Risk Grustlers EP 27: We can’t build enough AI agents to keep up with cybersecurity

AI security is moving quickly enough that Ashish Rajan had to rewrite AI Security Engineering before the book even came out. When he started writing, agents were barely part of the conversation. By 2026, they had become difficult to leave out.

That speed is showing up inside enterprises, too. Ashish says large and regulated organizations have adopted AI faster than he expected, while security teams are still working through what they need to govern, build, monitor, and respond to.

In this episode of Risk Grustlers, Ashish Rajan (CISO at TechRiot.io and author of AI Security Engineering) joins Nicholas Muy (CISO and VP of Engineering at Scrut Automation) to talk about the gap between having access to powerful AI and actually being able to use it safely. 

They get into agent harnesses, open-weight models, incident response for AI systems, the limits of AI-driven security testing, and why cybersecurity teams are nowhere near automating themselves out of work.

Ashish Rajan is the author of AI Security Engineering and host of the Cloud Security Podcast and AI Security Podcast. His work also puts him in regular conversations with security leaders at large organizations about how emerging technology is changing security programs.

Listen to the full episode here.

Here are some key highlights from the episode

Nick: I think security programs don't age well. You had to go back and change the book to make sure it was relevant. Think about how many security programs don't go back and change. Is that a 2015-vintage program? A 2020-vintage program? Is there continuity in leadership, even if there are different CISOs?

Ashish: A CISO who walks into a new role will most likely start with inventory and visibility because they want to know what they have and get some understanding and a source of truth.

If there has been a consistent change of leadership, you already have different versions of the security program. And if the team has changed as well, you have lost institutional knowledge as that progresses.

Nick: At least from what I've observed, if large enterprises don't have that continuity, they are perpetually doing inventories and top-down assessments. Wouldn't it be great if agents could figure out the lay of the land, share it, and give teams some shared context?

Ashish: Fortune 500 companies have genuinely surprised me in terms of how much AI adoption has happened. If I go back to cloud, especially in the regulated space, adoption was slower. It took years.

With AI, the amount of ground some large organizations have covered in a much shorter period has been surprising. You now have CEOs and CFOs pushing for AI adoption in a way that wasn't necessarily true with cloud.

The way I describe adoption is almost like a barbell. On one side, you have organizations saying, “We're not going to use this because there's no policy and nothing to govern it.” At the other end, you have tech-forward, high-growth companies, even in regulated industries, saying, “If we don't do this, we will not survive as a business.”

Then there is the messy middle, where one or two teams or AI champions are pulling the rest of the organization forward.

If I'm being honest, right now, we don't even know if this is the baseline for AI. We're assuming, “I know agents. I know MCP. I know Mythos is around the corner, so I have to protect for that.” But I don't believe this is where it pauses. There are going to be more models coming out.

A lot of my conversations now are about how organizations build agent harnesses and capabilities while still working with vendors. You don't want to recreate the vendor. You need to figure out what you need around those products to keep people safe while still staying at the forefront of the technology.

Nick: As a defender, I'm running into classifiers that classify benign security work as malicious. The majority of the world's defenders also don't work for the few companies with access to the newest capabilities. The rest of the world is going to have to figure out what to do and how to do it, and not wait for someone to give them permission.

Ashish: I think that is already starting to change. We are seeing organizations open-source security tooling and more security teams looking at the open-weight path because not everyone can afford an expensive model.

That leaves defenders with a choice. They can build harnesses using capabilities that are being open-sourced, or use an open-weight model to build something for their own organization.

Security teams know how SQL injection works. They know how Cross-Site Scripting works. The question becomes how they turn that knowledge into something usable in their own environment.

The second thing I've been harping on about is that we don't have incident response trained for what an incident looks like for AI.

Incident response today is designed around things like seeing something in your SIEM or CSPM/CNAPP and responding to it. But if somebody is using a chatbot to ask for a password behind the scenes, what does the detection for that look like?

Nick: Even before AI, incident response was heavily focused on infrastructure and IT security. Network intrusion, compromised email accounts, compromised Active Directory credentials.

Protecting product surfaces is harder for a lot of enterprise security teams. The people closest to the application may be looking at product telemetry, APM logs, outages, and RCAs, while the security team is five steps removed and the IR function is even further out.

Ashish: This happened with cloud as well. People who were amazing threat hunters, amazing at detection, or amazing at SOC-related work in the data center didn't automatically become amazing at cloud without training.

Now, with AI, it feels like we left incident response behind for a long time with cloud and we're doing the same thing again.

Nick: A perennial theme in my group chats is that we can't build enough agents to get rid of our jobs.

There's not a single person I'm talking to in security engineering who's saying, “I'm worried about this taking my job.” It is not even coming close. The work is too spread out.

You can have Devin, Cursor, or Claude Code, but these are very much in-repo, single-context tools. The application and infrastructure of an organization are multidimensional. This isn't something where you turn on your computer and say, “Do my job.”

Ashish: Even with Mythos, I think the marketing made people feel like you could point it at something and say, “Go crazy, hack this.” It doesn't work like that.

Every Project Glasswing participant had to spend time with real people and real engineers and build proper harnesses to use it well.

Everyone I spoke to who had access to Mythos described something similar. It's like having a Ferrari in your driveway but not knowing how to drive it. You have everything. You're sitting there with the key, but you still need to know what to do with it.

Mythos was identified as something created to write better code. It just happened to be good at cybersecurity. So it can find vulnerabilities in code, but it can't find vulnerabilities in business logic. It can't find vulnerabilities in things that are not code, which can still be security issues.

There are already a lot of gaps, but people want to focus on the idea that one capability is going to solve everything.

Nick: Not every gap you have is a CVE problem. There are business logic flaws, token misuse, JWTs, API keys being left around. You're not going to get a CVE for every API key your team leaves on GitHub.

Ashish: The fact that someone still has to manage and run Mythos in your environment should be a clear enough sign that we're not at the point where this is fully autonomous.

Nick: Open source has another problem too. It needs maintainers, money, time, and vulnerability patching. Some of the most popular projects don't have enough people maintaining them.

Ashish: That's one of the challenges I'm finding as well. AI can make it easier to build and ship something, but the community piece is super hard. That takes months or years.

It's one thing to build a project. It's another thing to build a community around it and keep it useful.

The bigger takeaway

The key question in AI security is no longer whether models are becoming more capable. It is what security teams need to build around them before they can be trusted in real environments.

Nick and Ashish keep coming back to context: security programs lose it when leadership changes, AI tools struggle beyond narrow tasks, incident response lacks it when threats move into product behavior, and vendors cannot fully understand every customer’s environment.

That is why more capable AI does not automatically mean less security work. Defenders still need to decide where automation fits, build the right harnesses, understand what the tools cannot see, and adapt security practices as the technology keeps changing.