#554 Securing the AI Era: Alex Schlager on Why AI Agents Are the New Attack Surface

In this episode of The CTO Show with Mehmet, I’m joined by Alex Schlager, Founder and CEO of AIceberg, a company operating at the intersection of AI, cybersecurity, and explainability.We dive deep into why AI agents fundamentally change enterprise risk, how shadow AI is spreading across organizations, and why monitoring black-box models with other black boxes is a dangerous mistake.Alex explains how explainable machine learning can provide the observability, safety, and security enterprises desperately need as they adopt agentic AI at scale.⸻👤 About the GuestAlex Schlager is the Founder and CEO of AIceberg, a company focused on detection and response for AI-powered workflows, from LLM-based chatbots to complex multi-agent systems.AIceberg’s mission is to secure enterprise AI adoption using fully explainable machine learning models, avoiding black-box-on-black-box monitoring approaches. Alex has deep expertise in AI explainability, agentic systems, and enterprise AI risk management.https://www.linkedin.com/in/alexschlager/⸻🧠 Key Topics We Cover • Why AI agents create a new and expanding attack surface • The rise of shadow AI across business functions • Safety vs security in AI systems and why CISOs must now care about both • How agentic AI amplifies risk through autonomy and tool access • Explainable AI vs LLM-based guardrails • Observability challenges in agent-based workflows • Why traditional cybersecurity tools fall short in the AI era • Governance, risk, and compliance for AI driven systems • The future role of AI agents inside security teams⸻📌 Episode Highlights & Timestamps00:00 – Introduction and welcome01:05 – Alex Schlager’s background and the founding of AIceberg02:20 – Why AI-powered workflows need new security models03:45 – The danger of monitoring black boxes with black boxes05:10 – Shadow AI and the loss of enterprise visibility07:30 – Safety vs security in AI systems09:15 – Real-world AI risks: hallucinations, data leaks, toxic outputs12:40 – Why agentic AI massively expands the attack surface15:05 – Privilege, identity, and agents acting on behalf of users18:00 – How AIceberg provides observability and control21:30 – Securing APIs, tools, and agent execution paths24:10 – Data leakage, DLP, and public LLM usage27:20 – Governance challenges for CISOs and enterprises30:15 – AI adoption vs security trade-offs inside organizations33:40 – Why observability is the first step to AI security36:10 – The future of AI agents in cybersecurity teams40:30 – Final thoughts and where to learn more⸻🎯 What You’ll Learn • How AI agents differ from traditional software from a security perspective • Why explainability is becoming critical for AI governance • How enterprises can regain visibility over AI usage • What CISOs should prioritize as agentic AI adoption accelerates • Where AI security is heading in 2026 and beyond⸻🔗 Resources Mentioned • AIceberg: https://aiceberg.ai • AIceberg Podcast – How Hard Can It Be? https://howhardcanitbe.ai/