AI agents are gaining access to enterprise systems faster than organizations can secure them. Many are operating with the same credentials and permissions as the humans who created them, introducing risks that traditional identity and access management wasn't designed to handle.
In this episode of the TPRM Podcast: Threats, Pitfalls & Risk Myths, Nate Lee sits down with Matt Chiodi, Chief Security Officer at Cerby, to examine what happens when autonomous AI agents have more access than they need, why prompts aren't reliable security controls, and how organizations can apply least privilege when they can't predict an agent's next move.
They explore the growing challenges of non-human identity, agent lifecycle management, and the need for independent security controls outside AI models. Matt also shares why security teams will increasingly need AI to oversee other AI systems, how CISOs can shift from managing technical activities to allocating investments based on business risk, and why vendor criticality should be measured by operational impact rather than contract value.
In this episode
- AI agents and identity: Why agents operating with human credentials create unnecessary risk.
- Least privilege for AI: How organizations can limit permissions when agents have unpredictable behavior.
- Prompts vs. security controls: Why instructions alone cannot reliably prevent unauthorized actions.
- AI governing AI: Why human oversight may not scale as organizations deploy thousands of agents.
- Threat modeling and testing: The importance of testing what agents can be manipulated into doing, not just whether they complete their assigned tasks.
- The evolving CISO role: Why security leaders should think like capital allocators and focus on measurable business outcomes.
- Third-party risk management: Why a vendor's ability to disrupt operations may matter more than its contract value.
- Lessons from cloud security: The security mistakes organizations risk repeating as AI adoption accelerates.
About the guest
Matt Chiodi is a cybersecurity executive with extensive experience in cloud security, threat intelligence, identity management, and enterprise risk.
He previously held security leadership responsibilities at Palo Alto Networks, overseeing security for its cloud division and the Unit 42 threat research organization. He is Chief Security Officer at Cerby, an identity security company focused on applications outside traditional single sign-on systems.
Matt brings a practical perspective on securing emerging technologies, helping organizations navigate the challenges of AI agents, non-human identities, and increasingly complex enterprise environments.