What CISOs get wrong on the way out, Jess Vachon says, is that they don't leave anything for the next person coming in. The team they built gets nervous, and whoever arrives doesn't know where to start. She thinks that's a disservice to both of them. Her team keeps someone whose job is writing down how the program runs, and they built an AI agent that runs exit interviews and turns the result into turnover documentation. When she left her last role, the person replacing her started with ten pages covering how the team is built, why it was built that way, the critical issues, and what the board likes to see reported.
Mitiga Field CISO Brian Contos puts the other half to her too. What do you find when you're the one walking in? She warns it sounds weird. She starts with service accounts, how old they are and whether anyone's ever rotated the passwords, because that's what points at the abandoned systems and servers everyone has forgotten.
From there they get to a question she says too few people are asking. When someone spins up an AI agent, is it running under that person's privileges, or does it get an identity of its own? It's the separation-of-duties argument security has always made about admin accounts, now pointed at agents that are already running.
Jess Vachon has been on Mitiga Mic once before. She's Global CISO at J.D. Power, has held the CISO role four times, and hosts two podcasts, Voices of the Vigilant and Ripple and Root.
