Topic
10 facts from 1 episode, in date order. These are what speakers said on the shows, each linked to the moment it was said. They aren't independently verified.
Undated
Ben Mayrides says much of an AI agent's reasoning is opaque and hard to reconstruct, and that existing observability controls do not integrate well with agentic architectures.
“a lot of agent reasoning is opaque, um, and it's difficult to sort of reconstruct those those elements as well, and we need that.”
Undated
Ben Mayrides says the ability to reconstruct agent actions is needed for compliance with regulations such as the EU AI Act.
“We need that for compliance reasons with things like the EU AI Act.”
Undated
Ben Mayrides says existing frameworks such as the EU AI Act and the NIST risk management framework are mainly organizational governance frameworks that do not go deep into technical controls for agents.
“the frameworks that are out there are predominantly organizational governance frameworks. So, when you think about the EU AI Act or the NIST, uh, risk management framework, again, they're great”
Undated
Pradeep Mannakkara says Ben Mayrides's security team evaluated Claude Cowork and concluded that the risk was too high.
“Ben and team kinda looked at this and said, Risk is too high.”
Undated
Ben Mayrides says that for agents, risk assessment must focus on what an agent can do, access and decide, rather than only on model security such as training data and data retention.
“in an agentic architecture, it's completely different, right? It is about what that agent can do, what it can access, what decisions it's making”
Undated
Ben Mayrides says answering five questions related to the AWARE framework gives security and business leaders shared success criteria and reduces gut-feel objections.
“if we can just answer these, let's say, 5 questions related to the aware framework, um, if we can agree on”
Undated
Ben Mayrides says on-device inference might slightly reduce the risk of data exfiltration but could cost visibility into and control over what an agent is doing.
“on-device inference, that's awesome. Uh, maybe, um, from the standpoint of it's going to maybe slightly reduce the risk of data exfiltration”
Undated
Pradeep Mannakkara says Ben Mayrides's security team and other teams at Cvent have created AI bots to perform part of the risk assessment.
“Ben's team, among other teams, have actually created AI bots to kinda do some of that risk assessment”
Undated
Ben Mayrides predicts SOC 2 will add control criteria for AI agents within about a year and a half to two years.
“I can see us seeing a control criteria in SOC 2 within, like, say, the next year and a half, 2 years, uh, we need to be ready for that.”
Undated
Ben Mayrides argues that applying the same level of governance to every agent will not scale, so risk processes should be tiered.
“if you're applying, you know, governance to, uh, the same level of governance and control to every agent or every AI system out there, your your governance, uh, capabilities are just they're gonna crumble”
Episodes