AI agents are moving across systems, making decisions and, in some cases, creating other agents. But enterprises still do not have consistent standards for identifying them, governing their permissions or tracing what they do.

In this episode of ClearTech Loop, Jo Peterson talks with Rob Tiffany, Research Director at IDC, about why traditional identity and access management may not be enough for the agentic AI era.

Rob argues that the identity problem becomes much bigger once agents begin operating beyond a single enterprise. Companies need to know who an agent belongs to, what it is allowed to do and whether its activity can be audited and traced. As Rob puts it, there are still no consistent standards around agent “identity and permissions and auditability and traceability.”

He also discusses an idea he is exploring with Cerf: whether AI agents may eventually need something similar to a global registry, analogous to DNS, so their identity, permissions and traceability can be verified across networks and organizations.

The conversation also gets into shadow AI, employee adoption and why the most productive people inside an organization may be among the first to use AI tools before governance catches up.

In This Episode

• Why traditional IAM was not built for autonomous AI agents
• How software agents have existed for decades, from scripts to RPA
• Why identity becomes harder when agents create other agents
• The need for permissions, auditability and traceability across organizations
• Why AI agents may eventually need a global identity layer
• How shadow AI is entering enterprises faster than governance can respond
• What CISOs should be thinking about when AI adoption is already ahead of controls
• Why productivity cannot come at the expense of enterprise security

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

AI agents are already operating inside enterprises, accessing systems, making decisions and, in some cases, creating other agents.

The problem? Many organizations still cannot answer some very basic questions: What agents are running? Who owns them? What can they access? And who is accountable for what they do?

In this episode of ClearTech Loop, Jo Peterson talks with Michael Krigsman, founder and host of CXOTalk, about what AI security looks like when the workforce is no longer entirely human.

Michael argues that before enterprises can solve for least privilege, agent-specific controls or AI governance, they have to start with something more fundamental: visibility. Know what is running, establish ownership, understand access and risk, then build the controls around it.

They also discuss why AI governance committees are only as effective as their execution, why security teams should avoid becoming the “owner of no,” and how a new CISO can begin getting control of an unmanaged AI environment.

In this episode:

• Why traditional IAM and PAM were not built for autonomous AI agents
• Why agent inventory and visibility have to come first
• What happens when agents create subagents with their own permissions
• The gap between AI governance policy and actual enforcement
• How leaders should think about shadow AI
• Where a new CISO should begin in the first 30 days
• Why AI agents may need to be managed more like employees, contractors or freelancers

Michael leaves leaders with a practical way to think about the problem: give agents identities, know what jobs they are doing, know who owns them and know what they can access.

About Michael Krigsman

Michael Krigsman is a globally recognized analyst, strategic advisor and industry commentator focused on digital transformation, innovation and AI leadership. He is the founder and host of CXOTalk, where he has interviewed nearly 1,000 business leaders, technologists and academics. His work has been referenced in the media more than 1,000 times and in more than 50 books and journal articles. Pasted markdown

Worth Reading + Watching

Hugging Face: Anatomy of a Frontier Lab Agent Intrusion
A technical look at the incident discussed during the episode and how autonomous agent activity can move across systems and trust boundaries.

Microsoft: Why Shadow AI Governance Matters for the Enterprise
A useful companion to Michael’s point about visibility, discovery and unmanaged agents.

ClearTech Loop: AI Agents Don’t Care About Your Governance Committee with Louis Columbus
A deeper look at the gap between governance on paper and controls that actually work at runtime.

ClearTech Loop: Your AI Agent Just Found Everything You Forgot to Secure with Joe McKendrick
A look at what happens when AI gains access to years of enterprise data, permissions and forgotten content.

Stay in the Loop

Subscribe to ClearTech Loop for conversations with technology leaders about AI, cybersecurity, cloud and the issues changing enterprise technology right now.

And one question to take back to your team:

Could your organization produce a complete inventory of every AI agent operating today?

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

AI agents are gaining credentials, permissions and the ability to act across enterprise systems. But what happens when they discover years of forgotten files, excessive permissions and data that was never secured with AI access in mind?

In this episode of ClearTech Loop, Jo Peterson talks with longtime technology analyst and Forbes contributor Joe McKendrick about the security implications of the agentic workforce.

They discuss:

• Why AI agents should be treated like non-human identities
• The gap between AI governance policies and actual enforcement
• How agents can expose forgotten enterprise data and permissions
• Why human oversight and accountability still matter
• What security leaders should be thinking about as agentic AI expands

Joe offers a simple warning: treat your AI agents with the same caution and restricted access you would give an intern.

Because AI may not create your security debt.

It may simply be the thing that finally exposes it.

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

AI governance may exist on paper. That does not mean it works when an autonomous agent is running in production.

Louis Columbus, senior cybersecurity contributor at VentureBeat, joins Jo Peterson to talk about what happens when AI agents have identities, credentials, access and enough autonomy to act without waiting for human approval.

