Taher Behbehani

C Suite & Public Officer I Fortune 100 P&L | Co-Founder and CEO of Confidential Core AI, building technology to ensure AI trust on an agentic level

[Taher Behbehani @taherbehbehani]

The world’s biggest enterprises are spending billions on cybersecurity.

Their AI inference pipelines - where sensitive data meets the model - have no meaningful defense.

Security stacks were built for a different era: perimeter firewalls for networks, endpoint tools for devices, DLP for data at rest or in transit.

None were designed for the moment when a hospital’s patient records, a bank’s financial models, or a law firm’s client files travel in clear text to a large language model.

That moment is now happening millions of times a day. 🧵1/5

[Aakash Gupta @aakashgupta]

$1.4M total comp at Google. He walked away from it.

Mahesh spent 13 years at Microsoft, Amazon, Meta, Google. Doubled his comp every two years through the AI wave. His friends from Meta moved to Nvidia and are at $2.5M now. The recruiters keep calling. The next 70% bump is sitting there.

He left anyway. The reason matters more than the money.

Every meaningful AI product of the last three years was built by a small team or one person. ChatGPT came out of a small company. Lovable started tiny. Claude Code was a small team inside Anthropic. OpenClaw is one developer in Australia.

Inside the $2T company, the two-page document needs a one-page approval that takes six weeks. In those same six weeks, somebody with no team and no permission became a builder PM who can ship anything.

The safe job stopped being safe the moment the tools collapsed the cost of building a product from a six-person engineering team to one person at a laptop.

The $1.4M is the price of staying static while the people around you compound.

[Taher Behbehani @taherbehbehani]

In practice, the impact of having threats at the model's decision layer means having visibility into how those decisions are formed.

And it raises the bar for deploying these systems. If you don't understand how this layer behaves, or don't have a way to monitor it, you're operating with incredible risk. 🧵6/6

[Taher Behbehani @taherbehbehani]

During most of my career in technology, one thing was consistent: security meant keeping the attacker out.

And that still matters. We can monitor systems, spot unusual behavior, and trace actions back to a user.

But with AI agents, there's a new way things go wrong, and it doesn't always start with someone breaking in. 🧵1/6

[Taher Behbehani @taherbehbehani]

2️⃣ What securing the reasoning chain looks like

→ Confidential inference runs the model inside a hardware-enforced boundary, so data can be used without being exposed to the cloud host, the model provider, or anything outside that environment. It also makes the inference process itself verifiable.

→ Runtime monitoring then operates inside the reasoning chain, where decisions are actually formed, so misalignment can be detected before anything surfaces in the output.

→ Every input is verified, and every output is attested, creating an audit trail by default rather than something reconstructed later. 🧵5/6

[Taher Behbehani @taherbehbehani]

@charleswayn Precisely. The moment agents touch money, sensitive data, or operational decisions, policy is not enough.
The missing layer is enforceable runtime control over what the system can see, decide and do.
Otherwise speed and safety stay in direct conflict.

[Taher Behbehani @taherbehbehani]

At the same time, AI-related risk is becoming increasingly difficult to insure, with carriers beginning to carve out exclusions for AI-driven incidents as exposure grows.

A contract is not a substitute for technical protection. Neither is a retention policy.

What, exactly, are your legal and security teams reviewing in your provider agreements?

6/6

[Taher Behbehani @taherbehbehani]

Fine-tuning a model on proprietary data is three separate data exposures.
Most legal teams reviewing the agreement only know about one. 🧵1/6

[Taher Behbehani @taherbehbehani]

Those logs contain more than user prompts. In many enterprise deployments, they may also capture the full RAG context, including every sensitive document retrieved to generate a response.

5/6

[Taher Behbehani @taherbehbehani]

The first wave of AI security products reached market quickly.

Most of them started life as perimeter tools, endpoint solutions, or DLP platforms with an AI feature layer added on top - which means none of them were built for the problem that agentic AI actually presents.

None started from the problem that actually needed solving: how do you protect data during inference, and how do you detect when an agent's goals have been corrupted at the semantic layer? These are not edge cases, they are the primary attack vectors for agentic AI in 2026.

Twenty years across Intel and Cisco teaches you something that no threat landscape report will - the companies that got security right never started from a product. They started from the threat model, and built backwards. And while those that tried to retrofit an existing solution onto an emerging threat didn't fail dramatically, they fell behind and couldn't catch up.

Confidential Core AI was built from a clean slate - ground-up for agentic security.

Four pillars in one platform:

1. Adversarial attack protection
2. Real-time goal alignment
3. Model and data confidentiality during inference
4. Sovereign deployment

This is not just our view. When independent security researchers evaluate the available approaches, confidential compute consistently comes out as the most comprehensive.

Confidential compute is the only approach that can run any model, any vector database, and any AI framework inside a hardware-enforced boundary without architectural compromise. The challenge researchers consistently flag is not technical viability but the complexity of monitoring agentic AI. It is hard to set up, hard to verify, and easy to misconfigure. That is the problem we are solving.

Enterprises that recognize the nature of the problem will build from the threat model. They will secure the inference layer before the first agent is deployed at scale.

The ones that don't will make that discovery later, under less favorable circumstances.

[Taher Behbehani @taherbehbehani]

I’m in Washington, DC this week at @semafor World Economy, joining a high-level set of conversations on AI, infrastructure, security and what it will actually take to move enterprise AI from experimentation to trusted deployment.

One thing is already clear from the discussions here: AI security and agentic safety are becoming massive concerns.

At Confidential Core AI, we’re focused on a problem I believe is becoming impossible to ignore:
Protecting sensitive data during AI inference is necessary, but not sufficient.

As AI systems become more autonomous, enterprises also need stronger control over what those systems understand, decide and do at runtime.
That is the trust gap we are building for.

If you’re here and thinking seriously about AI security, agentic safety, confidential inference, sovereign deployment, or runtime control, I’d be glad to connect.

[Taher Behbehani @taherbehbehani]

@aakashgupta The important shift is not just prompt injection but that agentic systems turn untrusted content into runtime behavior. Once an agent can read, reason, remember and act, security has to govern what it understands, decides and does, not just what it can access.

[Taher Behbehani @taherbehbehani]

@manthanguptaa The bigger issue is that we are scaling autonomy on top of infrastructure trust that is already too fragile. Once agents, dependencies and pipelines all sit inside the same execution path, a single weak link becomes much more dangerous.

[Taher Behbehani @taherbehbehani]

Confidential compute is also the hardest to implement correctly.

That is why most vendors have not gone near it.

Ask your vendor which approach underpins their product.

Then ask which approaches they decided to leave out.

The answer will tell you more than the sales deck.
🧵8/8

[Taher Behbehani @taherbehbehani]

Every major cybersecurity vendor announced an agentic AI security product in the first quarter of 2026.

Microsoft, Cisco & CrowdStrike.
Each added a new layer to a product that already existed.

That tells you one thing clearly: the threat is real.
🧵1/8

[Taher Behbehani @taherbehbehani]

4⃣Confidential compute, hardware-enforced private environments where data is processed in isolation and verified cryptographically, is the only approach that can run any model, any database, and any framework without architectural compromise.
🧵7/8