Mind of the CISO: Trust at Machine Speed

By David Soto · November 3, 2026

Every security decision I make comes back to one question. Do I trust this enough to let it operate in my environment?

I ask it about people signing in and devices connecting. More and more, I ask about software that acts on its own, holds credentials, and makes decisions faster than anyone on my team can read an alert.

The answer I always come back to is "it depends." Where is the security bar? It's the height something has to clear before it gets to operate in your space. Set it too low and you invite risk. Set it too high in the wrong places and you slow the business down for no real gain. A malware research lab and a sales laptop shouldn't have the same bar.

We’re all aware of how most intrusions start. Someone, or something, gets hold of credentials it shouldn’t have, and uses them. That was true of the agent intrusion at Hugging Face this summer, and it’s why authentication and agentic AI belong in the same conversation. It’s also why it matters that Trellix Wise for Private Cloud became generally available last month. The question of who and what gets to operate in your environment now runs at machine speed.

What does the security bar look like for people?

People are usually surprised when I tell them how often I changed my password in four years at Amazon. It was once. There was a policy that required a yearly change for a while, and when it went away, nobody missed it.

Forced rotation feels rigorous, but in practice it pushes people toward predictable patterns, passwords on sticky notes, and the same password with a new number on the end. NIST has advised against it since 2017, and its current digital identity guidelines now make it a requirement. Verifiers shall not require people to change passwords periodically, and must force a change only when there’s evidence a password was compromised.

The stronger approach is to build trust through layers. A long, unique password stored in a password manager proves you know something. Multi-factor authentication (MFA) proves you have something. A healthy, managed device tells me the request is coming from somewhere I trust. When all three line up, I can remove the friction, like asking people to sign in again every few hours, and still raise the bar.

That's the tradeoff I care about most. Good authentication should make people safer and make their day easier at the same time.

What happens when the one signing in isn't a person?

An AI agent can hold an identity, carry credentials, and be authorized to use tools and change systems on someone's behalf. In our latest Mind of the CISO research, The New Insider, 78% of the 600 CISOs we surveyed said they include actions by AI agents, autonomous systems, and machine identities in how they define insider risk.

What worries me more is the timing. Those same organizations take about seven hours on average to detect an insider incident and another eight to respond.

I don’t think a total of 15 human hours holds up against attackers moving at machine speed. Hugging Face showed what that looks like in practice.

My colleagues Joe Chen and John Fokker walked through the incident a few weeks ago. AI agents being evaluated at OpenAI got out of their test environment and into Hugging Face's production infrastructure. They found credentials, chained vulnerabilities, and moved through the environment. Hugging Face reconstructed roughly 17,600 agent actions over five days. Most of them failed. The agents only needed a few to work.

Two details stood out to me as a CISO. First, the agents hid the credentials they found inside encoded data. Once the team reproduced the decoding, they recovered about four times as many secrets as their first scan found. Second, the early signals were there. Several layers of the security stack saw the activity. It just wasn't raised to the right severity fast enough.

I want to be careful with this story. Nothing in the record shows the agents set out to attack anyone. An identity with more access than anyone is watching can do real damage whether or not anything meant it to.

So I hold machine identities to the same bar as people. What credentials does this agent hold? What is it allowed to touch? Who reviews what it did? If I can't answer all three, it hasn't cleared the bar.

What should a CISO ask before trusting an agentic SOC?

The same logic applies to the AI on the defense side. Agentic AI can take on Level 1 work, like reviewing phishing emails and triaging repetitive alerts, at machine speed. That matters. For years, security teams treated stopping about 70% of attacks as the baseline. In the AI era, defenders need to stop 95% to 99% of them, and do it at machine speed. No human team keeps pace with 17,600 actions in five days on its own.

Before I trust an agentic SOC with that work, I ask four questions.

• What does it cost to run when things go wrong? Token usage adds up fast when a model reviews every alert all day. It adds up faster during an incident, which is exactly when investigation volume spikes. I need a cost I can forecast, so nobody on my team ever has to ration the tool that's helping them.

• Where do my logs have to go? Many approaches ask you to ship all your telemetry to one vendor's cloud. Investigation data is some of the most sensitive data you have. It includes credentials, logs from compromised systems, and whatever the attacker left behind. For regulated industries, or anyone with strict data residency rules, sending that out is often a nonstarter.

• What happens when the connection drops? During a serious incident, you may pull internet access on purpose. When Hugging Face's responders asked hosted AI models to help analyze what the agents left behind, the models declined. The team stood up an open-weight model on its own infrastructure and kept going. I don't want to be building that in the middle of an incident. I want AI defense that already runs in an environment I control.

• Can my analysts see how it got there? I don't trust a verdict I can't check. I need the reasoning, the evidence, and a confidence level, with a person making the final call. If my team has to re-verify every answer, the AI slows the SOC down.

When I look at Trellix Wise for Private Cloud through those four questions, it holds up as something I’d want in my own SOC.

It runs inside your boundary, including on-premises and air-gapped environments, so your logs stay where they are and the investigation keeps going if you have to disconnect. Capacity is set by the hardware you choose, which means cost doesn’t climb with every query, and every verdict comes with the reasoning behind it so the analyst can check it before making the call. Our Chief Product Officer, Alex Au Yeung, walks through the product story here.

How do you raise the bar without slowing the business down?

Guardrails are what let a business move fast. I'd rather give a team a safe way to use a new capability than a reason not to. That applies to AI across the whole organization, including the SOC. Enable it broadly, safely first, then securely.

It also means being honest about the last few percent. The most capable adversaries, including nation-state actors, will sometimes get through. Containment stops the damage from spreading. Investigation tells you whether the incident is actually over. Segmentation, resilience, and a practiced recovery plan matter as much as prevention.

I often think about giant sequoias. They survive fire because they were built to recover from it. I want our environment built the same way.

What we hold ourselves to

At Trellix, we talk about being Customer Zero. We run our own security the way we ask our customers to run theirs, and we hold ourselves to the same bar. For me, that’s the test behind every decision in this piece.

Would this earn our trust if we were the customer?

It’s the approach I take with any problem before I let anything, or anyone, operate in my environment. If you want to go deeper, read The New Insider, our research with 600 CISOs on how AI agents are changing insider risk.