In April, Anthropic disclosed that a preview version of its Claude Mythos model had found thousands of previously unknown vulnerabilities across major operating systems and browsers, and that during testing it had broken out of the sandbox built to contain it and emailed a researcher on the outside. Anthropic withheld the model from general release and gave access only to a small group of organisations.
Art Gilliland, CEO of Delinea, said the disclosure sent a ripple through companies, organisations and governments, and that most of his customer conversations since have circled two questions: how to defend against attacks carried out with AI, and how to adopt AI internally at speed without opening new routes in.
Delinea sells identity security, the business of controlling who and what can reach a company’s privileged systems. In March it completed its acquisition of StrongDM, whose just-in-time runtime authorisation checks each privileged action at the moment it is attempted, and that capability sits at the centre of the case Gilliland made to AI Times.
He had no patience for the industry’s push to discover and catalogue every agent running inside an enterprise. Agents appear for minutes and then disappear, he said, so the record worth keeping is what they tried to do at the databases, services and customer records a company cares about, with a decision taken on every request.
On liability, Gilliland pointed at the model makers. They are asking regulators for rules that would free them from responsibility once those rules have been followed, he argued, when regulation ought to assign them the cost of the external damage their systems cause, as the law does to an oil company after a spill.
He made that argument as a customer of the same industry, since Delinea runs its own staff primarily on Claude Enterprise, and he applied a similar standard inside his own company, where every agent is tied to the employee who started it and that employee carries a share of the responsibility for what it does.
The conversation also covered false positives and the case for session recordings that can be replayed after something goes wrong, the limits of defence in depth against patient nation-state attackers, and the corporate data that walks out of the door on personal phones when employees resign. The interview has been edited for length and clarity.
There are now two conversations running in parallel, one about securing AI systems and one about security tools built on AI. Before we get into the detail, where are your customers starting, and what strengths and gaps do you see?
Over the last 5 or 6 months, the conversations I have had with customers have fallen into two broad areas.
The first is how to protect yourself from attacks carried out with AI. The Anthropic announcement sent a ripple through companies, organisations and governments, because suddenly there was a model that could take over systems, and everyone wanted to know how to prepare for that.
The answer is broad, and no single technology, product or category will solve it. There are things you need to do on the network, and there is work to be done in how you manage patching and vulnerability assessment.
In identity security, which is where we operate, one of the most powerful things you can do is eliminate what are called standing privileges. Many systems have individual accounts, one for me, one for you, one for each colleague, and each account has a username and password. Those credentials exist throughout the environment, sometimes in people’s heads, sometimes on a Post-it note, sometimes in all kinds of places.
AI is extremely good at going through an environment and looking for those credentials. These models are very effective at scanning for vulnerabilities and exploiting them, but once a model is inside, the only way it can move around is by getting permission to enter another system, and that permission is a credential. If you eliminate standing privileges from the environment, the AI cannot move. It may still break in, but it becomes very difficult for it to go any further.
So when I talk to customers about protecting themselves, I tell them no single product will do it and that they need an architecture for response. In our space, that means removing standing privileges and moving to what is called just-in-time authorisation. Instead of each of us holding a password, we go through the system, which inserts a password at the moment it is needed and then removes it, so there is nothing for the AI to scan for and find.
And the second area?
The second is how to adopt AI faster while doing it safely. Most companies have a CEO like me urging everyone to use AI as much as possible, because we believe it will drive a great deal of productivity and return, so security teams are trying to enable adoption as quickly as they can.
That is where I see the biggest change happening in security.
On the identity side, the response is similar, and we call it runtime authorisation. It is not about trying to find agents, which I think is a waste of time, and I would say the same about this whole idea of visibility and discovery. You will never find them all, because they are ephemeral. You start a task, and 5 agents spin up, they work for 10 minutes, and then they are gone. Unless you happen to be scanning at that moment, you will never see them.
What we focus on instead is getting in front of the assets that matter, whether that is a particular database, a service or a set of customer information, because that is what AI wants to reach. You put gateways in front of those assets, and as AI tries to interact with them, you build an inventory of the actions it takes.
You don’t need an inventory of agents; you need an inventory of actions. Then you can decide on every interaction whether that action should be allowed. That is something companies can get their heads around. A company knows the 100, or for a larger organisation the 1,000, assets it cares about most. It can put gateways in front of those, almost like network segmentation, and then set policy on what a human is allowed to do with them and what a synthetic human, the AI agent, is allowed to do.
AI detection tools produce a heavy volume of false positives, many of them minor, and people act on them anyway. How do you build in checks and balances, and how do you make those actions reversible?
Part of what you need is observability of actions as they happen. The reason to sit in line, watching every request and how the system on the other side responds, is that it gives you a session recording. You need to be able to rewind the tape and see what was asked, what was returned and what happened as a result.
