Lindsay Timcke

Lindsay Timcke sets out four assumptions traditional assessment relies on and says agents break all four: identity, because an agent works through delegated access while an access review still shows a human account; non-determinism, because the same prompt produces a different path, so a one-time test cannot certify the system; blast radius, because connectors get added without anyone documenting what the agent can now reach; and prompt injection, because an agent trusts text and does not need to be persuaded. The proposed practice is to inventory each agent as an asset with a named owner; run it as a privileged user with least privilege and short-lived credentials; map its tools and everything those tools touch; require human approval for irreversible actions; log prompts, tool calls and outputs; and red-team permissions rather than review policy.

The injection section offers a concrete illustration: an instruction hidden in a web page, a PDF, an email signature or a calendar invite, which an agent follows without hesitation. Drawing on a career in social engineering, Timcke contrasts this with persuading a person to do something they should not: agents remove the persuasion.

The audit post takes the argument further, moving from what agents are to how auditors should respond. That is where the control-surface proposal appears.

Read original · Original 2

But an agent that ran hundreds of thousands of times under several prompt versions, with a new tool connected partway through, is not one population but several.

• Nobody marked the boundaries, so a small sample tests a process that no longer exists.
• The proposed alternative is to test the constraint: what the agent can reach, what it can initiate without a human, how fast, and what it can hand off to.
• That surface is stable, testable and small enough to inspect properly.
• One rule underpins the approach: no agent produces its own audit evidence.
• If the thing being tested writes the log, it is self-attestation with better formatting.

The post opens with a scenario and its numbers: 400,000 agent runs in a quarter, three prompt versions, a new tool connected in week six, and a 25-item sample pulled from the total as if it were one process.

Read original

Approval thresholds, rate limits, credential scope and logging are not four independent controls but one control with four failure points; if any one goes soft, the other three become decorative.

• The proposed method is to test controls in pairs: ask what the second control is actually holding up when the first fails, and whether they share a dependency that could take them both down.
• The same logic applies to monitoring an agent with another agent.
• A monitor needs its own identity, credentials the operating agent cannot see or assume, read access to logs it cannot write, and no interface the watched agent can call.
• Ideally, it should also use a different model family: two models from the same lineage fail in correlated ways, and a correlated monitor is not a monitor.
• Point the monitor at drift rather than policy violations: new tools appearing, a call graph changing shape, or a workflow that used to touch two systems now touching five.

Three linked illustrations make the point: a fifty-thousand-dollar approval threshold means nothing if the agent can split the transaction; a rate limit means nothing if the agent can call a second agent carrying its own; and segregation of duties means nothing if both roles resolve to the same service account.

• The closing exercise is to take one agent and ask what its second control does when the first fails.
• If they share the same credential, log or rate limit, it is one control with a spare label.

Read original

Traditional vendor assessment maps data, software and hardware supply chains, but nobody maps the financial supply chain.

• Assessments ask for a SOC 2 but never ask who funds the vendor, who funds that funder, or what breaks when the cost of capital moves.
• A control that depends on a company continuing to exist is not a control but a bet.
• The proposed addition is a solvency line beside the security line for every third party in the critical path — debt load, funding source, customer concentration — plus a check on whether several vendors trace back to the same balance sheets.
• The practical warning is concentration: three vendors funded from the same two sources are one risk wearing three logos.

The post examines the financing layer rather than the stock market, citing large non-financial borrowers in the high-grade bond index, credit default swaps past 215 basis points, long bonds yielding near 7.8 percent, and companies running debt-to-equity near nine that borrow against short contracts to buy depreciating hardware. It also describes a circular structure — chipmaker funds the lab, lab commits to the cloud, cloud buys the chips — and concludes there is no single AI crash, but a sorting between companies funding capital expenditure from cash flow and those funding it with debt.

