From Shadow AI to Secure Agents: The C.H.A.N.G.E. Playbook

From Shadow AI to Secure Agents: The C.H.A.N.G.E. Playbook

Speakers: Barrett, Staff Product Security and AI Engineer, Adobe

Conference: BSides Seattle 2026

YouTube: https://www.youtube.com/watch?v=3JZBugiirhw

Overview

Barrett, a staff product security and AI engineer at Adobe, delivers a talk focused not on which AI model or tool is best, but on why well-meaning security teams keep failing to adopt AI securely -- and what to do about it. The talk centers on the C.H.A.N.G.E. framework (Communication, Human oversight, Attitude, Network, Governance, Enablement), originally developed by Nofar Gaspar at Superintelligent, which Barrett adapts specifically for security teams.

The premise is sharp: according to ISACA's 2025 European Union research report, 83% of IT organizations are already using AI at work, but only 31% have a formal AI policy -- a 52-point gap of unsanctioned AI activity with no guardrails. The talk maps six common failure patterns in enterprise AI adoption and provides a pillar-by-pillar playbook for addressing each one through cultural alignment rather than technology procurement.

This is fundamentally a governance and organizational change talk, but one grounded in real data about how developers and analysts actually behave with AI tools in the enterprise. Barrett's perspective as someone working at Adobe on product security and AI engineering gives the framework credibility beyond the theoretical.

Background

▶ Watch: Introduction and the shadow AI problem (0:00)

Barrett opens by painting a picture of four personas that exist in every organization: the analyst who discovered an AI tool that cuts triage time from 40 minutes to 4 minutes and copies live incident data into it daily; the senior engineer who blocks every AI pilot as a liability; leadership that promised the board an AI roadmap for next quarter; and the legal team that discovers AI tools in use during a routine audit with no prior notification.

Each persona is acting rationally, but together they create shadow IT, stalled initiatives, and real compliance exposure. The missing piece, Barrett argues, is not technology but cultural alignment.

Key Findings

▶ Watch: 27% of data entered into AI tools is sensitive; 98% via personal accounts (5:45)

Barrett identifies six agent failure patterns that map directly to the six pillars of the C.H.A.N.G.E. framework:

1. Shadow AI: Best employees find workarounds. Netscape's research found data sent to generative AI apps increasing 30% year-over-year. CyberEvents telemetry reports that 27% of corporate data entered into AI tools is sensitive, and 98% comes through personal accounts via copy-paste -- a vector that bypasses traditional DLP strategies entirely.

1. Productivity Mirage: Developers save 10 hours per week with AI but those hours vanish with no direction. Bottlenecks move upstream to the PR review queue, and net throughput remains the same.

1. Senior Engineer Veto: Legitimate skepticism becomes blanket obstruction. The talk reframes this: skepticism is an asset; obstruction is not.

1. Middle Manager Squeeze: Caught between executive pressure for visible wins and ground-level reality of inadequate tooling.

1. Compliance Scramble: Legal is looped in after incidents, not before deployments.

1. Reversion: Organizations swing from enthusiastic adoption to near-zero usage within months after a single bad experience.

Technical Deep Dive

▶ Watch: AI manifesto: addressing job security fears in writing (10:30)

The most technically grounded segment covers developer-specific AI tool configurations. Barrett highlights hidden configuration settings in tools like Cursor and Claude Code where developers must ensure privacy mode is enabled and data sharing is toggled off when using personal accounts. Enterprise admins must configure these platforms for safety on the enterprise side, not rely on individual developer behavior.

The three-tier autonomy model provides a concrete deployment architecture:

• Sandbox State: AI tools used only for enrichment and classification; no real actions allowed. This is the testing phase.
• Supervised State: AI performs certain automated actions under human oversight for a 30-day pilot period.
• Full Autonomy: The agent handles end-to-end workflows with periodic random audits. Promotion to this tier is earned through demonstrated safety in the previous tiers.

Barrett also references OWASP's identification of prompt injection as a top risk and the MITRE ATLAS framework's documentation of prompt injection propagating through RAG pipelines as specific threats that the human oversight pillar addresses.

Demo / Proof of Concept

▶ Watch: Three-tier autonomy model: sandbox, supervised, full autonomy (13:45)

No live demo was presented. The talk is structured as a framework presentation with supporting data points and real-world anecdotes from enterprise environments.

Defensive Implications

▶ Watch: From prompt engineering to agent managers: the real skill shift (22:00)

The defensive implications are primarily organizational and operational:

• Deploy an AI manifesto: A one-page document that addresses job security fears, defines what data is off-limits, specifies what needs human sign-off, and tells employees how to reinvest their saved time. Barrett cites the Shopify CEO and Duolingo CEO as examples of leaders who publicly stated AI proficiency is required for the job.
• Convert skeptics into safety advocates: Use the phrase "help me make this safe" instead of "get on board or get out." Give skeptics ownership of designing safety requirements.
• Build champions, not mandates: Top-down CEO emails do not drive adoption. Barrett cites research showing a team with no executive sponsor achieved 70% adoption in six to seven weeks because one practitioner showed peers what worked.
• Accelerate governance: Implement 48-hour sandbox approvals with conditions rather than six-month approval processes or blanket bans.
• Train for agent management, not prompting: Prompt engineering is table stakes. The emerging skill set is agent management -- recognizing hallucination, drift, and knowing when to escalate.

Key Takeaways

• The 52-point gap between AI usage (83%) and formal AI policy (31%) represents massive unsanctioned risk in most enterprises
• Shadow AI is driven by copy-paste into personal accounts, bypassing all traditional DLP controls
• Cultural alignment beats technology procurement -- diagnose human dynamics before buying AI tools
• The three-tier autonomy model (sandbox, supervised, full autonomy) prevents premature production deployment
• Skeptics are your best safety advocates when given ownership rather than exclusion
• Peer-driven champion networks outperform top-down mandates for AI adoption
• Governance must operate at the speed of innovation -- 48-hour conditional approvals, not six-month review cycles

About the Speaker(s)

Barrett is a staff product security and AI engineer at Adobe. He presented his personal views and public research, noting the talk does not represent Adobe's official positions. The C.H.A.N.G.E. framework he adapts was originally developed by Nofar Gaspar at Superintelligent.