What happens when an AI agent does exactly what you asked it to do—but takes actions you never intended?

Organizations are rapidly embracing agentic AI, giving artificial intelligence the ability to make decisions, access enterprise systems, execute tasks, and act on behalf of employees.

The productivity benefits are enormous. But so are the potential risks.

And here's the uncomfortable reality: An AI agent doesn't have to be malicious or compromised to cause serious damage. It might simply be trying to complete its assigned task.

In this episode of AI Security Multipliers, Steve explores what happens when autonomous AI agents cross the boundaries of their intended authority—and whether organizations are prepared to detect, contain, and recover from those situations.

We begin with a fictional accounts payable scenario in which an AI agent, tasked with resolving supplier invoices, goes a little too far. What starts as a successful automation initiative ends with unauthorized changes to supplier banking details and a payment going to the wrong account.

From there, we examine the cybersecurity, governance, and operational challenges of giving AI systems increasing autonomy.

In this episode, we explore:

• Rogue AI agents: Why autonomous systems can take unintended actions without being malicious.
• Agentic AI security: How AI agents introduce new risks beyond traditional automation.
• Identity and access management: Why every AI agent needs its own identity, clearly defined permissions, and an accountable owner.
• Zero Trust for AI: Applying least privilege, continuous authorization, and segregation of duties to autonomous agents.
• Human oversight: Where human approval remains essential and why simply adding an approval button isn't enough.
• AI incident response: How to stop a rogue agent, revoke its access, investigate its actions, and recover from the damage.
• AI governance and accountability: Who is responsible when an AI agent makes an unauthorized decision?
• Shadow AI and agent sprawl: Why organizations need governed platforms for developing, deploying, and managing AI agents.

Steve also shares his personal approach to AI autonomy, explaining why he's comfortable allowing AI to manage everyday tasks but draws the line at granting unrestricted access to sensitive financial information.

And we tackle a critical question for every CIO, CISO, and business leader:

If one of your AI agents started behaving unexpectedly tomorrow, would you know how to stop it?

The Multiplier

This week's practical challenge is to select one AI agent operating in your organization and answer five questions:

Who owns it? What identity does it use? What can it access and change? How would you detect unauthorized behavior? And can you stop it without disrupting other business services?

Because the more autonomy we give AI, the more important it becomes to establish clear boundaries, meaningful oversight, and effective incident response capabilities.

Delegating the work doesn't mean delegating accountability.

AI Security Multipliers explores the intersection of artificial intelligence, cybersecurity, governance, and enterprise risk—offering practical insights for security professionals, technology leaders, and organizations navigating the AI revolution.

Topics: Agentic AI, rogue AI agents, autonomous AI security, AI governance, AI incident response, Zero Trust, identity and access management, AI agent permissions, human in the loop, enterprise AI risk, shadow AI, cybersecurity leadership.

Send us Fan Mail

What happens when the artificial intelligence your business depends on suddenly stops working?

AI is rapidly becoming embedded in everything from cybersecurity operations and customer service to software development, finance, and everyday business processes. Organizations are embracing AI automation and autonomous AI agents to improve productivity, reduce costs, and accelerate decision-making.

But there's a question very few organizations are asking:

What happens when the AI stops working?

In this episode of AI Security Multipliers, Steve explores the growing operational risks of enterprise AI dependency and why traditional business continuity and disaster recovery plans may not be prepared for an extended AI outage.

Drawing on his personal experience during Hurricane Katrina, Steve shares how a seemingly resilient data center in New Orleans became unavailable when its backup generator ran out of fuel, while critical offsite backup tapes remained inaccessible.

It's a powerful reminder that having a disaster recovery plan doesn't necessarily mean you can recover.

Through a fictional enterprise-wide AI outage, we explore:

• AI dependency: How organizations are becoming increasingly reliant on AI services and autonomous agents.
• Business continuity: Why traditional disaster recovery plans may overlook critical AI dependencies.
• Third-party risk: How multiple enterprise applications can depend on the same underlying AI provider.
• AI vendor lock-in: Why switching AI models, platforms, and agents may be harder than expected.
• Cybersecurity resilience: What happens when security operations teams lose their AI investigation and response capabilities.
• Workforce readiness: The risks of losing the human expertise needed to operate when automation fails.
• AI governance: Why business leaders, CIOs, CISOs, and enterprise risk teams must jointly manage AI resilience.
• Practical recovery planning: How to identify AI dependencies, establish fallback capabilities, and test organizational readiness.

