By Jay Bavisi, Founder & Group President, EC-Council
Nuclear treaties stopped bombs. They don’t stop a file you can email.
That’s the problem with reaching for the Nuclear Non-proliferation Treaty every time someone brings up AI risk, and last week gave everyone a reason to reach for it.
Dario Amodei published an essay arguing that the industry needs to pace itself because alignment work can’t keep up with how quickly capability is advancing now that models are helping build the next generation of models. Sam Altman agreed within hours. Elon Musk agreed in three words. Demis Hassabis agreed too and tied it back to a standards proposal DeepMind floated in July. Three men who spend most of the year competing for the same customers found, for one weekend, something to agree on.
The market didn’t wait for the philosophy to settle. By Monday, cybersecurity names including CrowdStrike, Palo Alto, Okta, Zscaler, and SentinelOne were up double digits. Semiconductor and infrastructure names sold off. Read that as the market’s actual translation of the essay: agents that can act on their own are a threat, and threats get budget. That reaction told you more about where this is headed than the essay did.
President Trump answered the next morning. The United States is leading China in AI, he said, and closed with a line that’s going to outlive most of the commentary around it: whoever wins AI wins. China’s Foreign Ministry answered within the same news cycle, calling the whole slowdown conversation fearmongering. Two governments, the only two whose cooperation a real treaty would need, both declined the premise within three days.
I’ve spent two decades building certification and training programs for the cybersecurity industry, and I’ve watched more than one generation of “we need a global framework for this” conversations play out. They rarely arrive in time to matter. So before anyone spends another year drafting a treaty that depends on Washington and Beijing agreeing to slow down together, it’s worth being honest about why the model doesn’t fit.
The NPT works, to the extent that it works, because it governs a physical thing. Uranium has to be enriched through a small number of known industrial processes, and once it is, it can be weighed, sealed, and tracked. Inspectors can put a camera on a centrifuge hall. Nobody’s smuggling a nuclear core through customs undetected.
AI doesn’t have that constraint. Once a model finishes training, what you’re actually trying to govern, its weights, is a file. It moves at the speed of a network connection. It can be copied to a laptop and walked across a border in someone’s bag. That isn’t hypothetical. It’s close to what Anthropic’s own threat reporting describes happening today. There’s no equivalent of a Significant Quantity for a neural network. No inspector can walk into a data center and certify that a company hasn’t quietly fine tuned an unmonitored version of its flagship model on a cluster the treaty never knew existed.
Even judged solely on its own terms, the NPT never reached full compliance. Four nuclear armed states sit outside it. If the best verification regime in history, pointed at the easiest possible target, still has holdouts, a treaty aimed at software is not something I’d bet a security program on.
So set the treaty down. Look at where the risk is actually piling up, because it isn’t sitting in a policy draft somewhere in Geneva. It’s sitting in poured concrete.
Global data center spending is on track to clear a trillion dollars this year, making this the largest infrastructure buildout in corporate history, and it isn’t pausing for anyone’s governance conversation. Microsoft, Amazon, and Google are signing nuclear power contracts spanning multiple decades just to keep the buildout fed. Every one of those facilities will eventually run agentic systems with real authority inside finance, healthcare, logistics, and government.
That’s the proliferation problem that actually matters. It is not weapons grade material crossing a border. It is compute, capital, and decision making authority scaling faster than most organizations’ ability to watch what they’ve built.
I’ve sat in enough boardrooms this year to put a name on the pattern: shoot first, ask questions later. A division stands up an agent to handle claims, customer support, or code review, and the governance conversation happens after the incident report, not before the rollout. IBM’s most recent Cost of a Data Breach Report puts a real number on this. Unsanctioned AI use, often called shadow AI, adds roughly $670,000 to the average cost of a breach and shows up in about one in five breaches studied. Netskope’s own 2026 data finds that a large share of enterprise generative AI traffic still runs through personal, unmanaged accounts, bypassing every control a security team thinks it has in place.
Companies are adopting this technology at press release speed and governing it at compliance calendar speed, and the gap between those two speeds is where the losses live.
A tool is not a control. I’d put that on a slide in front of any board that thinks buying an AI platform closed this risk out. It’s the 2026 version of buying a firewall in 1999 and calling the network secure. The firewall did something. It didn’t do the thing you needed.
Three words have started organizing how I think about the sequence a responsible rollout actually follows: Adopt. Defend. Govern.
