In February 2024, a ransomware attack on Change Healthcare froze roughly 40% of US medical claims and left hospitals and physicians unable to get paid for weeks, even though most were never touched by the attackers. vCISO and author Kayne McGladrey explains why Change is still the best case study for concentration risk, why AI dependency is set up to repeat it (this time on purpose), and why "cyber risk" is really business risk with a different trigger.

"I run an independent advisory practice serving SMBs and mid-market firms – companies with enterprise-level risk but no enterprise-level budget for a full-time CISO. A lot of my job involves translation, like turning technical risk into board-ready decisions, and occasionally turning board fantasies about security back into technical reality."

Thinkers360 is proud to officially release the 2026 Top Voices Award winners, our fourth annual list recognizing the most influential thought leaders, analysts and influencers within the Thinkers360 community. This prestigious award celebrates the outstanding contributions of global experts who are shaping the future of business, technology, and sustainability. This year’s list honors top-tier academics, advisors, analysts, authors, consultants, executives, influencers, and speakers. These are the individuals who have made remarkable strides in advancing our collective knowledge and fostering meaningful professional connections.

Ridgeback Network Defense CEO Scott Fogarty welcomes Kayne McGladrey, CISSP, independent vCISO, author, and Senior IEEE Member, to Commanding Cyber.

Kayne McGladrey, an IEEE Senior Member and cybersecurity adviser, has tracked the agent identity gap across enterprises for the past year. In previous VentureBeat reporting, McGladrey described organizations as defaulting to human-style user profiles for AI agents, a practice that can lead to permission sprawl from the start. SOC 2, ISO 27001 and PCI DSS have not fully operationalized agent identities. A decision model that returns probabilities instead of prose does not map neatly onto those existing audit categories.

Kayne McGladrey, senior IEEE member, independent vCISO, and author of "Cyber Risk is a Myth," told VentureBeat that the privilege problem predates agents by decades. “We’ve had this pattern for 40-plus years,” McGladrey said. “Take this user account and clone it to that user account. We’re now doing that with agentic systems, except it’s an agent, not a human, and as we’ve seen with agentic AI, it does whatever it needs to do to get its job done, and sometimes that uses far more permissions than it should.”

Push notifications can give “a preview into people’s lives that they don’t really think about and that they don’t know they’re inadvertently disclosing,” McGladrey says. That’s because these notifications typically show the exact text of whatever message or email you’ve received. There’s no censor.

McGladrey offered a blunter test for CISOs weighing the decision. Most victims of AI-driven attacks, he said, "were losing to basic cybersecurity hygiene failures long before the swarms of agents arrived." His advice was to identify key business systems and the technical risks to those systems, and to close those gaps before buying the next generation of AI tooling.

Twenty-five years after 9/11, the systems built to make sense of instability are running lighter just as instability stacks up. The lead this week is the...

“The vendor owes their customers one page, in writing, before a single priority task lands in anyone’s queue,” McGladrey wrote in an email to VentureBeat. “That page should cover where the model sits in the pipeline, whether deterministic code parses the CVEs or the LLM does the counting, who reviewed the output, and what fraction of a 400-row list got verified against the source rather than skimmed.”

In Episode 84, fractional CISO, risk governance expert, and author Kayne McGladrey returns to the show to discuss the complex and rapidly evolving legal and financial realities of AI liability.

McGladrey said access can also be a problem, noting that the Verizon report flagged third-party involvement as contributing to 61% of manufacturing breaches. "Think about always-on VPN credentials issued to equipment vendors years ago that nobody has thought about since the equipment went on the shop floor," McGladrey said.

That 3% has a reason, Kayne McGladrey, author of the forthcoming "Cyber Risk is a Myth" and a senior IEEE member, told VentureBeat during a July interview. "It's only those well-resourced companies that are above the poverty line that have met all the prerequisites," he said.

If a multi-billion-dollar frontier lab can't keep its own models contained during controlled testing, why would you trust your dev team's implementation of an open-weight model? - Kayne McGladrey, fractional CISO

McGladrey walks through how that fails in practice. An agent told to "retrieve the market data report," he explains, could use an unauthenticated connector to skip the payment handshake, hand a fraudulent report to a paying client, and, under a deferred-settlement model that x402 supports, keep the discrepancy hidden until batch reconciliation shows a valid signature that delivered the wrong resource.

Almost nobody has built it. Kayne McGladrey, a senior member of the IEEE, has argued for years that an AI deployment needs a hard governance threshold, a named human holding a kill switch and a way to roll back. Asked whether any Fortune 500 company runs that, he was blunt. “I haven’t seen it done, and no, they haven’t come out and publicly said it,” McGladrey told VentureBeat.

"Kayne McGladrey, an IEEE senior member who advises enterprises on risk, put the funding logic bluntly in an interview with VentureBeat. “Anything that seems to have a cybersecurity flavor is generally put into the cybersecurity risk category, which is a complete fiction,” McGladrey said. “They should be focused on business risks, because if it doesn’t affect the business, like a financial loss, then nobody’s going to pay attention to it, and they will not budget it appropriately.” A rank number from a 29-person vote is a weaker budget argument than the business system the agent touches."

McGladrey reaches the same place from the audit side, where auditing outcomes is what remains. “We can audit code for compliance. We can audit code for security. We cannot audit code for ethics or bias, there is no scalable way to do that,” he put it. “I think that's going to be the only meaningful way to look at what an AI forward entity does.”

Kayne McGladrey, a senior member of the IEEE, has noted the structural distinction that explains why this matters for agent models specifically: "synthetic data lacks the unpredictability of human responses to the unexpected, such as when a window moves or is resized," and behavioral training data is what teaches a model "how tools flow together."

“If you look at the successful investigations over the past five years, there’s been about $350 million in ghost student schemes that have been thwarted,” says Kayne McGladrey, a cybersecurity risk adviser and senior member of IEEE, a nonprofit professional organization that champions technical innovation.