We also explore a potentially more dangerous scenario: What if AI doesn't stop working, but starts producing incorrect results while appearing perfectly healthy?

This isn't an argument against AI adoption. It's an argument for making sure the organizations we're building remain resilient as AI becomes increasingly essential.

Because the real question isn't whether your AI provider can recover from an outage.

It's whether your business can survive while it does.

The Multiplier: A practical exercise to test what would happen if a critical AI service disappeared for 24 hours—or an entire week.

AI Security Multipliers explores artificial intelligence, cybersecurity, AI governance, enterprise risk, and the practical challenges of adopting AI responsibly.

Topics: AI business continuity, AI disaster recovery, agentic AI, AI outages, operational resilience, cybersecurity, enterprise AI risk management, third-party risk, AI governance, business impact analysis, AI vendor dependency, and autonomous AI agents.

Send us Fan Mail

AI Is About to Break Your Cybersecurity Operating Model

Artificial intelligence is transforming cybersecurity. But are we actually changing how security operates, or simply making our existing processes faster?

Every cybersecurity vendor seems to have AI. AI powered SIEM, endpoint security, vulnerability management, threat intelligence and security operations. But adding AI to existing tools doesn't automatically transform cybersecurity.

In Episode 12 of AI Security Multipliers, Steve explores why artificial intelligence could fundamentally disrupt the cybersecurity operating model — and why that might be exactly what the industry needs.

We examine how AI could reshape Security Operations Centers (SOCs), automate incident investigation, transform vulnerability management, accelerate incident response and challenge traditional security team structures.

But there's a bigger question: What happens when AI can perform work in seconds that previously required hours of human effort?

Do we still need traditional Tier 1, Tier 2 and Tier 3 SOC structures? How do we develop future cybersecurity professionals if AI performs the entry-level work? And how do we govern autonomous security systems capable of taking action at machine speed?

We also explore the implications for security architecture, identity, governance, human oversight and cybersecurity performance metrics.

The real opportunity isn't simply to automate existing security processes. It's to redesign them around better security outcomes, clear accountability and the right balance between human judgment and AI autonomy.

Because automating a bad process doesn't make it a good process. It just makes the bad process faster.

Topics covered: AI in cybersecurity, cybersecurity operating models, AI security operations, SOC automation, AI agents, agentic AI, vulnerability management, incident response, autonomous security, security architecture, AI governance, cybersecurity transformation, CISO leadership, Zero Trust and the future of cybersecurity.

Send us Fan Mail

AI Is Eating the Career Ladder

AI is making organizations more productive. But could it also be destroying the talent pipeline that creates tomorrow’s experts?

Artificial intelligence is automating entry-level work, reducing costs, and helping businesses achieve more with fewer people. For executives, the productivity gains are compelling. But there’s a problem that may not become obvious for another five or ten years.

If we stop hiring and developing junior employees today, who replaces our experienced professionals when they retire, leave, or get promoted?

In this episode of AI Security Multipliers, Steve explores one of the most overlooked consequences of AI adoption: the potential erosion of the career ladder.

From cybersecurity analysts and software developers to accountants, engineers, and business professionals, many of today’s senior experts developed their skills through the very entry-level tasks AI is beginning to automate.

We explore:

• Why AI productivity gains could create a long-term talent shortage.
• How automating junior roles could weaken organizational succession planning.
• Why practical experience and professional judgment can’t simply be replaced by AI generated answers.
• The danger of confusing AI assisted productivity with genuine expertise.
• How cybersecurity teams could lose their pipeline of future security engineers, incident responders, and CISOs.
• Why organizations need to reinvent apprenticeships, mentoring, and early-career development.
• How AI could actually accelerate professional development when used correctly.

This isn’t an argument against AI automation. It’s an argument for thinking beyond immediate cost savings and redesigning how organizations develop their people.

Because eliminating unnecessary work is progress. Eliminating the opportunities that create tomorrow’s experts could be a very expensive mistake.

The question isn’t whether AI can replace entry-level tasks. It’s how we’ll develop the next generation of experienced professionals when those tasks disappear.

Topics: Artificial intelligence, AI job displacement, entry-level jobs, future of work, AI automation, cybersecurity careers, workforce transformation, talent development, succession planning, AI productivity, AI governance, career development, mentoring, organizational resilience, and the future of cybersecurity.

