In this episode of the Cybersecurity Awesomeness Podcast, host Chris Steffen welcomes Aviv Nahum, CEO from Above Security, for a deep dive into agentic AI and the evolution of insider threats.

Steffen and Nahum explore how autonomous AI agents, operating on behalf of employees, are rapidly expanding the enterprise attack surface. With legitimate credentials and access to core platforms like Salesforce, Google Drive, and GitHub, these agents execute thousands of operations in minutes. When an agent misinterprets an instruction, hallucinates, or handles data without proper context, it creates severe insider risk—not out of malice, but through accelerated error and scale.

Referencing recent industry commentary from Microsoft CEO Satya Nadella framing AI agents as top insider risks, the pair discusses why security teams must extend traditional Insider Risk Management (IRM) frameworks to include these "synthetic insiders." Nahum highlights that securing these agents requires independent behavioral telemetry, contextual understanding, and verifiable evidence graphs rather than relying solely on black-box model safety or self-governance. Ultimately, the guests agree that while introducing autonomous agents presents novel risks, AI-driven investigation platforms simultaneously offer defenders an unprecedented ability to analyze insider behavior and intervene at scale.

In this episode of the Cybersecurity Awesomeness Podcast, host Chris Steffen is joined by his Enterprise Management Associates colleague and lead data analytics analyst Herb Blecher, for a deep dive into data integrity, semantics, and AI-driven governance.

Steffen and Blecher explore how modern organizations are leveraging AI to aggregate and report data for Governance, Risk, and Compliance (GRC) audits. However, they highlight a critical distinction: the underlying data is rarely flawed; rather, the AI model training, semantic definitions, and data aggregation often introduce dangerous inaccuracies—ranging from misinterpreted definitions (like the multifaceted meanings of "revenue") to the accidental exposure of sensitive PII. Blecher emphasizes that achieving reliable AI outcomes requires returning to fundamentals such as strict semantics, data lineage, and contextual guardrails. Ultimately, the duo agrees that while AI is a powerful force multiplier for operations and security orchestration, organizations must maintain rigorous validation and treat AI outputs with active skepticism to avoid costly fiduciary and operational missteps.

In this episode of the Cybersecurity Awesomeness Podcast, host Chris Steffen tackles the critical and fast-evolving question of AI liability: when an autonomous system fails, who is truly responsible? Steffen examines recent insights from regulators—such as FTC Chairman Andrew Ferguson's observation that "AI going rogue" is usually just poor human configuration—to argue that the defense of autonomous machine independence is rapidly disappearing.

Steffen highlights how three powerful forces are reshaping accountability: legislative updates like California's AB 316 barring "autonomous AI" defenses in civil suits, insurance carriers aggressively introducing absolute AI exclusions into commercial policies, and real-world edge cases ranging from autonomous vehicle mishaps to faulty customer service chatbots. Ultimately, he stresses that organizations cannot hide behind black-box technology; companies remain fully liable for the decisions, recommendations, and missteps of the AI agents they deploy.