Read original

But stripping identity from large volumes of email and chat is not, because context identifies people: reporting chains, project codenames, who escalated what, who covered for whom, disclosures made to a manager late at night, and fraud or audit records that describe behaviour even when no name is attached.

• You do not need a name to reconstruct a person from their own writing.
• The practical conclusion is that retention policy protects employees as well as serving compliance, and organisations should ask directly what happens to the communications archive if the company fails.

The post examines a bankruptcy auction of an airline's data, not its planes or gates.

• It describes a reported ten million dollar purchase of around 100 million employee emails, 500 million chat messages, 30 million lines of code, records going back to 1986, and pricing data.
• The sale was legal, it notes, but the roughly 175,000 people whose messages were sold were not parties to it.
• A market is forming around failed companies selling communication archives.

Read original

Deterministic finance work — reconciliation, forecasting, modelling, payables, receivables, audit sampling, reporting — is eliminated, leaving a thin strategic layer to handle exception oversight, scenario interpretation and executive advisory.

• Traditional IT, built for static systems and ticket queues, gives way to orchestration, governance, architecture and fraud-aware design.
• Timcke proposes a unified function, Integrated Risk Technology and Finance Architecture, built on risk-first governance, fraud-integrated design, AI-aligned controls, automated finance oversight and executive-grade advisory.
• The reasoning: the department is no longer the unit of structure; architecture is.
• Firms that hold onto legacy silos face entropy collapse, slowly and then all at once.

Drawing on thirty years of watching organisations defend structures instead of assets, the post closes by asking leaders what would be left if every deterministic workflow were stripped out of Finance and IT tomorrow — and whether it would be worth keeping.

The post makes its case at the level of organisational design and ends with a direct commercial invitation, making it more proposition than operational guidance. Alongside the operational posts, it supplies the strategic frame for the agent, audit and vendor arguments.

Read original

A newcomer should start here: it defines the difference between a chatbot and an agent, then translates that into risk questions a brand or audit team can ask.

Lindsay Timcke argues that most AI risk assessments still ask whether a model hallucinates or whether a vendor trains on your data, but those are not the real risks.

• The essay distinguishes an agent from a chatbot: a chatbot answers, while an agent acts with goals, tools, memory, and standing permission.
• That creates four practical breaks from traditional assessment.
• Identity becomes non-human because the agent acts with delegated access while access reviews still show a human account.
• Non-determinism means one test cannot certify the system.
• Blast radius means nobody has fully documented what an agent can reach through connectors.
• Injection means hidden instructions in a web page, PDF, email signature, or calendar invite can make an agent comply without persuasion.
• The closing line sums it up: the control was never the model; it is the permission.

For brands planning a campaign

A speaking engagement on AI-era audit and third-party risk can use this piece as its opening frame. It draws a plain-language distinction between model risk and agent risk, then offers practical asks: inventory agents as assets, treat them as privileged users, map their tools and reachable systems, require human approval for irreversible actions, and red-team permissions rather than policy.

A newcomer should read it to see why an agent that ran 400,000 times under multiple prompt versions is not one population—and what a more stable control surface looks like.

The post opens with a concrete audit problem: sampling assumes a stable process, where 25 items out of 4,000 tell you something honest about all 4,000.

• An agent that ran 400,000 times last quarter, under three prompt versions, with a new tool connected in week six, is not one population but four—and nobody marked the boundaries.
• Lindsay Timcke recommends testing the constraint instead of the transaction: what the agent can reach, what it can initiate without a human, how fast, and what it can hand off to.
• Controls in an agentic environment work together more like a circuit than a checklist.
• Approval thresholds, rate limits, credential scope, and logging are one control with four failure points.
• A $50,000 approval threshold means nothing if the agent can split the transaction.
• A rate limit means nothing if the agent can call a second agent carrying its own.
• A monitoring agent needs its own identity, credentials the operating agent cannot see or assume, read access to logs it cannot write, and no interface the watched agent can call.
• The rule: no agent produces its own audit evidence.

