DOM GLAVACH

THE DUAL-SURFACE DEFENSE MANDATE: GOVERNING SHADOW AGENTS, MACHINE-SPEED VULNERABILITY OPERATIONS, AND THE RE-ENGINEERING OF ENTERPRISE TRUST

Published Exclusively by The Visionary CIOs (thevisionarycios.com)
Bureau of Enterprise Technology & Cybersecurity Architecture

EXECUTIVE EDITORIAL FOREWORD: THE SHIFT FROM CODE AUDITS TO DIGITAL WORKFORCE GOVERNANCE

In the modern hyper-automated SaaS enterprise, the traditional boundaries defining digital perimeters have completely disintegrated. For the past two decades, cybersecurity organizations operated on a recognizable cadence: developers wrote code, static and dynamic analysis tools audited builds, security teams approved scheduled releases, and firewall rules guarded cloud infrastructure. Today, that linear cadence has been shattered by the arrival of autonomous agentic systems and continuous deployment pipelines.

Enterprises no longer merely manage human users and static software dependencies; they are orchestrating a hybrid workforce of human engineers and autonomous “Shadow Agents”—non-human digital entities that independently write code, generate pull requests, interact with proprietary APIs, analyze private data stores, and trigger production deployments. When combined with threat actors deploying machine-speed exploits capable of weaponizing unpatched vulnerabilities in milliseconds, Chief Information Security Officers (CISOs) and Chief Information Officers (CIOs) confront an unprecedented architectural challenge: how to transition from reactive vulnerability management to proactive, machine-speed vulnerability operations without suffocating innovation or compromising system reliability.

Few cybersecurity leaders understand this dual-front reality with greater clarity than Dom Glavach, Chief Information Security Officer at Black Duck. As the security leader of one of the enterprise software industry’s most revered software supply chain and application security institutions, Glavach occupies a vantage point that is both unique and intensely demanding. He is responsible not only for securing Black Duck’s global enterprise surface and internal artificial intelligence adoption, but also for ensuring the integrity, provenance, and resilience of the security intelligence platforms that thousands of global enterprises rely upon to secure their own software supply chains.

In this landmark executive interview with The Visionary CIOs, Dom Glavach deconstructs the operational friction of securing modern SaaS environments. He outlines a rigorous five-stage lifecycle for governing autonomous Shadow Agents (Assess – Govern – Enable – Monitor – Improve), reveals why vulnerability management must evolve into an integrated “Vulnerability Operations” operating model, explains how to anchor security controls directly to business revenue and downtime metrics, and highlights the leadership doctrines of elite enterprise CISOs navigating the AI frontier.

EXECUTIVE DOSSIER & PROFILE

• Executive Name: Dom Glavach
• Current Title: Chief Information Security Officer (CISO)
• Enterprise Organization: Black Duck
• Core Focus Areas: Global Enterprise Cyber Strategy, Governance Risk & Compliance (GRC), Product Security Architecture, Software Supply Chain Integrity, Responsible AI & Autonomous Agent Governance
• Scope of Command: Enterprise defense of Black Duck infrastructure, internal AI/Agent security, and product assurance for mission-critical AppSec software utilized by global Fortune 500 enterprises
• Official Publication: The Visionary CIOs (thevisionarycios.com)
• Editorial Domain: Enterprise SaaS Defense, Machine-Speed Vulnerability Operations, Software Supply Chain Sovereignty

THE COMPREHENSIVE EXECUTIVE INTERVIEW

Q1. As a modern SaaS CISO operating at the center of the global software supply chain, what represents the most complex and demanding aspect of your everyday executive mandate?

DOM GLAVACH:
What I find most invigorating about serving as CISO in a premier SaaS environment like Black Duck is that the greatest structural challenges are simultaneously our most significant opportunities.

In a hyper-growth, modern SaaS architecture, everything operates at breakneck velocity. Engineering teams are innovating continuously, adopting bleeding-edge frameworks, leveraging open-source components across deep dependency trees, and increasingly integrating artificial intelligence—both into how our internal employees work every day and into the core capabilities we ship to global enterprises.

This environment creates what I define as the “Dual-Surface Challenge”:

On one side is the Enterprise Surface: You have internal employees across product management, engineering, finance, marketing, and sales independently deploying AI assistants, generative models, and autonomous agents. These systems ingest proprietary enterprise data, trigger workflows, interact with enterprise applications, and formulate strategic business recommendations.

