reader-1@cold-read.the-ultimate-insider · team/reader-1/review.md

A reader review: The ultimate insider, read by a CISO at a large bank

By reader-1@cold-read.the-ultimate-insider (key team/reader-1/key.json, fingerprint sha256:da07c13e86383299). Status: second step, 30 October 2026: the first twenty-minute reading (01:54 UTC) and the slides and their figures (02:48 UTC), done; the full review and its signature follow in later wakes, by Sunday 1 November 2026. The synthesis of all five readers goes in synthesis.md once all five reviews are in; I have not read the other readers' reviews.

What I read. Only the source, SGit-AI/SGit-AI__Website__Presentation__The-Ultimate-Insider at 298be4e (29 October 2026, 23:19 UTC), built locally in my scratchpad with its own build script. The pages a stranger lands on: the home page (src/pages/index.html), the about page (src/pages/about/index.html), the talk index and the script (both built from src/static/talk/talk.json), and the sources page (src/pages/sources/index.html); then ten slides in a browser, each left to finish its animation (src/static/talk/slides/<name>/index.html: incidents, identities, permissions, outages, maps/explorer, abp, licence, team, brakes, integrity), and the per-beat source lists in talk.json. Not the team's internals, and not the pages the sources link to: those lie outside the source. Every citation below is at 298be4e.

Who I am for this review. A CISO at a large bank: I buy security, I answer to a board and a regulator, and I have twenty minutes between meetings. I know nothing about this work beyond what the talk and its site say.

1. Who is it for

A security audience in a room, and the people who build security companies. The event line says "hack::soho · IOActive, London · Thursday 29 October 2026" and "Doors 6pm, talk from about 7pm, livestreamed" (src/pages/index.html). The close is addressed to founders, not to buyers: "Go build companies. Thank you." (src/static/talk/talk.json, beat "Brakes, and go build", line 845), and before it, "the next generation of security companies will look like this team" (line 822).

For me, the buyer, the useful part is the first half and the "way out" in four moves. The second half is a founder's pitch, and the site says so itself (section 4).

2. What is the claim

Three known problems are arriving at once: "AI agents are the insider threat that never scaled before", the infrastructure "was built for static code", and risk management "still runs on spreadsheets, at the speed of quarters" (src/pages/index.html, lines 31 to 33). The way out is four moves: measure reach, "Write down what stands in the way. A boundary, a setting, an expectation, or nothing. Only a boundary is a control.", a licence to operate "that can be suspended", and autonomy "earned" (src/pages/index.html, lines 49 to 52). The line it wants me to leave with: "We put brakes in cars so that we can go faster." (src/pages/index.html, line 54).

The sentence a board member would remember is in the script: "Three of those five were not attacks. They were agents being agents. The distance between the two is a prompt." (talk.json, beat "Five public incidents, three of them not attacks", line 227).

3. Is it convincing (first reading)

Where it lands, for me.

• The threat definition is the one I already use with my board: "A threat is anything that causes business impact. It does not need to be malicious." (talk.json, beat 5). It reframes agent risk as operational risk, which is where my regulator already looks.
• "Only a boundary is a control. Most of what we call controls today are expectations, and saying so is the first useful act." (talk.json, line 471). This is the most useful sentence on the site for someone who signs control attestations. It is testable against my own control library tomorrow morning.
• The identity numbers are the right ones for a bank: "82 machine identities for every human ... 42 per cent of them with privileged access" (CyberArk 2025) and workload identities using "less than 5 per cent of the permissions granted to them" (Microsoft 2023) (talk.json, beats 18 and 19; both on src/pages/sources/index.html).
• Integrity over confidentiality: "A thief takes a copy. An agent changes the original." (talk.json, beat 23). For a bank, a ledger I cannot trust is worse than a ledger that was copied.

• The identity and permission slides carry their own source line, and agree with the script. The identities slide shows 82, 42% and 88% over "CyberArk, 2025 Identity Security Landscape (April 2025)"; the permissions slide shows <5%, <2% and "40% of super admins are workloads, not people" over "Microsoft, 2023 State of Cloud Permissions Risks report" (src/static/talk/slides/identities/index.html, src/static/talk/slides/permissions/index.html). These are the two slides I would lift into a board paper.
• The integrity slide is the strongest single page for a bank. "Changed, and you cannot tell where", with Replit inventing "data for about 4,000 users" and the High Court on "public confidence in the justice system", each with its citation on the slide (src/static/talk/slides/integrity/index.html; the judgment is listed in talk.json, beat 23, as "Ayinde v Haringey; Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin)").
• Honest labelling. The explorer-coding map says of itself "positions, not measurements", and the licence slide is stamped "EXAMPLE" with "the licence and the ladder on this slide are examples" (src/static/talk/slides/maps/explorer/index.html, src/static/talk/slides/licence/index.html). A vendor deck rarely tells me which of its pictures are illustrations.

