Name: James Nettesheim, Block
Uploaded: 2026-11-11T00:00:00.000Z
Duration: 19 min 35 s

Clips
More from Block Builderlab Launch Event

James Nettesheim

Chief Information Security Officer

Block

play_circle_outline Mitigating Prompt Injection and Adversarial Manipulation with Agent Identities and Constrained Delegated Authority

play_circle_outline Information Flow Control: tagging sensitive data and enforcing security policies

play_circle_outline Auditable Agent Security: Immutable Signed Ledger, Monitoring and Egress Controls, Least-Privilege Isolation with JIT Permissions

play_circle_outline Trust as main adoption barrier; proven security builds enterprise confidence

18:15

08:26

Info

James Nettesheim, Block

James Nettesheim

Chief Information Security Officer Block

(INTRO)

Alison Kosik

>> Welcome back to Block Builder Lab Launch Day 2026. We're coming to you live from San Francisco. I'm Alison Kosik and I've got Paul Gillin, the enterprise editor with SiliconANGLE, with me. And joining us now on theCUBE is James Nettesheim, Chief Information Security Officer with Block.

James Nettesheim

>> Yes. Hi.

Alison Kosik

>> Welcome to theCUBE.

James Nettesheim

>> Thank you very much. Happy to be here.

Alison Kosik

>> Congratulations on the launch. And with that in mind, walk me through what your role is at Block and maybe the challenges that you have in your role as the technology grows and improves.

James Nettesheim

>> Absolutely. So I'm the Chief Information Security Officer and Head of Enterprise Technology. So that means I'm responsible for— me and my team, of course, are responsible end to end for security of our products, security of our corporate workforce, laptops, servers, cloud-based agents, software we're using, software we're building, hardware we're building overall. End-to-end and making sure that we're upholding both of our commitment to our customers at the end of the day with that security that we're delivering. I also run our enterprise technology teams to where we're enabling the workforce to use new and different technologies, whether it be the laptops and workstations they're on to other software they're using, which pairs up really well with the security story in that we can both innovate and secure it at the same time overall.

Paul Gillin

>> You have very much a developer audience here today. When you take this message into enterprises, How will it be different from what we saw?

James Nettesheim

>> Yeah, absolutely. I think it'll be that you can learn from all of the work we've done to enable everyone to be builders and with developers in mind to your enterprise to where you can enable this sort of rapid pace of innovation and development in a secure and thoughtful way with a technology that's been tested and that folks have used and hardened along the way overall.

Alison Kosik

>> So we're moving from AI that just answers questions to AI that is taking action. In fact, We've already moved to that, but how does that fundamentally change the security risks that companies face?

James Nettesheim

>> We have to solve some new areas with delegated authority and monitoring, but at the end of the day, a lot of these security principles have existed for a number of years and we just need to make sure we're applying them to this new technology overall. Things like least privilege, isolated environments, authorization, egress controls. We know how to do this and we can adapt it to this new technology. So we don't have to reinvent the entire wheel. And along with that, if we can, ourselves as security teams and organizations adopt the use of AI, that means we can move at the same machine speed that our attackers can. So it's sort of two sides of it to me. It's like adopt our historic principles in new ways for this technology. We know how to do that. We need to be creative, but we can do that. And then make sure we're aggressively adopting the technology too so that we can both keep up with attackers and we can be innovators at the same time. The best way to learn how to secure something is to adopt it and work through it. Obviously, you want to do this in a risk-based approach. So maybe don't start with the most risky areas of your business, but step into it with areas that you can experiment a little bit more in. And as you gain confidence, you expand it to other areas of your business and your technology stacks.

Paul Gillin

>> As you said, we have a lot of rich best practices that work in a world where humans do all the work. What new variables have agents introduced into that? —equation.

