AI is making it easier than ever to ship fast and assign blame later. But who actually owns AI-generated code? We dig into what happens when an agent deletes your inbox, and why “a human approved the pull request” is starting to sound a lot like an alibi.

This week’s episode is hosted by David Spark, producer of CISO Series, and Andy Ellis, principal of Duha. Joining is our sponsored guest, Jadee Hanson, CISO, Vanta.

Join the conversation on LinkedIn.

Huge thanks to our episode sponsor, Vanta

Full transcript

Intro 

0:00.000 

[Voiceover] Best advice I ever got in security, go! 

[Jadee Hanson] Best advice I received was assume that you’re wrong first, surround yourself with a team that challenge you, tell you you should dig in deeper. Curiosity and humility will find more risk than confidence ever will. 

[Voiceover] It’s time to begin the CISO Series Podcast. 

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I’m the producer of the CISO Series. And joining me as my cohost, it’s none other than Andy Ellis, the principal over at Duha. Andy, say hello to the audience. 

[Andy Ellis] Good afternoon, folks, or depending on when you are in the world, good morning, good evening, or good night. 

[David Spark] We’ve talked about people easily falling asleep listening to this podcast. My wife does that.

[Andy Ellis] Some days we’re more exciting than others. 

[David Spark] There you go. We are available at CISOseries.com where you can check out all of our wonderful programming. Did you know that we have four other shows on the CISO Series? We drop 10 episodes every single week on this network, and it’s all supported by fantastic people like yourselves who’s listening.

So, thank you very much. Our sponsor for today’s episode is Vanta, a phenomenal sponsor of the CISO Series. Automate compliance, manage risk, and accelerate trust with AI. That’s the magic dust to throw on all of it to make it run so wonderful. In fact, we’re going to be talking more about just that a little bit later in the show.

But Andy, I think we mentioned this before. Before we hit the record button, we decided on a quick little banter up front, not a what was your weekend like, but what would interest the audience, and I always kind of slam you because you bring up two topics that I don’t think anybody cares about, and that is Jewish holidays…

[Andy Ellis] [Laughter] Yep.

[David Spark] …and sporting events that are happening while we’re recording and will be a month to two months old when people hear it. 

[Andy Ellis] That’s fair. 

[David Spark] So, I want to know from our audience, are you in agreement with me that Andy’s ideas of opening banter are lame? So, please let me know. 

[Andy Ellis] [Laughter] Okay. Just since David’s going to start with that, the banter I was proposing was pointing out that the U.S. is now 4-0 against Canada in hockey because I’m including in the world baseball classic that just happened when the U.S.

played Canada, the Canadian baseball team came out in hockey jerseys during the warmup and then lost. 

[David Spark] Again, this will be two-months-old sports news. 

[Andy Ellis] But who knows? Maybe there’ll be more hockey events between now and then. Maybe Canada has a shot at redeeming themselves. 

[David Spark] Nobody’s going to care. No one cares. I would love to hear from our audience what they would love to hear in the opening banter, which we like it to be of interest to our audience. But I do know and just will mention this briefly because we want to get into the show right away.

We are literally just days away from us all going to RSA, and Andy’s going to do something he did at Black Hat, which is essentially critiquing the verbiage and signage at different booths at the trade show floor, and you’re going to do as many as you possibly can, create a report.

[Andy Ellis] I’m going to do all of them. What’s this as many as I possibly can? 

[David Spark] There’s no way you can physically do all of them. 

[Andy Ellis] Every booth. 

[David Spark] It’s impossible. 

[Andy Ellis] Should we put a bet on it? 

[David Spark] There’s no… I think I calculated one year that you’d have to like spend 20 seconds per booth and for your entire time. It’ll take you forever. 

[Andy Ellis] It’s like 630 booths. 

[David Spark] You can’t do them all. Andy. 

[Andy Ellis] Look, I’m not going to talk to everybody. I’m just writing down whatever they put on their booth. 

[David Spark] Yeah. That could take your time. Andy, what are the things you’re looking for when you’re looking at the booths? 

[Andy Ellis] So, what I look for is a couple of things. The first is do I know what you do?

[David Spark] Yes. We used to have a game like that. 

