Send us Fan Mail

Recorded live on October 8th in Palo Alto with Jason Chan, former VP of Information Security at Netflix, on whether security's most-admired model survives the age of AI agents. Reception, recording, and candid Q&A with over 40 security leaders.

​The safe path should be the easy path. That idea — security that paves a road engineers want to take instead of building gates they route around — is Jason Chan's signature contribution from his years running security at Netflix. It became the most-admired model in the industry. It's also, in Jason's own telling, one of the most misunderstood.

​Now the ground under it is moving. Engineers are shipping AI agents faster than any platform team can pave. Agents get credentials, call APIs, take actions, and spin up other agents — a workforce nobody hired and few teams can see. Every security leader in the Bay Area is asking the same question:

​Does the paved road survive when the drivers aren't human?

​What we'll get into

• ​What "paved road" was actually meant to be, and the ways it gets misread into something worse than the gates it replaced
• ​Guardrails vs. gates when the thing you're guarding moves at machine speed
• ​Identity as the new perimeter — including the non-human identities your agents already carry
• ​Who paves the road for an agentic workforce, and whether platform teams are set up to own it
• ​What Jason would build first if he were starting a security program in 2026

About our guest

​Jason Chan led information security at Netflix, where he helped define the engineering-first, guardrails-not-gates approach to cloud security that fast-moving companies have been trying to replicate ever since. He is one of the most recognizable practitioner voices in the Bay Area, and he says what he thinks — which is why he's here.

​Who this is for

​CISOs, deputy CISOs, heads of security engineering and platform, identity leaders, and the founders and investors who back them. This is a small room by design — 40 seats — so the conversation stays candid.

​Presented with HYPR

This live event was made possible by our Season 2 sponsor, HYPR. As organizations race to deploy AI agents, HYPR is building the identity and control layer to govern them, so you know who, and what, is acting on your behalf. Learn about HYPR AgentPass and their design partner program at hypr.com. Thank you, HYPR, for backing candid conversations.

Send us Fan Mail

In the premiere of Candid CISO Season 2, John Donovan sits down with Bojan Simic, co-founder and CEO of HYPR and a FIDO Alliance board member, for a frank conversation about what happens when the CEO walks into Monday's meeting demanding AI agents everywhere, and the CISO's first thought is how to keep the company out of the headlines.

Inside this episode:

• From passwords to probabilistic actors. How HYPR's quest for "non-shareable credentials" led from fraud prevention to FIDO to a new problem: handing credentials to systems that won't do the same thing twice.
• The 4% problem. People know about roughly 4% of the permissions they hold. Their agents know about all of them.
• Why deterministic controls break. Tell an agent it can't send more than $5,000, and it may just send several smaller transfers instead. Bojan makes the case for control agility, not just control coverage.
• Unintended consequences, big and small. A copilot that decided to email HR on an employee's behalf, a single Salesforce tool that could delete a thousand records in a millisecond, and pen-testing agents that need a chaperone.
• Evaluator agents and "human above the loop." Why the future looks like agents watching agents, with people stepping in only when it matters, and why nobody reads those permission prompts anymore.
• Data custody at machine speed. A global defense contractor, a French document, and an agent that wants to share it with a colleague in the U.S. Why enforcement has to happen at runtime.
• The banking wake-up call. What happens to a bank's moat when an agent can move your whole financial life in under an hour?
• Who paves the road for agents? Bojan's take on Jason Chan's paved road concept, and why security teams need to lead from the front so marketing, finance, and sales can say yes safely.

The takeaway is practical: don't reinvent the wheel, and keep the accountability model you already trust. If Bob's agent does something it shouldn't, it's still Bob's call to answer for.

This episode is sponsored by HYPR. Learn more at hypr.com/candidciso.

Join us live. The conversation continues at Candid CISO Live on Thursday, October 8th at Stanford, featuring Jason Chan, formerly of Netflix and the architect of the paved road, with Bojan joining us in the room. Visit candidciso.com for details and registration.

Candid CISO is a Tout Media production.

Send us Fan Mail

Candid CISO is back for Season 2.

This is the show where experienced CISOs talk to CISOs. No polished vendor talk, just the hallway conversations security leaders usually only have after the panel ends, here on the record.

The ground has shifted. A year ago, the AI question in security was whether to let people use ChatGPT. Now organizations are deploying AI agents that read data, take action, and make decisions on their own at machine speed. That breaks assumptions we built security programs on. Who's accountable when an agent acts? How do you give it an identity? How do you audit it? How do you even know which agent you're talking to?

Season 2 kicks off live on Thursday, October 8th at the Anderson Collection at Stanford University, with Jason Chan, former head of information security at Netflix and a pioneer of the paved road model. The session: The Paved Road Is Dead. Long Live the Paved Road. When agents are writing code and taking actions, is there still a road, and who's driving on it?

Join us for a reception followed by a live recording in front of a room of CISOs and security leaders. Seating is limited. Register at candidciso.com under Events.

Subscribe on Substack, Apple Podcasts, or Spotify, and share this with a CISO friend who needs to hear it.

Hosted by Steve Tout and John Donovan. Candid CISO is a Tout Media production.