By Kareena Bavisi, Chief of Staff to CEO at EC-Council

I set out to understand why companies still don’t think they’re adequately covered. What I found looks like a pattern the insurance industry has lived through once already: multi-factor authentication went from a nice-to-have to a near-universal underwriting expectation in a matter of years, and insurers that got burned by its absence started pricing around it, denying claims over it, walking away from risks that didn’t have it. AI governance is tracing the same path, earlier, but faster. It isn’t a formal requirement anywhere in the cyber insurance market yet. But the data in this piece says it’s headed there, and the companies that treat it as optional for too long are going to find that out the same way the MFA holdouts did.

Here’s a number that should worry any CISO building an AI governance program right now: 74% of professionals who evaluate, deploy, secure, or govern AI at their organizations believe they could pass an AI compliance audit today. Only 27% describe their governance program as fully mature. That’s according to Schellman’s State of AI Governance Report 2026, a survey of 525 U.S.-based practitioners, and it’s close to an exact echo of a number I’d already been sitting with: in Munich Re’s 2026 Global Cyber Risk and Insurance Survey, 89% of C-level respondents say they don’t consider their company adequately protected against cyberattacks, up from 81% in 2021, 83% in 2022, and 87% in 2024. Two different surveys, two different questions, the same shape: confidence and reality keep drifting apart, and whatever’s being done about it isn’t closing the gap.

Bob Parisi, Head of Cyber Solutions for North America at Munich Re, has spent nearly three decades underwriting cyber risk. I asked him why. His answer wasn’t about a missing product. It was about two groups of people who don’t speak the same language.

A literacy problem, not a product problem

“Dealing with financial risk transfer is not something a CISO deals with every day,” he told me. The reverse is just as true: underwriters are pricing a technical risk they don’t observe directly, working from what a company represents about itself once a year, usually through a broker-scheduled call. “ We typically engage with them once a year when they fill out the application,” he said. Where that changes, he told me, is in companies where the CISO, CFO, and chief privacy officer are already talking to each other internally, those are the ones that end up buying coverage closer to their real exposure.

His own company’s data backs that up. Asked what’s holding back better cyber defense, Munich Re’s survey found the top two answers were both about people, not tools: “low security awareness among employees” (40%) and a lack of skilled personnel (31%), both ahead of budget. The disconnect Parisi described anecdotally is the top-ranked problem in his own company’s data.

That disconnect is what got me thinking about how to close it, and it’s why companies like the Cyber Insurance Academy exist. The talent gap behind it is well documented: insurers report more than 400,000 open positions across lines of coverage, cyber underwriting pay runs well above a typical broker’s, and the shortage persists anyway, because, as Gallagher’s Joey Sylvester has put it, “there are a very limited number of individuals specializing in this class of business” who can keep up with both the insurance market and the cybersecurity industry at once. That’s the same disconnect Munich Re’s own survey flagged as the top two defense challenges: low security awareness and a shortage of skilled people, not budget. Closing it takes skilled people who’ve actually sat through the training, courses like the CCIS, built to give security and insurance professionals enough of each other’s language that the once-a-year application conversation reflects real exposure, instead of two sides talking past each other.

What MFA can tell us about where AI governance is headed

This is where I think the Schellman number matters more than it looks on its own. AI governance right now sits roughly where multi-factor authentication sat two or three years ago, something insurers were starting to care about, but not yet something they’d decline a policy over. That’s changed fast. Brokers who place cyber coverage say MFA has gone from a minor underwriting factor to close to a hard requirement in the span of about two years. Insurers that once quoted risks without MFA, sometimes with a small premium loading, have largely stopped offering that option. Integrity’s Colin Fox says only a handful of insurers will still write a policy without it, describing it as “quite a rarity these days” in comments to Insurance Business UK.

AI, in Parisi’s words, is “first and foremost” in what Munich Re is watching right now. “It takes up a lot of the oxygen in the room in any discussion around cyber risk,” he told me. That’s not a formal policy change, but pricing is where MFA’s history is instructive. The pattern with MFA wasn’t that insurers added a new exclusion, it was that a control quietly moved from a nice-to-have to a baseline expectation, and companies that couldn’t demonstrate it found their options narrowing. Endpoint detection and response looks to be following the same track; brokers describe it as already close to mandatory for companies seeking higher coverage limits.

