RSAC 2026 marked the moment agentic AI moved from experimentation to operational reality. The threat surface has moved with it. This is the priority stack the world’s security leaders are being asked to build, in order, in 2026 and 2027. The RSAC 2026 signal is unambiguous: agentic AI is a Read more
A control problem, not a model problem. Agentic AI has crossed the threshold from experiment to operational dependency. Gartner projects that 33% of enterprise applications will embed agentic AI by 2028, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously by Read more
A generic AI governance framework provides a starting point. Regulatory obligations, however, are sector-specific – and the gap between a general policy and a compliant program widens quickly once you enter a regulated industry. This chapter covers the requirements that apply directly to financial services (with particular focus on credit Read more
AI systems, by definition, are data systems. They are trained on data, they ingest data at inference time, they produce data-derived outputs, and they frequently generate inferences about individuals that those individuals never consented to produce. Every AI deployment in an organization is simultaneously a data governance question, a privacy Read more
AI and cybersecurity interact in two directions simultaneously. AI is an attack surface – AI models can be manipulated, poisoned, and exploited in ways that legacy security frameworks do not address. And AI is a defensive tool – AI-powered threat detection, behavioral analytics, and automated response are materially changing the Read more
The term “sovereign AI” has become a policy talking point across dozens of countries simultaneously. What it means varies – national AI capability, domestic model development, regulatory jurisdiction – but one thread has immediate operational implications for regulated enterprises: the question of where your AI governance decisions happen, and whose Read more
The insider threat model was built around people. An employee with legitimate credentials and a reason to misuse them – that is the scenario security teams have managed for decades. The controls are familiar: least-privilege access, behavioral monitoring, periodic access reviews, offboarding checklists. None of those controls were designed for Read more
When an organization deploys software to govern its AI agents, a natural question follows: how do you know the governance software itself is trustworthy? How do you know the version you installed is the version the developers built and signed? How do you know it does not contain a vulnerable Read more
Every security and quality tool has its own way of reporting what it found. One tool produces a JSON file. Another produces XML. A third produces a CSV. A fourth just prints to the terminal. The result, in most organizations, is a Tower of Babel problem: plenty of findings, no Read more
Most enterprise problems arrive one at a time. The control gap in AI agent governance is unusual because it creates three distinct problems simultaneously: a security exposure, a compliance liability, and a drag on the very adoption it is supposed to be enabling. All three share the same root cause: Read more
