Governing powerful technologies under uncertainty requires making bets. The question is not whether to bet. It is whether the bet you are making is calibrated to the actual risk.

This is the second in a series of articles examining the security implications of AI-driven vulnerability discovery. The first addressed the engineering foundation. This one addresses the operational reality. This one addresses how organizations must operate from where they actually are, which for most is not a clean, well-architected starting point but rather decades of accumulated technical decisions that were never evaluated through a security engineering lens.

For decades, the approach to building technology has operated on an implicit assumption that security could be addressed after the fact...This created an environment in which building technology that simply worked was sufficient, and the cost of building technology that was engineered to be secure was treated as an unnecessary burden on development timelines and budgets... The capabilities demonstrated by recent advances in artificial intelligence have fundamentally altered t

The Mythos moment is significant for reasons that extend beyond its immediate cybersecurity implications. It establishes, with unusual clarity, that AI capability has crossed a threshold in the offensive domain — and that the defensive and governance infrastructure available to most institutions has not kept pace. That gap is not a projected risk. It is a present condition.

Create a paper that guides the financial services sector and other sectors to evolve practices toward identity security (and away from identity governance platforms) as an essential component for AI Agent deployment at enterprise scale. Identify alignment with the practical approach used by Wells Fargo.

War has always targeted infrastructure. In conflict, the systems that sustain an adversary's ability to operate are identified and acted upon. In a digitally dependent society, data centers sit at the center of those systems. As the cybersecurity community gathers this week for the RSA Conference, the systems that support our digital world warrant closer attention.