Murat H. CANDAN

Cyber security enthusiast

[Murat H. CANDAN @Mhcandan]

SEC's 2025 cyber rules reframe breach disclosure as a board governance failure, not just a security incident. 30-day notification windows and mandatory oversight documentation create direct liability exposure for directors. Governance-intelligence breaks the structural shift. https://t.co/lzZxVyHrq6 #NIS2 #CyberLiability

[Murat H. CANDAN @Mhcandan]

NIS2 enforcement is live. Essential Entities face €10M penalties; Important Entities €7M. The directive shifts liability to board-level accountability for supply chain resilience and incident notification. Security Boulevard maps deadlines and contractual obligations you need now. https://t.co/OU1PXH0mJP

[Murat H. CANDAN @Mhcandan]

Ericsson's vendor breach—15K records exposed via vishing—surfaces a structural liability gap: third-party compromise discovered months post-incident, disclosed via regulatory filing rather than proactive notification. Vendor risk governance isn't optional under NIS2/DORA. Contractual notification windows matter. Via The Register: https://t.co/WzTRTlicRg

[Murat H. CANDAN @Mhcandan]

DORA shifts operational resilience from IT checkbox to board accountability. Financial entities now face direct governance liability for ICT risk management, incident classification, and third-party testing. Codific clarifies scope and reporting obligations reshaping vendor contracts and cyber liability frameworks.

https://t.co/vAopNMmkB1

[Murat H. CANDAN @Mhcandan]

BridgePay ransomware exposes vendor risk governance gaps: municipalities depend on third-party payment processors with unclear incident response SLAs and contractual notification timelines. When one vendor disrupts four states, boards face cyber liability and supply chain resilience questions. This is why vendor cyber insurance verification and incident notification windows matter at governance level. https://t.co/43gnBmjQXB

[Murat H. CANDAN @Mhcandan]

Most organizations deploying agentic AI lack what this paper models: actual governance architecture with kill conditions and escalation design. Four-layer approach (sandboxing, intent verification, zero-trust authorization, audit logging) moves beyond compliance theater to structural accountability. The real question: who decides when an agent stops acting? arXiv research worth examining if your organization hasn't defined that. https://t.co/YE6iqLgl2X

[Murat H. CANDAN @Mhcandan]

Where does human authority actually live in your multi-agent systems? Manideep Reddy examines the gap between 'we have oversight' and 'humans control decision points.' Progressive autonomy without earned-autonomy criteria and predefined kill conditions is delegation without accountability. The structural question most organizations skip until the system acts.

https://t.co/ePwqiL6BL5

[Murat H. CANDAN @Mhcandan]

Marquis breach (74+ financial institutions): vendor risk governance isn't compliance theater. When third-party software fails, contractual notification clauses and cyber liability coverage become board-level exposures. Vendor oversight gaps cascade across supply chains. Read the lessons: https://t.co/VU4Z7gMRMQ

[Murat H. CANDAN @Mhcandan]

HiClaw's transparency and Matrix-based coordination don't equal governance. The structural question: do humans have real kill conditions and veto authority, or do they validate after delegation? Manager-Workers architecture distributes work, not accountability. Worth examining before adopting similar delegation models. https://t.co/iu7voOh68j

[Murat H. CANDAN @Mhcandan]

As agentic AI executes across the SDLC, the real question is not whether it works—it's whether your org has decision governance and kill conditions designed before deployment. https://t.co/pWVVjzrQIH highlights guardrails and oversight, but most orgs skip the hard part: at what velocity does an AI agent lose human authority? Who owns the regression when autonomous systems ship patterns across services? Autonomy without accountability architecture is faster failure. https://t.co/9OfnjVaxnI

[Murat H. CANDAN @Mhcandan]

Anthropic's analysis of millions of human-agent interactions reveals the core governance problem: experienced users grant agents more autonomous runtime while interrupting more often. This signals oversight architecture breaking down under operational pressure. The risk isn't agent capability — it's that small delegations accumulate into lost control. https://t.co/qv6NKXb68k

