CISO Intelligence: The Agents Are Already Working. Nobody Is Sure Who Owns Them.
Two datasets arrived this week that, put side by side, describe the same gap from opposite ends.
The first is from Norforge, who went looking at the AI attack platforms the criminal market is using and found three of them still logged in, on the open internet, dashboards and all. The second is from IANS and Artico Search, who surveyed large organisations about who owns AI security and found that in fourteen to nineteen per cent of them, nobody does.
One side has operational tooling, shared infrastructure and an established method. The other has a job title that exists in two thirds of large firms and an accountability line that stops in mid-air. That is the asymmetry worth your attention this morning.
The attackers left the panel open
Norforge was following up on a Gambit Security report about criminals using AI harnesses against online retailers. They found something better than a second report: the operators of an open source AI platform called Cairn had left their control panels exposed.
Cairn is a general purpose problem solving engine that coordinates AI agents towards a goal, one step at a time, with each agent posting intents and findings to a shared blackboard. It was designed for research. It works perfectly well as an autonomous penetration testing engine, because the difference between those two things is a permissions boundary and a target list.
Norforge found three clusters of activity that look malicious. The largest uses Chinese language and runs over 1,100 attack projects across fourteen dashboards, aimed at e-commerce and payment infrastructure in the United States, Japan and Australia. Its goal appears to be persistent access to large platforms through webshells, for monetisation later. Targets were ranked by traffic and checked with Microsoft's Playwright browser automation before being handed to Cairn. Reuters named John Deere and SharkNinja among the victims, with more than a hundred companies breached across the operation.
The second cluster exposed ten panels, works in English, and goes after card and cryptocurrency theft from merchant payment services, grey-market payment sites and pharmaceutical platforms. Some of its targets are African commerce sites. The third ran fifty-nine projects against large American commercial platforms, chasing shell access, admin panels and databases.
Norforge puts the success rate at roughly ten per cent. If that sounds low, consider it in context. A ten per cent success rate against eleven hundred targets is a hundred and ten breaches, delivered by a workflow that runs without people, at a cost the operator can plan for.
The most useful detail is incidental. Hundreds of secrets sat in the exposed panel data, and eleven per cent of them verified as valid. Criminals harvesting credentials from badly configured panels, using tooling they did not build, is the least surprising sentence in this article. Your secrets are also sitting in panels somewhere. The question is whether anyone would notice if they appeared in somebody else's.
Who owns the agent?
The IANS and Artico Search numbers are a useful corrective to any assumption that governance is catching up with deployment. A head of AI security role exists in sixty-five per cent of organisations with revenue above ten billion dollars. In eighteen per cent of those firms it is a dedicated position, in forty-seven per cent it is bolted onto another leadership post. That is genuinely fast growth for a function. It is also, on the evidence, a title rather than a mandate.
Primary accountability for AI governance sits with the CISO in seven per cent of large organisations, eleven per cent of medium firms and twenty-six per cent of small ones. In large firms the chief AI officer is more often accountable, at twenty-two per cent. Across every tier, fourteen to nineteen per cent report that no single executive is accountable at all. Roughly forty-five per cent across all tiers have no board committee for AI ethics or responsible AI, and no plans for one.
Read those two datasets together and the structural problem is obvious. The person who understands the risk does not own the decision, the person who owns the decision does not usually answer for the control, and in one organisation in seven there is no person at all. Agents do not respect that ambiguity. They execute.
The checklist you may not have noticed
On Tuesday NIST, CISA and the NSA published ten voluntary practices for incident readiness and response around rogue AI agents, under the arresting title Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. The agencies use the phrase super intelligence throughout, in line with presidential executive order 14434. Put the framing aside, because the content beneath the vocabulary is the most usable artefact of the week.
The ten practices are grouped across prepare, detect, respond, recover and report. Preparation is unglamorous: asset and risk inventories, defence in depth, least privilege, zero trust controls, credential management, supply chain risk management. Detection depends on continuous monitoring for correct behaviour as well as anomalous behaviour, which is a different telemetry problem than most SIEMs were built for. Response means isolating systems, revoking credentials, rebuilding compromised environments, determining blast radius, and chasing root cause past the individual vulnerability into the system that allowed it. Recovery means testing restoration before you need it and documenting the residual risk you accepted. Reporting covers affected parties, legal obligation and public disclosure.
