Princess Okoro

Security GRC Manager | Author, The AI GRC Desk Newsletter | Building with AI and governing its use | AI in GRC, AI Security & Governance, GRC engineering

[Princess Okoro @prinnyokoro]

Hey @X ! 👋🏽 I’m Princess.

Cybersecurity GRC professional by day, AI enthusiast and builder by night 😅

I write about AI, AI Security and governance, cybersecurity, AI in GRC , the tools I’m building and whatever else catches my interest.

Haven’t posted here since 2024, but I’m back!

Looking to connect with people interested in AI security, AI in GRC, AI governance, AI agent security and building with AI.

Let’s #connect! 🤝

[Princess Okoro @prinnyokoro]

One thing I’m really interested in right now is how AI can make cybersecurity and GRC work less manual.

I’ve been experimenting with Claude Code, Codex and AI agents to see what I can actually build.

Still learning, breaking things and figuring stuff out 😂

Anyone else building in this space?

[Princess Okoro @prinnyokoro]

@DanielMiessler Who knows how many of these are sitting in vendor lists nobody's looked at since onboarding

[Princess Okoro @prinnyokoro]

@DanielMiessler Thanks for sharing, this is very useful

[Ryan @ryangrowthh]

Literally the sauce behind billions of lifetime views on 𝕏.

[Princess Okoro @prinnyokoro]

@ArtemPolynko GRC

[Princess Okoro @prinnyokoro]

@ReneChavez_wooo I think that’s one of the challenges. Governance often becomes a priority after something goes wrong, when ideally it should be built into how agents are deployed and operated. I’m particularly interested in connecting agent security to ongoing risk and control assurance.

[Princess Okoro @prinnyokoro]

Where are all the people building AI tools for cybersecurity, AI Governance and GRC? 👀

I’m particularly interested in AI agents, security automation, GRC engineering and agent security.

Would love to see what people are working on.

Drop your projects below! Lets #connect

[Princess Okoro @prinnyokoro]

@SimOnWebNow Completely agree on treating external content as untrusted. I particularly like your point about human approval for consequential actions. Curious, how do you currently track those approvals and verify the controls are still working as your agents evolve?

[Princess Okoro @prinnyokoro]

@CastorLabsDev That’s an interesting setup! For me, one of the biggest gaps is proving that an agent’s security controls are actually working, particularly as its tools, permissions and capabilities change. How do you evaluate whether your critic agent is catching the right things?

[Princess Okoro @prinnyokoro]

@lazeskid Same here! Especially when agents can access multiple systems and act on behalf of users. I’m particularly interested in how organisations govern those permissions beyond the initial approval. Are you building in this space?

[Princess Okoro @prinnyokoro]

This is exactly the area I’m interested in! I think there’s a real gap between having governance policies and making them work in day-to-day AI workflows. Curious, are the biggest challenges you’re seeing around approval processes, auditability, or connecting everything to the existing security and GRC tools?

[Vijay Rayapati @amnigos]

If you work in IT or Security, this one is for you.

Here’s why exploits exploded in 2026.

NIST scores AI models on a cyber capability index. This year, open-weight AI models crossed the 1000 mark.

GLM-5.3 is near 2400, just four months behind the U.S. frontier. That’s part of why so many critical vulnerabilities are being reported, even by non-security folks, in foundational software that enterprises and web applications depend on.

Some of these exploits sat hidden for 15 to 20 years, and AI can now turn them into working exploits that can compromise the entire system.

The real gap is the operational velocity between “we know about this” and “we’ve fixed it,” and that gap usually lives between IT and Security.

Human bandwidth cannot remain the last line of defense for enterprise IT and Security.

Here’s what I’d do this week: take your last critical advisory and trace where it sat waiting in your enterprise IT service management. Fix that handoff latency first.

This is a solvable problem and ops teams that tighten this enterprise service management loop now will be in a good shape.

I wrote up more of my thinking here: https://t.co/m0lhlTS8mg

#CIO #CISO #ITOps #SecOps

[Princess Okoro @prinnyokoro]

@mrtbrgl Hello hello 👋

[Princess Okoro @prinnyokoro]

@mrtbrgl Hello hello 👋

[The Hacker News @TheHackersNews]

‼️ WARNING - A researcher just dropped a report on Tailscale SSH flaws — one compromised device could get root on others, and there’s NO PATCH yet.

In lab tests, SSH port forwarding enabled privilege escalation and lateral movement across already-permitted devices.

Tailscale says a fix is coming.

Read - https://t.co/0wcJTvDoxV

[Princess Okoro @prinnyokoro]

@patrick_kuhnke_ Cursor, lol 😂 I don’t even use it

[Princess Okoro @prinnyokoro]

@bggoranoff Wow!! This is amazing, I’ll check it out

[Princess Okoro @prinnyokoro]

Amid all the security noise this week, one release caught my attention: 1Password for Agents.

So how does this work in practice?

Imagine asking Grok Bot to update your personal website in Squarespace.

When it reaches the login page, the agent app prompts you for the credential it needs from 1Password. You review the requested login and approve it in 1Password.

1Password then fills it in without exposing your password or one-time code to Grok Bot, or giving it access to the rest of your vault.

This obviously addresses one concern: sharing credentials with an agent.

Availability varies by integration, and several connections are still coming soon

https://t.co/2Ik2Gx7JCl

[Princess Okoro @prinnyokoro]

Everyone playing around with AI agents is exactly why cybersecurity skills will always be in demand!

[Princess Okoro @prinnyokoro]

@itsSanwalZia Hi 👋 let connect, I am into AI Security