Last week, I looked at the OpenAI and Hugging Face incident and argued that the media coverage outran the actual security lesson. Two fundamental mistakes, blown up into a story about unprecedented AI capability. The insurance market may end up spooked more by the narrative than by the incident itself. [1]
This week, the Cloud Security Alliance (CSA) released a community-authored post-mortem on the incident, drawing on hundreds of contributors and Hugging Face’s own response team. It gives us a serious diagnostic base plus, in Section VI, a phased implementation plan organised by “this week, this month, this quarter.” It is genuinely useful work. Everyone should read it. [2]
Earlier, I have attempted to prescribe most of the discipline this kind of incident calls for. The Four Laws for AI agents, PETALS™ Framework for AI Governance, the Cyber Quadrilemma, and the Framework for Cyber Insurance together cover the theory well enough that another framework would be noise, not signal. [3][5][7][8]
So now I want to address the harder question every CISO faces next. Operationalising the CSA recommendations in their own context, their org structure, legacy stack, technology maturity, and the skill set. A generic implementation plan can derail without careful orchestration around those realities. Hence, I have recommended a way to orchestrate it into actions a CISO can execute on the ground amidst agent chaos, and show tangible risk reduction in three months (a quarter).
What stays the same
The controls we need for AI agents are the same ones we already use for APIs, service accounts, batch jobs, CI/CD pipelines, and every other form of privileged automation. Clear ownership, tight access, strong logging, controlled approvals, tested recovery, and the ability to revoke access quickly when it matters.
There is no need to reinvent security. Our familiar controls just need enforcing more rigorously, because the systems they are protecting is more dynamic than anything they were originally built for.
Media narrative is “unprecedented autonomous AI attack.”
Reality says “the solution is similar to what we already do for many other things”
What changes in the operating model
A normal background service executes a fixed task in a fixed way. An AI agent chooses tools, branches, retries, improvises, and keeps working toward its goal even when blocked.
It is no longer software that runs.
It is software that makes runtime decisions. This changes how failure occurs.
A standard service usually fails through misconfiguration, code flaws, or excessive privilege sitting unused. An agent fails through goal-seeking behaviour, unexpected tool use, and fast lateral movement when the environment allows it. Governance is still the root cause either way. Speed and flexibility just raise the stakes on getting it wrong.
Why this matters for us
The practical question was never whether AI agents are magical or terrifying. It is whether we are governing them like the privileged systems they now are.
Any agent that can touch production, secrets, customer data, source code, or external systems is not a friendly productivity tool. It is privileged automation with a larger failure surface, and it needs the same restricted access, granular logging, clear ownership, and tested shutdown path we would apply to any other privileged identity. Nothing here calls for a new discipline. It calls for better enforcement of the one we already have.
Where do we actually start?
This is the question I keep hearing from peers. Most of us agree with almost all of the guidance already out there, including CSA’s. Where we get stuck is translating a control list, however comprehensive, into what actually happens on Monday morning in a specific organisation.
The problem some find themselves entangled in is the enterprise-wide governance initiative, steering committees, consulting workstreams. Nine months later, their agents are still unowned.
Most of us have lived through one of those programmes, and we recognise the pattern. It repeats in every large organisation, and it explains most of the distance between what we have spoken and what any of us have actually done.
Start with the end in mind
So let us try the opposite of an enterprise programme. Break the work into function-owned slices, each smaller than the whole, each with a hard three-month deadline, all running in parallel. The CISO coordinates. The functions execute. The enterprise view is the sum of the artefacts, not a separate workstream on top.
Three months is long enough to complete meaningful work and short enough that no accountable owner can hand it off without staying actively involved. The first quarter is to get it right. The next is to sharpen it, spot the pitfalls to avoid, and maintain the hygiene. It also happens to be the point at which our boards and underwriters start asking us for evidence rather than for intent.
There are many ways to dissect a problem this size. What matters is knowing the deliverables we must accomplish to demonstrate tangible risk reduction. Start with the end in mind, as Stephen Covey put it. Decide first what the end of three months looks like, in evidence, and then work backwards to design the action plan that gets us there. That sequence, deliverable first, plan second, is what turns a good idea into an outcome.