On the other side is the Product Surface: These are the commercial, AI-enabled software solutions and SaaS platforms that Black Duck builds, hosts, and delivers to global enterprises. Our customers rely on our intelligence to safeguard their proprietary source code, validate their software bills of materials (SBOMs), and identify zero-day vulnerabilities across their mission-critical software supply chains.

Both surfaces share foundational cybersecurity risks—such as unauthorized data exfiltration, identity compromise, and insecure interfaces—yet each possesses radically distinct attack vectors, architectural complexities, and regulatory expectations. An internal AI tool mishandling internal communications is an internal governance issue; an AI defect or supply chain compromise inside our commercial software delivery pipeline is a systemic customer trust issue.

The strategic opportunity for a CISO is to architect and scale a unified cybersecurity program that encompasses both the enterprise and the product portfolios simultaneously. It is about identifying the risks that actually threaten enterprise viability, establishing transparent, non-obtrusive guardrails around how AI and digital agents are leveraged, and empowering developers to build at maximum velocity while baking security directly into the DNA of system design, compilation, and deployment.

My passion comes from partnering directly with business and product units. Security cannot act as an ivory-tower department that issues mandates from afar. We must make risk management an intrinsic accelerator of business innovation, transforming security resilience into a primary catalyst of enterprise customer trust.

Q2. Employees across global enterprises are rapidly transitioning from using simple generative chatbots to deploying autonomous, task-oriented AI agents. How should security teams transition from managing ‘Shadow AI’ to governing ‘Shadow Agents’?

DOM GLAVACH:
The industry spent the last two years hyper-focused on “Shadow AI,” which was predominantly an issue of unapproved browser tools, prompt leakage, sensitive data ingestion, and employees utilizing unverified AI-generated text or code snippets. While Shadow AI certainly presents real risks regarding data privacy and intellectual property leakage, “Shadow Agents” elevate enterprise risk to a completely different magnitude.

An autonomous AI agent is not a passive conversational prompt engine. An agentic system possesses agency: it is connected to APIs, granted read and write permissions to enterprise databases, authenticated to corporate communication channels, and capable of executing complex multi-step workflows. An agent can independently alter source code, submit pull requests (PRs), provision cloud infrastructure, trigger webhook actions, and modify business records across enterprise platforms. When employees deploy unvetted autonomous agents, they are essentially introducing unmanaged, non-human digital contractors into the enterprise nervous system.

To govern Shadow Agents effectively, security teams must stop thinking in terms of static blocking and transition to managing agents like high-privilege digital workers. At Black Duck, we approach this through a continuous architectural lifecycle:

Assess – Govern – Enable – Monitor – Improve

1. Assess:
   Security leaders must establish deep, continuous visibility into where AI models and autonomous agents are actually being deployed across the business. What specific operational bottlenecks are they solving? Which internal microservices, code repositories, and customer databases are they accessing? What explicit actions are they authorized to execute? How is their execution affecting the Software Development Life Cycle (SDLC) and CI/CD pipelines?
2. Govern:
   Establish practical, repeatable, and transparent guardrails. This requires defining approved use cases, strict data-classification boundaries, and immutable access limits. Critically, governance must enforce mandatory “Human-in-the-Loop” (HITL) and “Human-on-the-Loop” (HOTL) verification for high-consequence operations. An agent must never possess autonomous authority to merge code to production branches, transfer corporate funds, or delete database clusters without explicit, cryptographically signed human authorization.
3. Enable:
   Security organizations that rely solely on friction and prohibition inevitably lose. When security teams simply say “no” or impose cumbersome ticketing processes, innovative engineers and business operators will circumvent controls to hit their delivery targets. The winning strategy is active enablement: provide the business with vetted, pre-approved, enterprise-grade AI platforms and agentic orchestration frameworks. When the secure path is also the fastest, cleanest, and easiest path to get work done, shadow adoption drops to near zero organically.
4. Monitor:
   Implement continuous, real-time telemetry across non-human identities. Security teams must monitor for privilege creep, anomalous data movement, unauthorized API token generation, and bizarre workflow sequences executed by agents. Furthermore, in the software engineering domain, monitoring must scrutinize how agents influence package dependencies, code commits, build artifacts, and release gates.
5. Improve:
   Agentic security is not a one-and-done audit. As model capabilities expand and agentic frameworks become more autonomous, security teams must continuously stress-test, refine, and update guardrails based on real-world telemetry, emerging threat intelligence, and red-team findings.

