Maxim Bar Kogan — Building an AI Guardian for Enterprise with Onyx Security CEO

In one sentence

The core thesis of the book is that because autonomous agents act 100x to millionx faster than humans, "human-in-the-loop" oversight is no longer viable, requiring a shift from preventing input (DLP) to governing autonomous actions via an independent security architecture.

Why read this (and who it's for)

This book is for enterprise leaders, CISOs, and security architects who are currently grappling with the "market-wide panic" regarding autonomous agent actions. It solves the dilemma of how to adopt high-productivity agents (like coding assistants or automated workflows) without exposing the company to "really bad actions"—such as an agent accidentally publishing private code, deleting a production database, or leaking tokens. After reading this, you will be able to move past the "ban AI" phase and toward a nuanced adoption strategy built on foundational security pillars and independent verification.

The big idea

The central argument is that we are moving from a period of LLM Chat (where the risk was what an employee typed into ChatGPT) to a period of Autonomous Agency. In this new era, agents are empowered with API access to perform loops of actions. Because these actions happen at speeds impossible for humans to monitor, traditional security tools—which rely on identity permissions or endpoint monitoring—fail because they lack the context of why an agent is performing a specific action.

To solve this, the author argues that enterprises must build a "Secure Control Plane." This isn't about running a massive, expensive model to watch every tiny move an agent makes (which would be a cost and latency dealbreaker). Instead, it follows a Blitz Chess logic: use small, specialized models to monitor routine actions and only trigger "overwhelmingly a lot" of intelligence/calculation during high-risk, critical moments. Finally, the author argues that safety cannot be self-certified; enterprises must rely on an independent party whose entire business depends on being right about the agent's behavior.

Key ideas

Exponential Risk of Agency

What it is — As agents gain the ability to decide actions via API access in a loop, the risk of "really bad actions" grows exponentially. Why it matters — Unlike a human making a mistake, an autonomous agent can execute a catastrophic error (like deleting a database) across an entire infrastructure in milliseconds. In the book — The author notes that while the concept of agents was right with early tools like AutoGPT, the models weren'1t good enough yet; now that they are, the risk profile has shifted fundamentally.

Failure of Traditional Security

What it is — Identity-based security and endpoint/API tools are "not very useful" for agents because agents require broad permissions to complete diverse tasks. Why it matters — If you give an agent the permission to "write code," it also has the permission to "delete the repo." Traditional tools can't distinguish between a legitimate task and a catastrophic mistake without contextual awareness. In the book — The author highlights that these tools lack the "context" to understand why an agent is doing something, making them insufficient for the agency era.

The "Human-in-the-loop" Failure

What it is — The belief that a human can oversee every action an agent takes is fundamentally flawed due to scale. Why it matters — Because actions are happening 100x, 1,000x, or millionx faster than humans can process information, manual oversight becomes a bottleneck that prevents adoption. In the book — The author explicitly states: "human in the loop... that's not going to work."

Independent Verification & Data Privacy

What it is — Enterprises are reluctant to share agent data with "data-hungry companies" like Anthropic or OpenAI because those labs will train on that data. Why it matters — To stay safe, enterprises need an independent party whose "whole business depends on telling you that this thing is correct." In the book — Onyx positions itself as this independent layer, analyzing historical agent behavior without feeding that data back into the foundation model labs.

Efficiency vs. Intelligence (The Blitz Chess Analogy)

What it is — A technical architecture where "very not smart" (small) models are specialized to decide if a smarter agent needs to interject or look at an action. Why it matters — Running a high-intelligence model for every single agent action is a dealbreaker due to cost, latency, and reliability issues. In the book — The author uses the Blitz Chess analogy: top players make intuitive moves based on experience but stop to calculate deeply only during high-risk, critical moments.

Revenue Preservation

What it is — The fundamental goal of security is not "compliance" or "checking boxes," but preserving revenue. Why it matters — Because the "pain is so strong" when a system goes down, enterprises will partner with early startups that can provide immediate relief from agent-related risks. In the book — This principle drives the urgency for building a Secure Control Plane to prevent systemic risks like airlines or power plants going down.

Frameworks & tools

The Pragmatic Security Strategy

Use this two-phase approach to move from panic to production:

1. Phase 1 (Quick Fixes): Identify and mitigate immediate risks through patching, mitigating controls, and establishing "know-how" playbooks.
2. Phase 2 (Foundational Pillars): Establish the permanent architecture including identity lockdowns, firewalls, and endpoint detection tailored specifically to AI asset classes/stacks.

The Secure Control Plane Architecture

To build a guardian for your enterprise agents, follow this logic:

1. Hook: Connect all enterprise AIs/agents into a centralized monitoring system.
2. Filter: Use small, specialized models to monitor routine actions (low-risk).
3. Escalate: When the small model detects a high-risk action, trigger a "smart" agent to interject and verify the move.
4. Verify: Ensure the verification is done by an independent party, not the vendor of the agent itself.

