MONDAYMOVE
One concrete action.
Every Monday.
COMING UP
identity
Map one agent's authority.
The model is rarely the risk. The risk is the connections — what data flows in, what tools it can call, what authority it operates under. If you can't answer these three questions for one agent, you definitely can't answer them at scale.
governance
Write the one-page security narrative for the board.
The CISO role got pulled into the boardroom at exactly the moment security became an engineering problem again. The leaders who keep both audiences are the ones who can speak in plain English about what the program actually does. That skill is built one draft at a time.
forward moves
Treat one agent as a first-class principal.
Agents are going to be the dominant actors in your environment within 24 months. The programs that started treating them as principals — with identity, authorization, and audit — are the ones that won't have to retrofit it under pressure later. Start now, with one.
access
Move one access decision out of the endpoint.
Zero trust became a marketing tier because most "deployments" left the policy on the endpoint. Real zero trust is access decisions expressed as code, in a place you can audit. The pattern that worked for SASE is the same pattern that works for AI gateways.
data
Read one week of DLP alerts you've been ignoring.
The new exfiltration path is a chat window. DLP rules built for email and endpoints don't see prompts. The pattern in the alerts is more useful than any single ticket — it tells you what behavior your existing tools were never designed to govern.
ALL MOVES
Every move, in order.
governance
Convert your last planning review into one commitment sentence and send it before noon.
Your review produced a list. A list is not a commitment.
access
Architect the YES on one blocked AI use case.
Blocking AI is a decision to go blind. Build the yes instead.
forward moves
Pick one chokepoint and make it the policy plane.
The control plane is consolidating, and the gateway is where your policy starts to actually live.
forward moves
Write your next 90-day commitment in one sentence.
The fundamentals didn't change. The blast radius did.
identity
Audit one privileged group and remove one person.
Privileged access creep isn't a tool problem. It's a Monday habit.
detection
Stand up a logging path for one agent
Your AI agent is making decisions in your environment right now. You have no record of most of them.
governance
The Part Nobody Sells You
Security teams are trained to find gaps. No one trains them to see what's already working
inventory
Create a CBOM (Cryptographic Bill of Materials)
Know your public endpoints, TLS version and cypher suites before Friday