For brands planning a campaign

This is strong material for an internal audit, SOX, or controls-testing audience.

• The campaign angle can focus on practical questions: take one agent in your environment and ask what a second control does when the first fails.
• If both depend on the same credential, log, or rate limit, you have one control with a spare label.

A newcomer should read it to understand the strategic argument connecting the more technical posts.

Lindsay Timcke writes from thirty years of watching organisations defend structures instead of assets.

• The argument: AI is not just automating tasks; it is dissolving whole professions and exposing structural weakness.
• Finance goes first because AI eliminates deterministic workflows such as reconciliation, forecasting, modelling, payables, receivables, audit sampling, and reporting.
• What survives is a thin strategic layer focused on exception oversight, scenario interpretation, and executive advisory.
• Traditional IT faces the same pressure: static systems and ticket queues give way to orchestration, governance, architecture, and fraud-aware design.
• The proposed replacement is a single unified function called Integrated Risk Technology and Finance Architecture, built on risk-first governance, fraud-integrated design, AI-aligned controls, automated finance oversight, and executive-grade advisory.
• Firms that cling to legacy silos, the post warns, will experience entropy collapse, slowly and then all at once.
• The closing question is direct: if you stripped every deterministic workflow out of your Finance and IT functions tomorrow, what would be left, and would it be worth keeping?

For brands planning a campaign

This piece supports an executive or keynote speaking angle rather than a narrow technical session.

• It can frame a talk around organisational redesign, the shift from departments to architecture, and why risk, fraud, and resilience belong in every system decision.
• Pair it with the agent-risk and audit pieces to move from board-level thesis to operational controls.

A newcomer should read it to see how third-party risk can depend on a company continuing to exist—and how to ask different questions about critical suppliers.

The post argues that everyone is watching Nvidia, but the financing layer is the better screen.

• Nvidia posted $96 billion last quarter, doubled revenue, and guided to seventy percent growth.
• Oracle is described as the largest non-financial borrower in the US high-grade bond index, with credit default swaps past 215 basis points, long bonds yielding near 7.8 percent, and a twenty billion dollar cash flow deficit while raising fifty billion more.
• CoreWeave runs debt to equity near nine.
• Neither sells chips; they borrow against short contracts to buy depreciating hardware.
• The macro context includes the ten-year Treasury touching 4.98 percent, August CPI at 3.4 percent, oil over a hundred dollars on the Iran conflict, and markets pricing near certainty the Fed hikes.
• The circular deal pattern includes over eight hundred billion in deals where the chipmaker funds the lab, the lab commits to the cloud, and the cloud buys the chips.
• Lindsay Timcke's call is not for a single AI crash but a sorting: companies funding capex from cash flow keep compounding, while companies funding it with debt get repriced hard.
• The risk method changes: every third party in the critical path gets a solvency line next to the security line, because a control that depends on a company continuing to exist is a bet.

For brands planning a campaign

For a risk advisory firm, this offers a practical third-party risk angle.

• The campaign can present vendor assessments that ask not only for a SOC 2, but who funds the vendor, who funds that funder, and what breaks when the cost of capital moves two hundred basis points.
• It also supports a warning about concentration: if three vendors trace back to the same two balance sheets, you do not have three vendors but one risk wearing three logos.

A newcomer should read it to see how a legal transaction becomes a concrete governance and privacy lesson.

The post describes Google winning a bankruptcy auction for Spirit Airlines data, not planes or gates.

