Maribel Lopez (00:02.303)
Hello and welcome back to the AI with Maribel Lopez podcast. I am Maribel Lopez and today I'm really excited to be speaking with Joe Peterson, who is the founder of ClearTech Research and the CIO of Clarify 360. Hey Joe!
Jo Peterson (00:16.361)
Hi Maribel, thanks for having me.
Maribel Lopez (00:19.519)
I'm very excited to have you. I mean, for those in the audience that don't know, I've known Jo for many years, and I find her to be one of the most grounded, respected voices in the enterprise technology industry today. She has deep roots in cloud strategy, cybersecurity, the emerging AI security field that we've been looking at. Jo works with both IT and cybersecurity leaders, which I think is really important because it's a level of practical expertise that you don't necessarily get.
with a lot of analysts that you're speaking with. she works on implementation, helping people translate, you know, these really complex shifts into clear, actionable steps so that they can get to the next level. So I thought it'd be great to have a discussion with Joe today about some of the issues that are going on with security and AI, particularly related to this move to agentic AI.
We have a lot of security tools, as everybody knows. And but they're not necessarily the right tools for AI security. So let's unpack that a little bit. So I'm gonna ask Joe the first question here. Joe, AI security. God. So so AI agents hold delegated credentials. They, you know, we talk about agents being autonomous, which means that they can authorize decisions in real time.
They can also do things like create sub-agents with their own permission sets. So we've got so many tools. You know, we've got traditional identity access management. We've got privilege access management tools. But these tools weren't designed to do this, right? They weren't designed for the AI world. So what does a realistic path to least privileged access for agent AI agents really look like for a large enterprise today?
Let's just start there. The easy question, just lob that one over the wall for you.
Jo Peterson (02:14.125)
Yeah, there you go. so I you know, AI is non-deterministic. And because it's non-deterministic, it does not behave like traditional security, which is binary. So you're seeing the industry make this shift towards non-human identity framework, and that is specifically tailored for agentic workflows.
And I think a realistic modern path to implementing least privilege for AI agents in large enterprises involves sort of this multi-layered architecture. And when I think about it, I think about swim lanes. And the four swim lanes that I think about are dual token cryptographic delegation, externalized policy as code, and microsegmentation.
contextual and dataware guardrails, and then continuous session auditing and behavioral baselines. And I can double-click on some of those if you'd like me to.
Maribel Lopez (03:14.826)
I th I think that would be good. We've got a wide range of people that are listening. So maybe if you could just give a little context on what those are, that would be great.
Jo Peterson (03:24.629)
Sure. So dual token cryptographic delegation
Think about this: enterprises cannot issue standing API keys to agents. Instead, they really need to enforce something called on behalf of or OBO authentication. So when a human triggers a primary agent, you're going to work with your co-pilot. The system issues a short-lived token that cryptographically binds my identity with the agent's identity and the session context, which is pretty important.
So if the primary agent decides to spawn a subagent, which they do, it uses an exchange protocol to issue a child token. And this is really important because the child token can only inherit this strict mathematical subset of the primary tokens permissions. And that prevents privilege escalation. So that was the first swim lane, right? Make sense?
Maribel Lopez (04:25.93)
Hundred percent. Yeah.
Jo Peterson (04:28.073)
The second one is externalized policy as code and micro-segmentation. We all know what micro-segmentation is. But back to the non-deterministic thing. Because larger language models are non-deterministic, access control logic can't live inside the prompt or the application code. So what we're seeing happen is enterprises with deep benches, because that's who has that skill set, they're externalizing authorization to decoupled policy decision points.
So instead of granting like you know access to a full database
Instead, the system exposes functionalities through something that's strictly scoped in terms of an API tool. So when an agent calls a tool, the policy enforcement point intercepts the call and verifies it's against the context and real-time rules. So that sort of helps, right? That is that is like a step above micro-segmentation.
My third swimline was contextual and data aware guardrails. So traditional IM controls access to a system, right? A genic IM, and you and I have been talking about this, controls access to the content.
So a realistic deployment forces agent control through a data-aware gateway. You're starting to see these gateways happen or semantic layers. Basically, it's structural data layer filtering and output content inspection. So that's part that's sort of the next step. And then the last swim lane is continuous auditing and behavioral baselines. So
Jo Peterson (06:11.255)
First of all, you can't audit anything you don't know about, folks. Got got get your inventories going, right? Every girl knows what her shoe closet looks like. Every girl knows, do I have some gold pumps for that dress? You got to know these things. so you know me. I'm I'm I'm just
Maribel Lopez (06:20.746)
Can't see it, can't work with it.
Maribel Lopez (06:35.914)
The gold pumps of security, I see it right now. Yes.
