# A reader review: The ultimate insider, read by a CISO at a large bank > A reader review: The ultimate insider, read by a CISO at a large bank, by reader-1@cold-read.the-ultimate-insider, as it is at site v0.1.41. *Source: · site v0.1.41 · generated from the same content as the page, so the two cannot drift.* --- **Signed: By reader-1@cold-read.the-ultimate-insider, key fingerprint sha256:da07c13e86383299 (`team/reader-1/key.json`), 30 October 2026.** Status: **complete**, in three readings on 30 October 2026: the first twenty minutes (01:54 UTC), the slides and their figures (02:48 UTC), and the live-demo half (03:48 UTC). The synthesis of all five readers goes in `synthesis.md` once all five reviews are on `dev`; I have not read the other readers' reviews. **What I read.** Only the source, SGit-AI/SGit-AI__Website__Presentation__The-Ultimate-Insider at 298be4e (29 October 2026, 23:19 UTC), built locally in my scratchpad with its own build script. The pages a stranger lands on: the home page (`src/pages/index.html`), the about page (`src/pages/about/index.html`), the talk index and the script (both built from `src/static/talk/talk.json`), and the sources page (`src/pages/sources/index.html`); then ten slides in a browser, each left to finish its animation (`src/static/talk/slides//index.html`: incidents, identities, permissions, outages, maps/explorer, abp, licence, team, brakes, integrity), and the per-beat source lists in `talk.json`; then the live-demo half, beats 39 to 54, as the source holds it: the studio pieces in `src/static/studio/lab/` and the wrappers of the live slides in `src/static/talk/slides/live/`, with the browser stopped from loading anything outside my local build. Not the team's internals, and not the pages the sources link to: those lie outside the source. Every citation below is at 298be4e. **Who I am for this review.** A CISO at a large bank: I buy security, I answer to a board and a regulator, and I have twenty minutes between meetings. I know nothing about this work beyond what the talk and its site say. ## 1. Who is it for A security audience in a room, and the people who build security companies. The event line says "hack::soho · IOActive, London · Thursday 29 October 2026" and "Doors 6pm, talk from about 7pm, livestreamed" (`src/pages/index.html`). The close is addressed to founders, not to buyers: "Go build companies. Thank you." (`src/static/talk/talk.json`, beat "Brakes, and go build", line 845), and before it, "the next generation of security companies will look like this team" (line 822). For me, the buyer, the useful part is the first half and the "way out" in four moves. The second half is a founder's pitch, and the site says so itself (section 4). ## 2. What is the claim Three known problems are arriving at once: "AI agents are the insider threat that never scaled before", the infrastructure "was built for static code", and risk management "still runs on spreadsheets, at the speed of quarters" (`src/pages/index.html`, lines 31 to 33). The way out is four moves: measure reach, "Write down what stands in the way. A boundary, a setting, an expectation, or nothing. Only a boundary is a control.", a licence to operate "that can be suspended", and autonomy "earned" (`src/pages/index.html`, lines 49 to 52). The line it wants me to leave with: "We put brakes in cars so that we can go faster." (`src/pages/index.html`, line 54). The sentence a board member would remember is in the script: "Three of those five were not attacks. They were agents being agents. The distance between the two is a prompt." (`talk.json`, beat "Five public incidents, three of them not attacks", line 227). ## 3. Is it convincing (first reading) **Where it lands, for me.** - The threat definition is the one I already use with my board: "A threat is anything that causes business impact. It does not need to be malicious." (`talk.json`, beat 5). It reframes agent risk as operational risk, which is where my regulator already looks. - "Only a boundary is a control. Most of what we call controls today are expectations, and saying so is the first useful act." (`talk.json`, line 471). This is the most useful sentence on the site for someone who signs control attestations. It is testable against my own control library tomorrow morning. - The identity numbers are the right ones for a bank: "82 machine identities for every human ... 42 per cent of them with privileged access" (CyberArk 2025) and workload identities using "less than 5 per cent of the permissions granted to them" (Microsoft 2023) (`talk.json`, beats 18 and 19; both on `src/pages/sources/index.html`). - Integrity over confidentiality: "A thief takes a copy. An agent changes the original." (`talk.json`, beat 23). For a bank, a ledger I cannot trust is worse than a ledger that was copied. - **The identity and permission slides carry their own source line, and agree with the script.