Download Transcript (pdf)
Your AI Agent Is a Narcissist. Secure It Accordingly.
AI agents don’t care about your policies.
They don’t worry about getting fired. They don’t stop because an action feels questionable. Give an agent an objective, access and enough autonomy, and it is going to keep working the problem.
Joanna Wiggum, founder and agency principal of Countervail, gave Jo Peterson one of the more memorable descriptions of agentic AI we’ve heard on ClearTech Loop:
“It has a personality, and it’s a narcissist. It’s only going to think about itself and what it wants to achieve.”
It’s funny. It’s also a useful way to think about AI agent security.
In this episode, Joanna and Jo talk about what least privilege and zero trust look like for AI agents, whether enterprise AI governance is actually working, and what a CISO should do when AI adoption has already outrun the organization’s security controls.
AI Agents Need Actual Zero Trust
AI agents increasingly have credentials, access enterprise data, make decisions and can sometimes create or direct other agents.
Joanna’s answer to securing that environment is straightforward:
“Zero trust. Actual zero trust.”
An AI agent shouldn’t be able to expand its own authority or independently create new credentials. Permissions need to be controlled externally, with agents isolated around specific tasks and clearly defined access.
But zero trust for AI only works if the security underneath it works.
Passwords sitting in shared drives, reused credentials and inconsistent MFA don’t suddenly become less dangerous because an enterprise has adopted AI. They become more dangerous when autonomous technology can discover and use those weaknesses at machine speed.
AI isn’t eliminating security debt. It may be accelerating the consequences of it.
Is AI Governance Becoming Security Theater?
AI governance committees are becoming increasingly common.
That does not necessarily mean AI is being governed.
Joanna points out an important distinction: writing a policy does not mean the policy is being enforced, and dedicating people to governance does not guarantee that the underlying security problems have been fixed.
Effective AI governance has to go beyond organizational charts and policy documents.
Enterprises need the ability to see what is being deployed, understand what agents can access, enforce controls and intervene when something operates outside established boundaries.
Otherwise, governance risks becoming little more than proof that a committee exists.
Starting From Zero on AI Security? Get Help.
Jo gave Joanna a difficult scenario:
A CISO discovers the organization has no AI-agent inventory, no agent-specific controls and no meaningful monitoring.
What should happen in the next 30 days?
Joanna didn’t hesitate:
“Outsource.”
Her point isn’t that CISOs lack the expertise to understand AI security.
It’s about time.
An organization that is already behind may not have months to develop entirely new capabilities internally. Joanna argues that leaders need to decide where their expertise provides the greatest value and where bringing in experienced outside resources can accelerate the work.
AI Is Exposing the Security Problems We Already Had
AI security requires new controls, architectures and ways of thinking.
But it doesn’t erase the fundamentals.
Identity still matters.
Least privilege still matters.
Credential hygiene still matters.
MFA still matters.
Policy enforcement still matters.
What has changed is the speed and autonomy with which technology can operate.
That is why Joanna’s perspective matters: enterprises shouldn’t build sophisticated AI governance programs on top of security foundations that were already shaky.
AI isn’t creating every enterprise security problem. It is getting remarkably good at finding the ones that were already there.
Watch the Full ClearTech Loop Episode
Jo Peterson talks with Joanna Wiggum, Founder & Agency Principal of Countervail, about:
- Zero trust and least privilege for AI agents
- Delegated credentials and agent permissions
- AI governance versus governance theater
- Enterprise security debt
- Human oversight of autonomous systems
- When CISOs should build internally versus outsource
About Joanna Wiggum
Joanna Wiggum is the founder and agency principal of Countervail. Her background spans enterprise incident response, red-team operations and cybersecurity leadership, including work across Microsoft, Oracle and Starbucks.
Learn more:
https://countervailintelligence.com/
Additional Resources
OWASP — Agentic Security Initiative
Research focused on visibility, control and security for autonomous AI agents operating across enterprise environments.
https://genai.owasp.org/initiatives/agentic-security-initiative/
Joanna Wiggum — The Moral Imperative to Fight
Joanna explores why cybercrime cannot be treated as background noise and the human consequences behind cyber prevention and response.
https://countervailintelligence.com/2026/07/08/the-moral-imperative-to-fight/
ClearTech Loop: AI Agent Governance Starts With Visibility — Alvaro Gonzalez
A companion ClearTech Loop conversation about discovering AI agents, establishing an inventory and why visibility has to come before governance.
https://cleartechresearch.com/ai-agent-governance-alvaro-gonzalez/
Stay in the Loop
Subscribe to the ClearTech Loop newsletter for new conversations on AI security, governance, cloud strategy and cyber risk.
https://www.linkedin.com/newsletters/7346174860760416256
Watch full episodes and subscribe to ClearTech Research on YouTube.