James Nettesheim

>> So you, you now have autonomous systems out there that are able to take action. And our job isn't to just shut down them being able to act autonomously, it's to scale that ability to do it in a trusted way. So it's things like how do you delegate your authority to a system to be able to take action? How do you monitor that still? How do you constrain? There's something called prompt injection where these prompts that you're sending to agents can be tricked into doing things. Humans, of course, can also be tricked into doing things, but it's how do you monitor for that? How do you protect against that? You can use other agents as judges to say, hey, is this a safe action for that agent to take overall? And things that we're doing in Builderlab and the Buzz space is we're making agents fully fledged identities overall. Some other systems are saying, hey, you're an extension, you're a bot, you're not a full, you don't have a full identity in your system, but Us giving these agents an identity means we can constrain them and use a lot of these tools we've already built to have delegated permissions, just-in-time permissions, giving them less privileges than we might need to do even though they're owned and authorized by a human. But with their own identity, that allows us a lot more flexibility in how we secure them overall.

Paul Gillin

>> There's an interesting question that came up in the Q&A just now about you can manage or lock down the identity controls of an agent, But how do you prevent that agent from sharing information with other agents who don't have those controls in place?

James Nettesheim

>> Yeah, so it's a very big problem that we need to solve overall. It's like, say I as a human give my agent permission to access data in a database, it takes it and potentially pastes it into a public forum or something like that. And there's ways to do it right now where we're just being very deliberate about how we're giving privileges and being very obvious in saying, hey, this is information that could get exposed outside of its intended area. The long-term solution that we're actively building is something called Information Flow Control, and that's where when you take that data out of that sensitive database, it automatically gets tagged as sensitive, and your security policy comes with the data. It's not enforced that, oh, you gave it permission to access the data so it can do whatever it wants. When it goes to that public place to post it, your security policy will block that posting because it knows the data was taken from a sensitive resource. And this is the way you can scale it and do it at agentic speed overall and keep yourself out of trouble.

Paul Gillin

>> Is that baked into this new technology?

James Nettesheim

>> We're building it out right now. So it's a future state that we're building and I'm really optimistic about it overall.

Alison Kosik

>> So you have agents working across different departments and systems. How do you maintain visibility into what each agent is doing and who authorized its action?

James Nettesheim

>> So yeah, one of the great things about our Builderlab launch is that we have an immutable ledger of all the actions agents are taking that are cryptographically signed. So we can go back and replay that and review that regularly. There's also things you do with gateways to analyze the prompts that are being taken. So you know what sort of chain of thought or reasoning is happening between the agent and the humans, and you can monitor that and you'll have alerts from your detection response teams or have more preventative controls that'll say, hey, this is it, this is going out of the intent of the original action and blocking it overall.

Paul Gillin

>> We know that a lot of security or a lot of development teams are taking a ready, fire, aim approach to agents. What's the basic blocking and tackling that needs to be in place before an enterprise really commits to agents on a big scale?

James Nettesheim

>> Yeah, so I'd say to that original point around, you need to make sure you've got your security principles sorted out. How are you going to constrain the identity around your agents? How are you gonna track authorization? How are you gonna delegate that authorization? How are you gonna monitor the egress controls of what data it's accessing? How will you revoke permissions? And with more risky things, how will you isolate what your agents are doing? In Builderlab, they're operating in constrained cloud VMs that are hardened and tested with the most advanced models out there to say, hey, they can't do anything outside of this area. And that's one of the big advantages we have as defenders is we can set the environment that agents are operating in and we can constrain them, say you don't have permission to that, you don't have access to that. And that's things that enterprises should really double down on implementing if they haven't already.

Alison Kosik

>> So, it's kind of like an interesting tension that's going on here. AI is making organizations faster, but security is a challenge. It requires checks, it requires safeguards. How do you balance that speed with the control that's necessary to keep operations secure?

James Nettesheim

>> You really need to adopt it with an enabling mindset overall. If you just say no to everything, folks will start to find other ways to use the technology. Shadow AI or shadow IT is something we talk about a lot. So if you can create paved paths that folks can know they can use securely to start adopting technology and experiment yourselves, you'll go a lot further with making sure the organization is doing it securely. And that comes along with us experimenting ourselves too. Back to my other point of if we're not actively trying to use it, we're not going to be able to fully secure it at the end of the day. You don't want to be on the sidelines, you want to be in the thick of it building new technology as well.

Alison Kosik

>> Yeah.

