Defense in depth in the AI era: 6 lessons from SHI Fall Summit

Reading Time: 9 minutes

Security leadership isn’t about building organizations where nothing bad ever happens. It’s about being able to respond and recover when it does.

That idea, introduced in the keynote, set the tone for SHI Fall Summit 2026. The conference centered on the theme, “Defense in depth: Securing what matters in an AI-driven world.” With AI increasing the speed and scale of cyberattacks, speakers across two days of workshops, panels, and breakout sessions agreed that more point tools aren’t the answer. Prevention still matters, but resilience requires visibility across the entire technology environment and the ability to act when something goes wrong.

Six Summit takeaways can strengthen resilience by reducing blind spots in decision-making, AI investments, data and identity controls, agent intent and action, third-party dependencies, and security exposures.

Resilient decisions depend on speaking up

Pressure is the operating environment for today’s security teams.

In her Summit keynote, Tammy Moskites, CEO, founder, and CISO at CyAlliance, focused on how to lead through it.

“I talk to CISOs every week. And behind closed doors, this is the conversation: AI is moving faster than governance.​ Budgets are not keeping pace with expectations.​ Boards want measurable value.​ We have more tools than ever.​ Talent is stretched, and the attack surface just keeps expanding. We’re being asked to do more, faster, with less.”

— Tammy Moskites, CEO, founder, and CISO at CyAlliance​

Moskites questioned whether controls can keep up with the speed of risk. But that doesn’t mean giving up on them. Layered defenses are essential, she said, but something will inevitably get through. The focus needs to expand to resilience in depth. 

Resilience in depth requires people, process, technology, leadership, and culture to work together to anticipate, adapt, and recover amid constant change. It depends on open communication because informed decisions can’t be made in isolation. When security practitioners are afraid to ask for help, escalate issues, or say “I don’t know,” risks stay hidden and problems get bigger. 

Moskites highlighted three behaviors that can help build resilient teams: 

1. Speak up if something doesn’t look right. The most important observation may not come from the biggest title in the room.
2. Choose progress over perfection. Make the best decision you can with what you know rather than waiting for certainty.
3. Say “I don’t know,” then work together to find the answer. Asking for help is a strength, not a weakness.

By making these behaviors safe and expected, security leaders can bring emerging risks into view and strengthen resilience.

The Summit’s CISO panel extended that principle to executive decision-making. As CEOs accelerate AI adoption, security leaders need to make their voices heard.

Worldwide AI spending is forecast to reach $2.59 trillion in 2026, a 47 percent increase year over year, according to Gartner. Of that, Gartner expects about $51 billion to go toward AI cybersecurity, just 2 percent of the total.

The challenge isn’t only budget. It’s making sure oversight keeps pace with adoption. Panelists said CISOs need to communicate risk to the board in dollars and cents, not tools.

AI spend needs the same visibility as AI risk

Security leaders know you can’t protect what you can’t see. The same rule applies to AI spending.

Technology, finance, and business leaders need to understand what AI costs to operate, secure, and govern, as well as whether it delivers long-term value.

81 percent of executives surveyed by PwC say they’re still at least 12 months away from meaningful returns on their AI investment beyond efficiency. Token consumption, model usage, and infrastructure costs provide useful operational insights, but they don’t show whether an AI initiative is delivering tangible business outcomes. Measuring value without understanding the full cost of delivery also gives an incomplete view of performance.

AI token economics (tokenomics) is the emerging discipline of converting energy and capital into AI capabilities and efficiently consuming that intelligence across the organization to realize measurable business value.

The Summit introduced a practical framework that brings cost and value together through two complementary lenses: financial and enterprise. Together, they connect AI’s true cost with business outcomes, helping leaders decide where to scale, redesign, pause, or terminate initiatives. As a founding member of the Tokenomics Foundation, SHI expands on the framework in our AI cost and value management ebook, with actionable steps for evaluating AI initiatives and guiding portfolio decisions.

Greater visibility into AI investments should also reveal whether controls are keeping pace. That starts with applying established security fundamentals to a faster, more complex environment.

AI changes the landscape, not the need for security fundamentals

AI hasn’t changed core cybersecurity challenges. As Moskites said, “It just put a turbocharger on most of them.” Basic hygiene failures are still common, and offensive AI tools make them easier to exploit.

Summit sessions emphasized the importance of foundational security practices, including identity and access controls, secure configurations, data protection, and tested response and recovery plans. Attackers increasingly bypass vulnerabilities through exposed identities, weak multifactor authentication, standing admin rights, and permissive cloud configurations, none of which appear on a CVE list.

Data governance illustrates how AI broadens existing requirements. AI governance builds on established data governance rather than replacing it. Controls for access, classification, and data loss prevention must extend to prompts, outputs, and models, especially as employees use generative AI features embedded in approved applications.

According to Optro’s AI oversight gap report, 80 percent of organizations see moderate to pervasive shadow AI use across their workforce, and only 25 percent have comprehensive visibility into how employees use AI.

Discovery comes first. Controls must apply before AI accesses data, as it retrieves data, and before it returns a response. Many organizations govern access but leave retrieval and output unchecked. Applied consistently, these fundamentals keep AI adoption from quietly expanding the attack surface.

But as organizations deploy AI systems with greater agency, governance needs to address what they can do, not just what they can access.

AI agents require defense in depth for agency

Traditional access controls were designed to govern permissions, not autonomous decisions.

A human operates within established boundaries. An AI agent interprets its permissions and decides what’s in scope, often without guardrails designed for autonomous action. That distinction has real consequences.