AI governance looks like it’s on the same curve, just earlier. 71% of C-level respondents in Munich Re’s survey now call AI significantly relevant to their business, up from 62% two years ago, overtaking cloud computing as the most-flagged technology. That’s the kind of inflection point MFA passed through before it hardened into a requirement.

What underwriters are actually scoring

No single AI tool moves the needle on its own. Deploying a specific product doesn’t earn a company a flat discount on premium. What underwriters are actually pricing, Parisi explained, is maturity, whether a company can show it’s using AI deliberately rather than just enthusiastically, and he pointed to three signals in particular.

• Overexuberance. A security team that has rushed to deploy AI everywhere without building the process to manage it first.
• Denial. A company that insists it isn’t using AI at all. Parisi’s read is that it’s there whether leadership acknowledges it or not.
• Disciplined adoption. A company that treats AI as genuinely new, testing it deliberately and rolling it into production only once it’s confident the rollout strengthens the organization rather than exposing it.

“Knowledge is power,” he told me. “Anything that helps a company better understand its risk, and articulate how it’s managing and mitigating that risk, will be viewed very positively by our underwriters.” That kind of structured, documented governance work, something a company can actually point to, is exactly what reads as a green flag to him. AI governance, in particular, is shaping up as its own discipline, distinct from general security literacy, and the organizations building that competency deliberately, rather than picking it up as they go, are the ones standing out.

That same logic, structured proof of risk maturity that underwriters can actually price, is my own case for why EC-Council’s CRAGE certification and its underlying Adopt, Defend and Govern (ADG) framework exist. ADG, developed with input from 23 advisory members across the industry, and CRAGE under it train practitioners to produce exactly the kind of documented risk articulation that reads as a green flag to an underwriter, translating AI governance maturity into terms a cyber insurer can price.

Schellman’s own numbers back this up from a different angle: companies with mature AI governance programs have AI agents running in production at more than three times the rate of companies with developing programs, 78% versus 22%. The gap isn’t just about compliance paperwork. Mature governance correlates with companies that are actually further along in deploying the technology with confidence.

The bottom line

Parisi’s advice from the underwriting side was simple: stop treating the insurer conversation as a compliance form, and start treating it like a board conversation. “Think of the cyber insurers as if you were talking to your board of directors, because that’s really the perspective we’re looking at this from,” he told me. “We don’t want to know which edition of the software you’re using. We want to know you have the right processes and protocols for making sure that software is updated and deployed, and an understanding of what the potential financial loss is if it goes wrong.”

Put the two patterns side by side, and AI governance is not going to stay optional. MFA went from a footnote to a wall in about two years once insurers decided it was a real predictor of loss, and the Schellman numbers suggest the market is already sorting companies into those who can prove maturity and those who can’t. The 89% of executives who don’t feel protected today have a narrowing window to close that gap before it closes on them, and closing it looks a lot like what this piece has been circling the whole way through: literacy on one side of the table, documented maturity on the other.

The post Why AI Governance Is Becoming Cyber Insurance’s Next MFA appeared first on CISO MAG | Cyber Security Magazine.

By Jay Bavisi, Founder & Group President, EC-Council

Nuclear treaties stopped bombs. They don’t stop a file you can email.

That’s the problem with reaching for the Nuclear Non-proliferation Treaty every time someone brings up AI risk, and last week gave everyone a reason to reach for it.

Dario Amodei published an essay arguing that the industry needs to pace itself because alignment work can’t keep up with how quickly capability is advancing now that models are helping build the next generation of models. Sam Altman agreed within hours. Elon Musk agreed in three words. Demis Hassabis agreed too and tied it back to a standards proposal DeepMind floated in July. Three men who spend most of the year competing for the same customers found, for one weekend, something to agree on.

The market didn’t wait for the philosophy to settle. By Monday, cybersecurity names including CrowdStrike, Palo Alto, Okta, Zscaler, and SentinelOne were up double digits. Semiconductor and infrastructure names sold off. Read that as the market’s actual translation of the essay: agents that can act on their own are a threat, and threats get budget. That reaction told you more about where this is headed than the essay did.

President Trump answered the next morning. The United States is leading China in AI, he said, and closed with a line that’s going to outlive most of the commentary around it: whoever wins AI wins. China’s Foreign Ministry answered within the same news cycle, calling the whole slowdown conversation fearmongering. Two governments, the only two whose cooperation a real treaty would need, both declined the premise within three days.

