How can anyone tell whether an AI agent’s risk score deserves trust?
Session 4 · ERQI Global Virtual Risk Summit
How do you like my guard rails? An AI love story
Rock Lambros, Cody Scott & Caroline Wong, moderated by David White
Overview
Most AI risk numbers in circulation have not been checked against what actually happens. Rock Lambros, Cody Scott, and Caroline Wong worked through what can be measured about AI agents, starting from Lambros's point that a score unable to separate "the agent did not misbehave" from "we could not see it misbehave" offers comfort, not assurance. Their answer: test rankings against evidence, score agents on the right variables, and record why an agent acted, not just what it produced.
Session 4 recording, ERQI Global Virtual Risk Summit 2026
Rankings built on fear
Lambros co-leads the OWASP Top 10 for LLM Applications, which this year compared the practitioner vote with the incident record. Prompt injection led the vote but sat around twelfth in the incidents, excessive agency climbed from sixth to third, and misinformation ranked second in the record but thirteenth in the vote. He cautioned that the incident data leaned toward deepfakes and disinformation because of one large source, the AIAAIC database. Agreement between the rankings measured a Cohen's kappa of 0.2, with a 90% interval reaching zero, so chance could not be ruled out. Incidents are also reported by business impact, while the list speaks of vulnerabilities.
Wong moved the problem one level down. Agents should be assessed on autonomy and authority separately. A morning briefing agent is fully autonomous and low risk, while an agent that executes a 5 million dollar transaction on command is not autonomous but holds enormous authority. She also separated trust from confidence. "Today, in September 2026, I cannot trust an agent," she said, but confidence can be assigned task by task, much as a new hire earns broader access.
Governance that touches the system
Scott argued that AI governance is a technical discipline, and that GRC systems were built around human actors who are easy to audit. Citing a Workiva benchmark, he noted that over 84% of senior executives were confident in the accuracy of AI outputs they report, while 26% said internal audit was catching more issues that lead to public embarrassment. As he put it, "a system can be fully compliant but not secure." His evidence chain runs from agent identity, to enforcement outside the agent, to a record of the decision and its context, to a control, to an obligation. A scoped scenario, such as customer PII exfiltrated through over-permissioned agents in the next year, with frequency and magnitude modeled as distributions, offers more assurance than any single score.
Where the panel diverged
All three started with inventory. Lambros added short-lived tokens in place of static keys, egress controls wherever agents read content the organization did not write, and a tested kill switch that cascades to sub-agents. Wong asked for cost, historical and projected, because meeting business objectives comes before governance. Scott advised starting with the highest-risk use case, validated with other stakeholders, and called governance the cheapest first step.
Looking ahead, Lambros expected NIST IR 8587 to become a deployment gate and read OpenAI's endorsement of third-party assessment as PR; Scott expected risk quantification to become a core GRC skill; Wong expected firms to learn which tasks are cheaper with humans and which with AI.
“A system can be fully compliant but not secure.”
Cody Scott, on why AI governance is a technical discipline
Key takeaways
1
Check how the number was made
The OWASP comparison of vote and incident data showed weak agreement. Rankings deserve testing against evidence before they drive spending.
Watch at 8:592
Score autonomy and authority separately
An agent with little autonomy can still hold dangerous authority. A single agentic risk rating hides the difference.
Watch at 11:383
Build confidence task by task
Wong would extend access as demonstrated performance justifies it, the way a new employee's access grows.
Watch at 21:544
Capture the decision, not just the output
Scott's chain ties identity, external enforcement, and reasoning records back to controls and obligations.
Watch at 26:135
Start with inventory and credentials
Lambros would follow the inventory by swapping static keys for tokens that expire in minutes. The panel agreed on the first step and differed on what came next.
Watch at 31:18Speakers
Rock Lambros
Director of AI Standards and Governance, Zenity
Founder, RockCyber
Distinguished Fellow, Enterprise Risk Quantification Institute
Cody Scott
GRC Industry Principal, Workiva
Founding Member, Enterprise Risk Quantification Institute
Caroline Wong
Chief Strategy Officer, Axari
Distinguished Fellow, Enterprise Risk Quantification Institute
Moderator
David White
President and Co-founder, Axio
Co-Chair, Enterprise Risk Quantification Institute
