DISC Infosec blog

Human Oversight vs Human Control: Where the Human Sits in AI Execution

disc7 — Wed, 09 Sep 2026 19:07:16 +0000

Where Does the Human Sit Relative to Execution? Outside the loop, in it, on it, or alongside it? The position determines what evidence exists, which risk tiers are defensible, and whether Article 14 oversight is real or theatre. Someone put a question to me recently that I thought was better than most of the governance […]

The post Human Oversight vs Human Control: Where the Human Sits in AI Execution appeared first on DISC InfoSec blog.

A signed two-page policy beats a fifty-page draft. Every time…

disc7 — Tue, 08 Sep 2026 16:41:24 +0000

Startups at Seed or Series A Don’t Need a CISO to Pontificate. They Still Need Governance. A viral take says early-stage startups need operators, not CISOs. Mostly right — but three of the four things it says startups need are governance work. What actually blocks the audit and the deal. A take went around recently […]

The post A signed two-page policy beats a fifty-page draft. Every time… appeared first on DISC InfoSec blog.

We have guardrails for that is not a control – Here’s the difference

disc7 — Thu, 03 Sep 2026 19:08:00 +0000

Why AI Systems Are Hard to Audit – AI doesn’t have controls, it has guardrails — and you can’t audit a guardrail AI Teams Think in Guardrails. Auditors Think in Controls. That Gap Is Where Programs Fail. Steven Ross made an observation in the ISACA Journal earlier this year that I’ve been chewing on since, […]

The post We have guardrails for that is not a control – Here’s the difference appeared first on DISC InfoSec blog.

Point-in-time remediation is dead against a persistent adversary

disc7 — Thu, 03 Sep 2026 04:31:30 +0000

The Rise of Fully Autonomous Offensive Loops Agent collectives found zero-days, shared them, escalated, and moved laterally for weeks — by accident. Automated offense now has an existence proof. Automated defense doesn’t. What defenders should do. Every post in this series has been building toward a question that stopped being hypothetical in July 2026: what […]

The post Point-in-time remediation is dead against a persistent adversary appeared first on DISC InfoSec blog.

Your Security Stack Isn’t Obsolete. Your Operating Model Is

disc7 — Wed, 02 Sep 2026 19:20:40 +0000

Your Security Stack Isn’t Obsolete. Your Operating Model Is. Is Enterprise Cybersecurity Infrastructure Already Obsolete? The $1T Claim, Examined. Palo Alto’s CEO put $1 trillion on the table. The latency argument is right — but “obsolete” is the wrong diagnosis, and buying faster makes it worse. What’s actually structurally dead, and what to do first. […]

The post Your Security Stack Isn’t Obsolete. Your Operating Model Is appeared first on DISC InfoSec blog.

Thirty years of security assumed the attacker was unauthorized – Your agent isn’t

disc7 — Mon, 31 Aug 2026 16:37:05 +0000

Agentic AI Governance: Mitigating Liability and Protecting Information Assets The model decided to do that” is not a legal defense The previous post in this series covered agent security controls — tool scoping, separating decision from execution, memory hygiene, egress control. That’s the engineering layer. This post is about the layer above it, the one […]

The post Thirty years of security assumed the attacker was unauthorized – Your agent isn’t appeared first on DISC InfoSec blog.

Frontier Model, Familiar Framework: Reading Fable 5’s Guardrails Through ISO 42001

disc7 — Sun, 30 Aug 2026 17:47:35 +0000

What Claude Fable 5’s Launch Teaches Us About AI Governance (An ISO 42001 Reading) In June 2026, Anthropic released Claude Fable 5 — the most capable AI model ever made generally available. But the more interesting story isn’t the benchmarks. It’s the governance architecture wrapped around the release. Because here’s the thing: while most organizations […]

The post Frontier Model, Familiar Framework: Reading Fable 5’s Guardrails Through ISO 42001 appeared first on DISC InfoSec blog.

ISO 42001 Evidence Checklist: What Auditors Actually Look For (2026)

disc7 — Sat, 29 Aug 2026 22:49:38 +0000

We Built an ISO 42001 Evidence Checklist for AI Companies — Here’s What Auditors Actually Look For Controls are rarely why organisations fail an ISO 42001 audit. Evidence is…A clause-by-clause evidence checklist, the seven patterns that separate a pass from a finding, and the questions auditors actually ask. ISO 42001 evidence checklist, ISO 42001 audit, […]

The post ISO 42001 Evidence Checklist: What Auditors Actually Look For (2026) appeared first on DISC InfoSec blog.