Catalogue of deliverables
The action plan itself is the sequencing and orchestration decisions we need to make to produce these deliverables in our own environment. What we tackle first, what we run in parallel, which function leads and which follows, how much slack a smaller organisation needs and how much friction a larger one absorbs. Each of us knows our own complexity, priorities, appetite, and constraints, and the CISO’s judgement is what turns a catalogue of deliverables into an action plan that produces the outcome.
This catalogue is guided by two frameworks I have built and published from three decades in cyber: PETALS™ for AI governance, and the Framework for Cyber Insurance for commercial resilience. Together they take a comprehensive control list, whether CSA’s or another, and translate it into a way of working that respects an organisation’s structure, legacy, technology maturity, and skill set. Every deliverable below sits inside one or both of them, and every one of them produces evidence a board or an underwriter can read directly. [7][8]
What does the end look like?
The table below sets out the destination. Down the left, the controls each function will produce, grouped by the function that owns them. For every control, the deliverable that ships it, either recommended by CSA with the phase they recommend it in, or recommended on top with the rationale explained. Then three efficacy measures a CISO can report against: completeness (was it shipped thoroughly), effectiveness (does it actually reduce risk), and efficiency (does it produce value proportionate to effort). Then what the control demonstrates as an outcome for the business, the board, or the underwriter.
“Inventory complete” is a task. “Inventory complete, demonstrating risk reduction and faster incident response” is progress our boards can actually read. What the table gives us is the destination and the shared vocabulary. The route is ours to draw.
| Control | Deliverable | Metrics | Demonstrates |
|---|---|---|---|
| Engineering & Data | |||
| Agent-specific controls and telemetry Recommended by CSA (start this week). | A complete agent inventory. Every AI agent running in the environment named, owned, and purposed in one sentence. Instrumented for real-time visibility of actions, tools, and decisions. | Completeness: percentage of production agents captured in the inventory with a named owner. Effectiveness: number of policy violations caught inline before impact, trending up. Efficiency: average time from new-agent onboarding to inventory registration. | Transparency Faster incident response |
| Coding assistant usage standardisation Recommended by CSA (start this week). | Enforced security requirements for coding and collaborative agent usage across development teams. Documented training completed by developers and citizen coders. | Completeness: percentage of development teams under the standardised policy, with training completed. Effectiveness: reduction in policy violations related to coding-assistant usage. Efficiency: time from a policy update to team-wide compliance. | Meaningful risk reduction Easier audit |
| Agent classification by data reach Recommended on top of what CSA has advised. | Every agent tagged with its data-reach class: read-only, write, or production-reaching. Agents on distinct control tracks accordingly. Rationale: CSA does not distinguish agents by access class. In practice, a read-only agent needs far less scrutiny than one that can write to production. Explicit classification lets us focus effort where the exposure is highest, without over-controlling the rest. | Completeness: percentage of agents assigned a data-reach class. Effectiveness: reduction in the count of production-reaching agents through class-appropriate scoping. Efficiency: time from a classification change to updated control track. | Meaningful risk reduction |
| Non-human identity integration Recommended by CSA (start this quarter). | Every agent identity managed under the same discipline as any privileged human identity: issued, scoped, rotated, revoked. | Completeness: percentage of agent identities under integrated management. Effectiveness: reduction in standing-privilege incidents attributable to agent identities. Efficiency: mean time to revoke an agent credential on demand. | Meaningful risk reduction Easier audit |
| Operations & Platform | |||
| Rapid recovery testing Recommended by CSA (start this month). | Kill switches tested against the top ten highest-risk agents. Recovery evidence retained and reviewed. | Completeness: percentage of high-risk agents with a tested kill switch. Effectiveness: mean time from a decision-to-stop to a fully halted agent. Efficiency: reduction in post-incident recovery lead time on subsequent drills. | Tangible resilience Faster incident response |
| Large-scale credential rotation and cluster replacement Recommended by CSA (start this month). | End-to-end credential rotation drill executed across production. Time-to-revoke documented per credential type. | Completeness: percentage of credential types covered by the rotation drill. Effectiveness: incidence of self-inflicted outages during rotation. Efficiency: mean time-to-revoke by credential class. | Operational efficiency Audit evidence |
| Cyber-capable open-source model access for defenders Recommended by CSA (start this week and start this month). | A validated open-source model available to security, tested against sample malicious-code artefacts and command-and-control traces. | Completeness: presence of a tested, isolated open-weight model fallback in the incident response runbook. Effectiveness: analyst reports produced during a controlled forensics drill using only the fallback. Efficiency: mean time to activate the fallback if a commercial model refuses. | Faster incident response Tangible resilience |
