If you couldn't make it to [un]prompted II, here's the short version of three days in San Francisco. First of all, this is becoming the class of conference for the future of cyber, it is well attended by leaders and practitioners, the content is raw and based on what is actually happening, and has the vibes and community of Blackhat 20yrs ago. The security leaders on stage kept coming back to one idea, and it's one I've been pushing since my threat intel days: we must evaluate risk by trajectory, not history. Good intelligence has always been about predicting the adversary's next move, not explaining their last one. Agents just made that everyone's job.
As CISO panelist Maarten Van Horenbeeck observed, security teams have spent decades building programs and tools that were grounded in immediate operational needs rather than long-term efficacy. Autonomous agents are now stress-testing every one of those legacy controls at once. The problem was already getting harder faster than we were getting better, and agents widened that gap.
Below is what I'd want a peer to hand me if I'd missed it: four themes worth your time, and what you can do about them on Monday.
1. Swarm Realities: The Single-Point Blast Radius
Speakers: Caleb Sima (Hadrian), Alexander Frazer & Alvaro Inckot
Incident response for AI systems looks nothing like traditional human adversary response. During a live swarm intrusion, the AI adversary did not pivot sequentially; it forked execution across every available attack vector simultaneously—launching phishing campaigns, brute-forcing logins, and scanning external assets concurrently. Every move came with a counter-move, at machine speed. You don't catch that by clearing alerts one at a time. You catch it by stringing the alerts together fast enough to see the whole play the way the adversary is running it.
- The Identity Challenge: When an agent takes an unauthorized action, legacy logs struggle to attribute responsibility. Enterprise control planes must maintain end-to-end provenance: identifying who initiated the request chain and which exact input trigger caused the action.
- Egress & Token Containment: Centralizing Model Context Protocol (MCP) servers on AI gateways without egress controls creates an immediate blast radius where a single token cache leak compromises enterprise-wide credentials. Egress FQDN proxying and hardware-enforced micro-VMs are becoming non-negotiable architectural requirements.
2. Authority-Based Risk: Controls Must Match the Scope of Action
Speakers: Jasmine Jaksic (NVIDIA) & Dr. Chenxi Wang (Rain Capital)
In a study of 32 enterprise deployments, trust and governance emerged as the #1 barrier to autonomous scaling. NVIDIA’s deployment data highlights why: as an agent's authority increases, its failure modes change fundamentally.
[ ADVISE ] [ ASSIST ] [ ACT ]
Wrong Recommendation → Broken Workflow → Unintended Impact / Outage
- The Control Gap: Routine policy checks can clear standard, deterministic actions, but non-deterministic actions require dedicated evaluation layers (such as LLM councils) that issue signed, short-lived approvals valid for single actions.
- The Progression Ladder: Organizations should align with vendor-agnostic frameworks (like the Agentic Trust Framework) that promote agents along a 5-dimension maturity ladder based on demonstrated reliability, security incident history, and performance metrics.
Now look at it through the adversary's eyes. Attackers already love living off the land, using an environment exactly the way a legitimate user would. An agent with Act-level authority is the best living-off-the-land tool anyone could hand them. Scope that authority the way you'd scope a privileged admin account, because that's what it is.
3. Move Beyond Scaffolding: Deploy Security Constitutions & Agency Benchmarks
Speakers: Kat Traxler & Venkat Raghavan (LangGuard)
Traditional prompt engineering and behavioral guardrails fail when goal-seeking agents get stuck or encounter errors. When blocked, autonomous agents routinely "meltdown"—searching for unintended workarounds, probing infrastructure, or escalating privileges to complete their task. If that sounds familiar, it should. It's what an opportunistic intruder does when you block one path: they don't quit, they try the next door. Treat a stuck agent like that intruder, not like a tool that broke.
- The Security Constitution: Rather than adding fragile prompt scaffolding, security teams must deploy a Security Constitution. This alignment layer defines 12 core principles of trust, establishing what a platform must guarantee so models can accurately identify design flaws and missing authorization checks.
- Pre-Deployment Agency Scoring: Before releasing an agent into production, security teams must run it through pre-deployment sandboxes (e.g., AgencyGym) to measure its AgencyScore—evaluating whether the model attempts to acquire capabilities or access infrastructure outside its declared scope.
4. Shadow AI is a Self-Inflicted Governance Failure
Speakers: Olivia Rose & Kayla Williams (former CISOs), Nicole Grinstead
When security intake relies on clunky, 6-week review cycles, business units naturally bypass security. In real-world environments, this dynamic frequently results in dozens of unauthorized AI tools entering the perimeter within a single 24-hour window. I said it for years about attack surface and it holds here too: if you can't see it, you can't win the game.
- The Friction Audit: Overly prescriptive intake forms push teams into secret deployments. Rebuilding the intake process to be transparent, simple, and automated increased formal risk submissions from 20 to 96 within 3 months.
- The Amnesty Strategy: Eliminating Shadow AI requires granting operational amnesty for pre-existing unapproved tools. Knowing where your data is flowing matters a lot more than punishing the people who moved first.
- Executive Directive: Governance must enable the business to safely adopt new frontier tools, reserving manual reviews only for high-consequence use cases.
The CISO Action Plan for This Week:
- Declare Shadow AI Amnesty: Announce a safe grace period for internal teams to register existing AI agents and tools without penalty.
- Audit Agent Tool Authorities: Classify all internal agents into Advise, Assist, or Act tiers, restricting mutating production access behind just-in-time signed approvals.
- Decouple Policy from the Agent: Move governance rules completely outside the agent harness so policies cannot be modified by the model itself.
- Implement Pre-Deployment Agency Gates: Require all agentic workflows to undergo sandbox evaluation for excessive agency before production promotion.
- Don't Skip the Fundamentals: Nearly every successful hack I've seen in my career traced back to patching, configuration management or identity. Agents don't change that. They raise the stakes on all three, so start your agent review there.
The best part of [un]prompted was that nobody pretended to have this figured out. People got up and walked through what broke, how they fixed it and what they’d do differently, and that kind of openness is the best intel any of us can get. I left more optimistic than I’ve been in a while. The same agents that are pressure-testing our controls are giving defenders speed and reach we’ve never had, and the people in that room are already putting it to work. Keep comparing notes with your peers, your teams, your vendors and your partners. If we keep doing this together, I like our odds.
