AI agents are entering enterprise AI faster than CIOs can govern them. Line-of-business users are vibe-coding their own tools, agents are operating with employee credentials, and foundation models are changing under running systems.

In CXOTalk episode 919, Anthony Scriffignano, PhD, a prominent data scientist, and Tim Crawford, a strategic advisor to CIOs at the world's largest companies, examine what enterprise AI governance, shadow AI, and agentic risk require of technology leaders today. The discussion grounds the AI agent conversation in practical decisions: what to keep from established IT governance, what is genuinely new, and where the CIO role must evolve.

YOU'LL LEARN:

✅ Why traditional regression testing breaks when foundation models, training data, and environments all change at once

✅ How shadow AI and vibe-coding by non-developers expand the threat paradigm beyond the enterprise perimeter

✅ Why HR-style policies do not transfer to AI agents, and what changes when super-agents call sub-agents through an orchestration layer

✅ Specific controls for shadow AI: sandboxes, token counting, personal Identifying Information (PII) guardrails, and watching for value leaving the organization

✅ Red, blue, and green teaming for autonomous agents, including why red teams need a defined target list, not a license to break things

✅ The three governance layers CIOs must now reconcile: user role-based access controls (RBAC), agent governance, and knowledge governance, across ServiceNow, Salesforce, and SAP

✅ When human in the loop is meaningful and when it becomes theater, including the limits of audited-sample review at machine speed

✅ How the transformational CIO mindset differs from the traditional one, and why business depth is now the prerequisite skill

⏱️ TIMESTAMPS

0:00 AI agents are running wild: framing the problem

3:11 From automation to autonomy: how CIOs should reframe risk

5:21 What old governance disciplines still apply, and what is new

6:12 Shadow AI, vibe coding, and the limits of control

9:11 Practical controls: sandboxes, token counting, PII guardrails

11:53 Why HR policies do not work for AI agents

15:24 Regression testing for misuse and misadventure

18:43 The aspiring CIO: traditional vs. transformational mindset

21:07 Disciplined red, blue, and green teaming

23:30 When mandatory automation becomes the only option

32:03 Human in the loop: meaningful or theater?

34:09 What AI governance actually looks like in practice

38:10 New roles: context engineers, AI FinOps, and value frameworks

40:30 Talent and jobs inside IT: what changes

🔔 Subscribe for weekly conversations with the world's top business and technology leaders.

📩 Get the CXOTalk newsletter: https://newsletter.cxotalk.com

💬 Read the show notes: https://www.cxotalk.com/episode/cio-playbook-agentic-ai-in-the-enterprise

🎙️ ABOUT CXOTALK

CXOTalk features unfiltered conversations with C-suite executives from major companies about AI, digital transformation, and business strategy. Hosted by Michael Krigsman.

Episode 919

#cxotalk #ShadowAI #AIAgents #AIGovernance #AgenticAI #CIO #EnterpriseAI #DigitalTransformation #AIRisk #CIOLeadership

Enterprise AI: Shadow AI and Agentic Risk - CIO advice

CXOTalk

Enterprise AI: Shadow AI and Agentic Risk - CIO advice