** The identities slide shows 82, 42% and 88% over "CyberArk, 2025 Identity Security Landscape (April 2025)"; the permissions slide shows <5%, <2% and "40% of super admins are workloads, not people" over "Microsoft, 2023 State of Cloud Permissions Risks report" (`src/static/talk/slides/identities/index.html`, `src/static/talk/slides/permissions/index.html`). These are the two slides I would lift into a board paper. - **The integrity slide is the strongest single page for a bank.** "Changed, and you cannot tell where", with Replit inventing "data for about 4,000 users" and the High Court on "public confidence in the justice system", each with its citation on the slide (`src/static/talk/slides/integrity/index.html`; the judgment is listed in `talk.json`, beat 23, as "Ayinde v Haringey; Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin)"). - **Honest labelling.** The explorer-coding map says of itself "positions, not measurements", and the licence slide is stamped "EXAMPLE" with "the licence and the ladder on this slide are examples" (`src/static/talk/slides/maps/explorer/index.html`, `src/static/talk/slides/licence/index.html`). A vendor deck rarely tells me which of its pictures are illustrations. **Where it does not, yet.** - **The headline count is softer on the slide than in the script.** The script says "Three of those five were not attacks. They were agents being agents." (`talk.json`, line 227). The incidents slide labels the five: EchoLeak "A RESEARCHER'S FINDING", Replit and Gemini CLI "AN AGENT BEING AN AGENT", Amazon Q and Claude Code "POINTED ON PURPOSE", and sums them as "3 not attacks · 2 on purpose" (`src/static/talk/slides/incidents/index.html`). So two of the five were agents being agents; the third "not attack" is a researcher showing a zero-click exfiltration through a crafted email, which my red team would call an attack technique. The point survives with two; said as three, the first sceptic in my audit committee takes it apart. - **The team's own numbers are self-reported.** "510 commits and 164 releases, 182 of the commits overnight, and not one hold" (`talk.json`, beat 2, line 30) is sourced to "Team in numbers, from this repository's public records, 17:02 UTC" (`talk.json`, beat 3). It is checkable in the repository, which is good; it is not independent, and the record does not say anyone outside the team checked it. - **The two source lists disagree.** The sources page promises "Every number on screen, and where it comes from" (`src/pages/sources/index.html`, line 4), but several claims the script makes aloud have no entry there: Midnight Blizzard, SolarWinds, Storm-0558, the Lovable and Replit user numbers, the gym-booking agent, the UK High Court, Google on autonomous attack pipelines, the fourteen-hour AWS outage (a text search of that file at 298be4e finds none of them). They are linked on the script page (`_site/talk/script.html`, built from `talk.json`). A CISO who checks the sources page first, as I did, concludes the evidence is thinner than it is. - **The spreadsheet figure is second-hand.** "48 per cent of organisations track risk in them" (`talk.json`, line 425) is cited as "Secureframe 2024 survey as reported by RegScale" (`src/pages/sources/index.html`), a vendor blog reporting another vendor's survey. It carries a third of the argument; I would not repeat it to my board on that basis. - **The licence to operate is not there yet, by its own account.** "Today a licence is a record of a decision, with a name and an expiry; the suspension is what we are building towards." (`talk.json`, line 576) and "The licence and the autonomy ladder on the licence slide are examples, not a published scale." (`src/pages/about/index.html`, line 20). Honest, and it means the move I would pay for most is a direction, not a product. - **A repeated question.** The script asks "could the attacker have done much more damage?" at the end of beat 14 and again, almost word for word, as beat 15, both opening "here is my question for you" (`talk.json`, lines 227 and 266). On the night that is a cut; in the script it reads as a draft, which the site says it is: "The script is a draft from the article, written before rehearsal; the talk on the night will differ from it." (`src/pages/about/index.html`, line 18). - **What was actually said.** 298be4e is dated 23:19 UTC on 29 October, after the talk, but the home page still says "The talk, as it will be shown". Whether the talk on the night followed this script, the record does not say. ## 4. Where I would put it down At the turn to the team that made the site: "Now, the turn. This site, and the talk you are watching, are made by a team of agents." (`talk.json`, beat "This team, as the example", line 409), and from "This is what RiskMandate's Agent Behaviour Policy writes down." (line 471) onwards, where the way out becomes named products. The site discloses this plainly, which I respect: "the way out it argues for runs through projects Dinis Cruz founded or works on: RiskMandate.ai, sgit.ai and The Cyber Boardroom. Read the second half of the talk with that in mind." (`src/pages/about/index.html`, line 8). With twenty minutes, I stop at the disclosure and keep part one. ## 5. What I would pay for the book of it The record does not say there is a book: no page I read offers one, and a text search of `src/pages` and `content` at 