Oct 20, 2026 · 45 min · 10 segments
Securing and governing AI agents is, according to Matthew Gardiner, the hardest problem in cybersecurity harder than securing the internet itself. In this episode, Matthias discusses with Matthew why…
Matthew GardinerGuest
Matthias ReinwarthHostand and i want to shift the discussion towards something that i see from from my experience as an advisor um when it comes to to dealing with such simple systems like an ian systems many organizations already struggle in making the right people responsible for the right task within the overall fabric of IAM.
So ending up with something like a proper target operating model to say, okay, this group of people is responsible for governance.
This group of people is responsible for actually doing things, for automating things, for making sure that data quality is proper.
But if you look at agentic AI cybersecurity, There are so many more people involved.
So is this not only a technical problem, but also an organization problem? I know this is a simple question.
Well, I think a lot of things you just mentioned for human identity has to happen for the agents.
I mean, one of my main concerns, you know, as been having worked in security for 25 years, is there is a tendency out there for the security team to take the blame for anything that goes wrong.
You know, in my mind, one might, you know, the framework, confidentiality, integrity, availability, that's the security team's responsibility, not every bad outcome that an agent may do.
Now, we may provide data, we may provide information or find things that we think are rogue and hand it off to the business.
And in my work, what I see with leading organizations is that they've been setting up these sort of AI governance committees.
Often there'll be a chief of AI strategy that maybe runs this governance committee.
Security team clearly has a seat at it, but it's your classic risk decision.
And, you know, you may be willing to accept a certain risk of a certain transaction being wrong because 99% of the time it's right.
The security team shouldn't be responsible for every failure of the, you know, the agent applications.
and and i want to shift the discussion towards something that i see from from my experience as an advisor um when it comes to to dealing with such simple systems like an ian systems many organizations already struggle in making the right people responsible for the right task within the overall fabric of IAM.
So ending up with something like a proper target operating model to say, okay, this group of people is responsible for governance.
This group of people is responsible for actually doing things, for automating things, for making sure that data quality is proper.
But if you look at agentic AI cybersecurity, There are so many more people involved.
So is this not only a technical problem, but also an organization problem? I know this is a simple question.
Well, I think a lot of things you just mentioned for human identity has to happen for the agents.
I mean, one of my main concerns, you know, as been having worked in security for 25 years, is there is a tendency out there for the security team to take the blame for anything that goes wrong.
You know, in my mind, one might, you know, the framework, confidentiality, integrity, availability, that's the security team's responsibility, not every bad outcome that an agent may do.
Now, we may provide data, we may provide information or find things that we think are rogue and hand it off to the business.
And in my work, what I see with leading organizations is that they've been setting up these sort of AI governance committees.
Often there'll be a chief of AI strategy that maybe runs this governance committee.
Security team clearly has a seat at it, but it's your classic risk decision.
And, you know, you may be willing to accept a certain risk of a certain transaction being wrong because 99% of the time it's right.
The security team shouldn't be responsible for every failure of the, you know, the agent applications.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
