AES Conversation
Starters

What you’ll hear: "EDR would catch anything bad." · "We block extension installs by policy." · "Developers have an exception."

How to read it: “EDR would catch it” is the answer to defend against, not argue with. “Developers have an exception” is a gift — the highest-privilege population just told you it has the weakest control.

Your answer: “EDR is genuinely good at malicious. The problem here is mostly not malicious — it is a real package from a real publisher, at a version with a known issue, holding a token that reaches production. That never looks like an attack, so it never fires. It is a software-supply-chain question wearing an endpoint costume.”

What you’ll hear: "Everyone uses Copilot." · "Engineering picks their own tools." · "We standardised on one, officially."

How to read it: “Officially” is the word to listen for. Standardisation on paper plus tool freedom in practice is the exact condition AES discovery is built to expose, and it produces the proof moment in week one.

Your answer: “We are not trying to take tools away from engineers — that fails. We inventory what is actually installed, at what version, from which publisher, with what permissions, then hand you a ranked list. Most of it you keep. A small slice you fix. That is a far easier internal conversation than a ban.”

What you’ll hear: "Joiner-mover-leaver handles that." · "We rotate credentials annually." · "That would be an identity problem."

How to read it: Dormant agents are the cleanest possible finding — no business owner will defend them, so remediation is politically free. If they say “identity problem,” they just named the internal team to recruit as your champion.

Your answer: “Agreed it is an identity problem — that is exactly why Palo Alto acquired CyberArk and rebuilt it as Idira. Prisma AIRS discovery is explicitly designed to find shadow and inactive agents that still hold access. We start there because it is the one category where nobody argues, so you get a fast uncontested win that funds the harder conversations.”

What you’ll hear: "A few pilots." · "Marketing built something in Salesforce." · "That’s the platform team’s problem."

How to read it: “A few pilots” is almost always an order of magnitude low. Citizen-built agents inherit the builder’s permissions, which are routinely broader than any application the security team has ever reviewed.

Your answer: “The pattern we keep seeing is a business user granting an agent their own access because that was the fastest way to make it work. SaaS agent security discovers and monitors agents, copilots, and plugins across more than ten platforms including Copilot Studio, ServiceNow, and Agentforce, and shows which touch sensitive data. The part we operate is the ownership question — every agent needs a named accountable human.”

What you’ll hear: "Probably all of them." · "We scoped them at build time." · "It was easier to give broad access during the pilot."

How to read it: “Easier during the pilot” is the most common and most useful answer — pilot-era permissions almost never get walked back, and those pilots are now in production. This is your privilege-reduction business case, quantified.

Your answer: “Standing privilege is what turns a minor agent misbehaviour into a major incident. The measurable outcome is reducing the count of agents holding permanent broad access, and the report shows that number falling quarter over quarter. That is a metric a board understands without a security briefing.”

What you’ll hear: "Everything’s read-only right now." · "We’re enabling write actions next quarter." · "There’s an approval step in the workflow."

How to read it: “Read-only for now, write next quarter” is the best timing signal you will get. The governance design has to land before that switch flips, which gives your service a deadline the customer set themselves.

Your answer: “Then let’s build the gate before you need it. Cortex AgentiX is designed for exactly this — you define when agents act independently and when they require approval for high-impact actions, operating inside existing roles and permissions with full transparency into the reasoning. We classify which actions are sensitive and set the approval policy; blocklist and policy-changing actions always stay human-approved.”

What you’ll hear: "It’s containerised." · "It only has access to one system." · "We’d have to trace it."

How to read it: “Only one system” is almost always wrong once you follow the token. The value of this question is not the answer — it is watching the room realise nobody owns the answer.

Your answer: “This is why we correlate rather than just inventory. Endpoint artifacts alone tell you an agent exists; joining them to authorised external exposure intelligence tells you which reachable service the agent’s configuration points at, what credential scope it carries, and which host is exposed. That graph turns ‘we have an agent’ into ‘here is the path, ranked.’”

What you’ll hear: "What’s a skill?" · "That goes through the same review." · "Developers install those themselves."

How to read it: If they cannot name the review gate for a skill, there isn’t one. The install path is a file copy, the review step is optional, and the artifact can run code with a developer’s credentials.

