Moreover, many CISOs are contending with what Almeida described as “organizational blind spots.”
“In my conversations with CISOs, I have found that most leaders, security ones included, cannot explain how an agent works. They know that they need to use it, but don’t understand the mechanics: where the agent gets its information, how it calls on tools, how it makes decisions, how human-in-the-loop actually works,” Almeida says. “When you can’t describe the mechanism, you can’t right-size the exposure.”
As for AI governance, Almeida cautions that clear ownership isn’t enough on its own; the real issue is security culture.
