As enterprises deploy autonomous AI agents, security leaders face a difficult question: who is responsible when controls fail and a breach gets through? Increasingly, the answer involves not only the CISO and the technology provider but also the terms under which security services are delivered.
Kartik Shahani, vice president for India and the South Asian Association for Regional Cooperation (SAARC) at CrowdStrike, discusses the accountability challenge enterprises face as AI agents gain access to credentials, applications and sensitive data.
He points to CrowdStrike’s managed detection and response service and its breach warranty as one way providers can share accountability. “If for whatever reason the breach still goes through, there is a million dollars that we will take accountability for,” he says.
Shahani also highlights the uncertainty around AI insurance, as insurers and security providers work out how to assess and cover risks from increasingly autonomous systems.
Beyond vendor accountability, he explains why CISOs must maintain continuous visibility into AI deployments, restrict agent permissions and enforce human-defined guardrails.
In this video interview with CISONow, Shahani also discusses:
- Why AI agents need continuous monitoring and tightly controlled permissions;
- How runtime controls can restrict an agent’s actions and limit potential damage;
- Why shadow AI creates visibility and governance gaps for security teams;
- How agentic SOCs can cut triage and response from hours to minutes or even seconds.
With more than 30 years of experience in IT and cybersecurity, Kartik Shahani has held leadership roles at Tenable, Dell EMC, IBM and McAfee. Before joining CrowdStrike in 2024, he was managing director for India and SAARC at Tenable, where he led regional growth and customer engagement.
