Writing

Why AI Governance Fails at Runtime and What CISOs Must Do Now

Most organizations that claim to govern their AI systems are doing something closer to documentation theater. Policies, review boards, and risk registers are disconnected from what the AI system actually does at runtime. This post explains the enforcement gap, why detection and audits alone cannot close it, what the ACR Standard provides as a control framework, and the practical steps CISOs should take to deploy runtime control now.

The OWASP Top 10 for Agentic Applications Gets a Lot Right. It Also Stops Where Real Control Has to Begin.

The OWASP Top 10 for Agentic Applications is a strong threat taxonomy. It is not a control model. It tells you what can go wrong with autonomous AI systems. It does not define the mandatory runtime conditions that make those systems governed. That is the gap the ACR Standard is built to close. This post walks through where OWASP gets it right, where it stops short, and provides a full crosswalk mapping each OWASP category to ACR control pillars.

Why AI-Driven Vulnerability Discovery Breaks Cybersecurity’s Operating Model

Project Glasswing goes beyond faster vulnerability discovery. It eliminates the foundational constraints modern cybersecurity depends on. AI-driven vulnerability discovery collapses the time between exposure and exploitation to near-zero, rendering detection, prioritization, and patch-based models structurally insufficient. The only defensible model is control at runtime, enforced at machine speed.

Runtime Governance Is the Only Governance That Counts

Why the Control Plane Is Non-Negotiable

If agentic AI can act without traversing a hardened enforcement boundary, you have policy theater — not risk management. Runtime governance requires a control plane that enforces policy at the moment an agent intends to act, provides auditable evidence, and constrains delegated authority. The gap between governance intent and governance effect is the largest unpriced risk in enterprise AI today.

LiteLLM Compromised

What the PyPI Supply Chain Attack Means for Every Organization Running AI

LiteLLM versions 1.82.7 and 1.82.8 on PyPI were compromised with credential-stealing malware as part of a month-long campaign by TeamPCP that included Trivy, KICS, a self-propagating npm worm, and Kubernetes wipers with Iran-targeted destruction. The implications for AI governance are immediate.

DNS as a Weapon

What the AWS AgentCore Sandbox Bypass Means for AI Governance

BeyondTrust Phantom Labs demonstrated a full sandbox escape from AWS Bedrock AgentCore using DNS-based C2. The implications for AI governance are significant, and most organizations are not accounting for this class of risk.

From Standard to Enforcement

Inside the ACR Control Plane

The ACR Control Plane is now a working reference implementation—open source, deployable, and designed to prove that runtime AI governance is not theoretical. It is operational.

AI Governance Is Entering Its Enforcement Era

Why 2026 Is the Year Enterprises Must Move From Policy to Runtime Control

AI governance is entering its enforcement era. Learn why enterprises must move from policy documents to runtime control architectures like the ACR Standard.