AI has quietly changed roles inside the enterprise from assistant to actor, capable of accessing data, invoking APIs, and making decisions on its own. That shift is rewriting the fundamentals of identity, trust, and access that security teams have relied on for years. In this conversation, Abbas Kudrati, Field CISO, APCJ, F5, unpacks why authentication alone can no longer signal trust, and why authority and intent must now be verified continuously, at runtime. He explains how Zero Trust must evolve to govern not just access but delegation, how shadow AI should be met with better guardrails rather than blanket bans, and why hybrid multicloud environments raise the stakes on blast radius and resilience. Kudrati also outlines what an “AI-ready” application and API security architecture looks like in practice, and why the organisations that scale AI fastest without losing control—not those using the most AI—will define the next 12 to 18 months.
Field CISO, APCJ
F5
CISO Forum: As Field CISO for APCJ, what shifts are you seeing in how enterprises across this region are approaching AI security compared to a year ago, and where are the biggest gaps?
Abbas Kudrati: The biggest shift I’m seeing is that AI has moved from being an assistant to becoming an actor inside the enterprise.
A year ago, many conversations were focused on securing GenAI applications, protecting data and managing employee use of AI tools. Today, organisations are embedding AI into business processes, connecting it to APIs and enterprise data, and increasingly allowing AI agents to make decisions and take actions.
That fundamentally changes the security equation. When an AI system can access data, invoke an API, call a tool or make a decision autonomously, the question is no longer simply, ‘Is the AI secure?’ We need to ask, ‘What can this AI actually do, what identity is it using, and how much authority have we given it?’
The biggest gap I see is that AI adoption is moving faster than security visibility and governance. Organisations need to extend security across applications, APIs, models and agents, with controls that operate continuously rather than relying only on point-in-time assessments.
AI security cannot be another silo. It has to become part of the broader security architecture.
CISO Forum: In practical terms, how should CISOs reframe security conversations so AI-led innovation doesn’t stall at the boardroom level?
Abbas Kudrati: I would change the conversation from, ‘Can we safely use AI?’ to ‘How do we safely scale AI?’
Security cannot arrive at the end of the AI journey and become the department that says yes or no. By then, the model, vendor, architecture, data flows, and access permissions may already have been decided.
CISOs need to be involved much earlier and translate AI risk into business terms. Which models are we using? What data can they access? What systems can they interact with? What actions can they take autonomously? And what happens if that AI behaves unexpectedly or is manipulated?
Boards respond much better when security is presented in terms of business impact, accountability and measurable controls, rather than abstract technology risk.
My message to CISOs is simple: don’t position security as the brake on AI. Position security as the mechanism that allows the organisations to accelerate with confidence.
CISO Forum: Frontier AI models are increasingly autonomous and capable. What traditional security assumptions around trust, identity, and access do you believe are breaking down first and what should replace them?
Abbas Kudrati: The first assumption that is breaking down is that authentication equals trust.
I’ve spent much of my career looking at security through the identity lens, and AI agents make that question much more complicated. An agent can act on behalf of a human, call APIs, invoke tools, access data, interact with other agents and potentially continue operating long after the original user interaction.
So, knowing who the agent is remains necessary, but it is no longer sufficient.
We also need to know what the agent is trying to do? What is it allowed to do? What data and tools can it access? Who delegated that authority? And should that authority still exist for this particular action?
I believe identity security is therefore evolving from simply authenticating identities to governing authority and intent at runtime.
In an agentic world, identity tells us who is acting; authorisation tells us what they are allowed to do, in what context and for how long.
That is why least privilege, continuous validation and runtime enforcement become increasingly important as AI becomes more autonomous.
CISO Forum: As AI applications, models, and agents become more interconnected, what does an “AI-ready” application and API security strategy actually look like in architecture, not just in principle?
Abbas Kudrati: An AI-ready architecture needs to recognise that AI is now part of the application and API stack, not something sitting outside it.
I look at this through three layers.
First, visibility: do we know which AI applications, models, agents and APIs are communicating with each other?
Second, governance: do we know what each identity- human or machineis allowed to access and what actions it can take?
Third, run-time protection: can we detect and stop something when behaviour changes, rather than relying only on a policy defined months earlier?
This becomes particularly important with agentic AI. An agent may start with a simple task, but then call another API, access a database, invoke a tool or interact with another agent. That creates an entirely different attack surface.
So, organisations should not secure the model, application and API as isolated components. They need to secure the interactions between them.
That means bringing visibility, API security, AI gateways, guardrails and runtime enforcement together so that security policy follows the AI interaction wherever it goes.
CISO Forum: You’ve referenced AI-powered threats like Mythos reshaping identity security. Can you unpack how these threats are forcing a move from static perimeter-based controls to continuous, run-time-based ones?
Abbas Kudrati: Mythos is a good example of why the traditional security operating model is under pressure.
The fundamental problem is speed. If AI can discover and exploit vulnerabilities faster than organisations can identify, prioritise, patch and deploy fixes, then a purely reactive security model is no longer enough.
I’ve always believed that prevention and remediation remain important. But there will always be a period when a vulnerability exists, and the permanent fix hasn’t been deployed yet.
That is where runtime protection becomes critical.
You can’t always patch at machine speed, but you can put controls in the traffic path that detect and block malicious behaviour while the organisations catch up.