• Ten million dollars is said to buy 100 million employee emails, 500 million Teams chats, 30 million lines of code, employee records going back to 1986, and pricing data on billions of flights.
• Spirit shut down in May, and four months later their workplace conversations are a line item in a Chapter 7 sale headed for a training corpus.
• Lindsay Timcke, writing from twenty-one years of breaking into organisations by exploiting this kind of material, argues that de-identification is not solved for unstructured communication.
• Stripping names from structured records is easier than stripping identity from 100 million emails and half a billion chat messages.
• Context makes communication identifying: reporting chains, project codenames, who escalated what, who covered for whom, who disclosed a family crisis to a manager at 11pm, and fraud or audit records that name behaviour even when they no longer name people.
• None of the 175,000 people were parties to the transaction.
• The post notes that this is entirely legal and likely to be approved, then offers a practical takeaway: assume everything written on a corporate system may one day be sold by a bankruptcy estate, and ask general counsel what happens to the communications archive if the company fails.

For brands planning a campaign

This piece supports a data governance, privacy, or cyber-risk speaking angle.

• It can challenge audiences to treat retention policy as an employee protection issue, not just a compliance exercise, and ask what happens to archives in a failure scenario.
• It also pairs well with the third-party solvency post: both examine what happens to data and workflows when a provider or employer no longer exists.

Whether a model hallucinates, a vendor trains on your data, or an output is accurate are reasonable questions, but they miss the risk: an agent acts.

• It reads mail, queries databases, calls APIs, writes records, moves files, pays invoices and hands work to other agents under delegated credentials issued to a person.
• That breaks four assumptions traditional assessments rely on: identity (the account looks human in an access review); non-determinism (the same prompt can take different paths, so a point-in-time opinion cannot certify it); blast radius (nobody documents what connectors actually reach); and prompt injection (agents trust text, so persuasion is no longer needed).
• The proposed programme is to inventory every agent as an asset with a named owner; run it as a privileged user with least privilege and short-lived credentials; map its tools and what they touch; require human approval for irreversible actions; treat ingested content as hostile input; log prompts, tool calls and outputs; add agents to vendor questionnaires; and test with a red team rather than a policy review.

Inventory agents as assets with named owners; treat each as a privileged user; require human approval for irreversible actions; log prompts, tool calls and outputs; red-team instead of relying on policy reviews.

For brands planning a campaign

For a speaking slot on AI-era audit, this is the strongest opening frame: it shows why the audience's existing model-risk checklist falls short, then offers concrete actions. A session built around it can send practitioners away with an inventory and control list, not just a definition.

Examples: Source 1

An agent that ran 400,000 times under three prompt versions, with a tool added mid-quarter, represents several populations, and the boundaries were never marked.

• A 25-item sample therefore tests a process that no longer exists.
• Lindsay Timcke proposes testing the constraint instead of the transaction: what the agent can reach, what it can initiate without a human, how fast it can act, and what it can hand off.
• That control surface is stable, testable and small enough to inspect.
• One rule underpins the approach: no agent produces its own audit evidence.
• If the system being tested writes the log, that is self-attestation with better formatting.

Replace transaction sampling with constraint testing, and reject audit evidence generated by the system under test.

The reviewed material addresses agents with standing permission to act, not lower-autonomy automation. Ask whether the session will cover the latter if that is relevant to your audience.

For brands planning a campaign

This directly answers an audit audience's first question about agentic AI. Its argument is quotable, unlike generic governance talks, making it a strong candidate for a speaking engagement's title or central theme.

Examples: Source 1

Approval thresholds, rate limits, credential scope and logging form one control with four failure points; if any one goes soft, the other three become decorative.

• A $50,000 approval threshold means nothing if the agent can split the transaction; a rate limit means nothing if it can call a second agent carrying its own; and segregation of duties means nothing if both roles resolve to the same service account.
• Timcke proposes testing controls in pairs: ask what the second control is holding up when the first fails, and whether the two share a dependency that could take them both down.
• They also argue that AI can constrain AI, but a monitoring agent needs its own identity, credentials the operating agent cannot see or assume, read access to logs it cannot write, and no interface the watched agent can call.
• Ideally, it should use a different model family, because models from the same lineage can fail in correlated ways.

