Last night I was back at the Metropolitan Club with a room full of Chicago CISOs, and the whole evening was about the unglamorous side of agentic AI. Who owns these agents once they're running, what identity they act under, and how you'd even know if one went sideways. One number from Rubrik Zero Labs set the tone. Only 37% of organizations keep a current inventory of their AI agents. So most of us are trying to govern something we haven't fully counted yet. A few things of note... - Agents need their own identities, with their own credentials and permissions, the same way people and service accounts do. An agent running under a human's login is a mess to untangle later. - Watch what an agent actually does, with the same attention you'd give a new hire's first month. Uptime alone tells you very little. - Every agent needs a named owner. If nobody can say who's responsible for it, it shouldn't be in production. - Recovery matters as much as prevention. When an agent drifts or fails, you need a clean, trusted state to get back to. Really glad this group is having these conversations now, rather than after an incident forces it. Thanks to the Evanta team and my fellow Chicago cybersecurity leaders for a great night. If you're rolling out agents this year, begin with a simple list: every agent, what it can touch, and who owns it. Everything else gets easier from there. https://www.evanta.com/ciso/chicago/chicago-ciso-inner-circle-9279 #CISO #AgenticAI #Cybersecurity #security #privacy #cloud #infosec #AI #Gartner #Evanta #RHRInternational @RHR_International