Phil Venables is a partner at Ballistic Ventures, which invests in early-stage cyber security companies, and a senior adviser at Warburg Pincus. He was the first chief information security officer of Google Cloud and, before that, spent 17 years as the first CISO of Goldman Sachs, later becoming its chief operational risk officer. He began his career as a software engineer. On episode 11 of Curiouser & Curiouser, the podcast from Alice, released in June 2026, he spoke with host Mo Sadek about how AI changes security, what it means for attackers and defenders, and how organisations should control AI agents.
Three ways to look at AI and security
Venables began by pointing out that most vulnerabilities are never exploited, so most organisations are targets of opportunity, chosen because they happen to be exposed. AI changes that by letting attackers be relentless and scale the way they make money from attacks.
He split the subject into three parts: the security of AI itself, meaning safe, compliant and well-managed deployment; AI used for security, in areas such as software security and the security operations centre; and AI’s wider effect on the threats organisations face. He thought the recent excitement around the Mythos model had been somewhat misleading, since models able to write code had been finding vulnerabilities for several quarters before it.
A flood of flaws and attackers at industrial scale
In the short term, he said, the volume of newly discovered flaws is worrying. Over the longer run, defenders can run the same models over their own code, which could leave them better off. Less advanced models later found many of the vulnerabilities attributed to Mythos, which in his view shows that restricting access to the most capable models is a weak basis for security. The capability is already widely available.
His larger concern, and one he thinks is underreported, is attackers industrialising. They have always been short of resources, and AI could let them run ten or a hundred times as many attacks.
“There’s no room and no place for organizations with weak security to hide anymore.”
He also raised authenticity. Fake workers, fake content and fake brands are pushing consumers, businesses and governments to check what is real.
Drawing on Google’s DevOps Research and Assessment work, he said AI amplifies whatever it lands in. A chaotic development process becomes more chaotic, while a well-controlled pipeline becomes more productive. He expects far more software to be written. Models may produce code with fewer vulnerabilities per line, yet the total surface open to attack will grow. Teams can improve the output by prompting or post-training models to write secure code and by restricting which third-party libraries they use.
Help for smaller security teams
Most organisations, Venables noted, cannot afford continuous red teaming, an insider threat programme or a full incident response team. AI agents can extend what small teams are able to do. His examples were Armadin, Kevin Mandia’s company, which uses agents for red teaming across the board; Above Security, a Ballistic investment working on insider threat; and BreachRx, which supports incident response and disclosure.
The basics still carry the most weight. He listed strong multi-factor authentication, network segmentation, binary authorisation and least-privilege access, applied consistently, because an attacker needs only one misconfigured system.
Controls that sit outside the agent
On agents, he compared the present to the internet of the late 1990s, when design patterns were still unsettled and security was layered on later. An agent might act under a person’s delegated identity, hold its own permissions for a workflow, or receive short-lived identities for individual subtasks. Each choice needs different permissions and different monitoring.
Models give variable answers, he observed, while processes in finance, health and critical infrastructure need predictable outcomes. The controls therefore belong in guardrails around the model that enforce business policy, as they do for human staff. His analogy came from high-frequency trading, where firms use independent checks such as circuit breakers to halt an algorithm that misbehaves. Enterprises will need a similar control layer for their agents.
He described the approach as shifting security down as well as left. Agents should inherit controls from the platforms they run on, and critical systems such as payment gateways and order systems should enforce access control, transaction policy, auditing and monitoring themselves, because agents cannot be relied on to police themselves. When a system keeps rejecting an agent, teams should study the identity and access failures behind it. Agents interacting with one another may also produce behaviour that no policy anticipated.
On models, he said most organisations avoid relying on a single one and route tasks to whichever suits the cost. He separated thin wrapper vendors from those adding real routing and validation, citing Rogo in investment banking and Harvey in legal work. His summary was that AI risk still comes down to the software lifecycle, data governance, operational guardrails, and identity and access. Organisations should limit agents’ privileges and enforce access control in the resources they touch, instead of trusting the agents to behave.
What it means for leaders
- Spending on the basics still earns its keep. If attackers can run a hundred times as many attacks, gaps in multi-factor authentication and segmentation are where they will land first.
- For technology leaders deploying agents, our reading is that the payment system or order book itself should hold the final say on what a transaction may do, whatever the agent requests.
- Fix the delivery pipeline before AI coding tools spread across a team, since a messy process gets messier at speed.
- Agent identity deserves a decision now, while patterns are still forming, with each option matched to its own monitoring.