[Andy Ellis] Can I glance at the booth and very quickly say, “Hey, do I understand why I would talk to you if I was a buyer or not?” So, that’s the first thing I’m going to look for. The second thing is I’m looking for like what are the words and keywords that people are using and not using?

Because we see this a lot, that people for a while, everyone was talking about risk management and then vulnerability management, and then now it’s back to risk management. And so, how are the different vendors in one space trying to change that space?

This year, the thing I’m looking for is what used to be the SaaS security world. I think they’re all trying to change the name to either app ecosystem or AI ecosystem or something else. So, we’ll see. That’ll probably have already been in the report by the time you’re all hearing this, which you can get at my website, which will be duha.co.

Just look at reports there. It should be published by the time you hear this. We’ll link to it. 

[David Spark] We can link to it. Don’t worry. All right. Let’s bring in our guest who we’ve had on many times before through our wonderful sponsor Vanta. We adore having her on. She’s fantastic. In fact, you heard her just at the very beginning of this show.

Our sponsored guest, the CISO over at Vanta, Jadee Hanson. Jadee, thank you so much for joining us. 

[Jadee Hanson] Thanks so much for having me. 

Is this really the right strategy? 

5:08.447 

[David Spark] “The thing I helped build is starting to hold the industry back.” Bil Harmer of Kraft Ventures had a hand in creating SOC 2, but now sees the whole model as broken, given the daily and minute-by-minute updates needed for secure environments, point-in-time audits producing PDFs that are already months stale by the time procurement reads them are – get ready for this, we all know it, let’s all say it together – useless.

Bil is back at it with the Open Trust Verification Protocol, OTVP, another acronym for you, his open source protocol that replaces audit reports with continuously running verification agents producing cryptographically signed real-time evidence about your actual security controls.

We’ll see if OTVP gets any industry traction, but if continuous machine variable evidence is technically achievable today, why does the industry still buy and sell PDFs, Andy? And is this just a case of, yes, it’s broken, but it’s the best broken solution we’ve got?

Why isn’t there a rush to get off of it? What do you think, Andy? 

[Andy Ellis] So, let’s separate out. I think there’s three different issues here. So, one is internal verification, and I actually love this for internal verification. I think we’ve seen a lot of the compliance industry already moving this way. For evidence collection, if your evidence is not being collected and verified in real time, you don’t actually have a control system.

There’s too many controls out there that are written like, “Oh, we make sure that a second person signs off on this,” and what you do is every month you go collect all the evidence that somebody filed the ticket correctly. That’s not a control system.

That’s a narrative. If you had a control system, you would be checking every single pull request to make sure that there was a second person signed off on it, and that you could verify this, and your entire security system would be running on this evidence continuously collecting.

You would notice deviations from your norm in real time. That’s actually how companies should be running security policy today, is that that evidence that you’re actually doing what you’re doing becomes output for compliance validation. So, that’s sort of step one.

There’s a second challenge here which is what’s really going on with the TPRM industry and how we deal with our third parties, and the reality is everybody’s asking the wrong questions. They’re basically saying, “Do you do compliance?” which is really saying, “Are you tall enough to fill out a report correctly and ship it to our procurement team, who might go look at it, but the people who look at it have no idea what we’re using you for?” Nobody’s actually asking the right questions in TPRM, which is how will you break us?

What will we do using you that will cause us to break? That should be the whole model of third-party risk management, should start from that, and compliance should be an afterthought. 

The third thing, which is this idea of real-time validation of vendor controls, there are places where that makes sense with subcontractors, but having been the vendor whose people have come in and been like, “Oh, I want to real-time verify your controls so that if I don’t like what you’re doing, that I can criticize you,” and I’ve had a lot of customers who, when you show them what they’re doing, it’s very clear that they have vendor compliance teams who just want to spend a lot of your time, and so I don’t think there’s a lot of vendors who want to sign up for real-time visibility into their controls.

Even if their auditor should have real-time visibility, I don’t think they want their customers with real-time visibility just because they’ll become an attractive nuisance. 

[David Spark] Jadee, I take this to you. I think I’m going to say with you, Andy, number two regarding third-party risk management is, I think, the big thing that obsesses everybody.

[Andy Ellis] Yep.

[David Spark] And the feeling that continuous verification can help us there. What do you think about because, I mean, this is very much your charge at Vanta, why is this not becoming industry standard? It’s interesting. You’re selling your business as kind of a bonus when it should be the norm.