Paul Gillin

>> Now OpenAI posted a case history last month about how Block is using AI as a preventive security measure. Can you talk through how has AI been useful to you? What kind of results are you seeing?

James Nettesheim

>> Yeah, we're using it across the spectrum. We're using it from everything to create autonomous code review software that we push. It will review it with an expert lens and a very thorough lens for code flaws, bugs, security practices. It can really give us a very high level of confidence that the code is secure. We also pair humans in the loop with that for sensitive actions, of course. We're using it a lot in our security operations space too with detection and response teams. It can analyze alerts, it can take the history of all of your alerts and compare that to the alert you have today. See if you have a false positive. It can challenge itself with a separate judge-type agent. And it can also find these flaws for you too. We use it extensively for that where it's reviewing all of our tools, how our systems are integrated. It can perform analysis for how it can chain exploits together to compromise systems that you didn't think was possible. And one of the things I really like about it is, take the detection and response example. The agent, when it's reviewing an alert, it works that issue like it's the only thing it has to do that day. It doesn't have a queue of 50 that it's worried about, or it has to go home or something like that. So you know it's going to be extremely thorough and extremely critical in the approach that it takes. Now again, we're obviously not taking direct disruptive actions purely based on the agent's analysis, but it gives the humans a packaged up thing to review and they can make much quicker decisions based off of it.

Paul Gillin

>> Now we know the bad guys have AI as well. What have you seen, incidents or tactics have you seen that are concerning for you? And do you think the good guys' AI is keeping up with the bad guys?

James Nettesheim

>> I think for the first time in a while, it's always been considered a somewhat asymmetric field where attackers only have to be right once, whereas I have to be right every single time. They can try every single doorknob and if we left one unlocked, they can get in. But we can scale with agents now at the same speed attackers are. It's one of the first times I've really thought we can keep up with the pace of attacker development. We can use these agents to secure our systems, to check all those locks, to make sure all the things that we with the inundation of different technologies, we can be a lot more thorough overall at the same time. And it allows us to really think through the processes we're using without having to be resource constrained in the way we historically were at the same time and allow our humans to really step through the very critical work and reasoning and thought process instead of working maybe the more monotonous type of work. And that'll help us keep up with the attackers too.

Alison Kosik

>> For a company that may be considering Builderlab, what's the first security question it should be asking? Its leadership should be asking actually, what are 3 questions they should be asking in reference to security?

James Nettesheim

>> Yeah. How do you treat the identity and authorization story to where the agents can act on behalf of humans and that we have a really strong principle there where they are an extension of a human and that a human has authorized them, but they have their own identity and we can constrain and limit what the agents can do in a very flexible way with that. How are you isolating the workloads so that they're not, a lot of agents are running locally on your laptops. There's a lot of stuff on your laptop that agents have access to here. A lot of security practitioners would like a lot of work to happen in cloud again where, we've developed the environment, it doesn't have access to a bunch of different files or systems. So how are we isolating that workload? In Builderlab, we have cloud VMs with isolated namespaces and restrictions on who they can talk to and what they can talk to. And then finally, how are you monitoring it? Because you still need to make sure it's doing the things you want it to do. And how are you able to get that insight overall?

Paul Gillin

>> So obviously you can control your own environment with a fine degree of Precision, but companies are going to be using agents from all kinds of other vendors and stuff they build themselves and consumer agents and whatever. How do you apply those security controls to agents you can't manage?

James Nettesheim

>> So, it's— you have to, a lot of us have very rigorous sort of third-party security review processes, and you need to integrate that into that review process to make sure they're following the same principles as you. But you also, to that monitoring aspect, need to develop how will you monitor to ensure that your data and your systems, they're actually operating in the way that, has been outlined in your paperwork or in the policies overall. We need to move beyond simply a, one-time checkbox exercise into a real-time monitoring exercise. And I'm actually, proposing that there's more industry collaboration here to where if I see something with a vendor or a third-party agent that we can share this in a way that is collaborative and helpful for the organization to make sure we're all leveling up our security together.

Paul Gillin

>> Doyou think NIST and ISO and the other standard-setting bodies are acting fast enough to address these problems?

