Cloudflare’s Volker Rath: As AI Weakens Traditional Defenses, Security Teams Must Stop Acting Like Police

The network, identity, and application defenses that organizations have spent years investing in are becoming less effective than they used to be. According to Volker Rath, Field Chief Information Security Officer (Field CISO) at Cloudflare, organizations first need to accept that reality, because AI on the attacker’s side now works faster and more automatically than traditional controls can handle.

Techsauce spoke with Rath during GovWare 2026 in Singapore, held as part of Singapore International Cyber Week (SICW) 2026. Throughout the conversation, Rath kept coming back to one idea: security tends to go wrong when we treat it as a technical problem. In many areas, the technology already has an answer. What still needs fixing is how people think and how organizations run their processes, whether the issue is defending against AI-era threats, managing shadow AI, or governing AI agents.

AI Isn’t Breaking Down the Door. It’s Exploiting Trust

Earlier this year, at Cloudflare Connect in Sydney, Rath spoke about a “post-Mythos era.” Mythos is a frontier AI model from Anthropic that can find vulnerabilities and develop ways to exploit them with minimal human input, and models like it are shifting attacks from brute-force entry to high-trust exploitation at high velocity. The first question, then, was what this actually changes for a mid-sized company in Southeast Asia, and whether, over the next two years, this kind of AI will favor attackers or defenders.

Rath joked that on the question of sides, you may need to ask the AI models which one they like more. As for the situation in Asia, he does not see it as very different from anywhere else in the world. Cloudflare Radar, the company’s internet traffic data platform, shows figures for individual countries such as Thailand, Korea, and Australia. The numbers vary a little, but the message is the same: the threat landscape is changing.

The clearest change is that AI is getting better at gaining our trust. Rath explained that trust is both our strongest defense and our weakest point. Not acting before trust is established is a good thing, but establishing trust too early is a bad thing, and AI is attacking exactly that vulnerability. On the attacker side, AI now runs every type of phishing in a fully automated way, including voice and video phishing. It also finds holes in firewall and Web Application Firewall (WAF) rules, and discovers vulnerabilities at the application layer, all automatically.

“We have to accept that our protective controls, network, identity, and application, are less effective.” 

The Answer Has Existed Since 2020: Zero Trust

Once that reality is accepted, the next question is how to respond. Rath insisted that we already have the answer: a 2020 paper from the U.S. National Institute of Standards and Technology (NIST) on Zero Trust and Zero Trust Network Access. He stressed that these are not products but principles, the core of which is to establish trust in every session.

At the network level, Rath gave an example. If an attacker has the most powerful AI available, such as Mythos, and wants to attack a network, being able to see that network means being able to scan it. Under Zero Trust, however, the attacker cannot even see the network until trust is established.

“With Zero Trust, before I establish trust, I don’t even see the network. So the most powerful weapon becomes useless.” 

Organizations should therefore expand their use of Zero Trust Network Access so that networks are not exposed to untrusted people at all.

The same principle applies to identity. Long-lived sessions, long-lived usernames and passwords, and long-lived access tokens are all bad, Rath said, because Zero Trust requires trust to be established in every session, which means trust must be short-lived.

“Everything long-lived in identity is poison.”

The idea extends to how defensive rules are written as well. In the past, a team would write a WAF rule that would stay in place for a long time and keep doing its job. That worked yesterday. Today, AI is constantly changing attack vectors and tactics, techniques, and procedures (TTPs), so long-lived rules are no longer what organizations need. Instead, they need to analyze what is happening right now and create dynamic rules that may last only a day, because when AI moves on, defenders need to move on too.

Rath therefore tells his customers not to select security solutions the way they did in the past when procuring security software. What matters is the agility of their defenses, something many organizations still do not have in their procurement playbooks.

“Speed is the new game. AI is changing all the time. Create not only strong, but agile defenses, highly automated.” 

