Category: Video

Here’s a video that isn’t from the place where I work (NetFoundry), but from someone works in a different part of AI security. Yet somehow they ended up at the same question that we at NetFoundry ask: How confident are you that your current tools can defend against the new threats brought about by AI?

The video features an interview that took place at the recently-concluded Black Hat 2026 in Las Vegas, and the interviewee is Daniel Bardenstein, CEO of Manifest Cyber.

While NetFoundry focus on identity-based security, Manifest’s focus is on the AI supply chain:

• Manifest’s approach to security is knowing what’s actually inside the models and software you build and buy. They’re paying particular attention to provenance: training data you didn’t source, open-weight models pulled from a public hub, what’s “under the hood” of your agents.
• NetFoundry approaches AI security from the other end: what’s outside the models and software you build and buy, and what’s allowed to reach it. We’re about machine identity, service-to-service access, and attack surface.

Watch the video; it’s got some notable stuff, including:

• Open-weight adoption is about to accelerate, and the reason is control. Bardenstein argues that with a frontier model you have zero control over the system prompt, the training data, or what some provider (or government) decides to change under you. With an open-weight model, you control the whole chain: prompt, data, deployment, guardrails. If you’re already self-hosting models behind OpenZiti, this is the security-side justification for it, from someone who isn’t us.
• The Hugging Face incident he describes is darkly funny. A lot of people say that the risk with AI models is that they’re non-deterministic, but the HF situation happened because the sandboxing was weak and guardrails  (which really means “ordinary software security”) were missing. Then, when HF pointed its own AI at the forensics, its guardrails read the request as “too cyber” and refused to help,. HF had to fall back to an open-weight model.I’m going to start saying this regularly: AI fails like software because it is software!
• “AI has its own supply chain and you inherit it.” Every model off a public hub and every third-party dataset is a dependency you didn’t build and can’t fully vet. Bardenstein notes public datasets have shipped with everything from PII to, in documented cases, outright illegal content nobody caught until after training. As the people on the Antiques Roadshow TV show will tell you, provenance is important.
• The Log4Shell framing is the one I’d steal (in fact, I’m doing that right now). Bardenstein built Manifest after the Pentagon Log4Shell vulnerability (a.k.a. CVE-2021-44228) scramble. The issue boiled down to a simple, embarrassing question: “Where is this one piece of code running across everything I’ve built and bought?” Even having seen what happened five years ago, if you told a CISO a model or dataset was poisoned, they’d likely not be able to tell you where it’s deployed, who owns it, or which vendors are affected without a lot of phone calls, emails, spreadsheets, and gnashing of teeth.

Bardenstein’s observations are pretty much the mirror image of our recently-published 2026 State of Secure AI Access report, where we observe that:

• 99% of CTOs/CISOs at orgs with 1,000+ employees admit they lack full visibility into their AI deployments.
• 54% named new AI-specific services like MCP servers and LLM gateways as fresh attack surface.
• 8% think their identity systems are sufficient for non-human workloads.

Pair our observations with Bardenstein’s supply-chain point and the full failure mode is bleak. An agent you can’t identify, running a model you didn’t vet, reaching services over credentials nobody rotates. That’s three unknowns stacked on top of each other.

My read (not Bardenstein’s or NetFoundry’s report’s) is that giving an agent its own OpenZiti identity solves the “reach” half of the problem. You know what the system or service can talk to and every log line means something.

What it doesn’t do is handle the composition half, or to put it another way, it doesn’t account for what’s inside the thing you just handed an identity to.

Two separate disciplines that happen to share a root cause: You can’t govern what you can’t see, whether “it” is a network path or a model’s provenance.

• Watch the video: https://www.youtube.com/watch?v=FZewRqZwfOM
• Download NetFoundry’s 2026 State of AI Access report: https://info.netfoundry.io/lp-survey-august-2026