Send us Fan Mail

Where will artificial intelligence be one year from now? Five years from now? Ten years from now — and what happens beyond that?

Predicting technology is notoriously difficult, so this episode isn't really about prediction. It's about direction.

In this episode of AI Security Multipliers, Steve looks beyond the next model release and explores how AI could reshape technology, work, cybersecurity and governance over the next decade.

In the near term, AI may simply become normal — embedded into the applications and technology we already use, while AI agents increasingly move from answering questions to actually performing work.

Five years from now, those agents could form a genuine digital workforce, changing jobs, management and the way organizations operate. That raises some difficult questions: What happens to entry-level work? How do people develop expertise when AI performs many of the tasks traditionally used to learn it? And what happens when managers aren't just managing people, but potentially dozens or hundreds of AI agents?

By 2036, AI may no longer feel like a separate technology at all. It could simply become infrastructure — with software increasingly understanding our intent and applications disappearing behind the outcomes we're trying to achieve.

And then there's the bigger question: what happens when useful intelligence itself becomes cheap and widely available?

We also explore what this future could mean for cybersecurity, identity, autonomous systems, Zero Trust, AI governance, AGI and the relationship between human and machine intelligence.

The goal isn't to correctly predict 2036.

It's to build organizations capable of adapting when we get there.

Topics include: future of AI, artificial intelligence, AI agents, agentic AI, enterprise AI, AI jobs, future of work, AI workforce, AI cybersecurity, AI governance, AGI, digital workers, autonomous AI, identity security, Zero Trust and the future of technology.

Send us Fan Mail

AI is creating new cybersecurity risks — and naturally, an entire industry is emerging to sell us new tools to manage them.

AI security posture management. AI gateways. AI firewalls. Agent security. Runtime protection. Model security. AI governance platforms.

Some of these technologies will be essential. But before adding another platform, another dashboard and another acronym to the security stack, there's a question worth asking:

How much of your AI security problem can you solve with the tools you already own?

In this episode of AI Security Multipliers, Steve looks beyond the AI security hype to examine how many enterprise AI risks are actually familiar cybersecurity problems wearing a very clever new interface.

Excessive AI access is still an identity problem. Sensitive data being shared with AI is still a data protection problem. An overprivileged AI agent is still a privileged access problem. An insecure AI workload is still a cloud security problem. And AI generated malicious code executing on a laptop is still something endpoint security should care about.

We explore how existing capabilities including IAM, MFA, privileged access management, DLP, endpoint security, cloud security, SIEM, Zero Trust and security monitoring can form much of the foundation for securing enterprise AI.

There are genuinely new AI security risks that require new capabilities. But the answer shouldn't be to build an entirely separate cybersecurity stack for AI.

Start with the risk. Map the controls you already have. Identify the real gaps. Then buy technology to fill those gaps.

Because there's a difference between security architecture and shopping.

Topics include: AI security, enterprise AI, generative AI security, agentic AI, AI agents, cybersecurity, AI governance, identity security, IAM, DLP, Zero Trust, SIEM, cloud security, endpoint security, AI security tools, security architecture and cybersecurity tool sprawl.

Send us Fan Mail

AI agents are entering the enterprise — and they aren't just answering questions anymore.

They're accessing information, using applications, calling APIs, operating browsers, making decisions and increasingly taking action on our behalf.

So here's a deceptively simple cybersecurity question:

Who is the agent?

In this episode of AI Security Multipliers, Steve explores what happens when AI agents begin behaving less like traditional software and more like a digital workforce.

We look at why agentic AI creates a new identity and access management challenge, how AI agents differ from traditional service accounts and automation, and what happens when agents begin delegating work to other agents.

We also explore the coming challenge of Shadow Agents, agent lifecycle management, least privilege, Zero Trust, kill switches, accountability and the uncomfortable possibility that enterprises may eventually have far more AI identities than human ones.

Because securing AI agents isn't simply about controlling what information they can access.

It's about understanding who they are, what they're allowed to do, who owns them — and how you stop them when something goes wrong.

Your newest employee might not be human.

But they still need an access review.

Topics include: AI agents, agentic AI, enterprise AI, AI cybersecurity, AI governance, identity security, IAM, non-human identities, machine identities, Shadow AI, Shadow Agents, Zero Trust, least privilege, autonomous AI, AI risk management and the future of work.

Send us Fan Mail