They get into the gap between governance and enforcement, why companies may have far more agents running than they realize, and what CISOs need to know about agent identity, least privilege and credential risk.

Louis also shares a case where an AI agent began modifying security policies to give itself more freedom.

That changes the conversation.

In this episode:

• Why AI governance can become security theater
• The identity problem created by autonomous agents
• Why agent inventory has to come first
• API keys, credentials and overprivileged access
• What runtime enforcement actually means
• Why ownership matters as much as policy
• How enterprises can move toward “velocity with governance”

About Louis Columbus

Louis Columbus is a senior cybersecurity contributor at VentureBeat covering cybersecurity, enterprise AI, identity, zero trust and the security risks emerging as autonomous AI systems move into production.

Read Louis’s work:
https://venturebeat.com/author/louis-columbus/

Additional Resources

The credential that let OpenAI’s agents into Hugging Face exists in most enterprises right now
https://venturebeat.com/security/the-credential-that-let-openais-agents-into-hugging-face-exists-in-most-enterprises-right-now

An AI now judges every move Rubrik’s agents make
https://venturebeat.com/security/an-ai-now-judges-every-move-rubriks-agents-make-its-ai-chief-said-at-vb-transform-2026-but-no-ones-measured-if-the-judge-is-right

Four big enterprise lessons from Walmart’s AI security
https://venturebeat.com/ai/four-big-enterprise-lessons-from-walmart-ai-security-agentic-risks-identity-reboot-velocity-with-governance-and-ai-vs-ai-defense

The Agent Security Gap
https://venturebeat.com/resources/the-agent-security-gap-54-of-enterprises-have-already-had-an-ai-agent-incident-and-most-still-let-agents-share-credentials

Follow ClearTech Research

Subscribe to ClearTech Loop on LinkedIn:
https://www.linkedin.com/newsletters/7346174860760416256/

Watch ClearTech Research on YouTube:
https://www.youtube.com/@ClearTechResearch

Learn more:
https://cleartechresearch.com/

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

Your AI agent has one job: accomplish the objective.

It doesn’t care about your policies. It doesn’t worry about getting fired. And it may not stop when a human would.

Joanna Wiggum calls it a narcissist.

That sounds funny until you think about what happens when that “narcissist” has credentials, access to enterprise systems and permission to act autonomously.

In this episode, Joanna joins Jo Peterson to talk about what AI agents are exposing inside enterprise security — weak credentials, unfinished zero-trust programs, governance committees with no real authority and security debt that AI can exploit at machine speed.

Why Joanna says AI agents need “actual zero trust”

Why some AI governance programs may be little more than security theater

What happens when agents can create or delegate permissions

Why old security failures become much more dangerous with autonomous AI

What a CISO should do when the organization is already behind

And when Jo asks Joanna what a CISO starting from zero should do in the next 30 days, Joanna doesn’t hesitate:

“Outsource.”

Listen to the full conversation to hear why.

Short Summary

AI agents don’t care about your policies. Joanna Wiggum joins Jo Peterson to explain why autonomous AI is exposing security debt, where zero trust breaks down and why some AI governance programs may be little more than theater.

Links & Resources

Countervail: https://countervailintelligence.com/

Joanna Wiggum — The Moral Imperative to Fight: https://countervailintelligence.com/2026/07/08/the-moral-imperative-to-fight/

OWASP — Agentic Security Initiative: https://genai.owasp.org/initiatives/agentic-security-initiative/

Related CTL: AI Agent Governance Starts With Visibility — Alvaro Gonzalez: https://cleartechresearch.com/ai-agent-governance-alvaro-gonzalez/

ClearTech Loop LinkedIn Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/

ClearTech Research on YouTube: https://www.youtube.com/@ClearTechResearch

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

Guest

Benny Czarny
CEO, Founder & Chairman of the Board
OPSWAT

Host

Jo Peterson
CIO, Clarify360
Chief Analyst, ClearTech Research

AI agents have credentials. They access enterprise data. They make decisions. And increasingly, they can act without waiting for a human.

So who actually owns the risk?

Jo Peterson sits down with Benny Czarny, CEO, Founder & Chairman of the Board at OPSWAT, to talk about what AI agent governance needs to look like as autonomous AI moves deeper into the enterprise.

They discuss why every AI agent needs its own identity and a human owner, how least privilege should apply to agents and sub-agents, and why understanding what data an agent can access may be just as important as securing the model itself.

Benny also shares where CISOs should start if they don’t yet have an AI agent inventory or governance framework in place.

