Your CISO Wants Zero Risk. That's the Wrong Mission.

Anthropic's deputy CISO, Jason Clinton, published a guide to securing AI agents this month. One line in it should reset how every technology leader thinks about deployment: "A CISO's responsibility in the age of agentic AI is not to achieve zero risk. Instead, our jobs are to make agentic risk legible and bounded."

Read that again. The person responsible for security at one of the most advanced AI companies on the planet just said the goal is not zero risk.

He's right. And the leaders still chasing zero risk are the ones whose agents will never ship.

Zero Risk Is a Fantasy, and It's Expensive

Here's what changed. Clinton points out that frontier models have compressed the time from vulnerability to exploit from months down to hours. Attacks now run at machine speed. Defense has to run at machine speed too.

You can't hit zero risk in that world. Nobody can. The only way to guarantee zero risk from an AI agent is to never deploy one, and while you sit in committee meetings debating whether it's safe enough, your competitor already shipped, learned, and shipped again.

Chasing zero risk feels responsible. It isn't. It's the most expensive decision on the table, because the cost doesn't show up on a line item. It shows up as the market you didn't enter and the capability you never built.

Prioritize and Execute means you identify the highest-impact risk, you bound it, and you move. You don't try to eliminate every risk at once. That's not caution. That's paralysis wearing a badge that says caution.

The Four Questions That Actually Matter

Clinton replaces the impossible standard with four questions every team should answer before an agent touches production. They're worth memorizing.

Untrusted content. What can this agent read that an attacker controls? External email, public repos, third-party documents, a support ticket. If an agent ingests text, that text can carry instructions. Assume it will.

Actions and identity. What can this agent actually do, and whose identity is it doing it under? An agent that can only read is a very different animal than one that can send money or delete records.

Blast radius. If this goes wrong, how far does the damage spread? One inbox or the whole customer database? You scope the blast radius before deployment, not after the incident.

Observability. Can you reconstruct exactly what the agent did from your logs? If the answer is no, you don't have an agent. You have a liability you can't audit.

Notice what these questions do. They don't ask "is it safe." They ask "do we understand the risk and have we bounded it." That's the whole shift. Legible and bounded, not perfect.

The Dangerous Middle Ground

Clinton's framework enforces two identity modes, and the discipline here is the point.

Either the agent runs as a service account, autonomous, single-purpose, and locked to least privilege, or it runs under human credentials with an accountable person supervising it. Those are the only two options.

The danger is the space between them. A delegated human identity drifting through systems with nobody actually watching is where accountability dissolves. It looks supervised on the org chart. In practice, no one owns it. When something breaks, everyone points at the tool.

Simple and Secure is a pillar for a reason. If you can't say in one sentence what identity an agent runs under and who owns it, you've already lost the thread. Complexity is where breaches hide.

The Boring Infrastructure Is the Whole Job

Here's the part people skip. Clinton's controls aren't clever prompts telling the agent to behave. They're plumbing: cryptographically-rooted identity, sandboxed execution, egress allowlisting, telemetry on everything, and an organization-wide kill switch.

None of that is exciting. All of it is the actual work. You don't secure an agent by asking it nicely in the system prompt. You secure it by building the boring stuff first, the same clean identity and access foundation that should have been in place before you bought a single AI tool.

And the numbers say this isn't theoretical. More than half of Anthropic's internal pull-request code is now agent-authored. They aren't writing this from the sidelines. They run their own company on agents and built the guardrails to match. Meanwhile the Ponemon Institute puts average insider-incident containment at 67 days. Two months to notice something went wrong. Observability isn't a nice-to-have when your window to catch a problem is that wide.

The Real Assignment

Your security team's job was never to make risk disappear. It was to make risk something you can see, size, and stand behind.

If your CISO is holding agents hostage until they're perfectly safe, they've misread the assignment. And if you're the one asking for zero risk, you're not protecting the business. You're stalling it.

Legible and bounded. Then execute.