You know what I mean? Shouldn’t that be the case? 

[Jadee Hanson] Yeah. The article’s interesting. I think Andy makes some great points. I agree with some. I actually disagree with a couple, so that should make you happy, David. 

[David Spark] Let’s hear it. 

[Jadee Hanson] So, when we think about continuous verification, it really does mean exposing your security posture in real time. Most companies are comfortable with the PDF SOC 2. They’re not comfortable streaming their messy, dynamic control environment.

And honestly, I think we have to get closer to that. If we want to raise the bar across the industry, I would almost push people to come in, to poke at my environment, to ask me the hard questions, to see where I have issues that they want to go further on.

And so, yes, it might be a bit of a nuisance, but I think it’s necessary. 

I think that it’s interesting the article is talking about SOC 2. I actually don’t think we have a problem with SOC 2, the framework. The framework is fine. It really is like the nature of the point-in-time assessment which is really the problem. And so, moving to a much more continuous assessment that is very transparent, I think, is the direction we need to go.

It’s interesting that like all of us security leaders, we all know we have issues and we have gaps in controls and whatnot, and we’re constantly working on improving like security and maturity over time, but almost every single SOC 2 report that I read has zero issues.

[David Spark] Mm-hmm.

[Jadee Hanson] That makes no sense. And so, to me, it’s like it’s less about the framework and it’s more about like the application of the framework and the much more push towards continuous verification and this concept of like full transparency to everybody who is using our product.

And so, at Vanta, we think a lot about this. Like, we would love to get out of the whole third-party risk management process. And Andy, you made a comment of like we’re not asking the right questions. I don’t think we should ask any questions. Let’s just get rid of the questions altogether, and if we move to this model of continuous assessment and full transparency, there’s no need for questions.

Like, you can see all the information that you need to see at a moment’s notice. And so, that to me is where I would love to see the industry evolve to. 

[Andy Ellis] I think, Jadee, you made an amazing point in there that I don’t want people to lose because it is the core of the problem, which is when you get the report, the report has no issues. And what we really want, I think, to understand from our vendors is not are you perfect or not because we know you’re not actually perfect, but it’s like how close to perfection did you actually get?

Like what is your reasonable norm? I don’t expect you to hit SLA on all patches, but I want to know what percentage of your patches are hitting SLA and which ones are not. And that is not a number that anybody even knows, let alone would be willing to have a conversation about.

And I think that’s the sort of the critical difference is the first person to reveal that they are not perfect to all of their customers is going to lose, and so nobody wants to be that first one. 

What about this AI security challenge? 

12:46.302 

[David Spark] AI is increasingly writing code, but who is responsible for it? “Every line of code written by AI is owned by a real person” was proposed as a commonsense solution for regulated industries in the cybersecurity subreddit until a commenter tore it apart.

“AI makes your junior dev look productive while the review team gets buried. Finance and healthcare are just now waking up to what that means when a regulator asks where the code came from and why it’s structured the way it is.” When your developers are vibe coding their way through your compliance-sensitive code base, who’s reading it?

Is “a human approved the pull request” going to satisfy the next audit, Jadee? And at what point does your AI coding policy or human in the loop become its own form of security theater? What do you think about this? 

[Jadee Hanson] Yeah, I can’t believe we got to question two without bringing up AI, it’s amazing. 

[Laughter] 

[Jadee Hanson] There’s a lot going on, obviously, with AI code generation and a lot that security teams are dealing with right now. I don’t actually think that AI code generation is the problem. I think the lack of governance and understanding around this topic is where we have problems.

And so, if you think of every AI-assisted commit should have humans who understand the architecture, the data flows, and the regulatory impacts, and the way that code’s being written today, it’s so easy that you don’t actually need a lot of deep understanding about the architecture, which makes all of it a bit more scary.

I think the future is lots and lots of AI code generation. So, it’s imperative that us as security professionals, we focus on this deep knowledge of architecture, traceability, making sure we have review discipline, and then clear accountability. The post here talks a lot about the overload that will end up on reviewers, but what we’re seeing already is that even AI code review can happen.