Test controls in pairs; give monitoring agents an independent identity, read-only log access and, where possible, a different model family.

For brands planning a campaign

This gives the control-testing portion of a talk a practical exercise audiences can run on an agent in their own environment. It also distinguishes the speaker from governance material that lists controls without explaining how they interact.

Examples: Source 1

They cite large non-financial borrowers in the high-grade bond index with credit default swaps past 215 basis points and long bonds yielding near 7.8 percent, companies running debt-to-equity near nine, and circular deals in which the chipmaker funds the lab, the lab commits to the cloud, and the cloud buys the chips.

• Their conclusion: there is no single AI crash, but a sorting.
• Companies funding capital expenditure from cash flow keep compounding; those funding it with debt get repriced.
• The risk-management consequence is that vendor assessments ask for a SOC 2 but not who funds the vendor, who funds that funder, or what breaks when the cost of capital moves 200 basis points.
• A control that depends on a company continuing to exist is a bet.
• The proposed addition is a solvency line beside the security line for every third party in the critical path, plus a check on whether several vendors trace back to the same balance sheet.

Add debt load, funding source and customer concentration to vendor reviews; map whether multiple vendors share the same balance sheets.

Several figures come from the author's reading of current market coverage, not from the posts themselves. Ask the speaker to verify the numbers before a live session.

For brands planning a campaign

This is distinctive material for a third-party-risk session: it shifts the conversation from security questionnaires to counterparty viability. Procurement and resilience audiences are also likely to quote the argument.

Examples: Source 1

It says traditional IT likewise becomes orchestration, governance, architecture and fraud-aware design.

• The proposal is a unified function named Integrated Risk Technology and Finance Architecture, replacing IT and Finance with one architecture built on risk-first governance, fraud-integrated design, AI-aligned controls, automated finance oversight and executive-grade advisory.
• The department is no longer the unit of structure; architecture is.
• Firms that keep legacy silos are described as facing entropy collapse, slowly and then all at once.
• The post closes with a direct commercial call to contact the author about restructuring work.

The argument is presented as a proposition about organisational design, not supported by named client cases. Ask for case studies if those are important to the session.

For brands planning a campaign

This is the most executive-facing theme in the reviewed set, suited to a keynote or leadership audience. The post also carries a consulting offer, so hosts should decide whether that framing fits the event.

Examples: Source 1

Lindsay Timcke accepts that stripping names from structured records is a solved problem, but argues that identity cannot be stripped from unstructured human communication: reporting chains, project codenames, who escalated what, who covered for whom, and fraud and audit records can all identify people through their behaviour, even without names.

• The point is that the transaction was legal, the people whose messages were sold were not parties to it, and a market is forming around failed companies selling communication archives.
• The practical takeaway is to treat retention policy as an employee-protection issue and ask general counsel directly what happens to the communications archive if the company fails.

For brands planning a campaign

This suits a governance, privacy or AI-ethics panel and gives audiences an immediate action: one question to put to general counsel.

Examples: Source 1

The relationship is listed as a disclosed partnership; ask whether they own, work for or otherwise formally represent the business.

View example

Like Lindsay Timcke, they treat AI governance as a practical control-design problem rather than a definition exercise.

Johar's evidence is concentrated in finance and accounting workflows and CFO-level budgeting, while Lindsay Timcke's posts range across agentic risk, internal audit, offensive security, and third-party solvency. Johar asks whether the right platform is in place; Timcke asks what permission and control structure the agent has.

Read original · Original 2

This resembles Lindsay Timcke's third-party risk posts, which look past security questionnaires to funding sources and concentration.

Gelb's domain is commercial real estate capital, with lender types, loan proceeds, and client second opinions. Lindsay Timcke applies the same hidden-structure analysis to AI and vendor risk, rather than property finance.

Read original · Original 2

The subject matter overlaps with Lindsay Timcke's third-party risk and AI governance posts; both explain how controls fail across connected systems rather than in isolated reviews.

