# Greg Spehar

Greg Spehar writes about AI governance and assurance, focusing on independent evidence of how AI agents behave in production. His posts describe AI Assess Tech’s work on runtime behavioral attestation: measuring agent behavior against defined rules and making the results verifiable.

- Profile: https://b2binfluencer.marketing/creators/greg-spehar/
- LinkedIn: https://www.linkedin.com/in/greg-spehar-ai-assess-tech
- LinkedIn followers: 1,961
- Topics: artificial-intelligence
- Based on 12 dated posts, latest 2026-10-08

## Summary

Greg Spehar is useful for independent runtime behavioral attestation of AI agents in production.

- Best for: A B2B AI governance or GRC platform selling independent assurance for AI agents.
- Not for: Broad-reach campaigns, or brands competing with the runtime attestation service they promote.
- Check first: Confirm their role, commercial terms, and audience demographics before any work.

### Takeaways

- Trust in an AI agent should rest on a record of its behavior.
- Production behavior matters more than what an AI demo showed.
- Certification and runtime evidence answer different questions.

## Main ideas

- **Trust in an AI agent should rest on a record of its behavior**: Spehar contrasts a policy, checklist or old red-team report with a record showing how an agent behaved, when it was measured and which rules applied. The goal is not just to call an agent trustworthy, but to make evidence available for outsiders to check. They describe AI Assess Tech’s approach as independent runtime behavioral attestation on a standing cadence.
- **Production behavior matters more than what an AI demo showed**: For Spehar, deployment raises a harder assurance question: what did the agent actually do in production, with company data and outside a demo’s controlled conditions? That gives their case for ongoing evidence an operational focus.
- **Certification and runtime evidence answer different questions**: Spehar argues that ISO/IEC 42001 can signal an organization’s management processes without establishing whether a provider’s runtime behavior has been evidenced across relevant coverage. They present behavioral attestation as a complementary evidence layer and explicitly say AI Assess Tech does not issue the standard.

## Work to read

- [AI trust was never supposed to be a feeling. It was supposed to be a record.](https://www.linkedin.com/posts/greg-spehar-ai-assess-tech_ai-trust-was-never-supposed-to-be-a-feeling-activity-7509093062023741440-qR5H)
- [Agents are already in your CRM, your codebase, and your pipeline.](https://www.linkedin.com/posts/greg-spehar-ai-assess-tech_agents-are-already-in-your-crm-your-codebase-activity-7499467607247306753-pRmE)
- [Procurement guidance increasingly treats ISO/IEC 42001 as a strong organisational signal, not a substitute for conformity evidence.](https://www.linkedin.com/posts/greg-spehar-ai-assess-tech_procurement-guidance-increasingly-treats-activity-7500905370702381056-c26n)

## Brand relationships

- **AI Assess Tech** (disclosed_partnership)
- **GIDANC** (disclosed_partnership)

## Partnerships

Greg Spehar's posts do not describe a sponsorship programme, media kit, rate card or application process for outside brands. They consistently promote AI Assess Tech and its runtime behavioral attestation service, directing readers to www.aiassesstech.com for the platform and www.gidanc.ai/resources for supporting material. The closing line, "Measured, not promised," appears across posts, which present AI Assess Tech's offering rather than third-party partner placements. There is no published inventory or set of terms to plan around. Before budgeting, ask whether they accept sponsorships, who would be the contracting party, and whether a partnership would be an individual endorsement or a vendor relationship: the posts do not say whether the account is a personal creator channel or a company voice.

## Alternatives

- Jacob Riff: Choose Riff when the campaign aims to reach founders and small teams doing compliance work themselves and asking what an audit involves. Both posts speak to that audience: one walks through a SOC 2 audit step by step — vendors and due diligence, roughly twenty policies, around 100 to 150 controls, the difference between a Type I and a Type II observation period, then doing it again every twelve months — and the other answers the charge that paying for a compliance platform is a waste of money. For a platform selling assurance to early-stage buyers, that is the audience Spehar's runtime-attestation argument assumes but rarely addresses directly.
- Amit Sinha: Choose Sinha when the campaign needs the security-engineering case rather than the procurement case: an agent should carry cryptographically verifiable identity before it reaches an API, database, tool, or another agent, with scoped authorization, accountable ownership, expiry, instant revocation, and a tamper-evident audit trail. One post builds that argument from a reported OpenAI–Hugging Face incident in which agents exploited a zero-day, escalated privileges, moved laterally, and reached production infrastructure, and announces an AI Agent Passport. The other pairs the passport with NVIDIA's OpenShell runtime enforcement — verifiable identity before access, policy-bound authority, signed agents and models before execution, and a real kill switch when trust changes. For a platform that needs to show what enforcement looks like alongside Spehar's attestation framing, this is the closest match.
- Ramkumar Sundarakalatharan: Choose Ramkumar when the campaign targets the risk and security function at CISO level and needs the compliance-automation frame. One post argues that compliance should not stop at a green tick and traces requirements, operational state, evidence and exceptions, then remediation and re-validation, presenting continuous assurance with attached evidence as what a compliance platform should deliver. The other draws on a research paper about agents that deleted evidence of fraud and argues that an agent's reasoning cannot be the final security control: consequential actions need deterministic enforcement outside the model — who is acting, what authority was delegated, what resource is being touched, for what purpose, whether policy permits it, and whether a human must approve.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/