Filar: As Head of AI at Sublime Security, I lead the team building our machine learning detection models and autonomous agentic systems, including our Autonomous security analyst (ASA) and detection engineer (ADÉ). My career began in geospatial analysis at the Department of Defense before shifting into security and machine learning research at Endgame, where I built some of the earliest natural language security agents like Artemis. I later led security machine learning teams through Elastic’s acquisition of Endgame. 

Around 2009, I was using ArcGIS’s statistical inference tools just as the field was shifting toward Activity-Based Intelligence, which emphasized behavior patterns over time rather than static locations. What hooked me was the inference step: deciding whether a cluster of activity was statistically meaningful or just noise. Since that job, I’ve been trying to answer some version of that question. Across my research, I’ve focused heavily on adversarial ML, malware classification, and human-AI collaboration, including co-authoring the 2018 Malicious Use of AI report alongside researchers from OpenAI and other groups. At Sublime, I’m focused on evaluating LLM-generated detection rules and testing the capabilities of agentic learning harnesses in cybersecurity.

Security: When it comes to security AI, what does the industry often promote as “autonomous?” What do you think of this label?       

Filar: “Autonomous” gets slapped on tools and products that still need a human in the loop for every action, which is one of the clearest and most recent cases of cyber marketing outpacing engineering. This results in a serious credibility gap where vendors promise autonomy, without truly building it in, and customers inherit the risk that comes along with slap dash products that have AI clunkily bolted on. 

The biggest issue I see with the label of “autonomous” is that most vendors treat autonomy as a capability they grant the product at ship time. It isn’t. Autonomy must be earned by the operator over time. Much like self-driving cars, you’d never hand over the keys or full control untested.

Security: How do you view autonomy?

Filar: Instead of asking “how autonomous is it?”, I ask “what has it earned the right to do?” because autonomy is a spectrum and autonomy for its own sake is never the goal. We should treat any AI agent as high-privilege untrusted code, implementing strict controls, sandboxing, and least privilege because the system must assume the agent can misbehave. To put this into practice, at Sublime we operate on four core pillars: adversarial input, calibrated outputs that accept “unknown” as a legitimate answer, tiered autonomy, and continuous symmetric red-teaming and evals. Products like ASA and ADÉ default to human-in-the-loop operation, earning greater autonomy only as customers accumulate proof of accuracy on their own timeline. Finally, this entire framework relies on three non-negotiable properties at every level: total transparency, clear explainability, and full auditability. A black-box system never gets to skip the line, no matter how good its accuracy numbers look.

Security: Is the goal maximum autonomy? Why or why not?

Filar: No, maximum autonomy is not the goal. Full autonomy cannot be purchased as a feature, it must be earned over time through a proven trust relationship. Security is an adversarial environment, meaning we enforce strict boundaries at the platform and infrastructure level rather than relying solely on the model behaving correctly. Because agents operate at machine speed and volume, they amplify potential human errors, making hard technical controls and strict permissioning essential over simply waiting for a “better” model. We measure this trust rather than asserting it, shipping every AI feature in a passive state by default and continuously evaluating performance against real-world benchmarks. Ultimately, a mature agentic system earns autonomy through continuous red-teaming, consistency testing, and strict fallback governance rather than pursuing autonomy for its own sake.

The bar I would hold any security vendor to, much like my own team, is pretty simple: do you have a real corpus of adversarial examples you test against, not just a written policy? Do you benchmark your model/agent/harness, not just focus on a fancy demo? Have you red-teamed the agent itself, not just the underlying detection logic? When something goes wrong, who owns the response, and how easy is it to roll back? None of that is a particularly high bar. It’s just what a mature agentic experience looks like, in security or anywhere else.

Security: Anything else you would like to add?

Filar: Looking at the recent high-profile agentic AI incidents at OpenAI and Anthropic, these events have understandably spiked anxiety about agentic AI, but I’d reiterate that these events are fundamentally sandbox and containment failures rather than proof of models turning malicious. Whether a model “intended” to misbehave is an interesting alignment question, but it’s the wrong question for a security team. Agents simply exploit privileges and unmonitored gaps faster than humans, reinforcing that safety relies on engineering controls, like network isolation, least privilege, and real-time monitoring, not alignment research or model “intent.” The security question is: what could this thing touch, what was actually monitoring it in real time, and how fast could we contain it once it went off-script?

This validates the core thesis of trust-earned autonomy: we must rely on solid system-level structural boundaries rather than expecting the model to always behave. The industry’s takeaway shouldn’t be to pull back on AI entirely, but to ensure agent capability never outpaces the security maturity required to contain it. Ultimately, this isn’t AI doomerism, but AI optimism with discipline: autonomy is incredibly useful, but trust must be systematically earned and measured, not blindly claimed.