Cowan writes from a platform and privacy-engineering perspective at Nylas, focusing on API design, least-privilege scopes, and privacy-by-design. Lindsay Timcke approaches the same territory through audit, social engineering, and risk-assessment practice.

Read original · Original 2

Johar's framing starts from the room the audience already sits in: AI governance means something different to a CISO, a data leader, and a controller, and for finance it means guarding the general ledger, enforcing internal controls, and guaranteeing auditability.

• The post then works through three concrete cases a finance audience recognises — an AI-drafted month-end journal entry that still needs deterministic policy enforcement and dual sign-off before it hits the ledger, AI-assisted three-way matching in accounts payable that cannot release cash without segregation of duties, authorization thresholds, and anomaly checks, and generative variance commentary that has to link back to transactional data and audit logs rather than hallucinated logic.
• That specificity is the reason to book Johar when the client is a controllership, audit-software vendor, or finance-transformation programme.

Johar's posts are short framing pieces, not deep operational analysis.

• The finance-governance post, published 2026-08-18, builds its case through three examples.
• A second post, published 2026-05-29, turns to the unit economics of enterprise AI, arguing that return on investment must be the entry ticket before funding.
• It poses three questions: what outcome is being replaced, what the fully loaded cost is, and where the break-even threshold lies.
• Neither piece covers non-human identity, prompt injection, connector blast radius, red-teaming, or the paired-control exercise at the heart of Timcke's audit material.
• A host choosing Johar gets fluency in finance's own control language, with less on adversarial testing and agent permissioning.

Examples: Source 1 · Source 2

Cowan's posts explain the mechanics: five ways risk propagates across connected systems, permission inheritance and automation risk, OAuth token and credential exposure, subprocessor-chain visibility, operational dependency and outage propagation, and a three-layer shared responsibility model spanning platforms, integrations, and organisations.

• The second post treats privacy by design as an engineering principle rather than a compliance checkbox, naming least-privilege OAuth scopes, data minimisation, reduced unnecessary data exposure, secure authentication, and access controls.
• For a campaign aimed at people who need to act on vendor ecosystems at the integration level, Cowan is a more precise fit than Timcke's audit-and-controls angle.

Cowan's posts summarise longer articles and link out, leaving the detailed arguments to the linked work.

• The perspective is that of a communications-platform vendor explaining shared responsibility from within the platform — useful for understanding how customers and providers divide obligations, but less independent than Timcke's adversarial framing, which draws on breaking into organisations and red-teaming.
• Cowan does not cover audit sampling, control pairing, or treating each agent as a privileged user with a named owner — the core of Timcke's pitch.

Examples: Source 1 · Source 2

His posts cover commercial real estate capital strategy: a recap of the Capital Strategy Exchange event covering acquisition and construction financing, bridge and permanent debt, refinancing, preferred equity and mezzanine capital, and how independent representation creates competition among lenders; and a worked borrowing comparison in which the same property, with $500,000 of net operating income, produced roughly $3.8 million of usable proceeds through a bank and roughly $5.1 million through institutional or life-company financing — a gap of about $1.3 million.

• The bank's real cost includes required deposits, shorter amortisation, higher debt-service coverage requirements, conservative vacancy assumptions, and personal recourse.
• If the host shifts the campaign to capital-side financing for property owners, that numeric second-opinion argument makes a strong session.

The tradeoff is the topic itself.

• Gelb's posts do not touch AI governance, agents, internal audit, or vendor risk, so booking him for a risk-advisory campaign means replacing the subject rather than addressing it.
• The material is product-led: one post closes with a direct invitation to call before accepting bank financing, while the earlier post recaps an event and thanks participants.
• Timcke's overlap with capital questions is analytical — arguing that third parties need a solvency line alongside their security line — not a lending or capital-advisory service.

Examples: Source 1 · Source 2