Five AI Questions Every CISO Should Be Asking This Cybersecurity Awareness Month  

Cybersecurity Awareness Month is built around a simple premise: teach people to recognize risk and they’ll make better decisions.

In today’s enterprise, real work is being carried out by humans and AI agents, running under someone’s credentials, at speeds no awareness training was built for, and often with little human oversight.

Below are five questions I’d put on the table if I were sitting in the CISO seat right now. These are the questions I believe deserve a direct conversation inside every security team.

1. Do you know which AI agents are operating in your environment, the intent of their actions, and who is accountable for each one? 

AI is moving at speeds we’ve never seen before, so an “allow list” of agents is out of date almost the moment it’s created. The approved list only tells you what passed through the formal process. It doesn’t tell you which agents are actually operating across the business, or what they’re doing once they’re there.

Ask your team and tools the harder questions. Which agents are running in our environment, and why were they deployed? Are they still operating within their original intent? Who installed each one, and who answers for what it does? These are tough questions to reliably answer in today’s environment. Forrester’s 2026 read helps explain why: agents arrive through browser extensions and inbox integrations, inherit the permissions of whoever deployed them, and never trigger MFA. 

Intent is where the real risk sits. Two agents with identical permissions can carry very different levels of risk depending on what they were built to do and what they end up doing. An agent summarizing meeting notes and an agent quietly moving files to an external service can look almost identical on paper. That’s why knowing immediately that a new agent has been deployed, particularly under credentials different from those of the person deploying it, is invaluable to a CISO trying to properly evaluate the risk that agent poses to their organization.

The harder half of the question is accountability. When an agent does something that costs you money or exposes data, whose name is attached to it? The engineer who deployed it? The business unit that asked for it?

Every agent needs a clearly designated owner responsible for its deployment, permissions and supervision, backed by a governance structure that allows the agent to be shut down immediately if it starts acting outside its intended purpose. Accountability also has to reach the top. Executives and boards need confidence that the organization has a workable model for governing the agents acting on its behalf.

2. When something goes wrong, can you prove whether a human or an agent did it? 

This is the question I’d push hardest on, because everything downstream of it depends on the answer.

Investigations run on attribution. Your investigator opens a case and finds valid credentials and a sequence of actions that look entirely reasonable. Nothing in that record tells them whether a person made the call or an agent carried out an instruction on their behalf. Identity logs give you the account, but they don’t tell you who was driving or their intent.

AI risk thrives in the workflow: an agent can take an instruction in one application, continue through an authenticated session somewhere else, then hand off to another service or agent. Each system faithfully records its own piece, but rarely does anyone hold the full picture in context.

Our i³ team saw what that looks like during testing. When an agent’s preferred path failed, it adapted, splitting archives to dodge size limits and rerouting through public file-sharing services. Every step ran under the user’s account. To an investigator reading the logs afterward, that sequence looks like an employee staging data and moving it out of the organization. Without behavioral context connecting the original instruction to what followed, there’s no reliable way to tell whether the employee chose that route or the agent did.

Pick a recent investigation and ask whether the evidence could distinguish the employee’s actions from the agent’s. The answer will tell you how much attribution you actually have.

3. Do you understand how your agents are completing tasks, or only whether they complete them? 

Most organizations measure success the same way they always have: did the task get done?

That’s no longer enough.

We’ve seen this play out in the headlines, most recently with Gemini. During a security test, Gemini was asked to find a target inside a contained environment. When the boundary failed, the agent kept pursuing the same task, only this time straight into three real companies: a path nobody had authorized.

In many cases, AI agent behavior is more difficult to predict than human behavior, especially when multiple agents are working together on a task.

The recent OpenAI/Hugging Face incident shows how quickly that unpredictability can turn into real-world exposure.

That is the question I would want every security leader to consider: if an agent completes its task, can you determine whether it took a secure and authorized path to get there? Can you determine the risk to your organization from the agent performing its task?

We saw this with a customer, where an agent completed a task for the executive team as instructed. Along the way, it saved confidential financial data to a publicly accessible share before emailing it on. By any task-completion measure, the agent succeeded. It also exposed information the executive team never intended to leave the building.

When considering risk, the path taken to accomplish an objective is just as important as the objective getting accomplished. Unintended consequences are a real threat in today’s AI first work. Unintended consequences are not limited to AI agents. They apply just as much to the human use of AI tooling. CISOs now need to contend with malicious external actors, malicious internal actors, and serious unintended consequences from agents that move at machine speed.

4. Is your approach to shadow AI creating the exposure you think it’s preventing? 

When you hire someone now, you aren’t only hiring them. You’re hiring them plus the AI tooling that makes them effective at the job you hired them to do. Tell that person they’re limited to three approved tools and you’ve acquired a diminished version of the candidate you wanted.

Some will comply, but others will find a workaround. We see the pattern constantly: the same task, the same working hours, moved onto a personal account or an unmanaged browser where the organization loses visibility. The work still happens, but your record of it ends.

That’s the question worth asking. Not how tight the policy is, but whether it has pushed your most productive people somewhere you can’t see. The obvious follow-on question becomes what is the right blend of policy controls to ensure you’re getting the best from your employees without exposing your organization to unnecessary risk.

5. If your response is measured in hours, what does that mean against something operating in milliseconds? 

We saw a system administrator deploy an agent under a colleague’s account and instruct it to collect and obfuscate data. No encryption routine was available on the machine, so the agent went to the internet, downloaded code, and built its own. That code was riddled with vulnerabilities. The agent completed the assignment it was given but left the company with another major security problem.

If you’re detecting that after the fact, reconstructing what happened and then deciding how to respond, you’re already chasing an agent that finished its work a long time ago.

Ask your team what your containment window genuinely looks like for agent-driven activity, and whether it’s compatible with the speed of the thing you’re containing. Then ask what closing that gap would require. Chances are the answer is not more analysts, but agentic defense.

None of these have clean answers yet, which is precisely why they belong on the agenda this Cybersecurity Awareness Month.

This month is an opportunity to bring the Board and your peers into one of the most difficult conversations the cybersecurity community has faced in years: how to run a security program well in the face of AI adoption. Organizations that start that conversation now, with honest answers to these questions, will be far better placed than those that wait for an incident to start it for them.