And so, just as we’re applying AI to writing the code, we can actually apply AI to review the code, and in many cases, it’s better than what the human can find and it can do it a lot faster. And so… 

[David Spark] Supposedly, Claude claims it can do it now. 

[Jadee Hanson] Yeah. I mean, Claude, I think they came out with code review just like two weeks ago. And so… 

[David Spark] Scared the whole cybersecurity industry.

[Jadee Hanson] It did, absolutely. 

[David Spark] Caused everybody’s stocks to tank, which, by the way, everything bounced back again. 

[Jadee Hanson] Mm-hmm. Yeah. It seems like it’s cyclical every time that there’s like a new release from Anthropic, everything tanks, and then things kind of sort of come back over time. But to me, I think the important thing to remember is that AI code writing, code review, code everything is going to take shape, and for us as security professionals, we really need to be thinking about the governance, the controls around it, making sure that the future state really is about like what are the key controls related to like this very new environment and making sure that we’re focusing a lot more on those versus trying to prevent AI from taking shape in any part of our organization.

[David Spark] We heard a line, Andy, “Just because it’s working doesn’t mean it’s ready for production,” and the problem is the people who are making it think, “Oh, it runs, we’re good to go. Hands are clean.” That is… 

[Andy Ellis] I’ve shipped code like that, so I don’t know why we should complain that AI does. 

[David Spark] Yes. 

[Andy Ellis] I actually think that this whole question misses a really big problem that already exists and predates AI, which is not about who owns code at the moment it ships, but who owns your code in production. You have a reorg, you riff a bunch of folks.

How do you know that all of the code that is in production is still owned by an organization? Right? I’ve been through this where I’m trying to get code patched and the organization that wrote it and maintained it doesn’t even exist anymore. The last developer to edit it has been gone for five years and now you’re trying to hunt down through an organization.

This predates AI. I think the way that we should be thinking about this problem is every piece of code that is in our infrastructure anywhere running needs to have traceable ownership back to a responsible manager who’s going to make decisions about it.

Now that traceability might come through AI. That’s totally acceptable because I foresee a world in which we have AI operators that are making decisions about shipping code, and that’s fine, as long as at the end of the day, there is some piece of the organization that is responsible for those choices, and it’s responsible for pulling that code out of production if it’s a problem.

It’s not just about when it went in. 

[Jadee Hanson] I think that’s a really good point. If you think of when we moved to security code review, if we miss a security issue, it’s still on us as the security team. We can’t point to like AI missed it. Well, AI is just a tool we’re using. We still have the deep accountability to like ensure we ship code bug-free, vulnerability-free software just in the same way that the developers have the responsibility to ship solid code as well.

Sponsor – Vanta 

18:31.510

[David Spark] Who’s our sponsor this week? No, it is not your imagination. Risk and regulation are ramping up, and customers now expect proof of security just to do business – we were talking about this – and that’s why Vanta is a game changer. Vanta automates your compliance process and brings compliance, risk, and customer trust together on one AI-powered function.

So, whether you’re prepping for a SOC 2 or running an enterprise GRC program, Vanta keeps you secure and keeps your deals moving. Now companies like Ramp and WRITER spend, get ready for this, 82% less time on audits with Vanta. That’s not just faster compliance, it’s more time for your growth.

You can get started on all of this if you go to their website, vanta.com/CISO. And do me a favor, add that /CISO in there. Easy way to let Vanta know you heard about them from us. Remember, vanta.com/CISO. 

It’s time to play “What’s Worse?” 

19:33.153 

[David Spark] Jadee, I know you know how to play this game because you’ve played it multiple times before. We always make Andy answer first and then I always love it when you disagree with him, no matter what is the situation. 

[Andy Ellis] And I think Jadee pretty much always disagrees with me. 

[David Spark] Yes.

[Jadee Hanson] Mm-hmm.

[David Spark] Usually. You’re pretty good about that. 

[Jadee Hanson] I think one time I agreed. 

[Andy Ellis] Yeah, one time. One time I got her to agree. 

[Jadee Hanson] [Laughter] 

[Andy Ellis] That’s still like high point for me. 

[David Spark] Well, this scenario, two scenarios, they’re reasonably long here, so hang tight when I read these. They come from James Purvis of Rubrik, and here you go, and we have titles for both of them. I think these had a little bit of AI supplementary help on them as well.

