Maman Ibrahim

expert panel

AI agents are quickly moving from helpful assistants to active participants in business workflows, and that shift is creating a new access-control challenge for security leaders. To do their jobs well, these systems often need to interact with customer records, financial systems, employee data, proprietary information and other sensitive resources. That creates a difficult balance: The more access agents have, the more useful they may become—but the more damage they can do when something goes wrong. And that risk isn’t theoretical. A 2025 IBM report found that among organizations that experienced an AI-related breach, 97% lacked proper AI access controls, and 63% had no AI governance policies at all.Traditional access models weren’t built for autonomous tools that can act across systems, make rapid decisions and process large volumes of data in seconds. When convenience trumps safety in AI adoption, loose access can expand an organization’s attack surface before security teams can assess the risk. As AI agents become more embedded in daily operations, organizations need to think differently about identity, permissions and accountability. Members of the Senior Executive Cybersecurity Think Tank bring deep expertise in enterprise cybersecurity strategies, data breach prevention, risk management and modern security architecture. Below, five of them share how leaders should weigh the trade-offs of AI agent access and rethink permissioning for AI-driven systems.

expert panel

Agentic AI systems are designed to operate autonomously to achieve a goal, interpreting objectives, selecting tools, executing multistep tasks across systems, and adapting their approach based on intermediate results. Unlike traditional software that follows fixed instructions, agentic AI can make decisions, delegate to other agents and take actions with real-world consequences, often with minimal or no human intervention at each step.Enterprises are adopting agentic AI at a rapid pace, drawn by its ability to compress complex workflows ranging from IT operations and software development to customer service and financial processing. These automated pipelines run faster and at a greater scale than human teams alone. But that same autonomy introduces a security challenge that conventional frameworks weren’t built to handle.Traditional access controls were designed around a simpler premise: Verify the user or system, then permit or deny the action. In agentic environments, that model breaks down. An agent may be fully credentialed and operating within approved systems yet still drift into behavior that no one explicitly authorized. That’s why intent-based security is quickly becoming a core consideration for enterprise AI adoption. For security leaders, the challenge is building controls that are strong enough to prevent harm without slowing the very automation they’re trying to enable. Members of the Senior Executive Cybersecurity Think Tank have deep expertise in enterprise cybersecurity strategies, risk management, regulatory compliance, and modern security architecture. Below, three of them discuss why intent matters in agentic environments and which runtime signals and safeguards leaders should prioritize as autonomous systems become more deeply embedded in business operations.

expert panel

A code audit might catch a misconfiguration before it ships. A penetration test might expose how a real attacker could chain vulnerabilities together. A bug bounty might surface something neither effort ever would have found. Each of these exercises brings value, but each one only shows part of the picture at a moment in time. But software risk constantly grows and changes as systems, dependencies, attackers and business priorities evolve. Security gaps often live where handoffs break down: between development and release, between internal teams and external researchers, and between finding a problem and implementing a fix. And as AI supercharges the speed at which vulnerabilities can be found, patching cadence matters more than ever. When teams design a security program in which code audits, pentesting and bug bounties reinforce one another across the entire software lifecycle, they’re better positioned to find issues early, prioritize what matters and build safer products without bottlenecks and delays. Moving from point-in-time testing to continuous improvement requires both structural changes and cultural ones, including how findings are tracked and how engineering and security teams collaborate day to day. Below, members of the Senior Executive Cybersecurity Think Tank share what they’ve learned about integrating code audits, pentesting and bug bounties into a security program that keeps improving with every test, fix and release.

