What Enterprises Get Wrong About AI Agent Security with Adrian Salas
In the fourth episode of Simform’s Enterprise Cloud and AI Forum (ECAF), Adrian Salas, Chief Information Security Officer at a leading healthcare workforce technology company, joins host Rameshwar Balanagu, Co-Founder, Dallas CTO Club, for a conversation about what happens after the rules written for an AI agent fail.
Adrian has spent more than 20 years securing healthcare, fintech and crypto businesses as a full-time and fractional security leader. He has seen that the weak point in AI security rarely sits where teams build their defenses first, and that a written policy can leave it untouched. If your AI policy has never been tested against an agent trying to get around it, this conversation tells you where to look first.
Key Takeaways for the Viewers
The prompt layer is not where AI agent security actually holds
Adrian explains where the control has to sit instead, why it has to be tied to identity at the data source, and why most teams building agents have not placed it there yet.
A written AI governance policy and an enforced one are two different risk profiles
The gap between them is where most enterprise AI exposure lives. Adrian names the one condition that separates them and what to check in your own program.
Security can approve a release it is not fully satisfied with, under the right conditions
Most security leaders make this call differently every time. Adrian walks through the repeatable method he uses and what has to be in place before he signs off.
Every board AI decision rests on a question most boards have not answered yet
Adrian shares what that question is and why it has to come first. The enterprises that skip it keep arriving at the same governance deadlock.
Cyber insurance still scores you on controls that predate the AI threat model
The questionnaire has not caught up with what agents can reach. Adrian describes what the carriers asking sharper questions have started including in their assessments.
Developers do not ignore security findings because they disagree with them
One change in how the same information was delivered got fifty developers to fix critical flaws and still ship on time. Adrian explains what that change was.
Stay updated with Simform's weekly insights.
Certified to deliver on Microsoft’s highest standardsÂ
As an Azure Expert MSP and Microsoft Solutions Partner across key solution areas, Simform meets Microsoft’s most rigorous benchmarks for architectural excellence, operational maturity, and customer impact. Each designation reflects validated technical depth, successful enterprise deployments, and a consistent track record of delivering measurable business outcomes.
