As security leaders, we need to learn how to make decisions about the AI agents we deploy to do security work. The right decision can differ for two actions by the same agent, such as reading a mailbox and deleting mail from it.
You'll explore how to decide which actions each agent may take on its own, which need a person's approval, and who can stop the agent. You'll consider where you'd draw the line in five scenarios inspired by real cases. In one, an agent deletes a detection rule during a change freeze. In another, an agent that only needs to read email follows instructions that an attacker hid in a message. For each scenario, you'll see the trade-offs and the limits a security leader might set.
You'll leave knowing how to make these decisions for your security team's AI agents and how to capture them in a Security Autonomy Matrix.
Who should attend?
- CISOs and Senior Security Leaders: Leaders who own strategy, budget, and the security operating model
- Security Directors and Team Leads: Leaders who put the transition into practice within their teams
Learning objectives:
- Learn how to make decisions about the AI agents deployed for security work
This session supports concepts from the SANS LDR550: Leading Agentic Security Teams. To learn more, browse upcoming course runs, and access a wide range of free Cyber Defense tools and resources, Click Here!