That’s the shift I’m seeing from security decisions made at a point in time to security decisions continuously evaluated at runtime.
AI is accelerating both sides of the equation. Attackers are becoming faster, but defenders also have an opportunity to use AI to improve discovery, analysis and response. The organisations that succeed will combine strong prevention with continuous runtime protection.
CISO Forum: Shadow AI is a growing concern for security leaders. What early warning signs should CISOs be looking for, and what’s the first practical step toward regaining visibility?
Abbas Kudrati: The first warning sign is simple: your employees are using AI services your security team doesn’t know about.
Look for unexpected AI-related traffic, connections to external models and APIs, sensitive or proprietary data moving towards services that haven’t gone through normal governance, and applications suddenly incorporating AI capabilities that weren’t part of the original architecture.
But I would caution CISOs against treating Shadow AI purely as a policy violation.
If employees are using an AI tool because it genuinely makes them more productive, simply blocking it may push that activity somewhere you can see even less.
The first practical step is therefore visibility. Understand what AI services are actually being used, who is using them, what data is being shared and what the business purpose is.
Then create intelligent guardrails rather than simply saying no.
The objective shouldn’t be to stop AI. It should make sanctioned AI easier and safer to use than unsanctioned AI.
CISO Forum: Zero Trust has been a buzzword for years. With AI systems now acting autonomously across workflows, how does the definition of Zero Trust itself need to evolve?
Abbas Kudrati: I don’t think Zero Trust goes away because of AI. AI forces us to finish the job.
Traditionally, we have thought about Zero Trust largely in terms of human identity requesting access to a resource: Who are you? Are you authorised? What are you allowed to access?
With agentic AI, we need to add another question: What authority has been delegated to the machine?
An AI agent might be acting on behalf of a person, but that doesn’t mean it should inherit all of that person’s privileges. It may need access to one application, one dataset or one API for one specific task and nothing more.
So, I see the next evolution of Zero Trust as continuous verification of identity, context, intent and authority.
Don’t just trust the identity. Don’t automatically trust the delegation. And don’t assume that because an agent was authorised to do one thing, it is authorised to do everything.
As machines become actors, Zero Trust must focus on controlling authority, not just access.
CISO Forum: Hybrid multicloud environments already stretch visibility thin. How does layering AI and interconnected agents on top of that complexity change an organisation’s resilience calculus?
Abbas Kudrati: Hybrid multicloud was already difficult because applications, data and identities were distributed across environments. AI adds another layer of dependencyand increasingly those dependencies are dynamic.
The resilience question therefore changes from, ‘Is my application available?’ to ‘What happens to the business workflow if one of these dependencies fails, is compromised or starts behaving unexpectedly?’
This is where security and resilience are becoming much more closely connected.
CISOs need visibility across the entire chain of applications, APIs, identities, models, agents, and data, and they need consistent controls across environments.
Most importantly, they need to understand the blast radius.
If one AI agent or one compromised identity is manipulated, how far can that compromise travel?
We cannot eliminate complexity. Modern enterprises are too distributed for that. The objective is to contain failure so that one compromised component doesn’t become an enterprise-wide incident.
CISO Forum: Having advised enterprises, governments, and financial institutions across Asia Pacific and the Middle East, what’s a mistake you consistently see security leaders make when securing emerging technologies—one that’s easily avoidable?
Abbas Kudrati: The mistake I see most often is treating emerging technology as a technology problem rather than a business and security architecture problem.
I’ve worked with organisations across different industries and geographies, and the pattern is remarkably consistent. New technology arrives, the business moves quickly because there is genuine productivity or competitive opportunity, and security is then asked to assess it after the architecture and operating model have already been established.
By then, security is playing catch-up.
The second mistake is assuming that because something has been authenticated, it can be trusted. That assumption is becoming particularly dangerous with AI and non-human identities.
My advice is simple: start with the outcome, understand the identity and authority involved, establish least privilege, and put controls where the activity actually happens at runtime.
You don’t need to predict every possible threat. You need to build an architecture that can continuously see, evaluate and control behaviour as the environment changes.
That’s much more resilient than trying to secure yesterday’s architecture against tomorrow’s threats.
CISO Forum: Looking ahead 12 to 18 months, what capability or control do you believe will separate organisations that securely scale AI adoption from those that get left exposed?
Abbas Kudrati: The organisations that pull ahead over the next 12 to 18 months will be the ones that build a continuous AI control layer, rather than treating AI security as a one-time assessment.
AI is changing too quickly for a point-in-time security review to be enough. The model can change, an agent can change its behaviour, the tools it can access can change, and the data it interacts with can change.
The critical capability will therefore be the ability to continuously discover, govern, test and protect AIparticularly at runtime.
Another dimension will also become increasingly important: AI economics.
As organisations deploy more agents and connect them to more models and tools, every interaction has both security and cost implications. An autonomous agent can consume tokens, invoke multiple tools and trigger downstream workloads at machine speed.
Organisations need to know not only, ‘Is this interaction safe?’ but also ‘Should this interaction happen, which model should handle it, and what is it costing us?’
Ultimately, I see the future AI control layer bringing together security, identity, governance, observability and economics.
And the winners will not necessarily be the organisations using the most AI.
The winners will be the organisations that can scale AI the fastest without losing control.