Memorable examples & stories

The Blitz Chess Analogy

Top chess players don't calculate every possible move in a simple opening; they use intuition. They only "calculate deeply" when the position becomes critical. Onyx applies this to AI: only spend "overwhelmingly a lot" of intelligence on high-risk situations to save on cost and latency. Lesson: Efficiency in security comes from knowing which moments actually require deep calculation.

The Evolution of AutoGPT

AutoGPT was the first truly autonomous agent, allowing models to decide actions via API access in a loop. While the concept was correct, the underlying models (like GPT-4) weren't yet sophisticated enough to execute reliably. Lesson: Technology moves in cycles; we are now in the era where the models finally match the ambition of the agents.

The "Mythos" Level Reality

The author points out that "there's a Chinese model that's mythos level," meaning high-level vulnerabilities already exist in the wild. Companies are currently vulnerable to these models regardless of their own internal security. Lesson: Assume the threat is already present; focus on stopping the "downstream effects" of those vulnerabilities.

Key quotes

"really bad actions happen" Why it matters: Shifts the focus from "hallucinations" (nuisance) to "actions" (catastrophe).

"human in the loop... that's not going to work" Why it matters: Forces a move away from manual review toward automated, intelligent oversight.

"You're going to want to have an independent party whose whole business depends on telling you that this thing is correct and being right." Why it matters: Establishes the necessity of third-party verification for AI safety.

"I think that security teams are also going to become completely high-powered... but I do think that they're going to be run by agents." Why it matters: Predicts the future state of the profession—security becomes an agent-led operation.

How to apply it

This week

1. Audit Permissions: Identify which autonomous coding agents or low-code automations currently have "write" access to production databases or public-facing repos.
2. Identify High-Risk Actions: List the top 5 actions an agent should not be allowed to do autonomously (e.g., deleting a table, publishing a token).
3. Assess Vendor Independence: Ask your current AI provider: "Who certifies that your agent's safety is correct?" Note if they are self-certifying.

Ongoing

1. Shift Strategy: Move from banning LLMs to building a "Secure Control Plane" for agents.
2. Prioritize Revenue Preservation: Evaluate every security tool by asking: "Does this prevent a 'really bad action' that would stop our revenue?"
3. Build Playbooks: Create community-shared playbooks for handling agent failures to build organizational "know-how."

Common pitfalls

• The "Chat" Trap: Treating AI security as a DLP (Data Loss Prevention) problem of what employees type. This ignores the much larger risk of what agents do.
• Self-Certification: Trusting an LLM vendor to provide the safety guarantee for their own product. They have a conflict of interest; you need an independent party.
• The "Smart" Bottleneck: Trying to run a high-intelligence model for every single agent action. This will lead to unacceptable costs and latency, causing the system to fail in production.

Connects to

• Mechanistic Interpretability: The book mentions this as a long-term research goal—understanding internal weights/activations as models become smarter than humans.
• Adversarial Thinking: Draws on the Israeli security ecosystem (8200, WIZ, etc.) to provide a deep bench of adversarial thinking for identifying agent vulnerabilities.

If you remember only three things

• Human oversight cannot scale to the speed of autonomous agents; you need an automated "Secure Control Plane."
• Security must shift from monitoring inputs (what people say) to governing actions (what agents do).
• Verification must be independent: You cannot trust a vendor to certify their own product's safety.

Internalize it

• Reflection questions

  1. If an agent were given "write" access to my most critical database today, what is the specific "really bad action" it could take in under 100 milliseconds?
  2. Where am I still relying on "human-in-the-loop" for processes that are happening too fast for a human to actually see?
  3. Am I currently using an AI vendor who is self-certifying their safety, or do I have an independent verification layer?

• Flashcards Q: Why does traditional identity software fail for autonomous agents? A: Because agents require broad permissions to complete diverse tasks, making traditional identity security "not very useful."

Q: What is the "Blitz Chess" analogy in AI security? A: Using small, specialized models to monitor routine actions and only triggering high-intelligence calculation during high-risk moments.

Q: Why shouldn't enterprises share agent logs with big labs like OpenAI/Anthropic? A: Because they are "data-hungry companies" that will train on that data.

Q: What is the fundamental goal of security in this book? A: Revenue preservation.

Q: What is the primary shift in AI risk for 2026? A: From simple DLP (what employees put into ChatGPT) to a "market-wide panic" regarding autonomous agent actions.

Fidelity note

Confidence: High. This summary is grounded strictly in the provided notes from Sections 1 and 2. Because no body text was provided, I have not included any specific numbers or case studies that were not explicitly mentioned in your notes (e.g., specific percentages of market share are only those listed in the notes). You should verify the "Phase 1/Phase 2" specifics against the full text to ensure they aren't part of a larger proprietary framework.