There’s a lot of FOMO surrounding AI right now. Leaders are asking: How do we move forward quickly without taking on too much risk? Finding that balance is like walking a tightrope, particularly as AI agents begin executing transactions with real dollars.
This shift into agentic commerce introduces a new enterprise identity: the autonomous agent. As these agents are given more autonomy to pay bills, book travel, and manage corporate funds, organizations face the complex challenge of controlling exactly what data and systems an agent can access.
But for Mark Hillick, CISO at Brex, the greatest threat is standing still. If security teams block AI adoption out of fear, the risks to the business could outweigh any security gains. “A lot of security teams think that the security risk is the bigger risk,” says Hillick in a recent conversation for our Executive Exchange series. “But if the business isn't viable and it's not making money, you're not going to need a security team.”
Hillick’s approach is to stay close as a collaborative partner to product and engineering rather than a gatekeeper. For Hillick, whose role extends beyond traditional security to oversee roughly a third of Brex’s engineering org, partnering from the very start of the development lifecycle ensures that security guardrails are baked into agentic commerce solutions by design.
Practically, that means treating AI agents as workload identities requiring the same rigor as human identities: attribution, authentication, and authorization are non-negotiable. “No agent should go in with blanket access to everything," says Hillick. Instead, any elevation to higher privileges should be verified by a human and time-boxed. Security teams also need tamper-proof observability logs that make attribution possible during an incident investigation.
Hillick is candid that no one has this fully figured out yet, himself included. "I think once you're comfortable with knowing that you don't know everything, it's a lot easier," he says.
Watch the full Executive Exchange video above to learn more from Mark Hillick on balancing AI innovation, embedding security into engineering, and establishing strict guardrails for agentic commerce.