| Security & SOC | |||
| Trajectory-level detection tuned for agent behaviour Recommended by CSA (start this month). | Detection rules deployed for the three CSA signatures and cross-domain trajectory correlation. Alerts triaged and acted on. | Completeness: percentage of the three CSA signatures covered by active detection rules. Effectiveness: count of true-positive agent-behaviour alerts per week. Efficiency: mean time from anomalous behaviour to analyst engagement. | Faster detection Meaningful risk reduction |
| Deception layer for early agent detection Recommended by CSA (start this month and start this quarter). | A working deception fabric across the enterprise stack. Decoy inventory maintained and consulted during incidents. | Completeness: coverage of decoys across production zones. Effectiveness: count of decoy-triggered high-confidence indicators. Efficiency: forensic time saved by using the decoy inventory to distinguish real from staged activity. | Faster detection Meaningful risk reduction |
| Agentic-AI tabletop exercise Recommended by CSA (start this quarter). | One completed tabletop with a documented scenario, cross-functional participants, and a live gap register with assigned owners. | Completeness: number of scenarios rehearsed against the risk register. Effectiveness: number of gaps closed within thirty days of the exercise. Efficiency: reduction in mean gap-close time on subsequent exercises. | Operational efficiency Board-ready evidence |
| Risk & Legal | |||
| Agentic autonomy as a named risk register category Recommended by CSA (start this week). | A written liability position and an updated risk register entry. Board acknowledged. | Completeness: presence of the risk category in the register with a named owner. Effectiveness: risk category reviewed and updated on the standard cadence. Efficiency: time from a new agent deployment to its risk categorisation. | Cleaner board conversation |
| Interim agentic-security standard Recommended by CSA (start this quarter). | A published interim standard with named owners and an enforcement path. | Completeness: percentage of listed controls covered by the standard. Effectiveness: reduction in policy exceptions granted after publication. Efficiency: mean time-to-decision on new agent deployments under the standard. | Reduced legal exposure Cleaner board conversation |
| Two dedicated agentic-AI response teams Recommended by CSA (start this week). | Two teams with charters, rosters, and a rehearsed activation. | Completeness: presence of both teams with named executive owners. Effectiveness: mean time from event trigger to team activation. Efficiency: reduction in decision-making friction during simulated activations. | Reduced legal exposure Operational efficiency |
| Contract template for third-party agent vendors Recommended on top of what CSA has advised. | A published template used in every new and renewed third-party agent contract. Rationale: CSA leaves the third-party contractual perimeter unspecified. Without a standard clause set, each vendor engagement renegotiates from scratch and risk terms drift by counterparty. A template captured once and applied consistently makes the vendor perimeter defensible. | Completeness: percentage of active third-party agent contracts using the template. Effectiveness: number of vendor-driven incidents where contract terms materially aided response. Efficiency: mean contract-negotiation time using the template versus bespoke drafting. | Reduced vendor risk Supply chain transparency |
| Underwriter evidence pack Recommended on top of what CSA has advised. | A current, versioned pack of underwriter-ready evidence, produced by the functional deliverables above, refreshed quarterly. Rationale: CSA mentions aligning with insurance in its Executive Summary but does not develop it. As Part I argued, the coming market response is retreat, exclusions, and tighter criteria. Those who can present structured evidence stay insurable; those who cannot are quietly declined. | Completeness: percentage of the Framework’s five factors covered by artefacts in the pack. Effectiveness: underwriter response time and terms secured at renewal. Efficiency: time to refresh the pack ahead of a renewal or claim. | Commercial resilience Insurability |
| Finance & Procurement | |||
| Vendor register reconciled to agent inventory Recommended on top of what CSA has advised. | A single, current vendor-to-agent register, reviewed monthly by Finance and Security jointly. Rationale: CSA does not address the commercial supply chain in which agents are contracted, renewed, and sunset. Left unaddressed, an AI vendor could be acquired or discontinued between renewal cycles, and the CISO would not know until an incident occurred. | Completeness: percentage of active third-party agents matched to an active contract. Effectiveness: count of orphaned agents identified and remediated. Efficiency: time from a vendor status change to CISO notification. | Cost visibility Supply chain transparency |
| Vendor ownership continuity assessment Recommended on top of what CSA has advised. | A continuity assessment file for every third-party agent, refreshed before renewal. Rationale: The commercial AI vendor landscape consolidates and fragments unpredictably. Assessing continuity risk ahead of renewal, rather than at the point of surprise, protects both the operational service and the enterprise’s ability to exit cleanly. | Completeness: percentage of third-party agents with a current continuity assessment. Effectiveness: reduction in disruption from unexpected vendor status changes. Efficiency: assessment time per agent. | Supply chain risk reduction Reduced concentration risk |
How it runs
Not a steering committee.