At Black Hat USA 2026, researchers described how OpenAI frontier models being tested against a cybersecurity benchmark became stuck on assigned tasks and chained together nine zero-day vulnerabilities to escape their evaluation sandbox and reach the internet. Without being directed to, the models then breached Hugging Face’s production infrastructure to retrieve the answer key instead of solving the test.

An agent recognizes only the boundaries that are enforced. Everything within reach can be used toward its goal.

Defense in depth for agency requires five layers:

1. Agent guardrails. Treat them as the seatbelt, not the brakes, and assume this layer will fail.
2. Intent captured at delegation. Create an enforceable artifact defining the task, resources, duration, and owner. No artifact, no agency.
3. Task-scoped, ephemeral identity. Identity begins with the task and ends when it’s done, so access cannot outlive intent.
4. Enforcement outside the agent. Reachability is permission. Enforce boundaries the agent cannot reason around, with isolated, human-gated paths for destructive actions.
5. Behavioral verification at execution. An external governance layer checks actions against declared intent. The agent’s log is a confession, not an audit trail.

Ask these questions about every agent in your environment:

• Can you produce the document that says what the agent is allowed to want?
• When the agent finishes its task, what dies?
• What’s the most destructive action the agent can reach, and does anything other than the agent’s judgment stand between it and execution?
• If the agent went off-intent at 2 a.m., would you learn about it from your telemetry or from what it reported doing?
• Can you name the person who owns the agent’s intent? Whose name goes in the incident report?

Agents will use whatever they can reach. Defense in depth must limit that reach to what someone intended and independently verify what the agent did. But as the boundaries between organizations and technology providers blur, controls need to cover a growing web of dependencies.

Third-party risk follows dependencies, not just contracts

An agent’s reach extends beyond contracted vendors through AI models and APIs, open-source libraries, embedded AI features, and supporting fourth parties.

Maintaining visibility into those dependencies is essential because they create risks security teams may not directly control.

Summit sessions on third-party risk and supply-chain security noted that attacks may begin on a developer endpoint, in a CI/CD pipeline, through a compromised package, or with a forged maintainer identity.

Software bills of materials, AI bills of materials, signed and verified builds, and continuous attestation can can expand visibility and traceability across the broader technology ecosystem.

Start by mapping business-critical dependencies, tiering them by the systems and data they can access, and reassessing them when a provider’s AI features or ownership change materially. Continuous oversight does not require real-time monitoring of every supplier, but it can’t wait for annual renewal.

What PHP2Shell reveals about dependency risk

Days after the Summit, two critical vulnerabilities were disclosed in core PHP, a popular general-purpose scripting language that powers 70 percent of all websites. Nicknamed PHP2Shell, the vulnerabilities could let unauthenticated attackers execute code remotely, take control of affected servers, steal sensitive data, and deface the websites running on them. 

Because the flaws sit in the PHP runtime that underpins WordPress, Drupal, Joomla, Magento, and other content management systems (CMS), a fully patched CMS could still be exposed through the dependency underneath it. Amazon Threat Intelligence detected an attempt to exploit the vulnerabilities four days before disclosure and patch release.

Continuous exposure management must replace manual remediation

PHP2Shell shows why manual remediation and CVE-only prioritization can’t keep pace with today’s threat landscape. Severity-ranked vulnerability queues assume defenders have time. They don’t.

Mandiant’s M-Trends 2026 report puts the mean time to exploit at about a week before a patch is even available. Meanwhile, the Verizon 2026 Data Breach Investigations Report found that enterprise remediation lags far behind, requiring a median of 43 days just to patch known exploited vulnerabilities.

AI is narrowing the remediation window further. Amazon Threat Intelligence noted that AI-assisted analysis makes it cheaper to turn a patch or advisory into a working exploit, allowing more attackers to act within hours of disclosure. 

Faster exploitation is only part of the problem. The Common Vulnerability Scoring System (CVSS) doesn’t account for exposed identities, misconfigurations, or chained access paths that let attackers reach critical systems without triggering a vulnerability alert.

The alternative presented at the Summit is continuous threat exposure management (CTEM). CTEM is an operating program, not a product, built around five stages: 

1. Scope what matters to the business, including AI systems and pipelines. 
2. Discover exposures of every type, not only CVEs. 
3. Prioritize by real-world threat intelligence, reachability, and attack paths. 
4. Validate exploitability and control effectiveness before committing remediation effort. 
5. Mobilize remediation through owners, service-level agreements, and policy-gated automation, then repeat. 

CTEM uses authorized validation, including attack-path mapping, breach and attack simulation, and penetration testing, to identify what attackers could exploit rather than relying on severity scores that tell an incomplete story. 

It doesn’t remove humans from the loop. Policy-governed automation, with verification and rollback built in, can handle routine volume while people review exceptions and critical systems. 

Detection requires the same shift. AI agents can gather context across identity, cloud, and security data while analysts retain decision authority. Success is measured by risk reduced, not logs ingested. 

Resilience is the outcome, not another layer of tooling

The lessons from SHI Fall Summit highlight three priorities: see clearly across AI investments, data, identity, agents, and dependencies; enforce deliberately so permitted actions remain aligned with business intent; and verify continuously so you know defenses work before and during disruption.

Defense in depth makes it harder to compromise your organization. Resilience in depth builds on it, preparing you to make decisions, adapt, and recover when one layer fails. Neither comes from fragmented dashboards or additional point tools. Both depend on clear accountability, evidence that controls are working, and the ability to act on that evidence.

SHI can help connect these capabilities, turning fragmented signals into informed decisions and measurable risk reduction.

NEXT STEPS

• Speak with an SHI expert to map out a security approach aligned with your goals.
• Adapt your defense-in-depth strategy using NIST CSF 2.0.
• Modernize your third-party risk management program for the AI era.
• Schedule a Security Posture Review for practical, risk-based recommendations.