Security Is the Brakes That Let You Go Faster | Glean's CISO on AI, Agents, and Trust ft. Sunil Agrawal

In this episode of **Security & GRC Decoded**, Raj Krishnamurthy sits down with Sunil Agrawal, CISO at Glean, to discuss why the traditional "security as friction" narrative is outdated. Sunil explains his philosophy that security functions as the brakes on a car—not to slow you down, but to provide the safety net that allows you to move faster. Drawing on three decades of leadership at companies like Netflix, Adobe, and Qualcomm, Sunil unpacks the critical shift in the post-Mythos threat landscape. As the window between vulnerability and exploit collapses from months to minutes, legacy tooling built for human triage is no longer viable. Sunil details how organizations must adapt, covering: - Why "security as brakes" changes product velocity. - The distinction between one-way vs. two-way doors in automated remediation. - How to architect security programs for machine-speed threats. - Why the conversation with the board is finally shifting from activity to risk. If you are looking to rethink your security posture for an agentic, AI-driven world, this episode provides the blueprint. **Key Takeaways**: - The vulnerability-to-exploit window has compressed from roughly a year to 10–24 hours, and is heading toward minutes — which means remediation has to operate at machine speed. - Every legacy security tool was designed for human consumption. In an agentic world, tools must generate high-confidence findings because no human is left to filter the false positives. - Automated remediation belongs on two-way doors. One-way doors — anything unrecoverable — still need a human in the loop. - Roughly 90% of enterprise AI work should be deterministic retrieval; the LLM should only handle the reasoning and summarization layer. - Security teams were always outnumbered — 100 engineers to five defenders. AI is the first technology shift that closes that gap in the defender's favor. **What You'll Learn**: - Why Sunil frames security as brakes rather than friction — and what that changes about product velocity - How to decide which remediations can be safely automated and which cannot - What "making your data AI-ready" actually means once security through obscurity disappears - How enterprises are really deploying open-weight models, and where regulation forecloses the choice - Why identifying your crown jewels is the prioritization discipline most security programs skip This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. **Learn more**: https://www.compliancecow.com **Watch more episodes**: https://www.compliancecow.com/podcast **Connect With Our Guest**: Sunil Agrawal | CISO | Glean **Connect on LinkedIn**: https://www.linkedin.com/in/sunilcagrawal/ Rate, review, and share if you enjoyed the show! Subscribe to Security & GRC Decoded wherever you get your podcasts: **Spotify**: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683 **Apple Podcasts**: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450