vs autonomous AI systems
- 9:05Confidence over trust in AI security
- 10:11Key terms in agentic AI security
- 11:58AI adoption outpacing governance
- 13:01Why AI agents differ from software
- 14:05Prompt injection and context challenges
- 15:32Frameworks for agentic AI security
- 16:39Onboarding AI employees
- 17:00Identity and non-human credentials
- 18:25Least privilege for AI twins
- 19:27Twin access and security oversight
- 20:32Non-negotiable controls for AI twins
- 22:00Supervision and validation loops
- 22:42Performance reviews and observability
- 24:06Stress-testing the security framework
- 24:28Six steps to secure agentic AI
- 25:52Evolving from trust to earned confidence
- 26:33Summary
related talks
21mSecurity in the Age of AI & Copilot
20mSecurity in the Age of Agentic AI
40mIn AI We Trust? Securing the Future, One Agent at a Time
44mWhat Security Teams Need to Know and Do
19mKeynote: Towards Building Safe and Secure Agentic AI
30mNavigating the New AI Security Landscape
22mFireside Chat - AI Security Vulnerabilities
31mAgentic AI Threats: How Multi-Agent Systems Get Exploited