expert panel

When they think about cyberattacks, most people likely picture a shadowy human adversary probing a network, finding a crack and then manually extracting valuable data. Even though such attacks have been all too common, there was some comfort in the idea that defenders had time, however limited, to detect anomalies and respond. That window may now be closing. Anthropic’s disclosure of a September 2025 breach marked a watershed moment in cybersecurity: Attackers deployed agentic AI to both design and execute the intrusion. As one of the first documented cases of unprecedented AI involvement in a cyberattack, it’s an early sign of a looming threat leaders can’t afford to ignore—AI agents that can recon, adapt and escalate an attack without a human in the loop.  While AI can’t carry off an attack completely on its own (yet), it’s already helping hackers pinpoint vulnerabilities and write malicious code. The cybersecurity vulnerabilities autonomous systems target aren’t necessarily new. Misconfigured services, overprivileged accounts and weak identity controls have topped security risk lists for years. What’s changed is the pace and persistence with which these gaps can now be found and exploited—continuously, simultaneously and at machine speed. That puts enormous pressure on defenses that were designed around human-paced threats. Members of the Senior Executive Cybersecurity Think Tank have extensive experience and deep experience in enterprise security strategy, zero-trust architecture, threat detection and cybersecurity leadership. Below, two of them break down the vulnerabilities autonomous systems are likeliest to probe—and detail the defensive models companies need to build before they’re put to the test.

expert panel

Employees will always find the fastest path to getting work done, even if it bypasses important digital protections. A quick snippet gets dropped into an AI assistant. A file is shared through a personal browser profile. Sensitive data now leaves enterprises every day through copy-paste—often into unmanaged AI tools, browser accounts or chat apps. The biggest cybersecurity risk for businesses may no longer be sophisticated hacks but “convenient” shortcuts. Employees aren’t trying to undermine policy. When official tools feel slow, clunky or restrictive, people improvise. Faced with a deadline or a long to-do list, they likely see these bypasses as harmless—they may even congratulate themselves on their efficiency. When these informal shadow workflows become the real operating model of a business, they not only increase cybersecurity risk but also signal costly friction in official processes. The question is not how to eliminate human shortcuts but to build better, more secure processes your team won’t want to bypass. That means understanding how work really gets done and building secure defaults into the tools employees already prefer.  Members of the Senior Executive Cybersecurity Think Tank have deep expertise in enterprise cybersecurity strategies, risk management and modern security architecture. Below, two of them discuss how leaders can rethink informal workflows—not as nuisances to stamp out but as intelligence to design smarter, more human-centered defenses.

expert panel

Remote and hybrid work haven’t just changed where many of us work; they have expanded the cyberattack surface and reshaped the ways risk moves through an organization. Laptops hop from kitchen tables to coffee shops. Sensitive files live in the cloud. Slack messages replace hallway conversations. While this flexibility is a win for professionals and, often, a catalyst for enhanced productivity, remote work also gives cybercriminals more chances to slip inside a company’s digital defenses. Most costly cybersecurity incidents don’t start with elite hackers battering down firewalls. They start with everyday employees making very human mistakes. Remote workers may hesitate to “bother” the IT team with questions or concerns, or asynchronous schedules may mean a wait for expert help. Home networks may not have the robust protections of those in an office setting. Cybercriminals are very aware of the vulnerabilities that come with remote work, and they’re taking advantage: In 2025, 78% of organizations with remote staff reported experiencing at least one security incident related to remote work.  Teaching all staff how to recognize threats and follow basic digital hygiene is now foundational risk management; every employee is part of the security stack, whether they know it or not. That reality leaves many leaders asking a practical question: What should every employee actually be taught—and required—to do? And how can executives without a cybersecurity background cover the essentials without killing the flexibility that makes remote work attractive and effective?  The members of the Senior Executive Cybersecurity Think Tank specialize in enterprise cybersecurity strategies, data breach prevention and risk management. Here, two of them cut through the jargon to focus on remote and hybrid cybersecurity fundamentals that scale, habits leaders can model, and simple expectations that significantly reduce risk—no computer science degree required.

