The AI Control Loop: What's Missing in AI Security Today - with Craig Thomas of Wallarm

Episode Summary

Executive Summary: The episode argues that AI security must shift from traditional gate-based, detect-and-respond models to runtime control and containment. Craig Thomas explains that AI agents move too quickly for after-the-fact response, so enterprises need kernel-level visibility, session-level isolation, and evidence-based governance to reduce blast radius without slowing innovation.

Main Topics: Why traditional security fails for AI (Priority: 5/5): Classic controls focus on who gets in, but AI risk emerges after access is granted and can unfold in milliseconds, making perimeter-based detection and response too slow. Runtime behavior as the blind spot (Priority: 5/5): The key security question is not just identity or network traffic, but what an agent actually does at runtime—its tool use, memory access, reasoning, and intent drift. Kernel-level visibility and enforcement (Priority: 4/5): Monitoring at the kernel layer exposes system calls, file I/O, and process behavior, giving defenders a fuller view than network, identity, or app-layer controls alone. Session-level containment (Priority: 5/5): Instead of killing pods or shutting down services, organizations should be able to terminate or sandbox only the compromised AI session while preserving other workloads and forensic evidence. Balancing security with velocity (Priority: 4/5): Policy as code, audit-first rollout, tiered enforcement, and developer self-service can preserve speed while enabling real-time blocking in production. Governance and board accountability (Priority: 4/5): Good AI governance becomes continuous and evidence-based, with logs tied to specific sessions, identities, and tool calls rather than annual attestations.

Key Arguments: AI systems compress attack timelines so much that traditional detect-and-respond workflows often react after the harm is already done. Static controls such as firewalls and IAM cannot evaluate intent or semantic drift, so they fail to govern what an agent does after legitimate access is granted. Real protection requires runtime controls that observe and enforce behavior as it happens, not just at the gate. Kernel-level telemetry reveals the actual actions of the model—system calls, file access, and process behavior—rather than only inputs and outputs. Session-level containment shrinks blast radius by isolating one compromised agent session while leaving the rest of the environment running. Broader AI permissions become safer when organizations can rapidly contain bad behavior; security then enables utility instead of limiting it. Organizations should immediately stop behaviors like data exfiltration, prompt injection execution, scope violations, abnormal query spikes, and lateral movement between agents. A practical rollout path includes policy-as-code, audit mode before enforcement, separate dev/staging vs. production controls, and developer dashboards that explain what would be blocked and why. Governance should be evidence-based: enterprises need logs proving what each agent did, what policy was enforced, and how incidents were bounded. Strong runtime controls can reduce incident fallout, legal exposure, and notification burden by limiting the number of affected customers and the amount of data touched.

Data Points: Incident timing: milliseconds - Craig says AI can exfiltrate, manipulate, or corrupt data in milliseconds, far faster than human-speed incident response. Traditional response window: hours, days, or weeks - Used to contrast the slower timelines assumed by legacy incident response with AI-speed attacks. Customer impact scale: 5 million to 10 million customers - Mentioned as the kind of broad notification burden that can be reduced when an incident is properly contained. Access frequency example: 4,000 times in Q2 - Example of how governance can quantify how often an agent accessed data within policy.

Pivotal Quotes: "A model can exfiltrate, manipulate, corrupt data in milliseconds versus hours, days, or even weeks." — Craig Thomas: Explaining why incident response built for human attackers is too slow for AI-driven systems. "Those are stateless remediations applied to stateful harm." — Craig Thomas: Describing why actions like restarting pods or rotating credentials often come too late to undo AI-driven damage. "Governance becomes evidence-based rather than attestation-based." — Craig Thomas: Summarizing how runtime enforcement changes enterprise accountability and board reporting.

Implications: Enterprises will need runtime AI controls, not just policies and post-incident response, to safely deploy agents at scale. The winners will be teams that can contain fast, prove compliance continuously, and let security enable innovation rather than slow it down.