Open-Weight Model Antares Delivers Stronger Code Security<\/a><\/p>\nLodge said AI can analyze screenshots, policy documents and security tool evidence, then map that material to controls under frameworks such as NIST RMF, ISO 42001 and CMMC. The same system, however, shouldn’t perform the work, validate its output and certify compliance without independent review. “There still needs to be the human,” Lodge said.<\/p>\n
That oversight becomes even more important in regulated, sensitive and air-gapped environments, where agents require strict boundaries, logging and continuous observation. “You can’t just like set it and forget it. You’ve got to review the logs. You’ve got to check out what it’s doing and observe,” Lodge said.<\/p>\n
In this video interview with ISMG at Black Hat USA 2026<\/a>, Lodge also discussed:<\/p>\nWhy specialized agents can improve validation without replacing human sign-off;
\nWhy agentic systems’ non-deterministic nature demands more scrutiny than traditional model testing;
\nHow preparation, validation and authorization must stay distinct steps in the audit process. <\/p>\n
Lodge is a cybersecurity executive, data scientist, professor and researcher focused on applying AI to security operations, compliance, audit readiness and threat defense. He is the creator of Audit CADDIE, an AI-powered governance, risk and compliance platform.<\/p>\n
![\"Why](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/ai-agents-cant-certify-their-own-compliance-work-image_large-8-a-32489.jpg\")
<\/p>\n