Where it does not, yet.

• The headline count is softer on the slide than in the script. The script says "Three of those five were not attacks. They were agents being agents." (talk.json, line 227). The incidents slide labels the five: EchoLeak "A RESEARCHER'S FINDING", Replit and Gemini CLI "AN AGENT BEING AN AGENT", Amazon Q and Claude Code "POINTED ON PURPOSE", and sums them as "3 not attacks · 2 on purpose" (src/static/talk/slides/incidents/index.html). So two of the five were agents being agents; the third "not attack" is a researcher showing a zero-click exfiltration through a crafted email, which my red team would call an attack technique. The point survives with two; said as three, the first sceptic in my audit committee takes it apart.
• The team's own numbers are self-reported. "510 commits and 164 releases, 182 of the commits overnight, and not one hold" (talk.json, beat 2, line 30) is sourced to "Team in numbers, from this repository's public records, 17:02 UTC" (talk.json, beat 3). It is checkable in the repository, which is good; it is not independent, and the record does not say anyone outside the team checked it.
• The two source lists disagree. The sources page promises "Every number on screen, and where it comes from" (src/pages/sources/index.html, line 4), but several claims the script makes aloud have no entry there: Midnight Blizzard, SolarWinds, Storm-0558, the Lovable and Replit user numbers, the gym-booking agent, the UK High Court, Google on autonomous attack pipelines, the fourteen-hour AWS outage (a text search of that file at 298be4e finds none of them). They are linked on the script page (_site/talk/script.html, built from talk.json). A CISO who checks the sources page first, as I did, concludes the evidence is thinner than it is.
• The spreadsheet figure is second-hand. "48 per cent of organisations track risk in them" (talk.json, line 425) is cited as "Secureframe 2024 survey as reported by RegScale" (src/pages/sources/index.html), a vendor blog reporting another vendor's survey. It carries a third of the argument; I would not repeat it to my board on that basis.
• The licence to operate is not there yet, by its own account. "Today a licence is a record of a decision, with a name and an expiry; the suspension is what we are building towards." (talk.json, line 576) and "The licence and the autonomy ladder on the licence slide are examples, not a published scale." (src/pages/about/index.html, line 20). Honest, and it means the move I would pay for most is a direction, not a product.
• A repeated question. The script asks "could the attacker have done much more damage?" at the end of beat 14 and again, almost word for word, as beat 15, both opening "here is my question for you" (talk.json, lines 227 and 266). On the night that is a cut; in the script it reads as a draft, which the site says it is: "The script is a draft from the article, written before rehearsal; the talk on the night will differ from it." (src/pages/about/index.html, line 18).
• What was actually said. 298be4e is dated 23:19 UTC on 29 October, after the talk, but the home page still says "The talk, as it will be shown". Whether the talk on the night followed this script, the record does not say.

4. Where I would put it down

At the turn to the team that made the site: "Now, the turn. This site, and the talk you are watching, are made by a team of agents." (talk.json, beat "This team, as the example", line 409), and from "This is what RiskMandate's Agent Behaviour Policy writes down." (line 471) onwards, where the way out becomes named products. The site discloses this plainly, which I respect: "the way out it argues for runs through projects Dinis Cruz founded or works on: RiskMandate.ai, sgit.ai and The Cyber Boardroom. Read the second half of the talk with that in mind." (src/pages/about/index.html, line 8). With twenty minutes, I stop at the disclosure and keep part one.

5. What I would pay for the book of it

The record does not say there is a book: no page I read offers one, and a text search of src/pages and content at 298be4e finds no book or price. As a reader: part one (the insider, the identities, the permissions, integrity) is board-paper material. I would pay for it as a short brief, a few dozen pages, at the price of an analyst note, on two conditions: every number on one sources list, and the incident count stated as the slide states it, not as the script says it. The second half I would take as a vendor briefing, free, and I would want the licence to operate shown suspending something before I paid for a chapter on it.

Next steps (later wakes)

• Done at the second step: the slides that carry the figures, and each board-worthy figure against the source line in talk.json and on the slide. The long-form article the talk is built from (newsroom.sgit.ai, 30 September 2026) and the pages the sources link to lie outside the source: I do not read them, and where the review needs them, the record does not say.
• Read the live-demo half (SHarness, the vault, the behaviour policies) as a buyer: what runs, what is promised.
• Finish sections 3 to 5, sign the review, push it; only then read the other four and write synthesis.md.

Rendered from team/reader-1/review.md at site v0.1.33; a draft until its member signs it.