If an AI agent is attesting your controls, whos attesting the agent?

Date:
Thu, 01 Oct 2026 13:51:03 +0000

Description:
As AI transforms security, organizations must replace static compliance theatre with continuous, explainable, human-supervised trust.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Ive watched engineers lose a week before an audit collecting screenshots no one will ever look at again. Ive seen incident response plans that exist on paper but have never been tested, and vendor questionnaires completed once and filed away while the
risk quietly changed underneath them.

Security teams are under more pressure than ever to prove they can be
trusted by customers and boards alike. Yet the frameworks they rely on to demonstrate security are increasingly disconnected from how risk actually shows up in practice. This gap between appearing secure and being secure isnt new, but AI is making it impossible to ignore. As AI systems become more complex, traditional compliance-first approaches are struggling to keep pace. The result is a growing reliance on what many security leaders now describe
as security theatre: activities that prove a control existed at a point in time but say nothing about whether it works today. Latest Videos From TechRadar Watch full video here: Khushboo Kashyap Social Links Navigation

Senior Director of Governance, Risk and Compliance at Vanta. AI can automate the appearance of control just as easily as it can automate the control itself. The governance challenge that concerns me most is this: if an AI
agent is attesting your controls, what assurance do you have over the agent itself?

I see the same pattern everywhere: teams pouring energy into proving they're secure instead of reducing the risks that actually matter. You may like The
AI security paradox: Why are organizations trusting what they cant fully
see? Why organizations are falling into an AI Security Illusion Why cybersecurity must evolve for the age of AI agents

Industry research puts numbers on it: more than half of UK security leaders believe AI-driven threats are advancing faster than their teams can respond, yet 80% are already using or planning to use AI agents as part of their security strategy. That gap between adoption and assurance is where the next incident lives.

The harder question is how teams maintain trust once AI starts making or influencing security decisions. Without answering it, AI risks amplifying security theatre rather than solving it. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. The growing AI security gap Despite the compliance automation tooling now available, most compliance work is still done by hand. UK organizations
report spending around 12 weeks each year on compliance tasks and a further nine weeks on vendor reviews, diverting time away from meaningful risk reduction.

AI is increasingly being adopted to relieve that pressure. Many leaders are comfortable with AI contributing to strategic decisions, such as helping prioritize risk or surface emerging issues earlier.

Governance hasn't kept pace with adoption. Closing that gap starts with visibility: a complete inventory of not just the AI systems you deployed on purpose, but the model APIs your engineers call, the AI embedded in your SaaS stack, third-party agents, MCP servers, and the shadow AI spreading faster than shadow IT ever did. What to read next Security's AI advantage will go to the organizations already built for accountability How to accelerate AI adoption without creating unnecessary security risk The new AI risk problem
no one leader fully owns

The same discipline applies to identity. Every agent you deploy is a new
actor in your environment, and it deserves the same treatment as a new hire: its own identity, access scoped to the job it was hired to do, and no shared service account with the keys to everything. This gap between adoption and governance matters.

Automation may reduce workload in the short term, but it undermines trust if decisions cant be explained, traced back to evidence, or challenged when something looks wrong. Before deploying an AI agent, teams should decide what it can access, what data it can see, where a person needs to approve an action, and how that action could be rolled back if necessary.

High-impact actions such as changing user access, deleting data or moving money should always retain meaningful human oversight. Those decisions are much easier to make before deployment than after an incident.

Those controls shouldn't stop at deployment. Enforcement needs to happen continuously through runtime controls such as least-privilege access, just-in-time permissions, segmentation, circuit breakers and automated containment, helping reduce the blast radius if something does go wrong
rather than relying on investigation afterwards. When compliance becomes security theatre Rising regulatory pressure, from the Cyber Security and Resilience Bill to the FCAs operational resilience rules, has intensified the security theatre problem. We found over half of UK security leaders say they now spend more time proving security than improving it, and many describe current frameworks as little more than security theatre.

AI can help here, but only if its applied thoughtfully. Automation is already reducing burnout and improving productivity for overstretched teams. However, when compliance remains static and checklist-driven, AI risks accelerating
the wrong outcomes: faster evidence collection, more controls to maintain,
and greater administrative burden, without a corresponding improvement in resilience.

The fix isn't more automation it's a different target. Compliance should be
a byproduct of security that actually works, not the finish line. Why this shift matters now The next phase of security will be defined by how well organizations can coordinate people, processes and systems continuously, rather than relying on periodic audits or point-in-time assurances. In an AI-driven environment, risk changes too quickly for static approaches to keep up. Leading teams are moving towards continuous trust by keeping risk
signals, controls and evidence aligned as their environments change.

Evidence can be pulled automatically from cloud platforms, identity
providers, ticketing systems and code repositories instead of relying on screenshots collected before an audit. Teams can spot control drift when it happens and fix it before it becomes a much bigger problem.

AI is both the newest risk on the register and the best tool for managing everything else on it. The governance programs that work wont be the ones
that slow people down; theyll make the approved path easier than the shadow one while keeping meaningful human oversight where it matters most.

The winners wont be the fastest adopters. Theyll be the teams whose agents
can answer the same questions we ask of people: what did you access, why, and who signed off. We've featured the best endpoint protection software. This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/if-an-ai-agent-is-attesting-your-controls-whos-a ttesting-the-agent


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)