All right. Active Directory Compromise, a mid-sized financial services firm is hit when an employee opens a phishing attachment, a remote access Trojan gives attackers a foothold using Mimikatz, they dump password hatches from the Active Directory database and authenticate as a domain administrator via pass the hash.

From there, they deploy ransomware across the network, encrypting critical servers, and exfiltrating customer financial records for additional leverage. Authentication services are disrupted for days, and the estimated loss exceeds 100 million in ransomware, downtime, and regulatory fines.

So, the vulnerabilities that are exploited are weak passwords, no MFA, unpatched domain controllers, and insufficient Active Directory log monitoring. That is the first scenario. All right?

[Andy Ellis] I don’t know that log monitoring would have helped there, but yeah, that probably was also there. 

[David Spark] All right. Scenario two, public shareable link with company financials. All right. A publicly traded retailer accidentally exposes an unprotected Google Drive link to some kind of cloud bucket containing full financial statements, earnings, tax records, and investment plans, which an employee posts to a public forum.

Now a threat actor scrapes the link, downloads the data, and sells it on the dark web. Stock price drops rapidly, immediate leaks, and the company faces a $20 million SEC fine for disclosure failures. The attacker also uses the financial details to launch a spear phishing campaign targeting executives, broadening the breach.

The total damage, so including the 20 million, exceeds 100 million. So, that’s equivalent financially to the previous just. 

[Andy Ellis] No, the previous one was just at 100 million. So, this one exceeds it.

[David Spark] No, it says estimated loss exceeds 100 million in ransom. 

[Andy Ellis] Oh, so they’re both the same losses in both scenarios. 

[David Spark] Same thing. So, total damage. So, we’re seeing “equivalent financial,” and I’m putting this in quotes, “equivalent financial loss.” So, vulnerabilities exposed, no employee training on secure sharing, obviously no access controls or link expiration, and no monitoring for public cloud exposure.

Andy, which one of these two scenarios is worse? 

[Andy Ellis] Well, it’s fascinating that these are both financially equally bad. 

[David Spark] Yes. 

[Andy Ellis] So, now we just have to look at which one… And so, I’m going to put the CISO hat on for a moment, and I’m going to go with the first one is basically a fundamental failure of the CISO. 

[David Spark] Mm-hmm.

[Andy Ellis] Like this is so many controls that are the obvious, like this is literally, I have my checklist of the four things when a CISO comes to me and says, “Hey, can you give me a strategic review?” This is the number one thing is, are you using Active Directory?

And are you doing it in this way? So, like, to me, that’s like the most fundamental failure is if you’re not tall enough to use [Laughter] Active Directory safely, stop. 

[David Spark] [Laughter] 

[Andy Ellis] That’s the biggest thing. So, I would go with the first one from that scenario. If I think about like the corporate impacts of it, they both have bad reputational issues, right?

[David Spark] Right.

[Andy Ellis] Because the first scenario, you’re out of business functionally for a few days if you don’t have authentication services. So, you’re highly disrupting your customer pipeline. Whereas in the second one, you lose a bunch of money. Although the stock hit is a fascinating argument to have because we earlier had the conversation about how stock hits are ephemeral, and I’ve actually been through a similar situation.

In this case, it was our, like, there’s an agency that you give them your reports, and they’ve dropped them right after the market closes, when you’re about to do your investment, your analyst call. They dropped it half an hour before the market closed, and it was exactly one year after we had converted tax losses, you know, the losses carried forward into sort of a tax cash account that made our EPS look really good one year ago, and so it tanked a year later.

Complete accounting trick that everyone would have figured out within 30 minutes. Unfortunately, by the time that happened, our stock had taken a 33% dive, and it did not recover for a very long time. That was just it’s its new setup. So, I’ve been there.

It sucked.

[David Spark] So, which one are you landing on here, Andy? 

[Andy Ellis] I’m still going to say the first one is worse. The first one is ultimately going to be the worst scenario for you. 

[David Spark] Being a CISO, it’s the worst one.

[Andy Ellis] From the CISO perspective, it is the worst one. 

[David Spark] But hold it. From just the overall company perspective, you don’t think the second is worse? 

[Andy Ellis] And actually from the company perspective, I actually think the first one is also going to be worse. 