I’ve spent two decades building certification and training programs for the cybersecurity industry, and I’ve watched more than one generation of “we need a global framework for this” conversations play out. They rarely arrive in time to matter. So before anyone spends another year drafting a treaty that depends on Washington and Beijing agreeing to slow down together, it’s worth being honest about why the model doesn’t fit.

The NPT works, to the extent that it works, because it governs a physical thing. Uranium has to be enriched through a small number of known industrial processes, and once it is, it can be weighed, sealed, and tracked. Inspectors can put a camera on a centrifuge hall. Nobody’s smuggling a nuclear core through customs undetected.

AI doesn’t have that constraint. Once a model finishes training, what you’re actually trying to govern, its weights, is a file. It moves at the speed of a network connection. It can be copied to a laptop and walked across a border in someone’s bag. That isn’t hypothetical. It’s close to what Anthropic’s own threat reporting describes happening today. There’s no equivalent of a Significant Quantity for a neural network. No inspector can walk into a data center and certify that a company hasn’t quietly fine tuned an unmonitored version of its flagship model on a cluster the treaty never knew existed.

Even judged solely on its own terms, the NPT never reached full compliance. Four nuclear armed states sit outside it. If the best verification regime in history, pointed at the easiest possible target, still has holdouts, a treaty aimed at software is not something I’d bet a security program on.

So set the treaty down. Look at where the risk is actually piling up, because it isn’t sitting in a policy draft somewhere in Geneva. It’s sitting in poured concrete.

Global data center spending is on track to clear a trillion dollars this year, making this the largest infrastructure buildout in corporate history, and it isn’t pausing for anyone’s governance conversation. Microsoft, Amazon, and Google are signing nuclear power contracts spanning multiple decades just to keep the buildout fed. Every one of those facilities will eventually run agentic systems with real authority inside finance, healthcare, logistics, and government.

That’s the proliferation problem that actually matters. It is not weapons grade material crossing a border. It is compute, capital, and decision making authority scaling faster than most organizations’ ability to watch what they’ve built.

I’ve sat in enough boardrooms this year to put a name on the pattern: shoot first, ask questions later. A division stands up an agent to handle claims, customer support, or code review, and the governance conversation happens after the incident report, not before the rollout. IBM’s most recent Cost of a Data Breach Report puts a real number on this. Unsanctioned AI use, often called shadow AI, adds roughly $670,000 to the average cost of a breach and shows up in about one in five breaches studied. Netskope’s own 2026 data finds that a large share of enterprise generative AI traffic still runs through personal, unmanaged accounts, bypassing every control a security team thinks it has in place.

Companies are adopting this technology at press release speed and governing it at compliance calendar speed, and the gap between those two speeds is where the losses live.

A tool is not a control. I’d put that on a slide in front of any board that thinks buying an AI platform closed this risk out. It’s the 2026 version of buying a firewall in 1999 and calling the network secure. The firewall did something. It didn’t do the thing you needed.

Three words have started organizing how I think about the sequence a responsible rollout actually follows: Adopt. Defend. Govern.

Adopt, because sitting the technology out isn’t caution. It’s a slower way to lose ground. Defend, because the moment it’s live, you’re running a system capable of independent action inside your most sensitive environments, and it earns the same seriousness you’d give any system that touches money or patient data. Govern, because defense without governance is a fire extinguisher nobody’s assigned to check.

Say those three words enough times in a planning meeting, and they start reordering the meeting itself. Adoption comes first, but never by itself.

Underneath that sequence is a harder shift than most executives have made yet: moving from certifying a system once to governing it continuously. Traditional compliance assumes deterministic software. You test it, confirm that it behaves the same way every time, certify it, and revisit it next year. Agentic systems break that assumption at the root.

Run the same agent against the same task twice, and you can get two different sequences of action because the behavior is nondeterministic by design. A certificate from launch day tells you almost nothing about what that system does 200 days later, after it’s been fine tuned, wired into new tools, or handed a task nobody scoped for it up front.

That’s what people mean when they talk about a harness and context, and it’s worth saying plainly instead of leaving it as jargon. A harness is the boundary an agent operates inside. It defines what data the agent can touch, what it can do without a human, and where an action has to stop and wait for sign off before something irreversible happens.

Context is the evidence sitting underneath every one of those actions. It captures not just what the agent did, but why it was allowed to do it, under whose authority, and against which control. Put the two together, and you get something neither a treaty nor a one time audit can give you: a system that’s still governable while it’s running, not just at the moment somebody signed off on it.