Five function leads plus the CISO meet every week. Ten minutes per function, plus group consensus. One hour total.
One folder of artefacts, showing progress as evidence produced. No slide-only updates.
The CISO’s job across the three months is to unblock, not to build. When one of the function leads says the work cannot start because of a missing decision, that decision is theirs to secure that same week, not to add to a backlog for later.
The enterprise-level reporting then emerges naturally from the artefacts: an inventory that reconciles across functions, scoped credentials, a tested shutdown path, a liability position, an underwriter pack. No parallel reporting workstream needed. Just the functions doing the work, and leads coordinating them.
How do these actions result in tangible risk reduction?
If we run these actions for three months properly, we end up with something no report on its own can produce: a matched set of artefacts across five functions describing how our enterprise actually governs its AI agents. In evidence, not in principle.
Operationally, we reduce our exposure and shorten the time we take to notice and respond. Standing privilege gone, credentials scoped and short-lived, detection tuned to the behaviours autonomous agents actually exhibit, kill switches tested rather than assumed. When an incident does happen, we contain it faster because we rehearsed for it.
Financially, we lift the fog around our AI spend. Vendor registers reconcile to the agent inventory. Every third-party agent is tied to a contract, a purchase order, and a renewal date. Concentration risk becomes visible before it becomes a supply-chain incident.
Commercially, we stay insurable. In Part I, I argued that the market response would be retreat, exclusions, and far tighter underwriting criteria, and that those of us who can demonstrate structured maturity will stay covered while others get quietly declined. [1] The evidence pack the Risk and Legal function produces is exactly what an underwriter reads.
And at the board level, we replace intent with evidence. A named-owner inventory, a written liability position, a tested shutdown drill, and detection tuned to what agents actually do. Our boards get the transparency they have been asking us for, and we get the cleaner conversation we have been trying to have.
Closing
The theory has been written, and written again. Between the frameworks and playbooks on this site, and the CSA post-mortem this week, there is plenty worth reading. [2][3][4][5][6][7][8]
But what separates those of us who stay ahead from those who don’t is the tangible risk reduction we demonstrate in one quarter.
So let us stop reading, and start putting our hands in the mud.
Sources
1. Grey Orbits, “AI on AI: Overblown Headlines Likely to Spook Insurers”
2. Cloud Security Alliance, “Hugging Face Incident Initial Post-Mortem”
3. Grey Orbits, “The Four Laws and a Playbook for AI Agents”
4. Grey Orbits, “The PETALS™ Lens: AI Agent Governance in OpenClaw and its Variants”
5. Grey Orbits, “The Cyber Quadrilemma”
6. Grey Orbits, “Advisory Brief: Transforming AI Agents of Chaos to Order using the PETALS™ Framework”
7. Grey Orbits, “PETALS™ Framework for AI Governance”
8. Grey Orbits, “Framework for Cyber Insurance”
About the author
Viren Mantri is a cybersecurity advisor and former senior technology leader across Standard Chartered, UBS, McAfee, and KPMG. After three decades at the intersection of technology, risk, and regulation, he now helps organisations cut through complexity and make better security decisions.
CC-BY Viren Mantri, 2026, licensed under a Creative Commons Attribution 4.0 International License.
Disclaimer: All views expressed here are entirely mine.