You summoned the Genie, asked for wishes, and then it happened...or did it?
Everyone is racing to inject AI into their business and simultaneously defend against the ghosts in the machine coming for their systems and data. The problem of AI-enhanced cyber threat actors is only the first part. What happens when the call comes from inside the house?
This talk explores a hybrid approach to securing the organization with AI, and from AI.
I have run a 7-node fleet since April, rebuilt from the ground up 5 times across 3 agent harnesses, and come to 1 core methodology for building enterprise-grade deployments. Binding agent authority is the easy half. Trusting what comes next is the hard half.
We look at a top-down design theory coupled with bottom-up hard lessons learned from my own agents, who:
fail silently
access unauthorized systems and data
drift beyond their granted authority
make false claims
take action based on false facts
And then the methodology: governance, discipline, measurement, and controls. Roughly 150 doctrine rules, nearly 500 controls within them, and a single test applied to every one: A control you cannot measure and validate is not a control.
About the Presenter: Rich Lindberg
Rich Lindberg, CISSP, is a Principal Researcher and a security executive. Twenty-seven years in technology, most of it leading information security and cyber risk in regulated and financial-services environments, building NIST-aligned programs and reporting risk to boards. He now runs a seven-node private AI fleet as a working laboratory, where AI agents perform day-to-day operations under a human ratification gate. His research is on assurance under agent operations: how a control decays from working into merely reporting, and what it takes to prove a check can still fail.