[David Spark] You think in both perspectives, you think it is? 

[Andy Ellis] Because you’re disrupting the business. You’re losing money in both cases, but the first one is disrupting the business and in a way that most people are not going to actually resonate with as, “Hey, this is a team failure.” Whereas in the second one, like the spear phishing does become a team failure.

So, I would rather almost deal with spear phishing than with like, “Ah, I had to deal with a rat and Mimikatz. ” 

[David Spark] Okay. All right. Jadee was nodding pretty much all the way through that. 

[Jadee Hanson] Yeah. 

[David Spark] So, I’m getting the sense that Jadee, you’re 100% agreeing with him here. Where do you stand? 

[Jadee Hanson] Yeah. I desperately want to disagree; however, I agree there’s too many things in the first one that went wrong that I think are going to fundamentally make you lose trust with your customers because they’re really bad. The fact that clicking on a phishing link at the very beginning can cause that much damage, zero isolation, the ability to move across things to cause that much damage is honestly just embarrassing.

And so, I think that the first one is going to cause a lot more reputational damage and just trust with customers. It also is going to cause the most operational burden, like the fact that it stems into a ransomware event where things are not operational, I think, is going to cause a lot more just like operational burden on the company itself.

And so, the first one definitely is worse. 

[David Spark] All right. We have agreement. 

Please, enough! No, more! 

26:31.544 

[David Spark] Today on our “Please, enough! No, more!” segment, we’re digging into AI in GRC. We have been hearing a ton about this. It seems like AI and GRC are kind of very well matched, if you will. So, I want to hear from you, Andy, what have you heard enough about with AI in GRC and what would you like to hear a lot more?

[Andy Ellis] So, I think when I hear most people talking about AI in GRC, they’re talking about LLMs in GRC. 

[David Spark] Mm-hmm. Yes. 

[Andy Ellis] Right. They’re not talking about the automation components of GRC. They’re not talking about the analytics. And so, what I really want to hear is like, how are you doing the analysis to say, okay, we’re pulling in all this data, and we can determine what your SLA is for vulnerability management, and we’re doing that in an automated way.

I don’t ever want to see an LLM that’s actually trying to do math. Right? I want to see the math being done by predictable, repeatable systems. And then where I want to see the LLMs is in like, oh, how do we now take and apply these controls to a different standard?

When somebody comes out with whatever new ISO standard is next month, I’m happy to hear AI being used as, “Oh, we want to write it in the appropriate language.” Fine, whatever. But I want to hear more about sort of the automation and the repeatability and the provability versus just like, “Oh, let’s throw ChatGPT at this problem.” 

[David Spark] All right. Good setup there. Jadee, I throw this to you. This is something that Vanta has sort of been tackling for quite some time. I’d like to hear again what you’ve heard enough about, what you’d like to hear a lot more, but I’d be also interested to know how you guys got to the point where you’re at today.

[Jadee Hanson] Sure. Yeah. So, we released our AI agent as part of Vanta, gosh, almost a year ago. So, it’s been quite a while. And if you think about an AI agent that has access to all your GRC information, so listing of risks, your policies, your how fast you’re completing your SLAs, there is a lot of yes, what Andy said.

Like LLM, you can ask a question, get a simple answer, but also like deep insight into what’s going on with your program, and that’s really the beneficial part. And so, an agent that can quickly analyze, hey, your policy says that you fix vulnerabilities within seven days, and I’m noticing you’re past your seven-day SLA for the last three weeks.

Like, you might want to dig into that. Or even something that can fundamentally change how we’ve always done something in GRC. So, I’ve definitely heard enough about AI auto-filling questionnaires. I think, yes, Vanta does that. 

[David Spark] There are plenty of vendors who can do that. Plenty. 

[Jadee Hanson] Yes. Vanta does that. We’ll do that for how long ever customers need us to. But what we want to do is really redefine this space and think about how can AI get rid of the questionnaire altogether? And so, instead of sending static questions, buyers could use AI to query kind of live control data directly from a vendor.

We talked about this a little bit earlier, but if we have all of our control information in a continuous way that is displayed, you could potentially use AI to control a vendor’s control environment, normalize what’s going on, and then translate it back to the buyer’s risk framework.

