How to secure your AI Agents: A CISOs Journey

Value of the Information & Strength of the Argument

The value of the information is high, offering practical insights from a CISO’s real-world experience. The argumentation is solid, grounded in specific examples and a clear rationale for the multi-layer trust approach. Yash effectively argues against the marketing hype of zero trust, advocating for a more realistic and layered security model. The discussion on incident response and the changing definition of security incidents is particularly valuable, as it addresses a gap in current AI security discourse.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the content is based on expert opinion and practical experience rather than formal research. The sources cited are primarily the podcast’s own website and social media, with no external references to academic papers or industry standards. The title accurately reflects the content, focusing on securing AI agents from a CISO’s perspective. The discussion is coherent and well-structured, but lacks formal citations to support claims.

The title accurately reflects the content, focusing on securing AI agents from a CISO's perspective.

8/10

The podcast features a CISO with extensive experience, discussing practical security strategies for AI agents. The content is based on real-world experience and industry best practices, but lacks formal citations or peer-reviewed sources.

• 00:00Introduction
• 02:20Who is Yash Kosaraju? (CISO at Sendbird)
• 03:30Sendbird's Pivot: From Chat API to AI Agent Platform
• 05:00Balancing Speed and Security in an AI Transition
• 06:50Embedding Security Engineers into AI Sprint Teams
• 08:20Threats in the AI Agent World (Data & Vendor Risks)
• 10:50Blind Spots: "It's Microsoft, so it must be secure"
• 12:00Securing AI Agents vs. AI-Embedded Applications
• 13:15The Risk of Agents Making Changes in Customer Environments
• 14:30Multi-Layer Trust vs. Zero Trust (Marketing vs. Reality)
• 17:30Practical Multi-Layer Security: Device, Browser, Identity, MFA
• 18:25What is "Trust OS"? A Foundation for Responsible AI
• 20:45Balancing Agent Security vs. Endpoint Security
• 24:15AI Incident Response: When an AI Gives a Wrong Answer
• 29:20Security for Platform Engineers: Enabling vs. Blocking
• 30:45Providing Enterprise AI Tools (Gemini, ChatGPT, Cursor) to Employees
• 32:45Building a "Security as Enabler" Culture
• 36:15What Questions to Ask AI Vendors (Paying with Data?)
• 39:20Personal Use of Corporate AI Accounts
• 43:30Using AI to Learn AI (Gemini Conversations)
• 45:00The Stress on AppSec Engineers: "I Don't Know What I'm Doing"
• 48:20The AI CTF: Gamifying Security Training
• 50:10Fun Questions: Outdoors, Team Building, and Indian/Korean Food

• Cloud Security Podcast Website — Official website for the podcast, providing additional resources and episodes.
• Cloud Security Bootcamp — Training program mentioned in the podcast description.
• Cloud Security Newsletter — Newsletter for cloud security updates.
• Cloud Security Podcast LinkedIn — LinkedIn page for the podcast.

• OWASP Top 10 for LLM Applications — Aligns with the discussion on AI-specific threats like prompt injection and data leakage.
• NIST AI Risk Management Framework — Supports the multi-layer trust approach with a structured risk management framework.

• Zero Trust Architecture — The podcast argues against zero trust as a marketing term, but NIST's zero trust architecture is a well-established framework that also emphasizes multiple layers of security.