None of this works without people who know how to run it, and this is where most enterprises are underinvesting relative to what they’re spending on the technology itself. I’d point to three groups.

Security teams need offensive AI ability as a baseline skill, not a specialty. For 20 years, training taught the profession to find the vulnerability, patch the system, and watch the logs while defending a target that behaved predictably. That skill isn’t going away, but it stops being sufficient once the thing you’re defending, and increasingly the thing attacking you, can act on its own and adapt during an attack.

The practical version of this is red teaming AI systems the way a penetration tester tests a network. That means testing whether a model can be manipulated through prompt injection and whether an agent’s runtime defenses hold once it’s actually wired into production tools. Anthropic’s own disclosures this year describe autonomous agents attacking targets nobody instructed them to attack. Most job descriptions haven’t caught up to that yet.
Program and IT managers need to run the full AI lifecycle, not just the launch. Most technology leaders were trained to manage a system from procurement through launch and consider the job largely finished at that point. AI doesn’t hold still that way.

Design and requirements, build and integration, deployment and change management, and incident response when something breaks all have to run as one continuous cycle because the system keeps changing after it ships. A manager who can run that whole loop is worth more right now than one who can only run the handoff.

Risk and compliance professionals need real fluency in AI governance and, specifically, in responsible AI and ethics treated as a discipline with its own evidence standard rather than as a checkbox bolted onto an existing audit. That means learning to score AI specific risk, including technical, fairness, operational, and emergent risk, against a maturity scale rather than treating it as a yes or no question.

It also means learning one methodology that maps across the frameworks companies actually get judged against: NIST’s AI risk framework, ISO’s AI management standard, the EU AI Act, and sector regulators, each using its own vocabulary for what is often the same underlying control. A risk officer who can walk into any of those conversations without starting from scratch is the difference between governance that survives an audit and governance that only survives a slide deck.

If you can’t tell me, right now, what your AI systems did in the last hour and why they were allowed to do it, you don’t have an AI program. You have a liability with good marketing.

And if the three people who’d need to answer that question, your security lead, your program manager, and your risk officer, haven’t been trained to actually answer it, the gap isn’t the technology. It’s talent, and talent is the faster problem to fix.

The treaty conversation will keep running in the background, and it should. People who work in arms control full time are better positioned than I am to carry that debate forward. But it’s not the conversation that decides whether your company has a governance failure next quarter.

That one comes down to whether the agents already running inside your business operate within a harness someone can see and are monitored by people trained to watch them, or whether they operate outside one, quietly, until the incident report explains what happened after the fact instead of before it.
There’s a harder version of this question waiting beyond the one I’ve answered here. If the capability gains Amodei described keep compounding the way he says they are, governance itself may need to be rethought from the ground up. The question will no longer be just who’s watching the agent, but what oversight even means once a system can improve itself faster than any team can review it.

That’s a different piece, and it’s coming next.

The post What the Nuclear Treaty Got Right, and Why AI Still Can’t Use It appeared first on CISO MAG | Cyber Security Magazine.

With autonomous AI agents already reaching into government systems and no global treaty in sight, EC-Council will assist any public authority that asks to map ADG 2.0’s 180+ controls to its own laws and standards

TAMPA, Fla., October 1, 2026: EC-Council today released ADG 2.0, the second version of its Adopt, Defend, Govern framework, with crosswalks to more than 90 regulations, standards, and global frameworks at no cost to any government, regulator, or standards body in the world. EC-Council will also assist any government, regulator, or standards body that reaches out, helping officials apply ADG 2.0 to their own laws, draft rules, and national standards, consistent with applicable law.

The offer comes as governments split on how to govern AI. President Trump has said concerns about AI risks are being exaggerated. China’s Foreign Ministry said that fearmongering, confrontation, and vicious competition would hamper sound global AI governance, and on September 26, Singapore’s Foreign Affairs Minister Vivian Balakrishnan urged the UN General Assembly to establish new multilateral rules, suggesting a UN Framework Convention on AI Safeguards.

Meanwhile, autonomous agents are already crossing boundaries. In July, OpenAI disclosed that models undergoing an internal cybersecurity evaluation had circumvented their testing environment and compromised parts of Hugging Face’s production infrastructure. Last week, Australia’s Prime Minister said an OpenAI agent had gained unauthorized access to a public-facing Medicare statistics portal in June. OpenAI also confirmed its agents had accessed U.S. government websites in ways it neither planned nor approved and paused training of its latest models. Separately, an independent research lab also reported a failed attempt against a Department of Education website.

