12 Questions That Expose Whether Your Security Program Is Actually Working

Key points

• Roland Palmer at JumpCloud calls IAM for human and nonhuman identities an "every-hour question" as AI agents multiply faster than governance can track.
• Mean time to detect correlates directly to blast radius: the longer it takes to spot a breach, the worse the damage.
• Employees are adopting AI tools before procurement or legal knows they exist, recreating shadow IT at speed.
• Vibe coding has handed code-generation to every employee; security guardrails built for slower pipelines may not keep pace.
• Most organizations have stronger visibility into their own environments than into the vendors sitting upstream.

Security programs don't fail dramatically. They calcify quietly, built for last year's threat model, staffed by teams that stopped asking uncomfortable questions. A dozen security leaders recently shared the questions they believe cut through the noise.

Some are classics reframed. Roland Palmer, CISO at JumpCloud, asks his team what specific incident the security program actually prevented, not generically, but concretely, with business impact attached. Vague answers mean vague value.

Should you worry about identity sprawl?

The identity questions are where things get interesting. Palmer calls IAM for human and nonhuman identities an "every-hour question" now. AI tooling and automated pipelines generate new identities faster than most governance processes can track. Richard Watson, global cybersecurity leader at EY, sharpens it further: traditional identity governance tooling wasn't built for nonhuman principals. That's a category gap, not a configuration gap. Threat Vectr first covered nonhuman identity risk on 8 June 2026; the tooling problem Watson describes hasn't closed since.

How fast would you actually know?

Mean time to detect still matters. Dale Hoak, CISO at RegScale, frames it bluntly: assume breach, then ask how fast you'd actually know. Purple team exercises and tabletop drills exist to stress-test that assumption before an attacker does. Smaller MTTD, smaller blast radius.

Third-party risk remains the question organizations keep deferring. Hoak notes that most companies have better visibility into their own environments than into the vendors and software dependencies sitting upstream. The asymmetry is known. Closing it isn't.

Is vibe coding your blind spot?

The vibe-coding problem sounds whimsical. It isn't. Nico Waisman, CISO at XBOW, is asking whether security guardrails can keep pace with AI-assisted development that has handed code-generation to every employee. Our coverage of shadow builders shipping production apps without auth on 29 May 2026 showed what happens when the answer is no.

Doug Kersten at Appfire draws the parallel plainly: employees adopt AI tools before procurement or legal even knows they exist. Same visibility problem as shadow IT, faster timeline, broader data exposure.

Sean Murphy at BECU, the fifth-largest U.S. Credit union, poses the question that probably belongs first: "What are the security things that will shut down the business?" Business resilience, not IT resilience. The gap between those two framings is where programs fall short.

Watson's speed question deserves a second read. Governance processes were built for a slower threat environment; AI accelerates attacker tooling alongside defender tooling. Failure mode: organizations that upgraded their offense wishlist but never touched their detection cadence.

None of these are novel categories. What changes is the rate at which AI compounds each of them. That's the story worth telling.