Q3. Adversaries are weaponizing AI to identify, weaponize, and exploit application vulnerabilities in milliseconds. How can a CISO transition their security organization from human-speed triage to machine-speed defense without destabilizing system reliability?

DOM GLAVACH:
The modern enterprise threat landscape has undergone a temporal shift. Adversaries are leveraging automated machine learning algorithms, parallel scanning swarms, and AI-driven exploit generation to compress the window between vulnerability disclosure, proof-of-concept weaponization, and active exploitation from weeks down to mere hours or milliseconds.

Under these conditions, any enterprise attempting to defend its digital infrastructure using traditional, human-speed ticketing queues and manual triage meetings has already failed. However, the solution is emphatically not to blindly automate everything. Blind, unvalidated automation deployed in complex production environments invariably triggers catastrophic service outages, false-positive network blocks, broken dependencies, and severe business disruption.

The solution requires two fundamental architectural transformations:

First, shifting from static “Vulnerability Management” to dynamic “Vulnerability Operations” (VulnOps).
Traditional vulnerability management is a passive queue: a scanner runs on Friday night, generates a list of 10,000 Common Vulnerabilities and Exposures (CVEs), and dumps them on an infrastructure team. Vulnerability Operations, by contrast, is a real-time operational discipline. It connects vulnerability intelligence directly to rich runtime context: software composition analysis (SCA), asset inventory, true network exposure, actual runtime exploitability, business criticality, code ownership, and automated remediation workflows.

When a zero-day exploit signal flashes across the wire, a mature Vulnerability Operations engine instantly answers five decisive questions:

1. Precisely which applications, containers, and services contain this component?
2. Where are these assets deployed across our cloud and hybrid infrastructure?
3. Is the vulnerable function or method actually invoked and reachable by external traffic?
4. Exactly which engineering squad owns the underlying code repository?
5. What is the verified, non-breaking remediation path or virtual patch?

Second, building trusted automation with human judgment strategically repositioned.
Machine-speed resilience does not eliminate human engineers from the loop; it elevates them. We automate the repetitive, high-speed cognitive tasks: signal enrichment, telemetry correlation, dependency graph traversal, and evidence collection.

This shortens the critical path between signal detection, contextualization, risk decision, and high-confidence remediation. The human practitioner’s intellect is reserved for designing the automation logic, establishing policy boundaries, validating edge-case mitigations, and governing the systemic resilience of the enterprise.

Q4. How should CISOs and cybersecurity leaders map their security controls to executive business objectives—such as revenue enablement, downtime reduction, and customer trust—rather than treating security as a checkbox compliance exercise?

DOM GLAVACH:
For decades, cybersecurity was treated as an insular, technical discipline whose success was measured by technical compliance checklists and audit stamps. That framing is completely obsolete in modern executive boardrooms. Controls only achieve genuine institutional value when the right business stakeholders own them, and when metrics demonstrate that those controls are actively protecting the commercial viability of the enterprise.

To bridge this chasm, CISOs must adopt three core practices:

1. Anchor Controls to Distributed Business Ownership:
   Every security control must have an unambiguous operational, business, and security ownership model. When a security control protects software release velocity and build confidence, engineering leadership must share ownership. When a control safeguards customer data privacy and intellectual property, product and customer-success executives must share ownership. When a control guarantees system uptime and transactional continuity, business unit general managers and technology leaders must be aligned. Security cannot own business risk alone.
2. Translate Technical Controls into Financial & Operational Outcomes:
   Board directors and executive committees do not calculate risk in terms of open port counts or raw vulnerability totals; they evaluate risk in terms of enterprise value preservation. Every security initiative should tie directly to metrics the business cares about:

• Eliminating customer-impacting security breaches that trigger revenue churn.
• Slashing Mean Time to Remediate (MTTR) critical flaws, thereby reducing development rework and engineering waste.
• Preventing unplanned downtime and emergency out-of-band releases that disrupt commercial operations.
• Accelerating enterprise sales cycles by providing enterprise customers with transparent, third-party validated software provenance and cryptographic software bills of materials (SBOMs).