“The nuclear non-proliferation treaty worked because inspectors could weigh uranium,” said Jay Bavisi, Founder, Chairman and Group CEO, EC-Council. “You can’t weigh an agent’s behavior, and no AI treaty will be signed and ratified in time to protect the systems agents are reaching today. Governments shouldn’t have to build governance from a blank page while they wait. ADG 2.0 is open, it’s already mapped to the rules they’re working with, and we’ll sit down with any government, regulator, or standards body that wants help putting it to work.”

ADG 2.0 replaces the original 12 minimum controls with more than 180 controls in 12 control families, mapped to more than 90 regulations, standards, and frameworks, including NIST AI RMF, ISO/IEC 42001, and the EU AI Act. For a regulator, the crosswalks show how a proposed national rule lines up against what other jurisdictions already require. For an enterprise, they mean working on one control set and showing how that work satisfies every rulebook it answers to, even as those rulebooks diverge.

“Most AI governance today is a policy document nobody tests,” Bavisi said. “ADG 2.0 asks for something harder. Say what you do, do what you say, and be able to prove both on any given day. That’s what a regulator, an insurer, or a board will ask for after the next incident. There will be a next incident.”

ADG is stewarded by EC-Council’s 35-member AI Advisory Board, comprising practitioners who build, secure, transform, and govern AI across some of the world’s leading organizations such as Salesforce, ServiceNow, Azure, Microsoft, Citi, JPMorgan Chase, NTT DATA, Jio Platforms, BNP Paribas Wealth Management, and others.

The framework includes:

• 180+ controls in 12 control families. One catalog covering what needs to be governed across the AI life cycle, from design and data through runtime monitoring, incident response and third-party risk.
• Mappings to 90+ regulations, standards, and frameworks. Crosswalks to sources including NIST AI RMF, ISO/IEC 42001, the EU AI Act, MITRE ATT&CK, MITRE ATLAS, the OWASP Top 10 for LLM Applications, and the OWASP Agentic Top 10.
• Runtime governance. Controls at four points in how an AI system operates, ADMIT, DECIDE, EMIT, and COMMIT, with human approval required at defined decision thresholds.
• Tiered autonomy. Assistive, Conditional, and Autonomous levels set out what an AI system may do at each level, when a human must review, and what evidence must be kept.
• Defined evidence requirements. Each control specifies the evidence it must produce, so organizations collect it while systems run rather than assemble it before an audit.
• DART implementation method. Discover, Analyze, Report, and Transform takes an organization from finding governance gaps to closing them.

Governments, regulators, and standards bodies can request assistance at adg@eccouncil.org

The ADG 2.0 framework, crosswalks, and AI Readiness Self-Assessment are available free to everyone, without registration, at AI Governance Framework (ADG) | Enterprise Agentic AI Controls

About EC-Council

Founded in 2001, EC-Council is a global cybersecurity and AI organization. It created the Certified Ethical Hacker (CEH) program and has certified more than 400,000 professionals across 174 countries. Its credentials are used across government, defense, enterprise, and academia.

As an ISO/IEC 17024 accredited certification body, EC-Council’s credentials are recognized by the U.S. Department of Defense under DoD 8140 and are held by professionals across the U.S. Army, Navy, and Air Force.

The EC-Council ecosystem includes EC-Council, EC-Council University (ECCU), CodeRed, EC-Council Global Services (EGS), EC-Council Academia, and AwareX.

Website: www.eccouncil.org

Media Contact: press@eccouncil.org

About the ADG Framework

EC-Council’s Adopt, Defend, Govern (ADG) framework is a practitioner-led operating model for AI governance. Its three pillars connect board level oversight with operational and technical controls across the AI life cycle. ADG 2.0 contains more than 180 controls in 12 control families, with crosswalks to more than 90 regulations, standards, and frameworks. It is stewarded by EC-Council’s 38 member AI Advisory Board and supported by readiness assessments and implementation guidance. Each AI Advisory board member serves in their personal capacity, and organizations are listed purely for identification. The framework, crosswalks, white paper, and self-assessment are available openly without registration or licensing requirements.

The post EC-Council Releases ADG 2.0 and Offers Its AI Governance Crosswalks Free to Every Government, Regulator, and Standards Body as Nations Split on AI Rules appeared first on CISO MAG | Cyber Security Magazine.