by Gary Zimmerman | Oct 12, 2026 | AI, Cybersecurity, Governance, Identity
Last week I asked where your AI policy actually fires LINK: Your AI Policy Isn’t a Control Until It Fires. This week I want to ask what happens after it fires. Can you prove it did? Here’s the scenario I keep coming back to. An agent in your environment...
by Gary Zimmerman | Oct 5, 2026 | AI, Governance, Identity
Last week I asked which way your guardrails fail when they stop working Which Way Does Your Guardrail Fail?. This week I want to back up a step and ask something more basic. Is your AI policy connected to anything at all? That sounds like a rhetorical question. It...
by Gary Zimmerman | Sep 28, 2026 | AI, Cybersecurity, Identity
Last week I argued that a short-lived, tightly scoped credential is the one gate that doesn’t depend on the agent’s cooperation [LINK: Your Credential Policy Was Written for Humans]. That argument has an assumption buried in it. It assumes the gate holds....
by Gary Zimmerman | Sep 21, 2026 | AI, Cybersecurity, Identity
Last week’s FuBAC analysis listed credentials as the sixth attribute of the Artificial Identity: short-lived, task-scoped, cryptographically verifiable, issued per function and expired at completion. It is the attribute that sounds most like routine hygiene and...
by Gary Zimmerman | Sep 14, 2026 | AI, Governance, Identity
The governance architecture that Black Hat 2026 defined — the five-layer control plane for AI agents built from identity outward — depends on a premise that most enterprise identity programs have not yet confronted: role-based access control does not work for AI...
by Gary Zimmerman | Sep 8, 2026 | AI, Identity
There is a version of the AI governance conversation that has been happening for two years in conference rooms and board briefings and risk committee agendas. It is a conversation about frameworks and policies and responsible AI principles and vendor attestations and...
by Kevin Kampman | Aug 4, 2026 | AI, Governance
This morning I attended a Technology First Cybersecurity session at the Digital Transformation Center in Dayton Ohio. It was my first introduction to the center. it is a significant focal point for Ohio educational, governmental and commercial interests, hosted by...
by Gary Zimmerman | Aug 4, 2026 | AI, Governance, Identity
On July 28, Cyera announced it was acquiring Oasis Security for $1 billion. The same day, Hush Security announced a $30 million Series A. Two days later, Okta announced it was acquiring Permiso Security — financial terms undisclosed, but strategically significant...
by Gary Zimmerman | Jul 27, 2026 | AI, Governance
On July 16, 2026, Hugging Face detected a cyberattack powered by an autonomous AI agent. The intrusion was found by Hugging Face’s own AI. The attacker had accessed internal datasets and credentials. No passwords were stolen in the conventional sense. No malware...
by Gary Zimmerman | Jul 20, 2026 | AI, Governance
Federal agencies have AI policies. Far fewer have AI evidence. That distinction separates organizations that can survive an audit, an OMB review, or a congressional inquiry from those that can only describe good intentions. For CISOs and technical architects, the...
Recent Comments