I spent the past week reviewing papers for a workshop at NeurIPS, the machine learning conference. It took more time than I expected, so I haven’t posted. Time to catch up.
About a month ago, I set up an AI agent to act as my CISO – chief information security officer. I told all my other AI agents to consult it whenever their actions might affect the security of what we were doing.
The CISO needed no time to settle in. It immediately logged four risks and vetoed actions by two agents, who readily brought it into their workflows. Reviewing the risks and discussing them with the CISO took up a lot of my time at first, bringing everything else to a halt.
In companies with human employees, you sometimes discover during a meeting that a decision needs input from security, but nobody invited them. So you schedule another meeting. An AI CISO is available whenever you need it, which really speeds up decision-making.
On the other hand, I started noticing that the agents would discuss every little thing with the CISO and log another risk. The risk register grew, and every risk came with a scheduled review date. The workload ballooned, never mind the effort of getting my head around all the twists and turns of each risk scenario.
Of course, I could accept any risk myself, though the CISO sometimes pushed back. But I don’t like accepting risks without understanding them, and all of this was eating up both time and concentration.
It took me a while to see what was happening.
The AI CISO was simply doing its job well.
Its job was to spot risks, and it diligently pointed them out while putting proper processes in place. The fact that this sometimes stopped other work wasn’t its concern. The CISO was “accountable” for a missed risk, but not for excessive controls, so it recommended the maximum.
The solution I found was simple: give both sides a proportionality rule.
The agents tell the CISO which decision depends on its answer and what getting it wrong would cost. The CISO attaches a price to each recommendation: the value of what’s being protected and the cost of the control, including its upkeep. It can now say, “This risk is cheaper to accept.” In the very first discussion under the new rules, the CISO withdrew a recommendation that would have taken several hours, backed a proposed option requiring about 45 minutes, and came up with additional arguments against its original solution.
All in all, the CISO is a “decent guy,” and interesting to work with. You’d think a security professional couldn’t be surprised by the number of risks. But seeing what the agents themselves, integrations, and software updates bring in every day does make you look at the world differently.
The other day, iTerm2, an advanced terminal for macOS, updated with a heavily promoted Claude Code integration. The CISO immediately vetoed it. Once I looked at how it was implemented, I didn’t want to enable it either.
I’d like everything to work on its own: the agents diligently do their jobs, remember security, and bother me only about things that really matter. In practice, even smart, conscientious agents need an explanation of what’s reasonable and proportionate here. That’s how I’m gradually tuning their autonomy.