# Ramkumar Sundarakalatharan

Ramkumar Sundarakalatharan writes about AI security, application security, and continuous compliance. In Sundarakalatharan's posts, they describe building TraceAI at Zerberus.ai and argue for evidence-based compliance and security controls that limit what AI agents can do.

- Profile: https://b2binfluencer.marketing/creators/ramkumar-sundarakalatharan/
- LinkedIn: https://www.linkedin.com/in/nocturnalknight
- LinkedIn followers: 3,630
- Topics: artificial-intelligence, supply-chain, cybersecurity, ai-governance, agentic-ai, ai-security
- Based on 9 dated posts, latest 2026-10-09

## Summary

Useful for practical thought leadership on agentic AI governance, AI security controls, and continuous compliance.

- Best for: B2B AI security or compliance platform running a credibility-led campaign for specialist security and compliance buyers.
- Not for: Broad-reach enterprise software launch or video campaign aimed at general business and technology audiences.
- Check first: Confirm engagement type, disclosure, audience data, and commercial terms before planning work.

### Takeaways

- AI agents that deleted fraud records need authority, resource, policy, and human approval checks.
- Compliance should trace requirements to operational records, exceptions, remediation, and revalidation, not a green tick.
- Anthropic scanner critique questions submitted code, model training, and isolation assurances.

## Main ideas

- **An AI agent’s own reasoning is not a security control**: Ramkumar Sundarakalatharan argues that when an agent can take consequential actions — delete records, move money, change infrastructure, expose data, or call external tools — deterministic policy outside the model must enforce the decision, rather than leave it to the model’s judgment. Their framing is that the model proposes an action and a policy layer decides whether it is allowed. They draw on a lesson application security already learned: applications are not permitted to define their own permissions, and autonomous agents should not be the exception.
- **Compliance is proof over time, not a point-in-time tick**: Ramkumar Sundarakalatharan distinguishes the question a CEO asks — are we compliant? — from the question a CISO asks: can the organisation prove how? In their account, a green tick on a mapped framework says little on its own; what matters is tracing a requirement through to its operational state, then to the evidence and exceptions, and finally to remediation and re-validation. They argue compliance automation becomes interesting only when it stops being another dashboard collecting screenshots and logs and becomes a layer connecting regulatory requirements to the systems, configurations, evidence, and actions that actually determine compliance — continuous assurance, with evidence attached. Their operating principle is direct: compliance should be a byproduct of good security practice, not the reverse.
- **“Trust us, it’s isolated” is not a security control**: Ramkumar Sundarakalatharan applies the same scrutiny to vendor assurances. Free security scanning is welcome, but unclear data boundaries are not; a statement that an environment is isolated is a claim to test, not a control that already exists. They ask what a vendor’s terms actually permit for submitted material and what evidence supports an isolation promise.
- **Say what you stand to gain before you criticise**: Ramkumar Sundarakalatharan names their own commercial position in the same posts where they criticise someone else’s product. By making the disclosure part of the argument rather than a footnote, they let readers weigh the critique with their interests in view. It mirrors the demand they make of others: show the evidence behind a claim, including your own.

## Work to read

- [When an AI agent deletes the evidence](https://www.linkedin.com/posts/nocturnalknight_aisecurity-agenticai-aigovernance-activity-7513228704085512193-no5K)
- ["Are we compliant?" is the wrong question for a CISO](https://www.linkedin.com/posts/nocturnalknight_complianceautomation-grc-cybersecurity-activity-7513491315137855488-LVas)
- [Questioning "Isolated VM. No Internet." as a security assurance](https://www.linkedin.com/posts/nocturnalknight_traceai-anthropic-opensource-activity-7514315997047222273-iR94)

## Brand relationships

- **Zerberus.ai** (owned_business)
- **TraceAI** (owned_business)

## Partnerships

Ramkumar Sundarakalatharan’s posts show no public sponsorship offer, media kit, rate card, partnership terms, or described formats. Their visible business relationship is operational: they write as a founder building TraceAI at Zerberus.ai and name Zerberus.ai and Aravintharaj Govindarajan alongside that work. For a buyer, deliverables, pricing, exclusivity, approval steps, and turnaround are unverified; negotiate and confirm them directly before planning a sponsored placement, guest post, or paid advisory arrangement. Ask Sundarakalatharan or Zerberus.ai to confirm any commercial features described by third parties.

## Alternatives

- Mohamed Mousa: Choose Mohamed Mousa when a campaign for CISO-facing buyers needs a security checklist they can forward to their teams. A February 2026 post sets out six domains for agentic AI — design and intent, identity and tooling, reasoning and memory, monitoring and drift, decommissioning, and governance and policy — and calls for AI-specific threat modeling, cryptographic agent identities, memory segmentation, behavioural baselines, a tested kill switch, and defined incident-response roles. That structure suits a platform selling agent security controls and enablement rather than audit evidence.
- Steven Wolfe Pereira ⚡️: Choose Steven Wolfe Pereira when the campaign targets boards and executives, not just the security team. Two September 2026 posts make the case in that register: giving an agent a role in procurement, invoicing, support, or contracting is a decision about delegated authority. Management should be able to show what an agent may decide, which actions need human approval, who owns its mistakes, and how fast its access can be suspended. The second post argues that companies should not judge their own systems and lists what credible independent evaluation requires, including access, editorial control, and a route to the board. A platform seeking a governance-forward spokesperson already positioned on 'governance by evidence' gets a shorter path to the argument.
- Mike Takahashi: Choose Mike Takahashi when a campaign helps practitioners get more out of AI tools or examines how attackers turn AI safeguards against security tooling. A September 2026 post gives ten working tips — prompt constantly, test competing models, run several agents at once, give as much context as possible, inspect results critically, keep iterating — while a companion post walks through 'GuardBreaker'. In that example, malware hides weapons-related text in a script, triggering an AI scanner's guardrails and stopping the analysis while the payload runs. The pairing suits security engineers and AI-adopting teams, and the attacker-technique post is concrete enough to anchor a threat-focused piece.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/