From the “Office of No” to an Engineering Function

The need for more agile defenses leads to another challenge: employees using tools outside official systems. Cloudflare’s Security Signals Report cites research showing that 98% of employees use unsanctioned apps across shadow AI and shadow IT use cases. Rath has written that the usual response is to suppress these tools, even though people who work around official systems are usually signaling a real business need. How should security teams act on that signal instead of shutting it down?

Rath pointed to an old problem in the field: security is often seen as “the office of No,” the function that wags its finger, tells people what they should not do, and insists that everyone come to it first as the gatekeeper. His answer starts with changing that role, from a policing function to an engineering function. A police officer says, “Don’t do it.” An engineer asks, “What do you need? How can I help you?”

The reason is not only about attitude but also about scale. In a world that is changing this quickly, no organization can have enough people to respond to every request, and many of those requests are valid. Employees need certain tools to do business and cannot wait until the security team has finished its analysis.

“Policemen don’t scale, because they’re humans. What scales is things that I have automated.” 

That does not mean opening everything up. Rath suggested thinking about security in risk scopes. Anything involving highly sensitive information still calls for black-and-white thinking and still needs a police function, because mistakes there can cause serious damage. But not every use case in an organization deals with highly sensitive information, and in many areas, organizations can afford to be more “scrappy,” because if something goes wrong, it is not the end of the world.

Security itself is a good example. Tools that support automated triage or automated event analysis are helpers. If they produce output that is slightly off, it is still better than not having them at all. So if organizations need more tools, they should put automated validation processes in place and approve those tools earlier.

Shadow AI Is Solved Technically. The Rest Is About People

On shadow AI specifically, Rath said the problem has been solved technically. He offered a simple example: if he uses his Cloudflare notebook to access an unapproved AI tool, it gets blocked straight away. Behind that is a combination of Zero Trust tools and an AI Gateway, which sits between users and AI models to control those connections.

The harder question is what to open up, what to allow, and what to block. When it comes to AI, Rath believes choice is very important, because using the most expensive models for the simplest tasks is simply not viable. The business needs choice, but it also needs control. Combining Zero Trust endpoints with an AI Gateway, he said, solves about 90% of the technical problems, and the industry has moved past where it was in January this year, when people were still unsure what tools they might need to develop.

With the technology in place, what remains to be fixed are process and people: implementing the right tools and providing the right guardrails. Rath said he particularly likes the word “guardrails.”

“Guardrails doesn’t say ‘No.’ Guardrails says ‘Yes, until here.’ And that’s exactly the right approach.” 

Policies Trapped in PDFs Can’t Keep Up With AI

From tools, the conversation moved to policy. Rath has written that the AI governance playbook most organizations are drafting is already obsolete before it is even finished. In Thailand, the Bank of Thailand has issued AI risk management guidelines for financial service providers, and a draft AI Act was opened for public consultation this year. What should Thai organizations do differently so their policies keep up, and which decisions should never be handed over to an AI agent?

Rath opened with a short answer: “PDFs don’t work.” Imagine telling a developer to deliver something by tomorrow, then adding that they should first go to SharePoint and read 20 PDFs. It simply does not work. Organizations are still over-indexing on policies and frameworks. These are, of course, necessary, but they do not need to live in PDF format.

The first part of the solution is to automate policies, writing them as code (policy-as-code) so that they can scale. This is where most frameworks and policies fail, Rath argued, because they treat the policy itself as the most important thing. If a policy cannot be enforced at scale, an organization would need another 50,000 police officers to enforce it.

“The policy is a very important thing, comma, and it needs to be enforceable at scale.”

The second part is more practical guidance. Rath sees existing risk frameworks as common sense and correct, but they only set high-level goals. Most people already know they need a governance framework, need to assess risks, and need to implement controls. What is missing is the “beef on the bone,” or practical advice that can actually be put into action, which is what Rath is currently working on with many customers.

If You Had 10,000 AI Agents, Which Would You Shut Down First?

With no industry or global standard for AI governance yet, Rath said he helps customers ask better questions rather than looking for ready-made answers. To do that, he uses a thought experiment.