3. Measure Behavioral Outcomes Rather Than Vanity Activities:
   Measuring activity—such as “we executed 500 scans this month”—is meaningless. Measure behavioral transformation. In Vulnerability Operations, track how rapidly a critical, weaponized vulnerability is assigned to the definitive repository owner, patched, validated, and closed in production. In secure software development, measure whether engineering squads are identifying logic flaws early during the design and pull-request stages, thereby reducing downstream code refactoring and enabling the business to ship software with verified confidence.

Q5. As the threat landscape accelerates, what foundational dogmas must modern CISOs and CIOs dismantle to maintain proactive enterprise resilience?

DOM GLAVACH:
The speed of modern technological evolution is rendering traditional security dogmas completely obsolete. Technology leaders must fundamentally dismantle three legacy paradigms:

First, discard the concept of periodic, point-in-time security assessments.
Annual penetration tests, quarterly vulnerability scans, and single-visit compliance audits are dangerously insufficient. Modern software delivery is continuous; infrastructure is ephemeral; code is generated in real time by AI copilots; and cloud environments scale up and down dynamically. An annual audit provides zero visibility into an environment that changes thousands of times every week. The modern threat landscape is continuous, dynamic, and non-linear. The security operating model must match that reality with continuous posture evaluation, persistent asset discovery, and real-time dependency analysis.

Second, dismantle the fallacy of uniform urgency.
Security teams cannot continue to treat every vulnerability scoring a CVSS 7.0 or higher with the same panic. Attempting to remediate every theoretical CVE burns out engineering squads and blinds security operations to catastrophic risks. Prioritization must become multidimensional, evaluating:

• Real-world exploitability (is active exploit code circulating in the wild?).
• Runtime exposure (is the affected component exposed to public egress traffic?).
• Business impact (does this microservice process financial transactions or sensitive PII?).
• Actionability (is there a stable, non-breaking upgrade path available?).

Third, recognize that speed without governance is catastrophic.
Both attackers and defenders now have access to high-velocity automation. The organizations that succeed will not simply be the ones running fastest, but the ones running fastest under absolute architectural control. This means investing heavily in automated workflows equipped with immutable audit logs, granular policy constraints, instant rollback capabilities, and strict human authorization for destructive operations.

Our mandate as modern CISOs is not to slow the enterprise down in the name of risk aversion. Our mandate is to serve as the high-performance braking system on a Formula 1 car: providing the precise control, visibility, and resilience that allows the enterprise to move at unprecedented velocity with absolute confidence.

Q6. In closing, which enterprise security leaders across the global SaaS ecosystem do you particularly respect, and what lessons can the industry draw from their execution?

DOM GLAVACH:
There are three security leaders in the global enterprise software sector whose execution and leadership philosophies offer profound lessons for our industry:

1. Igor Tsyganskiy, Global CISO at Microsoft:
   Igor brings extraordinary engineering credibility, technical depth, and operational rigor to the CISO office. He assumed executive command during an era of unprecedented geopolitical and nation-state scrutiny, as Microsoft responded to sophisticated global intrusions. What I respect immensely is that he did not deflect or resort to corporate public relations; he confronted systemic architectural challenges directly, acknowledged historical shortcomings, and spearheaded Microsoft’s Secure Future Initiative (SFI). His organization is systematically re-engineering Microsoft’s internal security governance, baking cryptographic verification and zero-trust engineering directly into the core of Microsoft’s cloud and AI operating systems.
2. Andrew Dunbar, CISO at Shopify:
   When I reflect on Andrew’s leadership at Shopify, what immediately stands out is his mastery of scaling security in lockstep with staggering commercial and infrastructural hyper-growth. Scaling a global e-commerce backbone that processes hundreds of billions of dollars in gross merchandise value requires security to become an intrinsic part of the engineering culture. Andrew has succeeded in making security an organic attribute of developer velocity, transforming platform resilience into a core trust asset that Shopify’s global merchant base relies upon every second.
3. Iain Mulholland, CISO at Salesforce:
   Salesforce operates one of the most vast, intricate, and high-consequence multi-tenant enterprise technology ecosystems on Earth. Iain has an extraordinary track record spanning senior leadership roles across Google Cloud, VMware, Microsoft, and now Salesforce. What I admire most is his unwavering insistence on treating cybersecurity strictly as a rigorous engineering discipline rather than a compliance checklist. He is a premier authority on AI-native product security and secure software design. His analytical, engineering-first approach to enterprise defense provides a masterclass for any technology leader navigating complex distributed environments.