Your answer: “A skill is functionally a package with none of the controls you spent twenty years building for packages — no signing requirement, no registry policy, no version pinning. AES treats those artifacts as first-class inventory: publisher, version, permission scope, and behaviour. We operate the policy and the exception register on top.”

What you’ll hear: "We use a commercial API." · "Data science pulls models from a hub." · "We scanned the container."

How to read it: “We scanned the container” is the tell — container scanning does not inspect model internals. If data science pulls from a public hub with no gate, security has never seen that supply chain.

Your answer: “A model file is executable content in practice. Prisma AIRS model security performs deep inspection for architectural backdoors, poisoning, and malicious code inside model components before deployment. Practically, we put a gate in front of the hub so inspection happens once, at intake, instead of never.”

What you’ll hear: "We did a pen test last year." · "The red team looked at it once." · "There was no retest."

How to read it: “No retest” is the whole opportunity. A one-time test is a document; a scored, repeated test is a trend line, and a trend line is what justifies a retainer instead of a project.

Your answer: “Prisma AIRS red teaming runs automated scans against a model, application, or agent using crafted attack prompts and returns a 0–100 risk score. Unit 42 Frontier AI Defense goes further — it validates whether an exposure is actually exploitable and connects weaknesses into attack paths. We own the cadence, triage the findings, drive the fixes, and show the same population scoring better next quarter.”

What you’ll hear: "Finance flagged a spike last month." · "That’s the platform team’s dashboard." · "We cap it at the provider."

How to read it: This is the question that gets a CFO into the room. Cost is the only agent-governance metric that is already someone’s job, so it opens budget doors pure risk framing cannot.

Your answer: “Runaway token spend and a compromised agent look identical from a distance — both are an agent doing far more work than its task requires. Chronosphere supports OpenTelemetry GenAI standards for real-time visibility into input, output, and total token spend by model, plus execution traces and tool-call reliability. We set the thresholds and own the alerts, so the same telemetry serves finance and security from one place.”

What you’ll hear: "Too much." · "We’re mid-renewal on the SIEM." · "Retention is a compliance requirement."

How to read it: “Mid-renewal on the SIEM” is the highest-value sentence on this page. It gives you a funded event, a deadline, and a comparison the customer is already making.

Your answer: “There is a lower-risk first move than replacing your SIEM. The Chronosphere Telemetry Pipeline is a Fluent Bit-based control plane that collects from hundreds of sources, then filters, normalises, enriches, and routes — with a Cortex XSIAM destination plugin shipping today. Security-relevant data lands in XSIAM while high-volume application logs stay queryable where they are. Fund the platform conversation with the savings.”

What you’ll hear: "Our AI policy." · "We’d pull screenshots." · "That question is already in vendor questionnaires."

How to read it: “Already in questionnaires” means the requirement is external and revenue-linked, which moves it out of the security budget queue. A policy PDF is an intention; an inventory with decisions and dates is evidence.

Your answer: “We deliver a CycloneDX AI/ML bill of materials plus exposure correlation and human-reviewed findings — a portable evidence object you own, reusable across audits, questionnaires, and board reporting, rather than another dashboard you log into to screenshot.”

What you’ll hear: "We’re still human-in-the-loop everywhere." · "Per program, not per agent." · "It was set during the pilot."

How to read it: Most customers can answer per program, not per agent. That gap is the finding. Autonomy set once during a pilot and never revisited when the agent moved to production is the most common governance failure in the category.

Your answer: “Autonomy is a per-agent setting with a per-agent blast radius, so it needs a per-agent review with a named owner. We classify each agent by autonomy tier and by whether its actions are reversible, then set the approval gate where irreversible meets unsupervised. AgentiX enforces that split without slowing the reversible work down.”

What you’ll hear: "We’d show the number of findings." · "We don’t have a baseline." · "We report incidents, not exposure."

How to read it: Reporting findings found is a growing number that looks like failure. Reporting exposure reduced on the same population is the only version a board rewards. If there is no baseline, the assessment is the baseline — and that is your entry offer.

Your answer: “The deliverable we build toward is a before-and-after on the same population, mapped to a named framework — NIST AI RMF or ISO/IEC 42001, whichever your auditors already speak. Findings found is a project metric. Exposure reduced is the one that renews.”