Sharing Is Securing: The AI Shared Responsibility Model

My teenagers have a well-rehearsed routine. One of them asks to download a new app, and I say no. That’s my answer almost every time.  

Then the counterattack begins. “So you don’t want me to have friends?” Or my personal favorite, “You just don’t want me to be creative.” It’s a negotiation I lose more often than I’d like to admit.

So I had to laugh when Dr. Alex Shulman, Global CISO at Kraken Technologies, turned the tables on me during a recent episode of The Segment podcast. I’d asked how security leaders should respond when employees push for more freedom to try new tools. She answered with a question of her own: as a parent, am I happy when my kids experiment with things?

Definitely not, I told her. But I understood her point. Kids who only ever hear no will find a way around their parents. And employees who only ever hear no from security will do the same thing. The ones who don’t will do exactly what they’re told and nothing more, and innovation grinds to a halt.  

The better approach, at home and at work, is a deal where both sides own a piece of keeping things safe.

Alex and I go back more than a decade to our days at Citi, where she was building the security patterns that helped us adopt public cloud safely. She’s been preaching the shared responsibility model for as long as I’ve known her.  

Today, AI is rewriting who’s responsible for what. To secure AI, organizations need to extend the cloud shared responsibility model to AI agents and back up their side of the deal with Zero Trust.

What cloud security taught us about shared responsibility

Every major cloud provider has explained the shared responsibility model since the early days of cloud. As Alex put it, providers “can do the best work in securing what they control.” They run and secure the cloud and its services. Customers are responsible for using those services securely.

That split sounds simple, but plenty of organizations learned it the hard way. The cloud providers gave us a strong set of security tools. Teams still left S3 buckets world-readable because it was easy, and those buckets sat squarely on the customer’s side of the line.

I’d argue we made another mistake back then. We treated cloud security as a brand-new discipline, as if none of its challenges had existed before. In reality, the cloud was a lot like the data center, only one misconfiguration away from exposure to the internet. I see teams making the same mistake with AI today.

Alex agrees. “I think it’s the same problem, and I think we can learn a lot from cloud,” she said. We already have the playbook. Now we need to apply it.

The AI shared responsibility model raises the stakes

With AI, the line between provider and customer gets harder to draw. Tech providers will offer platforms to run AI agents. The customers who use those agents will control how they’re configured, including their identities, their scope, and what they’re allowed to do.

“It’s this joint shared responsibility model that’ll become even more critical as we’re stepping into these new AI models,” Alex said.  

Providers need to give customers the tools to control their agents. Customers then need to manage the scope and identities tied to each one.

Identity is a big part of this shift. Ten years ago, identity fundamentals were built around humans and passwords. Cloud added a flood of non-human identities, like service accounts.  

Alex believes AI identities deserve a category of their own. An agent’s risk comes from what it can do combined with what it can reach.

Here’s the catch. Customers have good tools for their side of the model in cloud and SaaS. For AI, those tools are still catching up. Alex hopes the industry will build more of them, and I’m with her. Until then, teams need a strategy that holds up even when the tooling has gaps.

Shadow AI puts more weight on the customer’s side

The customer’s half of the deal keeps getting heavier because of shadow AI.  

Twenty years ago, end-user laptops were trusted and plugged straight into production networks. IT decided exactly what ran on them. Then SaaS arrived, and employees started bringing in tools of their own.

AI takes this even further. “Even the definition of shadow AI is not clear,” Alex said. Soon, employees will build their own tools with AI. Those tools won’t have a formal name or a company behind them. They’ll just be pieces of code that people write to get their work done faster.

Alex wants that creativity. She focuses her team on helping people protect themselves and what matters most: access to cloud, access to data, and the secrets that unlock both.

She’s also realistic about human nature. When I asked what accepted wisdom she thinks is wrong, she pointed to the belief that people do what they’re told.  

“We need to accept that it’s human nature, and we need to build controls around it,” she said. That’s the logic behind treating every device as untrusted.

Zero Trust means zero assumptions

When I asked Alex to define Zero Trust, she gave me an answer I’d never heard before. For her, it’s about “operating with zero assumptions about the underlying layer.” That covers the access, the device, the platform, and every layer above or below.

That makes Zero Trust much bigger than identity or network controls. Every component should assume nothing about the components around it. The goal, in Alex’s words, is “essentially reducing the blast radius for everything.”

If AI makes devices even less trustworthy, we need more Zero Trust everywhere else.  

“Everything that we’re going through with AI right now will only accelerate the need for Zero Trust,” she said. That includes extending Zero Trust to AI agents that reach your data through Model Context Protocol (MCP) servers and other channels.

Follow the data and segment early

So where should those controls live? Alex’s answer is simple: where the data is.  

That’s your side of the AI shared responsibility model in its most practical form. Even when a homegrown tool slips onto a laptop, you can still control what it’s able to reach.

Data protection has changed a lot in 20 years. Back then, encryption was the main focus. Today, it’s about who and what can access the data, and that starts with design.  

“Segmentation should be part of everyone’s design,” Alex said. “It’s the most critical thing that you need to do as early as possible, and it’s very difficult to add later on.”

This is where microsegmentation earns its keep. Say a homegrown AI tool on an employee’s laptop gets compromised. With segmentation in place, the attacker can’t use that foothold for lateral movement toward your critical assets. The breach stays small, and the blast radius stays contained.

Hold up your end by making security everyone’s job

Shared responsibility works inside your company, too.  

Alex pointed out that cloud-native companies rarely have a central cloud security team. Every engineer is expected to build and run secure solutions in the cloud. Large enterprises often stood up dedicated cloud teams to speed up migration, but the plan was always for those teams to be temporary.

She sees the same pattern with AI. Some companies are building dedicated AI security teams, and that can help kick-start the work. The long-term goal should be for everyone to pick it up.  

“If we’ll have engineers who don’t understand cloud or AI or security, it’s a problem,” she said.

I see a parallel in my customer conversations. Teams often focus on their day-one outcome. They spend far less time on how they’ll run things on day two, day three, and beyond. If security belongs to everyone, it has to outlast the launch.  

A strong AI security program needs a plan to keep it evergreen.

That also means building security into how software gets made. In the past, some companies had a dedicated day for installing patches. That won’t work anymore, because today’s developers redeploy hundreds of times a day. Security has to be part of that process from the start, so teams handle as few issues out of cycle as possible.

Why your side of the AI shared responsibility model can’t wait

The pressure on your side of the model is building fast. Frontier AI models keep making headlines for their cyber capabilities, and attackers are paying attention.  

At the same time, AI makes writing software easier every month. That means more homegrown tools on more untrusted devices, each one a possible way in.

Alex compared cybersecurity to healthcare. Most people aren’t perfectly healthy, which is why doctors learn protocols to treat disease and save lives. Security teams should assume the same about their environments. Something is already wrong somewhere, and your controls need to work anyway.

The AI shared responsibility model is taking shape right now. Providers will keep adding controls for their part, but the configuration, identities, scope, and data access of your AI agents are on you.  

Organizations that apply Zero Trust to that work today will contain the breaches that are coming. Those that wait will find themselves where we were with open S3 buckets, cleaning up after the fact.

Alex’s advice for the next 12 months is to make cybersecurity everyone’s priority, in their work lives and their personal lives.  

“It’s not someone else’s problem,” she said. “It’s part of the business.” That’s true for my teenagers, too. They just haven’t admitted it yet.

Escucha el episodio completo de The Segment: Un podcast sobre liderazgo de confianza cero en Apple Podcasts,  Spotifyo Nuestro sitio web.