Agents don’t produce wrong answers anymore They take wrong actions – A practitioner’s guide to agent security

disc7 — Fri, 28 Aug 2026 16:30:22 +0000

AI Agent Security: Nobody Authorized That Action, and That’s the Problem The last two posts in this series ended in the same place from different directions. The one on AI-executable workflows argued that when the convertible tasks leave, what remains valuable is specification, oversight, evidence, boundary judgment, and the signature. The one on Bay Area […]

The post Agents don’t produce wrong answers anymore They take wrong actions – A practitioner’s guide to agent security appeared first on DISC InfoSec blog.

AI Governance for Bay Area Startups: What to Put in Place Before Enterprise Customers Ask

disc7 — Tue, 25 Aug 2026 16:30:03 +0000

AI Governance for Bay Area Startups: What to Put in Place Before Enterprise Customers Ask There’s a specific email that changes a startup’s quarter. It arrives from a champion who is genuinely on your side, and it reads something like: “Security review went fine, but our AI risk team added a section. Can you send […]

The post AI Governance for Bay Area Startups: What to Put in Place Before Enterprise Customers Ask appeared first on DISC InfoSec blog.

How Much of Your Job Can Become an AI-Executable Workflow — and What’s Left Standing When It Does

disc7 — Mon, 24 Aug 2026 16:34:30 +0000

How Much of a Job Can AI Automate? What Remains valuable is not the leftover task In my last post I argued that governing AI is a more durable bet than racing to build with it. The obvious follow-up question is the harder one, and it’s the question I now get asked in almost every […]

The post How Much of Your Job Can Become an AI-Executable Workflow — and What’s Left Standing When It Does appeared first on DISC InfoSec blog.

The AIMS/ISMS readiness ladder: seven steps from curious to certified

disc7 — Thu, 20 Aug 2026 17:38:49 +0000

A practical seven-step path from a 15-minute readiness call to ISO 42001 and ISO 27001 certification — with the prep work that makes each step fast instead of painful. Most organizations don’t stall on ISO 42001 or ISO 27001 because the standards are hard. They stall because step one is unclear, and the gap between […]

The post The AIMS/ISMS readiness ladder: seven steps from curious to certified appeared first on DISC InfoSec blog.

AI Governance Careers: The Skills Gap Nobody Is Filling (2026)

disc7 — Mon, 17 Aug 2026 18:51:20 +0000

Everyone Is Learning to Build With AI. Almost Nobody Is Learning to Govern It. I keep meeting people who are burning nights and weekends teaching themselves to build with AI. Agents, RAG pipelines, orchestration frameworks, the whole stack. I understand the instinct completely. The tooling is genuinely exciting, the demand looks self-evident, and nobody wants […]

The post AI Governance Careers: The Skills Gap Nobody Is Filling (2026) appeared first on DISC InfoSec blog.

AI Governance & Cybersecurity That Holds Up Under Scrutiny

disc7 — Sat, 15 Aug 2026 22:08:34 +0000

AI risk is moving faster than most organizations’ governance programs. Expert AI Governance and Cybersecurity Consulting Strengthening B2B SaaS and Financial Services with Robust Compliance Frameworks – DISC InfoSec turn AI governance and cybersecurity requirements into practical, defensible programs—not another stack of policies. Deura Information Security Consulting LLC provides expert guidance for B2B SaaS and […]

The post AI Governance & Cybersecurity That Holds Up Under Scrutiny appeared first on DISC InfoSec blog.

“Sorry, Typo”: Why a Markdown File Is Not a Security Control

disc7 — Mon, 10 Aug 2026 17:33:07 +0000

“Sorry, Typo”: Why a Markdown File Is Not a Security Control PCWorld ran a piece last week on the one command you should never let an AI coding agent execute: rm -rf. The reporting is solid and the anecdotes are grim — developers who let an agent handle a routine cleanup task and lost a […]

The post “Sorry, Typo”: Why a Markdown File Is Not a Security Control appeared first on DISC InfoSec blog.