Seeing isn't proving
Prove it · 02 · For CISOs and security leaders
The alert looks routine. An account in finance exported a supplier file to a shared drive at 2:14am. The account belongs to Claire, who was asleep.
It wasn't an intruder. It was an AI agent Claire set up last month, working through its task list under her name. Your tools saw every step. Now the audit committee wants to know whether your controls held.
Fewer than half of CISOs (47%) are confident they can identify all of the agents across their business. [1] About a quarter (26%) of senior AI executives whose organisations use AI agents say they cannot spot unapproved agents running inside their own company. [2]
Today's tools give you visibility. You also need proof.
Tools that watch agents as they work are arriving fast, and that's welcome. They answer an important question: what did the agent do?
A board, an auditor or a regulator asks different questions:
- Who acted? The log says Claire. Was it Claire, or an agent working in her name?
- Did the control hold? Not whether it fired an alert, but whether the action was allowed, prompted or stopped as your organisation's policy intended.
- Can someone else check? Evidence has to convince people who weren't in the room, months later.
21% of organisations use shared credentials or service accounts with broad permissions to govern AI access. [1] When identity is shared, "who acted" can't be answered from the log alone.
What proving takes
Four things have to be true. The left column is what good practice asks for. The right is what we do today.
| What good practice asks for | What MeshLogic does |
|---|---|
| Capture it where the work happens. Agents work on staff laptops and servers, in files and applications. Network and cloud logs cannot see inside the device, so evidence gathered away from the work has gaps nobody can close later. | Runs on the device itself. What happens in files, applications and terminals is recorded on the spot, not inferred from network traffic. |
| Give every agent its own identity. Role-based access control is a well-trodden practice for your existing human workforce: people get the access their role needs, and nothing more. Extend it to agents, because an agent sharing a service account cannot be told apart from a person, however good the rest of your controls are. | Shows whether a person or an agent was behind each record it captures, and which agent it was. |
| Try a control before you turn it on. You should be able to see the decision a control would make, on one machine, without switching it on for everyone. | Records the decision a control would have made while still in watch-only mode, on a single laptop, with nothing changed for anyone else. |
| Make the record stand on its own. Sealed when it is made and checkable by someone outside the vendor that collected it. A record put together after the event is an argument, not proof. | Seals each outcome into a chained record, so a later change shows. |
The third row is the one to ask other vendors about. Testing a control on one machine, without arming it across the business, is how you find out whether a policy is right before it can stop someone working.
The result: when the audit committee asks who acted and whether the control held, you answer with evidence instead of a best guess.
Where MeshLogic fits
MeshLogic watches where the agent actually acts, on the device itself, tells you whether a person or an agent was behind it, and seals every outcome into evidence anyone can verify without trusting us. It installs with the device tools you already use, works alongside your existing security software, and starts by watching only, with enforcement switched on when you're ready.
MeshLogic is SOC 2 Type 2 across all five trust services criteria, AWS Qualified Software and live on AWS Marketplace.
References
[1] Okta, "Global CISO Insights 2026: Identity security in the age of AI", 29 July 2026. 306 CISOs and security executives. https://www.okta.com/newsroom/articles/global-ciso-insights-2026/
[2] EY, AI Risk and Governance Survey, press release, 15 September 2026. 202 senior AI decision-makers at publicly traded companies with $1B+ annual revenue. https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap
Want to test your AI controls before the next board paper?
We are taking on a small number of design partners. Bring a control list and we will show you what the evidence carries and what scores insufficient. We can start under NDA.