"It took 9 seconds" wrote Jer Crane, founder of PocketOS, after an Ai coding agent deleted his company's entire production database and all backups in a single API call, despite explicit instructions no to. The same month, two more incidents made headlines. Same failure pattern every time, broad credentials, no confirmation gates, and systems designed as if a human is always in the loop.

Ai adoption is moving faster than governance can follow. Security and GRC teams are being left out of the conversations. This session puts them back in it.

Drawing from named, published incidents and mapped directly to NIST AI RMF and NIST Generative AI Profile (AI 600-1), this talk introduces my own actionable AI governance methodology.

You'll leave with a framework you can implement Monday morning, not a document you'll hope to be able to get to read someday. Because someday already happened. It took nine seconds.