Two of the ten go beyond the technical. Notify Government, where statute requires it. Share Information Publicly, early and honestly, including what you changed as a result. That last one is the practice the security profession has never quite managed, and AI incidents will not be the exception unless someone makes it so.
There is no new information in this document. That is the point. It is a clear checklist that a security team can act on today, and if you are being asked this quarter to explain how you would govern agents, it answers the question better than most vendor whitepapers will.
The SOC is the same problem from the inside
Help Net Security published a short video with Vince Stoffer of Corelight on bringing AI into the security operations centre. Two things in it are worth your time.
The first is the honest accounting of benefit. Agentic triage gives faster work, fewer false positives, and lets junior analysts go deeper into network data. LLMs help with detection engineering, writing SIEM rules and small programs that parse packets or Zeek metadata. This is real, and if you are not getting it you are behind.
The second is Stoffer's boundary. A human stays in the loop before agents take blocking or response actions. He also names the risk that follows directly from the benefit: shadow AI in the SOC, loose permissions, and changes that nobody audited. Your analysts adopting agentic tooling faster than your change control can approve it is the same governance gap as the Cairn story, just with better intentions.
His closing advice is network monitoring to find AI use across the organisation. In practice that means knowing what talks to model endpoints, from where, with whose credentials. If you cannot answer that today, start there. It is a finite piece of work with a clear output.
Identity is still the substrate
Dark Reading ran a roundtable on identity in the software development lifecycle, and the finding is the one practitioners already suspected. AI complicates SDLC security, not because models are malicious but because the identities doing the work have multiplied. Build agents, CI service accounts, test harnesses with production tokens, and coding assistants with repository write access all need to be authenticated, authorised and reviewed. Most organisations have not rebuilt their identity model for the number of machines that now act on their behalf.
The roundtable's practical conclusions are modest and correct: collaboration between platform and security teams, better identity visibility, and reduced testing costs through targeted automation rather than blanket coverage. What it underlines is that every AI incident in this article is, underneath the novelty, an identity incident. The agents that broke into a hundred websites did so with credentials they could use. The panels that leaked secrets leaked because the secrets were there. Your own agents will run into exactly the same boundary.
What this means for you
1. Find every agent, harness and AI console your teams have deployed, including the ones bought on a card. Ask for the inventory this week, not next quarter. If the answer is a spreadsheet that has not been opened since the pilot, you have your first finding.
2. Decide who owns agent behaviour, and write it down. Not who is interested in it. Who is accountable when an agent takes an action that costs money or breaks something. If your organisation falls into the fourteen to nineteen per cent with no answer, that is the single highest value half day of work available to you this month.
3. Apply least privilege to agents as though they were contractors. Separate credentials per agent, scoped to the task, rotated on a schedule, with spend and action alerts attached. The Cairn operators found eleven per cent of harvested secrets still valid. The equivalent failure on your side is an agent token that outlives its project by eighteen months.
4. Take the NIST, CISA and NSA checklist and turn it into a table with names and dates. Ten practices, five stages, one owner per line. Voluntary guidance becomes real the moment it has an owner. Where you have no answer for detection of incorrect agent behaviour, write that down too, because that gap will be asked about.
5. Log what your agents do, in a place your security team controls. Every action, every tool call, every credential used. An agent makes a useful audit trail if you capture it and a liability if you do not. This is the cheapest insurance available and most teams skip it because the vendor dashboard looks sufficient.
6. Prepare the disclosure conversation before you need it. The tenth practice, share what happened and what you changed, is the one your legal team will resist and the one that buys you the benefit of the doubt next time.
Six months ago the argument about AI agents was whether they were ready for production. This week the criminal market settled that question by running them at scale, with a ten per cent hit rate and an inventory of secrets to show for it. The organisations that come through the next year well will not be the ones with the best models or the loudest governance frameworks. They will be the ones who can say, without hesitating, who owns the agent, what it can reach, and what it did yesterday.
---
Sources: 21 publications checked, 14 AI-relevant stories analysed over a 24-hour window.