Topic starter
10/07/2026 9:15 pm
TL;DR: At RSAC 2026, CISO AI uncertainty was framed as a board-level operating reality, according to Elisity, with Gartner citing that by 2028 half of incident response efforts will involve custom-built AI-driven applications and IBM reporting 97% of AI-related breaches in organisations without proper AI access controls. The decisive issue is not model trust, but what AI can reach, because containment and blast-radius control now matter more than prediction.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “CISO AI Uncertainty at RSAC 2026: Joan Goodchild Interview”.
Key questions
Q: What should organisations do before deploying AI agents in enterprise workflows?
A: Define the agent’s identity, privilege scope, and accountability before enabling production access.
Q: Why do AI agents create more governance risk than ordinary integrations?
A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services.
Q: How can teams tell whether AI oversharing controls are actually working?
A: They should measure whether realistic prompts produce restricted answers, redactions, or blocks when policy should apply.
Practitioner guidance
- Define AI reach boundaries before deployment Map which applications, data sets, and administrative functions each AI tool or agent can touch, and block everything else by default.
- Classify AI use cases into control tiers Separate fully controlled, compensated, and still-in-motion AI use cases so the board can see where governance is mature and where it is provisional.
- Limit standing privilege for AI identities Assign the minimum access needed for the task and remove any persistent permissions that are not required for the current workflow.
Bottom line: The article frames CISO AI uncertainty as a normal response to rapid change, not as a sign that leaders are failing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:38 pm
CISO AI uncertainty is a governance signal, not a leadership defect. The article makes clear that the smartest security leaders are not pretending AI is settled. They are acknowledging that the threat, the tooling, and the regulatory frame are all changing at once. That honesty is itself a control posture because it prevents false assurance from driving premature access decisions. The practitioner conclusion is simple: boards should reward bounded confidence, not theatrical certainty.
A question worth separating out:
Q: What is the difference between controlling model trust and controlling AI reach?
A: Model trust asks whether the system behaves as expected. AI reach asks what systems, data, and permissions it can touch if behaviour changes. The article’s core lesson is that reach control is the more actionable security question because containment matters more than prediction.
👉 Read our full editorial: CISO AI uncertainty at RSAC 2026 reveals a control gap