Security teams are being asked to protect AI systems that are already in production, often before the controls to match exist. Two CISOs, an IT audit officer and a VP of IT discuss how they harden models, agents and data pipelines without becoming the function that says no. This panel will cover how access control, logging and monitoring apply to models and agents, how third-party model risk gets assessed, and what audit teams and boards expect to see as evidence. Key Takeaways: → Where to apply access control, audit logging and monitoring across models, agents and data pipelines → How to assess third-party model risk and enforce AI policy without blocking delivery → What a defensible incident response plan looks like when an AI system is the thing that fails