James Nettesheim

>> I think they're getting there overall. I think there's some good baseline frameworks that organizations should look at. We're going through ISO 42001 as well on our side.

Paul Gillin

>> The new AI rules, right?

James Nettesheim

>> Yeah, to really give us And what I think that really does is say, hey, we've got the principles down right. We've got— and that's where I think the standards bodies are most helpful when you're initially adopting it, is you can give yourself a confident baseline that you're doing the right things overall.

Alison Kosik

>> Looking ahead, I'm curious if you believe AI will ultimately make companies more secure or will it introduce a whole new category of threats?

James Nettesheim

>> it's a really good question and there's a lot of debate around it overall. I think There'll be parts of security that change. It's already changing. There's been an explosion in vulnerabilities, for example, and there's a big debate about whether that will continue or we'll get through all of the vulnerabilities. I personally think it'll be somewhere in the middle. Overall, I don't think we'll completely eliminate all vulnerabilities, but I do think code that companies around the world are writing will be more secure at the end of the day. Now, the new threat environment will be, you have this always-on attack. That could be happening with very advanced, skilled attackers. And that's where you need to be aggressively both hardening your systems with those principles and using agents to combat that speed overall. So I'm optimistic long-term. I do think it will be a net gain for security with time. There's gonna be some bumps in the road, of course, but as long as we're keeping those principles and foundations solid and adopting the new technology instead of trying to push it to the side. I think we will continue to increase the security of our systems overall.

Paul Gillin

>> One relatively new threat vector is deepfakes and their ability to human engineer, to practice social engineering. What's your thinking on what are you doing to fight back against those and how serious a problem is that?

James Nettesheim

>> It's a very serious problem. You have a very large fraudulent worker sort of attack that's happening out there where folks are trying to gain fraudulent employment with your companies overall to either steal wages or other things like that. And with the advent of deepfakes, there can be extremely convincing videos or voice sort of attacks that are made. And that's where you need a defense-in-depth strategy where you're not just relying on a video call or something like that. If you're transferring funds or things like that, work out a process beforehand that they would not know. If you're hiring new folks, work out an identity verification system, a new way of interviewing that isn't able to just be passed by someone that is able to replace their video overall and build in some controls behind the scenes. Again, you can maybe bring them on site. That is not 100% solution either because sometimes these folks are coming on site even. But— Oh my God. There's a variety of things that if you layer them together, you can give yourself a lot higher confidence that you're going to catch these sorts of things.

Alison Kosik

>> It just feels like it's a game of whack-a-mole. But I mean, you know,

James Nettesheim

>> I think that's what we want to specifically try to make sure we don't rely on overall is, can we create the environment to where you don't have to play whack-a-mole, that you can say, hey, I've eliminated this entire class of problems overall so that this isn't an issue. And that's one of those things those principles help with. And then using agents to accelerate your workflow can allow you to harden yourself as well. So

Paul Gillin

>> there's a question I've asked security practitioners for the last 4 years: is AI ultimately better for the bad guys or the good guys?

James Nettesheim

>> I'm firmly in belief that it's better for the good guys in the long run. I think us being able to move quicker, more thoroughly, and at higher scale, and again, automating away the work that we didn't really enjoy doing first so that we can spend the work on the more high-leverage areas, means that, we'll win in the long run as long as we, stay focused on it.

Alison Kosik

>> What are the scenarios that keep you up at night concerning security and networks?

James Nettesheim

>> I think it's, a big part of it is that third-party risk is, I can spend all day every day hardening our environment, but it's possible that a vendor we're using hasn't done that. And how do I gain the confidence that they are also protecting our data and our systems the right way goes to the earlier things we were talking about overall. And obviously with the rapid pace of just everything happening, new vulnerabilities, always-on attackers, it's an issue of prioritization. What is the most important thing? What is going to get you the most value and the most security the fastest? And how do you cut through that noise to make sure you're still staying on the most important things and not burning your teams out overall with all of the different things? So you have to be very strategic and very principled in your thinking through this overall, because otherwise you'll just sort of spin in circles and not make any progress.

Alison Kosik

>> Yeah, it really is about staying ahead, one step ahead of the bad guys.

