AI Needs a Governed Path, Not a Ban, Armor Founder Tells GovWare

Chris Drake says AI should complete useful business work automatically within policy. CISOs can enable that autonomy by resolving data classification, owning routing rules and demanding auditable evidence.

SINGAPORE, Oct. 14, 2026 /PRNewswire/ — CISOs face pressure to get out of the way of AI innovation while keeping the business alive, Armor Founder and CEO Chris Drake told GovWare 2026 today. Leaders see a competitive risk in moving too slowly. Security leaders must also protect customer trust, contractual commitments, and operations. AI is already arriving through employees and the tools they use, often without a separate security decision. In his Tech Talk Spotlights session, “Once Again. AI Puts CISOs Between a Rock and a Hard Place,” Drake argued for AI to complete useful business work automatically within policy, with CISOs setting the conditions for adoption and having the authority and evidence to enforce them.

“With the cloud, the CISO at least got a say. With AI, nobody asked. Banning it doesn’t work, and ignoring it is how the breach report gets written,” said Drake.

Drake contrasted AI with the cloud transition, when security could assess a provider and influence which applications and data left the corporate environment. AI can arrive inside existing browsers, productivity tools, and employees’ machines without that checkpoint. Depending on permissions, an agent can read files, send data, and take actions. The risk can travel over an allowed connection even when the firewall works as configured.

After decades spent defending the perimeter, organizations must now examine the AI agents running on employees’ machines. Drake highlighted specific local virtual machine visibility gaps: Anthropic documents that host endpoint detection and response (EDR) cannot inspect activity inside Cowork’s local VM, while Docker documents that processes inside its local sandbox microVMs are invisible to the host. EDR alone cannot provide complete oversight; platform telemetry and network controls remain important. An employee clicking “Allow” does not settle whether the business approved the data access or processing.

Drawing on his conversations across APAC, Drake described the pressure on CISOs who report to the CIO or CTO sponsoring an AI rollout. He urged them to gain trust and lead the decision: agree on the business outcome, define what earns a yes and demand evidence that the controls and business result work. CISOs also need a written mandate to approve, restrict or pause AI use; a named executive who owns each risk exception and its expiration date; and an escalation path to the risk committee. These are decisions about the conditions for AI adoption, not approval of every routine AI action.

Suppliers extend that exposure. A vendor’s use of another AI provider to process an organization’s data introduces fourth-party risk. Organizations need evidence of the providers involved, where data is processed, what is retained and which contractual protections apply. Protiviti’s February 2026 AI Pulse Survey found that 47% of large organizations reported incomplete visibility into employees’ use of AI tools. A useful, approved AI path can reduce the incentive to work around security, while discovery and supplier oversight remain essential.

Drake said data classification has moved from nice-to-have to must-have. Organizations must know what their data contains, who owns it and how it may be used. Classification, ownership, permitted use and auditability provide the basis for rules that systems can enforce automatically. “AI cannot safely use data you cannot govern,” he said. Once that foundation is established, organizations should own the routing policy. Use approved external models when data policy permits and private execution when required. Task complexity, model capability, business needs and cost then guide the choice among permitted options. AI can complete authorized work automatically, with records of the data accessed, policy decisions, models, routes, actions and outcomes. Those receipts let the organization reconstruct what happened without making a person approve every step.

Armor, a provider to regulated industries since 2009, faced the same challenge. Drake said the company was concerned about sending customer data through public AI services where the controls and audit evidence could not meet its customer commitments. It built a governed AI platform for its own operations, now Sovereign AI, and runs its business on it.

Drake closed with the principles behind Sovereign AI: know the data, preserve model choice, own routing policies, control actions and demand full auditability. Give the whole company useful, approved AI so employees have less reason to turn to shadow AI. He called for powerful agents and their credentials to run in governed, isolated, auditable environments, with scoped access, rather than on employees’ laptops.

Before granting an AI tool access, he urged CISOs to ask three questions:

1. What can it touch?
2. Where can it send?
3. Can we control what it does?

His message to CISOs was: “Yes. With rules. With authority. With evidence.” The presentation is available at https://www.sovai.com/govware26.

Armor is demonstrating Sovereign AI at Booth A22 through October 15. Press and analyst briefings with Drake are available on-site and virtually; requests go to the media contact below.

ABOUT SOVEREIGN AI

Sovereign AI is the governed AI work platform for the whole company, built by Armor. One control layer for every model, every team, and every dollar, inside your walls, under your rules. Armor has spent 17 years securing regulated industries, protecting over 1,700 organizations across 40+ countries held to the highest compliance bars in the business. Sovereign AI is what that experience looks like as a product. Learn more at sovai.com.

ABOUT ARMOR

Since 2009, more than 1,700 organizations in 40+ countries have relied on Armor to protect regulated data in the public and private cloud. AI is the next risk, so Armor built Sovereign AI to bring that same protection and compliance to how organizations use AI in the workplace: a fully governed platform that lets them leverage AI without creating undue risk to their data and their regulatory obligations. For more information, visit armor.com and sovai.com and follow us on LinkedIn.

Media Contact
Michele Glassman
Marketing Director, Armor
michele.glassman@armor.com