The chief information security officer's role has expanded into territory that did not exist two years ago. Engineering teams across enterprise IT are writing software with AI coding assistants, spinning up agents that act on their behalf, and assigning those agents the same access privileges their human creators hold. The shift is changing what defenders worry about most, according to Hrvoje Englman, CISO at Span, speaking at the Span Cyber Security Arena conference.
Span's workforce includes a sizable population of developers alongside a larger group of engineers. The engineers are the new variable. With AI-assisted coding, they are building applications and personal agents to automate parts of their own jobs. Each new agent inherits the identity of its creator, and those identities are typically over-provisioned. Least privilege remains an aspiration that is hard to enforce in production environments.
Enabling secure AI instead of blocking it
"I cannot be the blocker," Englman said. "You cannot block progress. People will find ways around it." His priority is enabling secure use of AI inside the company rather than prohibiting it. That means setting guardrails, providing safe tools, and creating a culture where engineers can bring their experiments to the security team instead of hiding them. The approach acknowledges that shadow AI cannot be eliminated; it can only be made visible and less risky.
This position reflects a practical reality. Developers and engineers under pressure to deliver will adopt AI tools with or without security's blessing. A blanket ban encourages workarounds, often with consumer-grade tools that provide no visibility or control. By offering approved assistants, centralized logging, and clear policies, a CISO can at least see what is being built and who is using it.
The bus-factor problem multiplies
The risk extends beyond access control. When a single engineer automates a business process using five interacting agents and then leaves for another job, the organization inherits an undocumented system that nobody understands. Englman called this an inversion of the traditional bus-factor problem. Previously, a key person leaving created a knowledge gap. Now the agents they built keep running, and the company has no record of what they do or why.
The original bus-factor concept asked how many team members would have to be hit by a bus before a project collapsed. It was a measure of knowledge concentration. In the AI era, the equation has changed. A single person can create a sprawling digital workforce that outlives their employment. If no documentation exists, the agents may continue performing actions with the departed employee's credentials, triggering alerts, modifying data, or interacting with external services. Untangling that mess is far harder than replacing a human subject-matter expert.
Organizations now need to treat agentic workflows as production systems that require design reviews, inventories, and retirement plans. Security teams must be able to audit what an agent does, revoke its access when necessary, and ensure that the human who created it is not a single point of failure in a new, more dangerous way.
Defender's leverage is real, with limits
AI has produced concrete gains in defensive work. Englman pointed to log analysis as one area where the value is immediate. Feeding hundreds of megabytes of log files into an AI tool and asking it to surface anomalies or pivot on an IP address compresses work that previously took analysts hours. Policy drafting is another use case. Generating a first draft from internal context can cut a three-day task to a single day, and the time savings compound across a workforce.
These gains are not theoretical. Security teams are already using large language models to triage alerts, summarize threat intelligence, and translate complex detection rules into plain language. The key is knowing where the technology is dependable and where it is not. Log analysis benefits from the model's ability to find patterns across huge datasets, but it still requires a skilled human to interpret the results and decide on action.
Englman drew a sharper line on the vendor pitch for autonomous AI-driven security operations centers. The idea of defensive AI battling offensive AI in real-time, with no humans in the loop, does not match what is achievable now. Log ingestion remains the hardest part of running a SOC, and detection engineering still depends on people who can explain why an alert fired.
"You get an alert, but your analyst doesn't understand the alert," Englman said, describing the failure mode he sees in teams that lean too heavily on automated tooling. "And you have two million alerts, and then what?" Autonomous isolation of systems remains out of reach because the AI does not understand the business process. Decisions about when to shut down a critical service get escalated to senior leadership during real incidents, and that judgment stays with humans.
The gap between vendor promises and operational reality is significant. A SOC that relies on AI to correlate alerts still needs robust data pipelines, clean logs, and humans who can determine whether an anomaly is benign or malicious. Automation can reduce the noise, but it cannot replace the context that comes from knowing the organization's risk appetite, compliance obligations, and business priorities.
The threat model for a services provider
Span sells IT services to enterprise clients, which doubles its exposure. The company is a target in its own right and a target for attackers seeking access to its customers. A typical end-user organization can absorb a breach and recover. For Span, the response itself becomes the product on display.
Englman said the company has to be able to demonstrate that controls were in place, that the failure was contained, and that the incident was handled with the same discipline it offers customers. Reputation is what gets sold, and negligence would end the business.
This distinction shapes every security decision. A services provider cannot simply say it was attacked; it must show that its detection and response processes are mature enough to protect clients. That means continuous validation of controls, transparent incident reporting, and a willingness to learn from near misses. The trust of customers is an operational asset, not a marketing afterthought.
Skills shortage, restated
The widely discussed cybersecurity talent gap, in Englman's view, is misframed. Entry-level applicants are abundant. Senior practitioners with five or more years of operational depth are scarce, and that gap cannot be closed quickly through training programs. The Span Cyber Security Center has trained more than 3,000 people, and Englman said the pipeline matters precisely because the industry's push toward automated tooling threatens to eliminate the junior roles where future experts get built.
If automation removes the entry-level analyst position, how will the next generation of senior defenders learn the craft? The security industry has long relied on a progression from tier-one triage to incident response to threat hunting. That ladder is now at risk. Training programs can teach fundamentals, but they cannot replace the experience of working through real alerts, making mistakes, and developing intuition under the guidance of a seasoned mentor.
His measure for a SOC analyst centers on whether they can explain what the alert means and how the conditions that triggered it came about. Without that understanding, an analyst rolling a fifty-fifty guess on relevance is no better than a model doing the same. The value of human analysis lies in the ability to connect a suspicious event to the larger context: what systems are critical, what an attacker might be trying to achieve, and what business impact could follow.
Automation should augment that judgment, not substitute for it. The best SOC of the future will likely be a hybrid, with AI handling the grunt work of correlation and enrichment while humans focus on the decisions that require nuance. But if organizations eliminate junior analysts in the name of efficiency, they will find themselves hiring senior practitioners who no longer exist.
The wisdom he has discarded
Asked which piece of conventional security wisdom he has stopped believing, Englman named the framing of humans as the weakest link in the chain. He called it lazy and a form of blame culture. The responsibility, he said, sits with the CISO to build systems where a user clicking a malicious link does not bring the environment down. Brittle defenses that depend on perfect human behavior are a design failure.
This is a significant departure from the standard narrative. For years, security awareness campaigns have told employees to be careful, to think before they click, and to treat every email as a potential threat. The implicit message is that if breaches happen, it is because someone wasn't careful enough. Englman rejects that framing. Users will make mistakes, especially when they are juggling multiple priorities and deadlines. The security architecture should assume that mistakes will happen and be resilient enough to contain them.
Instead of blaming individuals, CISOs should ask why a single click can escalate into a full-blown compromise. Why are credentials over-privileged? Why is lateral movement so easy? Why are critical systems reachable from a compromised workstation? Answering those questions is hard work, but it is the work that protects the organization.
The same principle extends to AI agents. If an agent inherits excessive permissions, the fault lies with the identity and access management design, not with the engineer who created the agent. A culture that blames people for falling victim to a phishing email will not encourage the openness and reporting that make an organization more secure. Psychological safety, not fear, is what leads to early detection and rapid response.
Source:Help Net Security News