James Nettesheim

>> As much as you can.

Paul Gillin

>> Always has been. Yeah. We see still that the number one issue with enterprises, the blockage of enterprises adopting agents more aggressively, is trust. Is that a security issue or is that a risk management issue?

James Nettesheim

>> It's100% a security issue. I think if we Similar to, I've used the analogy before is we're becoming more trusting of driverless vehicles right now because they've been proven to be safe. And we need to build the same security principles into how we're using agents so that folks can trust that they will do what they're supposed to be doing, won't expand beyond their privileges overall, and that you can monitor 'em at the same time.

Alison Kosik

>> Thanks so much for your time, for stopping by theCUBE. Really enjoyed the conversation and listening to your expertise.

James Nettesheim

>> Thank you very much. It was a pleasure being here. Thank you, James. Thank you.

Alison Kosik

>> And you're watching theCUBE, the leader in live technology coverage and in-depth expert analysis. Thanks for watching.

James Nettesheim, Block

(INTRO)

Alison Kosik

James Nettesheim

>> Yes. Hi.

Alison Kosik

>> Welcome to theCUBE.

James Nettesheim

>> Thank you very much. Happy to be here.

Alison Kosik

>> Congratulations on the launch. And with that in mind, walk me through what your role is at Block and maybe the challenges that you have in your role as the technology grows and improves.

James Nettesheim

Paul Gillin

>> You have very much a developer audience here today. When you take this message into enterprises, How will it be different from what we saw?

James Nettesheim

Alison Kosik

James Nettesheim

Paul Gillin

>> As you said, we have a lot of rich best practices that work in a world where humans do all the work. What new variables have agents introduced into that? —equation.

James Nettesheim

Paul Gillin

James Nettesheim

Paul Gillin

>> Is that baked into this new technology?

James Nettesheim

>> We're building it out right now. So it's a future state that we're building and I'm really optimistic about it overall.

Alison Kosik

>> So you have agents working across different departments and systems. How do you maintain visibility into what each agent is doing and who authorized its action?

James Nettesheim

Paul Gillin

James Nettesheim

Alison Kosik

James Nettesheim

Alison Kosik

>> Yeah.

Paul Gillin

>> Now OpenAI posted a case history last month about how Block is using AI as a preventive security measure. Can you talk through how has AI been useful to you? What kind of results are you seeing?

James Nettesheim

Paul Gillin

>> Now we know the bad guys have AI as well. What have you seen, incidents or tactics have you seen that are concerning for you? And do you think the good guys' AI is keeping up with the bad guys?

James Nettesheim

Alison Kosik

James Nettesheim

Paul Gillin

James Nettesheim

Paul Gillin

>> Doyou think NIST and ISO and the other standard-setting bodies are acting fast enough to address these problems?

James Nettesheim

>> I think they're getting there overall. I think there's some good baseline frameworks that organizations should look at. We're going through ISO 42001 as well on our side.

Paul Gillin

>> The new AI rules, right?

James Nettesheim

Alison Kosik

>> Looking ahead, I'm curious if you believe AI will ultimately make companies more secure or will it introduce a whole new category of threats?

James Nettesheim

Paul Gillin

James Nettesheim

Alison Kosik

>> It just feels like it's a game of whack-a-mole. But I mean, you know,

James Nettesheim

Paul Gillin

>> there's a question I've asked security practitioners for the last 4 years: is AI ultimately better for the bad guys or the good guys?

James Nettesheim

Alison Kosik

>> What are the scenarios that keep you up at night concerning security and networks?

James Nettesheim

Alison Kosik

>> Yeah, it really is about staying ahead, one step ahead of the bad guys.

James Nettesheim

>> As much as you can.

Paul Gillin

James Nettesheim

Alison Kosik

>> Thanks so much for your time, for stopping by theCUBE. Really enjoyed the conversation and listening to your expertise.

James Nettesheim

>> Thank you very much. It was a pleasure being here. Thank you, James. Thank you.

Alison Kosik

>> And you're watching theCUBE, the leader in live technology coverage and in-depth expert analysis. Thanks for watching.