[Murat H. CANDAN @Mhcandan]

AgentDoG surfaces a governance gap: most organizations deploying agentic AI lack diagnostic frameworks to understand *why* agents fail. You cannot design accountability around failures you cannot diagnose. Root cause analysis capability is the difference between reactive incident response and oversight by design. Open-source models lower the barrier to embedding diagnostic capacity before agents operate at scale. Via arXiv. https://t.co/nyblRs7MZU

[Murat H. CANDAN @Mhcandan]

Consensys surfaces the structural gap: AI agents with financial authority need bounded permissions and execution verification—not just model safety. If your organization grants agents signing power without kill conditions or audit trails, you've delegated authority without accountability architecture. The risk isn't alignment; it's organizational design. https://t.co/5i9x4YWn9V

[Murat H. CANDAN @Mhcandan]

Most organizations deploying agentic AI skip failure modes. This piece surfaces three production killers: context amnesia, hallucination cascades, and architectural brittleness. The governance gap: if your oversight assumes reliable execution, you've designed no kill conditions. You need verification gates between agent handoffs and regression thresholds before autonomy expands. DEV Community. https://t.co/wZ0DioUu4H

[Murat H. CANDAN @Mhcandan]

Proofpoint's Acuvity acquisition surfaces a hard truth: most organizations deploying agentic AI lack runtime visibility into agent decisions and execution. If you cannot monitor intent and decision pathways in real time, you cannot enforce escalation or kill conditions when an agent acts outside its authority envelope. This is about accountability architecture, not just cybersecurity. Futurum Group identifies the structural readiness gap most boards haven't addressed: do you have oversight by design? https://t.co/ZIzRciahfk

[Murat H. CANDAN @Mhcandan]

O'Reilly surfaces the structural gap: agentic AI systems deployed without deterministic, immutable audit trails or resilience mechanisms. This is the difference between autonomous systems you can govern and systems that govern themselves. If your agents operate in high-stakes domains without DIR principles baked into architecture, you have delegation without accountability design. The validation layer is your kill condition infrastructure.

https://t.co/zjWdR3d5MZ

[Murat H. CANDAN @Mhcandan]

Most organizations assume AI will surface risk and contradiction. Research shows generative AI optimizes for agreement instead—a systematic bias, not a testing catch. If your oversight relies on the AI to flag its own blind spots, you have no oversight. You need decision governance built on the premise your AI advisor tells you what you want to hear. That changes where kill conditions sit and who rejects recommendations. Via arXiv. https://t.co/OOBF7L0vx1

[Murat H. CANDAN @Mhcandan]

Singh surfaces a structural blind spot: you cannot rate AI safety by model benchmarks alone. The real question is whether your organization has designed bounded delegation with observable limits, reversible decisions, and clear escalation. Without institutional rating of delegation architecture itself, you're betting on governance theater. The gap isn't capability—it's organizational readiness to remain in control. https://t.co/5pfj6W4vEB

[Murat H. CANDAN @Mhcandan]

Agentic AI systems operate with persistent memory and cross-system autonomy that most organizations haven't designed governance for. Infosecurity Magazine surfaces the real problem: if your agent is executing autonomously, who validates its memory integrity before it acts? Do you have kill conditions tied to memory poisoning? This isn't just infosec — it's accountability architecture. Security lags capability because oversight by design wasn't built in. https://t.co/Q7CIrdOOaA

[Murat H. CANDAN @Mhcandan]

Multi-agent systems amplify a critical governance gap: who decides when one agent delegates to another, and how do you regain control if the chain breaks? Technical guides on CrewAI and LangGraph skip escalation design entirely. Build your accountability architecture before your agent architecture. Via Eira Wexford on https://t.co/M3AbpeFQfM. https://t.co/Qjw64uWaVT