Work with Aaron: https://protectitallpod.com/work/
The book: https://protectitallpod.com/book/
This episode: https://protectitallpod.com/ep127/
The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Three months ago Ben Wilcox's company was running roughly 200 AI agents. When he checked the day before we recorded, it was 900. Nobody stood them up on purpose, and every one of them runs under somebody's identity.

Ben Wilcox is CTO and CISO at ProArch, which means he carries both sides of the argument: the pressure to adopt AI and move fast, and the job of answering for identity, governance and compliance when the moving fast gets ahead of the preparation. Most conversations about AI risk are one of those two people talking about the other. This one is held by somebody who cannot pass the problem across the table.

His position is not that AI is dangerous. It is that AI security does not start with securing the model, it starts with securing the environment you drop the model into: identity, access, data scope, logging and ownership. All things security teams already know how to do.

• Why agent sprawl is already here, and why the real question is who owns an agent when the person who built it leaves
• How to say no to a risky request and still give the business a path, so the work does not go to shadow AI
• Why you fork a community MCP server and keep only the 20 of its 107 tools you actually need
• The vendor due diligence question the questionnaire never asks: who can read the key, and can you get the log
• Why physical segmentation is coming back for truly critical systems, and why OT never left it
• How security review can finally run at the speed AI-built code is written

• 2:42 Plan for when something breaks
• 6:31 The risks people are ignoring
• 10:03 Build it yourself and you support it forever
• 12:51 200 agents to 900 in three months
• 20:40 Defending at machine speed
• 21:46 Physical segmentation is coming back
• 24:06 107 tools and you only need 20
• 26:46 How the conversation changes by industry
• 30:11 Still working on the fundamentals
• 31:17 Third parties and the weakest link
• 36:25 A guardrail, not a stop sign
• 41:46 Bring only the data you need
• 49:30 Did AI write the book?
• 51:20 Security finally at development speed

Ben Wilcox is the Chief Technology Officer and Chief Information Security Officer at ProArch, a global technology consulting and services firm specializing in cybersecurity, cloud, data and AI, and software development. With more than 25 years of experience in technology, Ben has led enterprise architecture, cybersecurity strategy, regulatory compliance, incident response and large-scale business transformation initiatives. In his dual CTO and CISO role, he helps organizations balance innovation with security, evaluating emerging technologies from both a business and a risk perspective.

• ProArch: https://www.proarch.com
• Ben on LinkedIn: https://www.linkedin.com/in/ben-wilcox/

Learn more about PrOTect IT All:

Work with Aaron: https://protectitallpod.com/work/