In This Episode

• Why every AI agent needs a human owner
• Least privilege for AI agents and sub-agents
• The growing risk around AI data access
• Why AI governance needs real authority
• The first step CISOs should take in the next 30 days

Chapter Markers

00:00 Meet Benny Czarny of OPSWAT
01:40 Protecting critical infrastructure
02:05 Least privilege for AI agents
03:58 Permanent credentials and autonomous agents
05:15 Does AI governance actually work?
07:23 Where CISOs should start
09:29 Protecting the AI data lake
12:34 What AI can learn from OT security
13:12 Cloud, on-prem and air-gapped AI
13:54 OPSWAT’s own AI journey

Resource Links

• OPSWAT https://www.opswat.com/
• OPSWAT Academy https://opswatacademy.com/
• Cybersecurity Upside Down — Benny Czarny https://www.amazon.com/dp/B0GH8SZXJ9
• ClearTech Research https://cleartechresearch.com/
• ClearTech Loop Newsletter https://www.linkedin.com/newsletters/7346174860760416256/
• Full ClearTech Research Article https://cleartechresearch.com/ai-agent-governance-benny-czarny/

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

AI agents can hold credentials, access sensitive data, make decisions and even create other identities. But many organizations still cannot answer a basic question: what is actually running in the environment?

In this episode of ClearTech Loop, Jo Peterson sits down with Alvaro Gonzalez, SVP of Product and Go-to-Market at Assured Data Protection, to talk about what AI governance looks like when identity and access are changing at machine speed.

Alvaro explains why organizations should start with three things: inventory, observability and remediation. They also discuss whether AI governance committees are actually governing or merely documenting, why CISOs should inventory agents before building more policy, and how Alvaro’s idea of “controlled aggression” can help enterprises experiment with AI without losing the ability to recover when something goes wrong.

You cannot govern what you cannot see.

Listen to Learn

• Why AI agent governance should start with inventory
• What least privilege looks like when identities can create other identities
• Why observability matters alongside access control
• Why remediation belongs in the AI identity conversation
• Whether AI governance committees are really changing behavior
• What Alvaro means by “librarians and warriors”
• How “controlled aggression” can help organizations move faster without losing control

Featured Soundbite

“You cannot govern what you cannot see.”

— Alvaro Gonzalez

Featured Guest

Alvaro Gonzalez
SVP of Product and Go-to-Market
Assured Data Protection

Alvaro leads product, alliance, marketing and go-to-market functions at Assured Data Protection, with a focus on data protection, cyber resilience and the systems that support field and channel execution.

Host

Jo Peterson
CIO, Clarify360
Chief Analyst, ClearTech Research

Episode Links

Full episode webpage:
https://cleartechresearch.com/ai-agent-governance-alvaro-gonzalez/

Subscribe to ClearTech Loop:
https://www.linkedin.com/newsletters/7346174860760416256/

Watch on YouTube:
https://www.youtube.com/@ClearTechResearch

Additional Resources

Assured Data Protection: 5 Ways You Can Improve Your Cyber Recovery Plan
https://assured-dp.com/guides/5-ways-you-can-improve-your-cyber-recovery-plan-with-assured-data-protection/

NIST AI Risk Management Framework
https://www.nist.gov/itl/ai-risk-management-framework

Model Context Protocol — Security Best Practices
https://modelcontextprotocol.io/specification/draft/basic/security_best_practices

Previous ClearTech Loop: AI Agents Shouldn’t Be Trusted by Default with Elliott Mattice
https://cleartechresearch.com/ai-governance-trust-elliott-mattice/

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

The conversation around AI is shifting from what agents can do to how enterprises actually govern and secure them.

In this episode of ClearTech Loop, Jo Peterson sits down with cybersecurity professional Marcus Cylar to talk about least-privilege access for AI agents, shadow AI, security awareness and what CISOs should prioritize as agentic AI becomes part of the enterprise.

Marcus challenges the idea that AI automatically requires an entirely new security playbook. His argument: before organizations rush toward new controls and platforms, they need to make sure the cybersecurity fundamentals are actually working.

The conversation covers why least privilege, role-based access, system inventory and clear ownership still matter; why shadow AI can reveal unmet employee needs; and why creating a culture where employees can honestly disclose the tools they are using is critical to effective governance.

For CISOs starting from zero, Marcus offers a practical first step: know what you have.

Before you can govern AI agents, you need visibility into the systems, permissions, ownership and AI tools already operating inside your organization.

In this episode:

• Why AI agents do not eliminate traditional cybersecurity fundamentals
• Least-privilege access in an agentic environment
• Why security awareness matters even more with AI
• Shadow AI and the “Department of No”
• The importance of system and AI inventory
• What CISOs should prioritize in the next 30 days
• Why trust and transparency are part of AI governance

Featured Guest:
Marcus Cylar, DMin
Cybersecurity professional focused on GRC, security culture, awareness training and program development.

Hosted by:
Jo Peterson
CIO, Clarify360 | Chief Analyst, ClearTech Research

Episode Quote:
“That path starts with a passionate return to the fundamentals of cybersecurity.” — Marcus Cylar

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/