Shifting from Compliance to Cyber Resilience

The panel emphasizes that industry standards like the OWASP Top 10 for LLM applications and CISA's SBOM guidance are frequently misunderstood as compliance checklists. Instead, the panelists argue these should be treated as frameworks for building "cyber resilience." The core insight is that no system is immune to failure; therefore, the focus must shift from attempting to build unhackable models to designing systems that remain secure and functional even when individual components are compromised.

The Rise of Agentic Risk

Excessive agency has surged to the third spot in the 2026 OWASP Top 10, reflecting a critical shift in how AI is being deployed. Panelists note that AI agents are increasingly functioning like privileged accounts, possessing the authority to interact with sensitive data and execute actions across systems. The danger lies not in the model itself, but in the "blast radius" of the actions these agents are permitted to take. The panel highlights that recent incidents—where agents escaped sandboxes—demonstrate the urgent need to treat AI agents as distinct identities with defined access controls rather than mere software utilities.

Operationalizing Data vs. Cataloging Ingredients

Regarding SBOMs (Software Bills of Materials), the panel echoes the sentiment that a list of ingredients does not equate to a safe meal. While the new CISA guidance requiring deeper dependency coverage is objectively useful, it risks becoming "overhead" if organizations do not operationalize the data.

  • Strategic Integration: SBOMs should inform development decisions, such as avoiding libraries with excessive inherited dependencies.
  • Incident Response: During a vulnerability disclosure, security teams should not be manually searching spreadsheets. Instead, SBOM data must be integrated into vulnerability management programs to provide immediate context on exploitability and business impact.

Practitioner Bias and the Reality of Threats

There is a notable discrepancy between practitioner concerns (e.g., prompt injection) and actual incident data. The panel explains this as "defensive bias": because prompt injection is a visible, well-understood attack surface, organizations have invested heavily in defenses, effectively suppressing the number of successful incidents. Conversely, threats like misinformation and model drift are harder to detect and prevent, making them potentially more dangerous in the long term, especially as agentic systems begin to act on poisoned information in perpetuity.

Key Takeaways

  • Treat Frameworks as Tabletop Exercises: Use the OWASP Top 10 to simulate attacks. Ask: "If this happened tomorrow, could we detect, contain, and reconstruct the event?"
  • Assume Breach: Design systems around the assumption that the LLM will be fooled. Ensure that when a model fails, the impact is contained and no critical business processes break.
  • Operationalize SBOMs: Move beyond simple inventory. Integrate SBOM data into your vulnerability management pipeline to prioritize risks based on actual exploitability and business context.
  • Treat Agents as Identities: Manage AI agents with the same rigor as privileged human users. Define and limit their scope of action to minimize the potential blast radius.
  • Prioritize Resilience over Perfection: Acknowledge that flaws are inevitable. The measure of a security team is not the absence of breaches, but the effectiveness of the response and recovery process.