A Guardrail, Not a Stop Sign: Securing AI at Business Speed

Work with Aaron: https://protectitallpod.com/work/

The book: https://protectitallpod.com/book/

This episode: https://protectitallpod.com/ep127/

The OT Security Starter Kit: https://protectitallpod.com/starter-kit/

Three months ago Ben Wilcox's company was running roughly 200 AI agents. When he checked the day before we recorded, it was 900. Nobody stood them up on purpose, and every one of them runs under somebody's identity.

Ben Wilcox is CTO and CISO at ProArch, which means he carries both sides of the argument: the pressure to adopt AI and move fast, and the job of answering for identity, governance and compliance when the moving fast gets ahead of the preparation. Most conversations about AI risk are one of those two people talking about the other. This one is held by somebody who cannot pass the problem across the table.

His position is not that AI is dangerous. It is that AI security does not start with securing the model, it starts with securing the environment you drop the model into: identity, access, data scope, logging and ownership. All things security teams already know how to do.

What you will take away

Why agent sprawl is already here, and why the real question is who owns an agent when the person who built it leaves

How to say no to a risky request and still give the business a path, so the work does not go to shadow AI

Why you fork a community MCP server and keep only the 20 of its 107 tools you actually need

The vendor due diligence question the questionnaire never asks: who can read the key, and can you get the log