Jo Peterson (06:38.559)
Right, right? I mean, yeah, you gotta have a little fun. So because agents execute tasks autonomously, we all know that, security teams can't rely on post-incident log reviews. We did that for a long time. Instead, sort right, it's too fast. Modern NHI security platforms build dynamic behavioral baselines for each agent class.
Maribel Lopez (06:55.146)
Well it's too fast now, right?
Jo Peterson (07:06.069)
So it's not just one class of agents, it's a lot, you're gonna you have this proliferation, that's a hard word, say that ten times, of agents, right? So the system monitors metrics like the velocity of API calls or anomalies in tool chaining or atypical data volumes. If an internal subagent suddenly attempts to pivot from reading a document to mutating a database, the system invokes an immediate
Routine revocation of that agent's token. So it's like a mini kill switch. We're starting to hear that, right? We're starting to hear about kill switches. So this is like a mini version of that. So I hope that kind of you know sets the table and maybe gets some folks thinking about what they're seeing and hearing too.
Maribel Lopez (07:56.811)
I think you bring up a I think if we look at this conceptually from what a senior leader should be asking of their security team, you know, the first thing is you can't have your agents permission the way you'd have your humans, right? So that's that's what you get from some of the things that you're saying. You also have to make sure that you can see in real time with a high volume of, you know, non human trackable
type of transactions, what is going on, right? So that's the observability that you mentioned, the goal pumps of security. And then I think in addition to that you also got to this concept of what a kill switch would look like in a GENTIC. If you can see it and the behavior is anomalous, you can turn it off right away. You can go back and inspect it and see if that was supposed to happen. But there are some things that are obvious red flags and there are some things that aren't obvious red flags and you need to make sure that
regardless of how obvious it is that you can in fact stop those actions from happening. And I think what we're really not accustomed to now is the speed and scale of how this could happen. And we need to get a handle on that. So I really appreciate the fact that you broke out those different things that really are actionable things that people can do today. So I want to switch a little bit to thinking a little bit more about the the strategy. So
Jo Peterson (09:04.203)
Yeah.
Maribel Lopez (09:22.632)
I believe it was a Deloitte report that said roughly 50, maybe a little over over 50% of large enterprises now have a dedicated AI governance committee. which, you know, when you go to organizations, there's various levels of governance to begin with, and then you're moving into AI, and there's another issue around AI governance, and maybe you end up starting at AI governance because you didn't have a rich governance portfolio to pull from. So
I wanted to ask you, is that structure actually working or is it creating the appearance of governance without substance?
Jo Peterson (09:59.404)
Yeah. So first of all, I want to applaud organizations for the effort that they're making. It's important to be at least aware that you need to have this in place, right? But unfortunately, for various and sundry reasons, sometimes it becomes governance theater. right? you know, and I'm wearing my gold pumps, right? So back to the gold pumps. So
IBM actually talked about this enforcement disconnect. And they said that 87% of organizations claim to have a clear AI governance and structure in place, but actually fewer than 25% have actually imp implemented underlying technical controls. Right? So that that's a that's a vast difference between the two. And the committees
are often cross-functional advisory panels, and that's important to hear everyone's voice in the organization and how AI is affecting them. But sometimes they layer bureaucracy on top of existing product lifestyles. And the thing that they're missing is they they don't have any operational accountability. So who owns the kill switch?
Who owns the agents, right? that that's the stuff that's like not happening. And I think that you're starting to see folks be aware of the fact that that maybe this is just window dressing, and we're starting to see them shift to more of an operationalized governance framework that's focused on hard guardrails rather than soft policy.
Maribel Lopez (11:51.871)
I think you bring up a very interesting point because I think the first step is acknowledgement that you need to do something. And getting together a committee and getting some dialogue around what's going on is one thing. But then there's the whole operational execution of that. So to your point, you can come up with a great policy, but if nobody knows who has the the lever for the kill switch, then we really haven't
done much. We've made ourselves feel a little bit bit better about it. We have made progress to this extent if somebody could ask you for your policies and procedures, you may have that. However, if you get to the real test, you know, for some reason you need to prove that you were a good corporate citizen and you put in the governance and the security that you were supposed to, if you don't have that execution layer, it's it's almost as if you didn't do anything at all. So much ado about nothing as they say. So
But okay, all right, so let's roll it back to the CIO. so if I'm a CISO, and this audience is starting from zero, which they could be. you never know. We've got all kinds of realm here. But let's say they have no inventory, no agent specific controls, no monitoring. what is the single most important thing they should do in the next 30 days? And maybe even if they've had that stuff, there's they might have missed this.
Jo Peterson (13:20.097)
Yeah, so the natural default answer is gonna be inventory. Right? You walk in the door and you think it's inventory. Here's the problem with that.
