Craig Thomas

speaker

382 appearances 2 recordings 1 series first heard Jun 2026 last heard 8 Jul

Craig Thomas’s voice in public audio — every appearance, attributed to the second.

Trend

recordings per month · last 12 months

Recordings per month over the last 12 months — 2 in all, peaking in Jul 2026 with 1.

Appearances

newest first · ▶ plays the moment

Code Story | Startup Podcast for CTOs, CEOs and Technical Founders · The AI Control Loop: When AI Goes Rogue - with Craig Thomas of Wallarm · 24 Jun 2026 podcast

Or at least provide feedback to your vendors, right?

So that you understand what's going on there and you understand the full risk picture.

It's maybe a little bit outside of the scope of this conversation, but SBOMs, software bill materials and AI bill materials, they're crucial to understand truly what makes up your software and understand all your risks.

Those are point in time, maybe from your vendor, but the fact that you need to be able to understand and build those so you can understand the risk and stop that as well.

And then I'd ask, or kind of add one other thing, unsanctioned agents.

They inherit the developer's credentials, right?

So developer goes in, just puts his credentials in, and now they get a broader role than they probably should have.

So the agent, same person as me or you, right?

Maybe in an administrative role, which is much more than it needed to actually do the task at hand.

And so those are a couple of things from Shadow LM you're really looking at.

One big stat that kind of comes out, 72% of corporate AI tools in active use are rated high or critical risk.

Not future state problem, that's current state today.

We have to get that under control for sure.

One, because our tools aren't keeping up, right?

Tools that are using signatures or specific, this is allowed, this isn't allowed, just can't keep track when you're doing chaining actions together.

In that case, individual actions pass every check, but the sequence could fail the audit.

Maybe reading a customer record is fine.

You keep summarizing, it's fine.

Passing the summary to a third party API, all good, right?

But doing all three automatically at scale without a human review step, it could be a conversation around GDPR or other things that you just don't want to have.

Showing 241–260 of 382 · page 13 of 20