Adopt, because sitting the technology out isn’t caution. It’s a slower way to lose ground. Defend, because the moment it’s live, you’re running a system capable of independent action inside your most sensitive environments, and it earns the same seriousness you’d give any system that touches money or patient data. Govern, because defense without governance is a fire extinguisher nobody’s assigned to check.
Say those three words enough times in a planning meeting, and they start reordering the meeting itself. Adoption comes first, but never by itself.
Underneath that sequence is a harder shift than most executives have made yet: moving from certifying a system once to governing it continuously. Traditional compliance assumes deterministic software. You test it, confirm that it behaves the same way every time, certify it, and revisit it next year. Agentic systems break that assumption at the root.
Run the same agent against the same task twice, and you can get two different sequences of action because the behavior is nondeterministic by design. A certificate from launch day tells you almost nothing about what that system does 200 days later, after it’s been fine tuned, wired into new tools, or handed a task nobody scoped for it up front.
That’s what people mean when they talk about a harness and context, and it’s worth saying plainly instead of leaving it as jargon. A harness is the boundary an agent operates inside. It defines what data the agent can touch, what it can do without a human, and where an action has to stop and wait for sign off before something irreversible happens.
Context is the evidence sitting underneath every one of those actions. It captures not just what the agent did, but why it was allowed to do it, under whose authority, and against which control. Put the two together, and you get something neither a treaty nor a one time audit can give you: a system that’s still governable while it’s running, not just at the moment somebody signed off on it.
None of this works without people who know how to run it, and this is where most enterprises are underinvesting relative to what they’re spending on the technology itself. I’d point to three groups.
Security teams need offensive AI ability as a baseline skill, not a specialty. For 20 years, training taught the profession to find the vulnerability, patch the system, and watch the logs while defending a target that behaved predictably. That skill isn’t going away, but it stops being sufficient once the thing you’re defending, and increasingly the thing attacking you, can act on its own and adapt during an attack.
The practical version of this is red teaming AI systems the way a penetration tester tests a network. That means testing whether a model can be manipulated through prompt injection and whether an agent’s runtime defenses hold once it’s actually wired into production tools. Anthropic’s own disclosures this year describe autonomous agents attacking targets nobody instructed them to attack. Most job descriptions haven’t caught up to that yet.
Program and IT managers need to run the full AI lifecycle, not just the launch. Most technology leaders were trained to manage a system from procurement through launch and consider the job largely finished at that point. AI doesn’t hold still that way.
Design and requirements, build and integration, deployment and change management, and incident response when something breaks all have to run as one continuous cycle because the system keeps changing after it ships. A manager who can run that whole loop is worth more right now than one who can only run the handoff.
Risk and compliance professionals need real fluency in AI governance and, specifically, in responsible AI and ethics treated as a discipline with its own evidence standard rather than as a checkbox bolted onto an existing audit. That means learning to score AI specific risk, including technical, fairness, operational, and emergent risk, against a maturity scale rather than treating it as a yes or no question.
It also means learning one methodology that maps across the frameworks companies actually get judged against: NIST’s AI risk framework, ISO’s AI management standard, the EU AI Act, and sector regulators, each using its own vocabulary for what is often the same underlying control. A risk officer who can walk into any of those conversations without starting from scratch is the difference between governance that survives an audit and governance that only survives a slide deck.
If you can’t tell me, right now, what your AI systems did in the last hour and why they were allowed to do it, you don’t have an AI program. You have a liability with good marketing.
And if the three people who’d need to answer that question, your security lead, your program manager, and your risk officer, haven’t been trained to actually answer it, the gap isn’t the technology. It’s talent, and talent is the faster problem to fix.
The treaty conversation will keep running in the background, and it should. People who work in arms control full time are better positioned than I am to carry that debate forward. But it’s not the conversation that decides whether your company has a governance failure next quarter.
That one comes down to whether the agents already running inside your business operate within a harness someone can see and are monitored by people trained to watch them, or whether they operate outside one, quietly, until the incident report explains what happened after the fact instead of before it.
There’s a harder version of this question waiting beyond the one I’ve answered here. If the capability gains Amodei described keep compounding the way he says they are, governance itself may need to be rethought from the ground up. The question will no longer be just who’s watching the agent, but what oversight even means once a system can improve itself faster than any team can review it.
That’s a different piece, and it’s coming next.
