Continuous Validation of AI Security Controls: SRE Practices for a World Where Agents Change Everything
Static security controls break in dynamic environments – and AI-driven infrastructure is the most dynamic environment enterprises have ever operated. This session applies SRE discipline to cybersecurity: treating security controls as SLO-backed services, building continuous validation pipelines that detect control drift before attackers find it, and designing break-glass procedures for when AI-driven automation goes out of bounds.
Susan is a 2x CISO who has rebuilt programs from inception, matured, operationalized and optimized results. She has more than 25 years of experience in Information
Technology, Cybersecurity, Business Continuity and Third-Party Risk Management. She has served in executive leadership roles with PNC as the CISO (Fortune 150),
Aetna as the Chief Data Protection Officer, Synovus as the CISO and BNY as the Managing Director of Technology Risk Management.
She has a record of rebuilding programs with highly capable teams. She reengineers processes and technology for efficiency and innovation – creating opportunities to
achieve continuous learning to address complex issues.
Susan is a CISO Executive Network Advisory Council member, Governing Body of the Global Evanta CISO Council, Member of the BITS Security Steering Committee and
prior Board members of the Cyber Risk Institute and the Financial Services Information Sharing and Analysis Center. She holds a Bachelor of Science in Electrical Engineering
and a Masters in Business Administration.
Lena Smart is the former CISO at MongoDB, and served as Global CISO for Tradeweb, as well as CIO and Chief Security Officer for the New York Power Authority, which is the largest state power organization in the country. She is a founding member of Cybersecurity at MIT Sloan and, most recently, she has joined CTGT.ai as their advisor and is also an investor. Lena is also an angel investor and board advisor to companies including Accrete.ai, Acium.io and Humma.ai.
I focus on what I see as the next frontier of cybersecurity: securing autonomous AI agents and
systems.
I lead ONUG’s Agentic AI Working Groups, where I work alongside industry peers to define the
security standards and guardrails that autonomous AI systems will need as they take on greater
operational autonomy. This work sits at the intersection of emerging risk and practical enterprise
defense, shaping how organizations think about trust, control, accountability and safety in
agentic AI.
I was named an ONUG Fellow in recognition of my contributions to enterprise security, notably
as the creator of the Cloud Security Notification Framework (CSNF).
Prior to focusing entirely on cybersecurity research, I was a security executive at Cigna, where I
led teams responsible for cloud and AI security strategy and execution.
My work in digital forensics complements this focus, grounding the guardrails I help define in the
technical realities of how systems actually fail and how incidents actually unfold.
I’m always glad to connect with fellow researchers, practitioners, and industry groups working on
the security challenges of autonomous systems and digital forensics.
Technology leader and Senior Solution Architect with 24+ years of experience defining enterprise technology strategy and leading the architecture of secure, scalable, and cloud-native solutions across Azure, AWS, and other cloud providers. Specializing in Enterprise AI, Generative AI, cloud modernization, and digital transformation, I partner with executive leadership and cross-functional teams to deliver innovative, business-aligned solutions that accelerate growth, improve operational efficiency, and drive measurable business outcomes.
