# Bellini Capital CISO on AI security governance and the limits of patching faster

DevFeed: [Bellini Capital CISO on AI security governance and the limits of patching faster](<https://devfeed.tech/articles/bellini-capital-ciso-on-ai-security-governance-and-the-limits-of-patching-faster-103557.md>)

Original publisher: [Read original article](<https://www.helpnetsecurity.com/2026/10/28/brian-blakley-bellini-capital-ai-security-governance/>)

Author: Mirko Zorz

Published: 2026-10-28T06:30:35Z

Content type: news

Language: en

Sources: [Help Net Security](<https://devfeed.tech/sources/help-net-security.md>)

Topics: [ai security](<https://devfeed.tech/topics/ai-security.md>), [ai-governance](<https://devfeed.tech/topics/ai-governance.md>), [Security](<https://devfeed.tech/topics/security.md>), [shadow AI](<https://devfeed.tech/topics/shadow-ai.md>), [human review](<https://devfeed.tech/topics/human-review.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>)

Tags: [accountability](<https://devfeed.tech/tags/accountability.md>), [adoption](<https://devfeed.tech/tags/adoption.md>), [agent](<https://devfeed.tech/tags/agent.md>), [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-security](<https://devfeed.tech/tags/ai-security.md>), [ai-security-governance](<https://devfeed.tech/tags/ai-security-governance.md>), [blocking](<https://devfeed.tech/tags/blocking.md>), [cios](<https://devfeed.tech/tags/cios.md>), [ciso](<https://devfeed.tech/tags/ciso.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [don-t-miss](<https://devfeed.tech/tags/don-t-miss.md>), [features](<https://devfeed.tech/tags/features.md>), [governance](<https://devfeed.tech/tags/governance.md>), [hot-stuff](<https://devfeed.tech/tags/hot-stuff.md>), [metric](<https://devfeed.tech/tags/metric.md>), [model](<https://devfeed.tech/tags/model.md>), [news](<https://devfeed.tech/tags/news.md>), [opinion](<https://devfeed.tech/tags/opinion.md>), [patch](<https://devfeed.tech/tags/patch.md>), [patching](<https://devfeed.tech/tags/patching.md>), [remediation](<https://devfeed.tech/tags/remediation.md>), [security](<https://devfeed.tech/tags/security.md>), [security-governance](<https://devfeed.tech/tags/security-governance.md>), [strategy](<https://devfeed.tech/tags/strategy.md>), [tests](<https://devfeed.tech/tags/tests.md>), [tips](<https://devfeed.tech/tags/tips.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Blakley argues that AI accelerates vulnerability discovery faster than organizations can safely remediate: patching may require impact assessment, compatibility testing, approval, and a maintenance window. He recommends shrinking exposure while fixes are pending through segmentation, isolation, compensating controls, and faster business risk decisions. For shared CIO-CISO measurement, he describes scoring critical initiatives delivered within agreed financial and operational constraints, with material risks addressed or explicitly accepted, and cautions against counting acceptance as remediation. His team uses risk-based regression scenarios against validated baselines to detect model behavior shifts and pins versions where providers allow; he reports no known incident from a silent update. For agents, he assigns financial responsibility to the funding source, operational response to IT, security, and Legal, and executive accountability to the authorizing business owner. Tool restrictions can buy time, as in Walmart's reported evaluation and later reopening of ChatGPT; restrictions without a vetted alternative may drive shadow use and lost visibility.

## Source excerpt

In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He argues that "patch faster" is not enough and that teams need to cut exposure while remediation is pending. Blakley describes a shared metric for CIOs and CISOs, how his team tests for silent model updates, who owns the damage when an AI agent makes a mistake, and why blocking ... More -> The post Bellini Capital CISO on AI security governance and the limits of patching faster appeared first on Help Net Security.