What did the AI Tool Actually Log?
About This Session
Someone on your security team will eventually have to investigate an AI agent. Maybe it accessed a sensitive file, ran an unexpected command, changed a repository, or called a connected system. The first question will be simple: what did the tool actually log? The answer will not be. One product records prompts and tool decisions. Another records only the policy change that allowed the action. A third proves that a feature was used while omitting the prompt, resource, and result.
This session maps the evidence boundary across today’s AI tooling. We will separate runtime telemetry from administrative audit logs and feature-usage records, then show what each evidence class can establish on its own. We will examine the identifiers that make investigations possible, the blind spots that detections inherit, and where endpoint, identity, network, Git, CI/CD, and SaaS telemetry must fill the gaps. We will also cover the collection, parsing, retention, and privacy decisions that determine whether these records are useful when an incident occurs.
Come if your organization is deploying AI tools faster than your security team can instrument them. You will leave with a practical model for deciding which records to collect, which questions they can answer, and where your current visibility ends.
This session maps the evidence boundary across today’s AI tooling. We will separate runtime telemetry from administrative audit logs and feature-usage records, then show what each evidence class can establish on its own. We will examine the identifiers that make investigations possible, the blind spots that detections inherit, and where endpoint, identity, network, Git, CI/CD, and SaaS telemetry must fill the gaps. We will also cover the collection, parsing, retention, and privacy decisions that determine whether these records are useful when an incident occurs.
Come if your organization is deploying AI tools faster than your security team can instrument them. You will leave with a practical model for deciding which records to collect, which questions they can answer, and where your current visibility ends.
Speaker
Yichen Jin
CEO - Fleak
At Fleak, we’re on a mission to make data infrastructure so smart it practically runs itself. Imagine data that auto-standardizes, reduces engineering effort by up to 90%, and never calls in sick. That’s us—building adaptive intelligence to help businesses unlock next-decade opportunities in days, not months.
Before Fleak, I spent eight years in VC, wrangling 400TB of startup data to spot the next big thing (and occasionally questioning my life choices during 3 a.m. debugging sessions). Now, I’m focused on making data work harder so humans don’t have to.
If you’re drowning in messy data or just curious how we’re getting data to do its own chores, let’s connect. I promise not to pitch you… unless you ask nicely.
Before Fleak, I spent eight years in VC, wrangling 400TB of startup data to spot the next big thing (and occasionally questioning my life choices during 3 a.m. debugging sessions). Now, I’m focused on making data work harder so humans don’t have to.
If you’re drowning in messy data or just curious how we’re getting data to do its own chores, let’s connect. I promise not to pitch you… unless you ask nicely.