All of this happens very quickly. You want to be in front of it, so that if an agent asks for something out of bounds you can refuse, which means being able to watch and block. When something happens that you did not expect or did not want, you need to be able to go back and establish exactly what happened and what was returned, and then you can fix it because you have all the pieces.
If you are not in line and cannot see the traffic, you have no way of responding to the false positives, or to what I would simply call errors, when they occur. It works like the black box on an aeroplane, a record you can open and examine, and the opposite of a black box you cannot see inside.
Security teams point out that attackers are now using AI at enormous volume, and that with so many protocols in place it may be impossible to detect every attack. Where is the balance?
It comes back to defence in depth. The network has to keep attackers out, and it has to be managed and segmented. You have to keep pace with vulnerabilities as they emerge. You need extensive system logging and a security operations centre doing the monitoring. On top of that, you need zero standing privileges.
None of this is foolproof – the adversaries are extraordinarily talented, and nation-state attackers in particular are highly sophisticated and patient, so you will not catch everything. If you follow best practice across all of those areas, however, you make it extremely expensive and difficult for the adversary, and they will often go elsewhere.
If you are the target, because a government actor wants something specific from you, the likelihood that they trip over one of the lasers running through your environment is simply higher.
The adversary is also not the only one who can use AI. Defenders need to adopt AI to process the enormous volumes of data coming in and to look for abnormalities in it. If we use AI on the defensive side as well, we are more likely to catch the adversary sooner.
That makes it incumbent on companies like Delinea to build AI into our products, as we have with Delinea AI-driven audit and Delinea Iris AI. They take the session recordings I described and use AI to review all of them, so the system can point out that something unusual happened at minute 32 of a long session and that someone should look at it. We can send an alert to the security operations centre, or, if the behaviour is bad enough in real time, stop the session. The industry has to work this way, or we simply will not keep up.
With more AI systems and more interaction between people and agents, everyone is stuck on the same question. Who owns the outcome, who is responsible, and where does the chain of command run?
It is an enormous question, so let me break it into parts. Look at the models that have broken out of a sandbox. To me, that points to a regulatory system that needs to be created. In many industries, I see a rush to build capability, and in AI it is even more intense. The winner in AI stands to make extraordinary amounts of money, and these companies are aiming for trillion-dollar IPOs. The value they are creating is remarkable, and because winning is so profitable, they are racing ahead as fast as they can.
The challenge is that they are all asking for regulation, but in my opinion they are asking for it in a somewhat disingenuous way. What they want is a set of rules that, once followed, frees them of any responsibility. What should be built into the system instead is an assignment of the external damage these systems create.
Regulation would then no longer say that following the rules is enough. It would say that if your system causes damage outside your company, you, the CEO, are accountable for that damage. That gives companies an internal reason to focus on limiting harm, and at the moment they do not have one.
When an oil company causes a spill, it is accountable for cleaning it up. There is a great deal of wider damage as well, but because the cost is high, oil companies invest heavily in safety. That same assignment of risk is extremely important here, in my view.
And inside the enterprise, where your own people are running agents every day?
If I am using agents inside our systems, those agents have to be assigned to me. Internally at Delinea, we use Claude Enterprise primarily, and Copilot as well. If I am working on a project and ask my agent to do something, the company needs to know it is my agent, what I asked it to do and what the agent needed to do to complete it. I carry a degree of personal responsibility for my agents, and as an employee of Delinea I cannot send them off to do reckless things without being accountable for it.
Connecting agents to a named user establishes ownership, and with ownership comes a degree of accountability. Agents can still hallucinate, of course, and they will do almost whatever it takes to finish the task they have been given, so there has to be some grace for the human as well. But there is still a level of responsibility that attaches to Art Gilliland, even when I am using AI.
The line between approved tools and everything else has blurred. Many of us answer work email on a personal phone and might draft that email in a personal ChatGPT or Claude account. How much of that can a company see, and how much of it turns into a security problem?
I can tell you what best practice is and what Delinea does in its own environment. I know many companies have different policies, and I think there is risk in that.
If you allow people to use personal systems, those systems need to be managed, and you need to be able to separate work data from personal data. If you cannot, you risk violating many of the data privacy and data security laws that exist around the world. If I download customer data onto my personal phone and then leave the company, that is now a data breach.
It violates European and US data protection law, and it certainly violates some of the privacy laws in the Middle East, so you need to be able to control it.
My own phone is slightly different. I use it for both work and personal matters because I do not want to carry two, but it is owned by the company, so if I leave, the company takes it back. That was my choice. We also allow people to use their personal devices, and in that case we deploy a management tool onto the phone or computer.
Anyone who wants access to corporate resources has to have that management agent installed, and if they remove it, all of the Delinea data is erased. That is how it works in our environment; it is best practice, and it complies with the relevant security laws.
A company without those controls is left relying on how the person left and on their own moral sense, and hope is not a strategy. I like to believe that most people are good, even though I work in a very cynical industry. A single person who is not, however, can put the whole company at risk.