Imagine an organization has 10,000 AI agents, all running autonomously on behalf of people, some of whom have already left the organization. As Rath put it, “There is no such thing like a Monday morning meeting with the agents.” Then costs run too high, and the organization orders a 20% cost reduction. Based on what metrics could it make automated business decisions about which agents to shut down?

Should it shut down the agents with security and compliance problems first, or the ones that matter least? How does it measure return on investment (ROI) for an agent? Price alone is irrelevant, because something expensive that delivers a 10-times return is worth paying for. Should the decision rest on quality, duplicated use cases, customer satisfaction with the agent’s output, business need, or all of these?

With human employees, Rath noted, we know the answers. We know whether someone behaves well, produces quality work, shows up on time, and is reliable. We do not have that information for agents yet. Few people are thinking about the end of the life cycle either, meaning when an agent should be shut down, because everyone is either in building mode or in panic mode about AI security.

Organizations, he said, need to step back and ask who needs governance. The list includes the CEO, application owners, the Chief Financial Officer (CFO), the Chief Risk Officer (CRO), and the assurance, risk, audit, and forensic readiness teams. Each of them has questions. Rath collects those questions as user stories, such as, “As an application owner, I want to know that my agent…”, which can easily produce 10 to 20 questions, because the money comes out of that person’s pocket.

“What does visibility and control actually look like, so that we could operate agentic AI at scale with confidence?”

For Rath, governance guidance should help organizations move toward that North Star, even if nobody has all of the answers today.

When an Agent Makes a Mistake, Whoever Pays Owns the Risk

Good governance leads to the hardest question of the agent era. Rath has said that accountability for an agent’s behavior can never be outsourced. So if a vendor’s AI agent makes a mistake, who is accountable?

Rath shared a recent encounter with someone who was very proud of something they had built with AI. When Rath said he did not find it particularly great, the person blamed the AI. That, he said, reflects a very common habit: when things go well, we take the credit, and when they do not, we blame the AI agent.

“You own it. If the stuff that comes out of your AI, you own it. The good, the bad, and the ugly.” 

This is part of a governance model, which needs to make a clear distinction between responsibility and accountability. Rath gave the example of a CISO, who is responsible for security but not accountable for it. If security fails, it is the CEO who faces legal consequences, unless the CISO has done something wrong. When an organization runs an AI agent, it therefore needs to answer three questions: On whose behalf is the agent running? Who pays for it? And who owns the business risk?

The question became very real after an OpenAI AI agent hacked into Australia’s Medicare, the country’s universal health insurance system. Rath observed that others whose agents had escaped and hacked another company could face jail time, while OpenAI issued a press release, which suggests the current model of accountability and responsibility is broken. Even so, the case is a stark reminder. And none of this is new: the industry has dealt with the same questions before in Operational Technology (OT). The problem is not that organizations do not know what to do, but that they need to remind themselves to actually do it.

For Rath, whoever runs and pays for an AI agent should have visibility into its risks and be aware that they are accountable for them. If the agent escapes and the police knock on the company’s door, they will want to talk to you. Only when people see the risk clearly do they change their behavior and make the budget available for proper controls.

What many people have not yet considered, Rath added, is that guardrails built into an agent do not really work, because of the conflict of interest within the agent itself. Proper governance requires mechanisms that sit outside the agent and oversee it, just as organizations do with humans.

“Every agentic workload needs the same amount of AI token power to govern it. That means we double the cost. Are you up for that? If not, you carry the risk.”

Rath believes many organizations have not yet realized that the cost of AI is not just the cost of building something. It also includes the cost and effort of managing the associated risks, along with making it very clear who owns those risks. His answer to the final question brought the conversation back to where it began: this is a people and process problem, less so a technical one.

References: Interview with Volker Rath, Field CISO at Cloudflare, by Techsauce at GovWare 2026, part of Singapore International Cyber Week (SICW) 2026; Cloudflare Security Signals Report 2026