Most real risk doesn’t live in theory. It lives at runtime.
As cloud environments become more dynamic, identity-driven, and increasingly shaped by AI, the gap between what security tools see and what security teams can act on continues to widen. Cloud-native application protection platforms (CNAPP) promise consolidation, but many still leave CISOs staring at dashboards full of potential risk, unsure which issues truly matter in the moment.
Now, with the near-universal use of large language models (LLMs) and businesses deploying agentic AI to drive efficiency and lower costs, CISOs face an even more challenging operational landscape replete with new risks that question whether human-in-the-middle timescales will ever be sufficient.
The widespread use of agentic AI across business processes, back-office IT, and security operations (including those from service providers) will tax telemetry and generate additional noise and distraction for security leaders and their teams. Effectively, the ability to ‘detect’ a signal in this noisy environment all but requires that deep runtime telemetry be priority one.
Too much of the existing security stack is bypassed by a new class of security risk factors that accompany agentic AI and LLMs. As noted in the CISO Desk Reference Guide, CISOs should be asking “What is it that I don’t see, that I should see, and why don’t I see it?” Clearly, we need greater visibility into the cloud and AI stack, including threats to each component organizations rely on.
It’s not just that the telemetry may be off, it’s also that the timescales of responses may be woefully too slow – akin to running in wet cement. Sysdig’s 555 Cloud Detection and Response Benchmark (5 seconds to detect, 5 minutes to correlate, and 5 minutes to respond) was a similar wake-up call. The co-pressures of telemetry and real-time/machine-speed response require CISOs to pause and rethink how we view security architecture for a modern enterprise empowered by AI and cloud services. Candidly, security programs face a multitude of new risks that many current tools, absent runtime insights, would miss.
A non-exhaustive list of risk factors that need attention includes the following:
At the heart of runtime is visibility on what matters: what's being executed and what's running in production. Runtime is where enterprises generate value. Runtime telemetry can help shed light on the risk factors noted above, be they directly related to AI tools and services or the cloud and microservices that power them.
Runtime telemetry is foundational to the “ity” language that permeates discussions on AI, namely “observability,” “traceability,” and “explainability,” among other similarly synonymous terms. If CISOs were Chief Financial Officers, they’d be focused on key assertions such as completeness, accuracy, validity, and restricted access (CAVR), as well as other financial-statement assertions. The status of these assertions helps validate the accuracy of the organization’s financial statements. Runtime insights into cloud services, AI applications, and AI services are required to provide the parallel assurances needed for AI-enabled applications.
CISOs face a near-infinite number of risks to their organizations. How they prioritize which risks require attention and mitigation is integral to their roles. Knowing how their organizations derive enterprise value is essential. Enterprises are inherently noisy and ever-changing from a risk management perspective. Focusing on the runtime risks of applications and services that are integral to enterprise value is a pragmatic way to filter and address not only the signal-to-noise challenges but also the increased attack surface and threats enterprises confront.
When security programs anchor their decisions in runtime truth — what’s running, what’s reachable, and what’s being exploited — the noise reduces, priorities sharpen, and taking action becomes possible.
Runtime insights are no longer optional. They are foundational.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。