In this episode of "Full Tech Ahead," host Amanda Razani reports from the Qualys ROCon 2026 conference, interviewing Ivan Milenkovic, VP Cyber Risk Technology at Qualys. They unpack the critical question of who actually owns AI cyber risk within an enterprise.
Milenkovic notes that C-suite executives (CEOs, CFOs, CIOs, CISOs) often display "sloppy shoulders" when pressed on accountability, driven by the novelty and rapid evolution of AI. However, he argues that even as autonomous AI begins launching attacks without human intervention, the root vulnerabilities remain the same: unaddressed technical debt and outdated legacy processes.
To secure the enterprise, Milenkovic advises treating internal AI agents like human users by strictly governing their identities, rotating credentials, and baselining normal behavior.
He also introduces the concept of "Risk Yoga"—practicing holistic, proactive risk management through a Risk Operations Center (ROC) to remain calm and adaptable—while urging leaders to practice fundamental cyber hygiene today to prepare for the approaching horizon of quantum computing.
Key Quotes
- "I used the word during the panel session 'sloppy shoulders' when I was trying to put people on the spot and effectively ask them a simple question: Are you the one owning that risk?"
- "We saw cases where AI sort of made that decision [to hack a company] on its own. That is definitely something different. However... the fundamentals, the base for everything is still the same. We have problems we haven't fixed for a very long time."
- "Bad guys are running businesses. They really take care of ROI. If they can open a bottom drawer and reach for something that's been there the last ten years and you still haven't fixed it, that's what they're going to go for."
- "Make sure that all the agents that are running across your environment obey the same rules that your users have to obey. Make sure that the identities behind those agents are controlled."
Takeaways
- Eliminate "Sloppy Shoulders" in AI Ownership: Executive teams often hesitate to claim direct ownership of AI cyber risk. Leaders must stop hiding behind the novelty of AI or waiting for a perfect framework ("perfection is the enemy of good") and immediately assign clear names and roles to govern data and user access.
- Fix Legacy Processes and Technical Debt: While autonomous, non-human AI attacks are a new phenomenon, they still exploit old, unresolved vulnerabilities. Threat actors prioritize their own ROI and will always target 10-year-old unpatched flaws before spending money on complex exploits. The true bottleneck is fighting modern machine-speed threats with slow, legacy remediation processes.
- Govern AI Agents Like Human Users: To prevent internal "rogue agents" from causing damage, organizations must enforce strict identity and access management for machines. Control agent identities, expire and rotate their credentials regularly, and baseline their "good behavior" now so extraordinary anomalies can be spotted instantly.
- Practice "Risk Yoga" and Prepare for Quantum: Just as yoga trains the mind to remain steady during highs and lows, a Risk Operations Center (ROC) prepares an organization to handle cyber crises without panic. Using a "three lenses" approach—magnifying glass for immediate hygiene, periscope for near-term AI threats, and telescope for the quantum horizon—companies must inventory their data and expiring encryption protocols today before quantum renders them obsolete.
Find Amanda Razani on LinkedIn. https://www.linkedin.com/in/amanda-razani-990a7233/
Follow the FTA LinkedIn Page: https://www.linkedin.com/company/full-tech-ahead/
Visit the FTA website: https://fulltechahead.com/
Check out the Substack Channel: https://fulltechahead.substack.com/