expert panel

Quantum computing is poised to quickly turn a mindset of “we’re in good shape right now” into “why didn’t we start preparing sooner?” This is especially true when “now” refers to the encryption protecting customer data, intellectual property and the secrets a company’s board assumes are safe. Today’s widely used public-key systems were built for classical computers. A cryptographically relevant quantum machine could change the math fast, potentially wiping out the protections built over years of security planning. That’s why the quantum conversation is shifting from tech experts’ speculations to plain business risk management. Data has a shelf life, and for a lot of organizations, it’s a long one. Contracts, health records, financial history, M&A documents and source code don’t become innocuous just because the quarter ended. Add in the “harvest now, decrypt later” reality—adversaries collecting encrypted traffic today and unlocking it later—and the timeline to address quantum risk shrinks. The urgency is also being reinforced by credible signals that the transition is already underway, including NIST’s finalized post-quantum encryption standards. The good news is that organizations don’t need a quantum lab to start getting ready. But they do need clarity on where cryptography lives, how quickly it can be upgraded without breaking business processes, and who owns the decision-making when trade-offs emerge. Here, members of the Senior Executive Cybersecurity Think Tank weigh in on what organizations should do now to assess cryptographic vulnerabilities and build real crypto agility. 

expert panel

AI-powered browsers are quickly becoming co-pilots that can read, reason and sometimes even act on a user’s behalf. Professionals may be especially tempted to turn to AI browsers because they make work feel faster and smoother, especially when someone is juggling research, analysis or repetitive tasks. The promise of instant summaries, automated workflows and fewer clicks can be hard to resist.  However, cybersecurity experts are increasingly raising red flags concerning these tools’ security weaknesses. While their capabilities are impressive, AI browsers open up a fresh class of risks that traditional safeguards weren’t built to handle. Indeed, a recent Gartner report recommends businesses block AI browsers for the foreseeable future.  The members of the Senior Executive Cybersecurity Think Tank bring years of experience to this timely topic. With expertise in enterprise security, regulatory compliance and threat detection, they’re watching the evolution of AI browsers with a blend of anticipation and concern. Below, two of them explain the unique risks these systems introduce and the essential precautions all stakeholders—developers, regulators and end users—must take as AI-powered browsers gain traction in both enterprise and personal settings.

expert panel

Data protection rules are tightening faster than most executive teams can update their playbooks. California has approved new regulations requiring risk assessments and cybersecurity audits for many businesses, and the SEC has rolled out new cybersecurity disclosure requirements that raise the stakes for boards and C-suites. Globally, companies face tightening scrutiny, and the penalties for missteps can be steep: GDPR violation fines exceeded €3 billion in the first half of 2025 alone. For business leaders already juggling digital transformation, AI adoption and sprawling data ecosystems, managing incoming (and ongoing) waves of cybersecurity rules and regulations can feel overwhelming. But the real danger isn’t just the number or complexity of new rules—it’s the blind spots leaders don’t realize they have. From siloed security and shadow IT to hidden vendor vulnerabilities, many organizations have all the warning signs of an incoming compliance headache. As experts in enterprise cybersecurity strategies and regulatory compliance, the members of the Senior Executive Cybersecurity Think Tank know where leaders most often overlook risk—and why regulators tend to focus on those areas after a breach. Below, three of them share what executives should prioritize now to stay compliant and resilient and avoid costly surprises down the line.

expert panel

Third-party technology tools promise efficiency, scale and all the digital bells and whistles execs need to keep productivity humming and power growth—but not all tools are created equal. Cloud platforms, SaaS productivity suites, niche workflow apps and industry-specific managed services can all introduce unseen risk when they plug into core systems. However, in many companies, third-party risk management continues to fly under the radar—even though 30% of enterprise data breaches involve a third party. From misaligned encryption standards and unclear data flows to vendors that treat compliance like a box-checking exercise, there are significant risks that can come with working with third-party vendors and SaaS tools. As experts in enterprise cybersecurity strategies, data breach prevention, risk management and regulatory compliance, the members of the Senior Executive Cybersecurity Think Tank know that to operate on trust when working with tech vendors is to court disaster. Below, three of them share the details to dig into before entering into a partnership with a third-party vendor or software provider.