And so, figuring out what matters to the buyer just from an AI query. And so, this is where we’re trying to take the GRC industry is beyond what we’ve always done and really think about it in a new way and a much more quality way to deliver results.

Yes, on the questionnaire, on the vendor piece, but throughout a person’s GRC program as well to really deliver those deep insights. 

[David Spark] Well, you bring up a very good point, and you think about it like so much in technology is systems that never had security built in in the first place, that we’ve had to create solutions on top of it to fix it, and we all know, there’s no question in anybody’s mind, this is a bad system, but it’s the only one we’ve got.

And so, it seems that the first step, the whole thing with the filling out of the questionnaires, is addressing that issue, but like you said, is we all know we need to move away from this. 

[Jadee Hanson] Yes, we all need to agree. Let’s get rid of this. 

[David Spark] So, God willing, that will be a service you’ll no longer provide because no one will need it, is the hope is, I’m assuming, yes, with the questionnaires? 

[Jadee Hanson] That is the hope. I think the hope is we definitely need a mechanism to evaluate security posture of the products that we use, 100%, but we need a better, more quality and continuous way to do that. And that’s really the future that we look through.

Do you trust this LLM? 

31:43.275 

[David Spark] “If AI can’t be reliably stopped, then we’re automating at machine speed without machine grade brakes.” Ross Young of CISO Tradecraft Podcast is sounding the alarm after an OpenClaw agent reportedly speed ran, deleting a Meta AI safety director’s inbox.

It was told to confirm before acting. It didn’t. And nothing stopped it in time. If it can happen to the person whose job is AI safety, your guardrails are probably not as solid as you think. This has the stench of Terminator 2. This machine we created can’t be stopped from killing us.

How do we create a kill switch, Andy, that works across every system? And how can we regularly test our “cut the hard line” moment? And by the way, we’re seeing this also in our military as well. It’s going all over the place. 

[Andy Ellis] So, I am really happy that this happened because this highlights one of the fundamental failures of how most people are trying to use LLMs, which is they think that LLMs are safe, and fundamentally LLMs are not safe. So, you always want to build your LLM where its output is then checked by something, which might be [Laughter] another LLM, honestly.

But the fact that this happened to a safety director means that maybe we should be rethinking how they’re approaching safety. And if we say, “Oh, we’re giving an LLM permissions to be an admin and then we’re asking the LLM to decide what to do.” That’s probably not a good combination.

Like, we had this with humans. It was like separation of responsibility. We’re really bad at it. But that’s where we should be with AI. Like, create a set of tasks to do and then pass that across some safety filter before actually executing them. So, I’m happy this happened now because it gives us an opportunity to have more people rethinking how to implement safe controls around their AI agents, but I suspect we will get more and more cases of this out of OpenClaw.

[David Spark] Yeah. I mean, I think it’s important that we see this problem… Because this problem we knew was going to happen, and it’s good that we’re seeing it early so we can address it, but it does scare the crap out of everybody. Yes, Jadee? 

[Jadee Hanson] Yeah. I mean, it’s scary. I don’t think the scary part is like, “AI can’t be stopped.” Like, that’s not the scary part. I think that the thing that is going wrong is we see AI as a really powerful technology and we are giving agents right access to really high-risk systems without really thinking through all the risk and impacts and the what could go wrong.

So, to me, it’s like more about the architecture and the controls. The kill switch don’t really live in prompts. So, this article talked about like the kill switch being in a prompt. The kill switch should live in controls, and it should live in aspects of like identity and access management and what you’re giving the agent access to.

I think for every agent that we build, we should think about principles of like short-lived credentials and like scoping permissions, and I also think that every agent should be chaos tested, almost like going back to like the chaos engineering days.

And one of my favorite brainstorming activities that I do with my team is like the threat modeling and asking yourselves what could go wrong with this agent, given what it has access to, what is it doing, and almost like stimulate like a rogue agent and then figure out what are the controls that you need to put into place from the what could go wrong.

I think that there’s a lot that certainly could go wrong with AI agents, this article proved it, but thoughtfully architecting like the right controls around it, I do think there is a very effective way to use agents throughout an organization. 

[Andy Ellis] And this isn’t new. This is a problem that every systems administrator has had.

[Jadee Hanson] Yes.