You've got to route and intercept all external AI traffic through an enterprise control API proxy gateway. And why I say that is the first step is because AI agents are highly distributed and they're frequently deployed as shadow AI by individual engineering teams.
Engineers love to play with stuff. Hello. the the only accurate inventory is an observed network level inventory. So by deploying a central gateway proxy, such as a really specialized LLM proxy, right? Or configured enterprise API gateway, you establish a single choke point for visibility and control. So I would say that the first 10 days you intercept that.
network traffic like we talked about. The next 10 days you discover your real inventory, right? You're gonna know what your real inventory is and you're gonna track token and key usage.
you're gonna enforce that choke point, right? So you're gonna do things like revoke standing keys, you're gonna implement implement base logging and rate limiting, right? Those are the things that you're gonna do in the first 30 days. Inventory may feel like the natural thing, but you don't know if you're gonna catch everything. So that's what I think. But I want to go back to something that we talked about earlier for just a second.
Maribel Lopez (15:04.489)
I think that's
Jo Peterson (15:09.193)
And I'd love to get your thinking on it. I'm starting, you know, I I've started to see a bunch of chief AI officers pop up. Right? And at first I kind of thought, well, is that like, what is that person's role? And maybe it depends on the company, but I'm starting to see that chief AI officer become a risk executive. And I'm starting to see that person sit independent.
of product or engineering organizations. And because of that, I think that we're gonna see that person evolve into person that sits with the board and has the explicit board-backed authority to kill a production system immediately if a breach occurs. What are you seeing?
Maribel Lopez (16:00.862)
I I think they it's not just a breach, actually. I fit this into the so if you talk to technology vendors, they tell you you can use AI agents and they will go off and automagically do everything for you. And the first question I think in any rational organization's mind is what could go wrong? So it doesn't have to be an actual security risk for it to be something tragically wrong.
It could be that you've made bad decisions with your AI and you're giving people refunds that you're not supposed to give them. It could be that you've made bad decisions with your permissioning and AI has access to your your human resources data, which is, you know, an eternal security risk as opposed to a full-on breach of the company. So I think why you're seeing this and I think why it's important is someone has to understand.
Jo Peterson (16:37.57)
Yeah.
Maribel Lopez (16:59.87)
The totality of both the risk and the opportunity of AI and what it means for their business. And the person that is doing, say, your ERP system may or may not be qualified to look at that AI opportunity. The person that is your CISO obviously cares about that AI opportunity, but could use assistance with that as well. So I think the short answer to your question is I think you're right. I think that
There there is somebody that needs to be responsible for that kill switch. I think if you have a chief AI officer, they're going to be that person that's responsible for the kill switch. It is actually a very broad and distinct role, and I think some people don't approach it appropriately. I think some people approach it as like, that's the the gal or guy that picks which models we use. Necessary, but not sufficient, right? There's a lot of issues, right? So, you know, that's the person that looks at it and says,
Jo Peterson (17:54.485)
But
Maribel Lopez (17:58.987)
Do we have observability? Do we have testing? Do we have rollback mechanisms? Do we have the ability to switch out tools if the tools we have aren't working well for us? So there's just a lot that's going on. You know, we're building the new equivalent of the software development lifecycle with AI. So that rise of the AI, the chief AI officer.
Which at one point I think was a chief data officer that's now got like a whole new category of responsibility. But it's exciting, you know. I think for somebody that's gonna be a phenomenal role. But it is a very, very important role with a lot of responsibility.
Jo Peterson (18:25.013)
Right. Right.
Jo Peterson (18:38.241)
Yeah, and I think it it it is very interesting because to me it crosses several domains. Right? It's it's maybe depending on the organization, it's about productivity and workflow too.
Right, it's not just on the risk, it's on the reward side of the equation. Right. So it'll be interesting to see it could be one of the most pivotal and important roles in the C suite.
Maribel Lopez (19:00.65)
Yes.
Maribel Lopez (19:13.15)
Absolutely and brand new and actually hard to hire for. So I think we're gonna have to grow some of our existing talent into that. So I think that this is you know, the assumption that you're just gonna go out first of all, the war for AI talent is real, as we all know. We've seen it happen with the large model providers and the large cloud providers.
But then you extend beyond that to organizations. It's like how do they get that talent? And not everybody's gonna have an army of forward deployed engineers from anthropic or open AI coming into their shop to help them figure out how to do AI. So I really do think that we as organizations need to be thoughtful about upskilling some of our existing staff for the AI era. So
Jo Peterson (19:53.045)
Yeah, I think the forward deployed engineer thing is just really cool. But yeah, off topic. But always interesting to talk to you.
Maribel Lopez (20:02.472)
Yes. Excited to have had you, Joe. I look forward to seeing what you build next and what you're hearing from enterprises across the globe. Thank you. And this has been the AI with Maribel Lopez podcast. Thanks for listening.