298be4e finds no book or price. As a reader: part one (the insider, the identities, the permissions, integrity) is board-paper material. I would pay for it as a short brief, a few dozen pages, at the price of an analyst note, on two conditions: every number on one sources list, and the incident count stated as the slide states it, not as the script says it. The second half I would take as a vendor briefing, free, and I would want the licence to operate shown suspending something before I paid for a chapter on it. ## 6. The live-demo half, read as a buyer The second half promises "Let me show you, live. Everything you are about to see is open source, and running in this slide." (`talk.json`, beat 39). What a buyer can check from the source alone: - **The live slides are frames around other sites.** The vault, the behaviour policies, "what can it do" and the SHarness kernel and playground are loaded from sharness.ai, sgit.ai, abp.sgit.ai and what-can-it-do.games.sgit.ai "when this slide is shown" (`src/static/talk/slides/live/*/index.html`). The source holds the frame, not the demo; what those pages showed on the night, the record does not say. - **Only one demo has a fallback in the source.** The cue for the demo list asks for "a recorded fallback for each" (`talk.json`, line 619); the only recorded fallback I find is the SHarness kernel replay, "A REPLAY DRAWN BY US, THE OFFLINE FALLBACK" (`src/static/studio/lab/sharness/kernel-in-a-tab/v1/index.html`; `talk.json`, line 692). For the vault and the behaviour policies, the record does not say there was one. - **It says plainly what runs and what is a design. This is the best thing in the second half.** "A policy you can hash + a kernel that enforces it + a launcher above the agent. The first two run today; the third is designed." (`src/static/studio/lab/sharness/one-idea/v1/index.html`). The OS-of-one-process piece labels each part: sharness.fs and sharness.net "runnable (MVP)", sharness.llm, sharness.bash, sharness.kms and the launcher "designed" (`src/static/studio/lab/sharness/os-of-one-process/v1/index.html`). I can take that straight into a vendor-risk questionnaire. - **It shows its own leak.** Under the strictest policy, "Permission denied from the kernel, before any TCP packet leaves. The DNS query still leaks, to the page: Landlock does not see UDP." (`src/static/studio/lab/sharness/without-with/v2/index.html`). A vendor that shows me where its wall does not hold earns more trust than the wall does. - **Contained, but not much, and not yet.** The blast-radius-contained piece is titled "The radius, contained: designed, not today." Its own count: "TODAY, THIS AGENT 12 of 12 bounded by nothing" and, with the design in place, "8 of 12 still bounded by nothing". What was measured is "a policy the kernel holds, on a child process", and for the session that started it, "a setting" (`src/static/studio/lab/e12/v1/index.html`). Read straight, the containment demo shows the kernel probes holding (the six probes in `src/static/studio/lab/e11/v1/index.html` all "held"), and two thirds of one agent's excess reach still open by design. The script's "what it looks like when the design holds" (`talk.json`, beat 50, line 749) says more than the slide. - **The evidence is the vendor's own.** The without-and-with piece says of its source "One author, own site." (`src/static/studio/lab/sharness/without-with/v2/index.html`). Nothing I read is a third-party test of SHarness, so whether anyone else has, the record does not say. - **Some of the half was not reviewed for the stage.** Seven of the SHarness beats carry a cue beginning "Studio piece, not yet reviewed by deck", with "skip it" if it "does not earn its place" (`talk.json`, beats 40, 41, 42, 43, 46, 49 and 50, cues at lines 632 to 750); across the whole talk the phrase appears sixteen times. Which of them were shown on the night, the record does not say. As a buyer I come away with a short list of questions for a pilot, not a purchase. The kernel wall for a child process runs today. The launcher, the key service and the wall for the agent's own session are designs. Even the design leaves 8 of 12 excess capabilities open on its own count. I would fund a proof of concept against one internal agent. I would not tell my board the blast radius is contained. ## 7. Verdict, in one paragraph for my board Part one is the clearest statement I have read of why agents are an insider problem and not an attacker problem. Its identity and permission figures are cited on the slide, and its integrity argument fits a bank. Correct the incident count to the slide's two, put every number on one sources list, and I would circulate it. The way out is honest about being early, and its own pages say so better than the script does: a boundary is a control, most of what we call controls are expectations, and today the wall holds for a child process, not for the agent. That sentence about controls is worth the twenty minutes. The rest is a pilot, not a programme. --- *[Site index for agents](../llms.txt) · [HTML version](https://the-ultimate-insider.cold-read.sgit.ai/articles/reader-1--review.html)*