[Andy Ellis] Without dating myself of when I learned how to use Linux, but it was not this millennium, folks, one of the first things that you learn to do is you alias rm to rm -i. For those of you who are not familiar with this, this forces interactive mode on removing files, and it overrides the force commit [Phonetic 00:36:14] flag.

So, if you accidentally, if you type in rm -rf, remove recursively and force everything, the i pops up and says, “Nope, nope, nope. We’re going to prompt you on everything to make sure you really wanted to do this.”

[Jadee Hanson] Yes.

[Andy Ellis] There are ways to bypass that alias, that’s okay, but you build in these safeties because computer systems are fundamentally dangerous because they’re so powerful so quickly. This is not about AI. This is just about how computers work. 

[David Spark] But also how humans work with computers. One example I gave, I have this tool for sort of a CRM-based tool, and whenever I try to delete huge groups of contacts, it forces me to type the number of contacts I’m deleting…

[Andy Ellis] Yes!

[David Spark] …to be able to delete them. 

[Andy Ellis] I think we all know what CRM tool you’re using now, at least those of us who use it. I have the same one. 

[David Spark] Yeah. I find that I… In fact, I thoroughly enjoy that it does that to me because I know I could easily accidentally delete a ton. 

[Andy Ellis] Right. Yep.

[David Spark] And it’s a nice little safeguard. 

[Jadee Hanson] Yeah. I think it’s easier to make mistakes with some of the agent tech that is out there. I’ll give you an example of like I have a lot of just like productivity things running for me and I set them up, what I thought was in just a read mode, and my agent gave me my daily debrief, it summarized the things that I needed to share to like the leadership team, and then it said, “Do you want me to post this to the forum?” And I was like, “Wait a minute, it can write?”

[Laughter] 

[Jadee Hanson] Like, hang on a minute, go back, change settings. And so, I think it’s like those, some of the agent tech that is set up today, you have to really dig for like what does it have access to, and then what does it have access to write to?

And understanding those aspects are really important. And in many cases, it’s a little bit buried, and so you have to almost like hunt for it because it’s not as visible as maybe it would be in like a static CRM system. 

Closing 

38:21.478 

[David Spark] Very, very good point about automation, about how it can go a little awry, and how we need to understand how humans operate with it. Thank you very much, Jadee, and thank you to your company, Vanta. Remember – automate compliance, manage risks, and accelerate trust with AI.

Don’t just go to Vanta.com, go to Vanta.com/CISO. Vanta.com/CISO, easiest way to let them know that you heard about them from us. All right, Jadee, I’m going to let you have the very last word here. The question I like to ask is are you hiring over at Vanta?

[Jadee Hanson] We are always hiring. So 100%. I have roles within my IT team, I have GRC subject matter expert roles, and then I have core security roles open within my team. So, check out our Careers page, absolutely hiring. And then before we close, I do want to make a plug for all my fellow CISOs out there at product companies.

Call to action. We talked about this a lot throughout the show but join me in this move towards continuous control testing, real, real transparency. It’s okay if you don’t have your controls all working perfectly. Guess what? I don’t have all mine working perfectly every single day either.

I know, right? [Laughter] 

[David Spark] It’s like a CISO Anonymous club here. [Laughter] 

[Jadee Hanson] Yes, exactly. The goal isn’t flawless security. It really is that measurable improving over time. I think when we lean into transparency, instead of hiding behind this point in time artifacts, we really raise the bar for like the entire ecosystem, and that’s a huge thing that we could do for the security community overall.

So, if we want trust to evolve, we really have to be able to show our work and be transparent about it. 

[David Spark] So, this is what I was thinking about when you were talking about that and your opening tip, which was assume that you’re wrong. If you have others looking at it, they will find your mistakes for you. Something I’ve said to my own employees, “I love it when you find my mistakes.” And if you’re asking the community to come find your mistakes, it makes you better.

Yes? 

[Jadee Hanson] Absolutely. What’s the term? All ships? 

[Andy Ellis] A rise in tide raises all boats. 

[Jadee Hanson] There it is. There we go. 

[David Spark] Rise in tide. Excellent. I love that. All right. Well, thank you very much, Jadee. Thank you very much, Andy. And to our audience, as I always say, and I do mean it. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review.

This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com.

Thank you for listening to the CISO Series Podcast.