AI agents in risk assessments
Justin Garlick joins Shruti Gupta to explain how AI agents support first-party risk analysis, how his team adapted FAIR, and why analysts still review the evidence.
Justin Garlick · Cyber Security & Privacy at Plaid. Hosted by Shruti Gupta · Founder & CEO, Zania.
Video published October 29, 2026.
Episode notes
Selected ideas from the conversation, with practical questions for your team. Chapter links open the relevant moment on YouTube.
How can AI agents support a risk assessment?
Justin separates information gathering from analyst judgment. Agents help discover evidence, research threats, and read control narratives. Analysts validate what they find. A newly discovered control is a lead to investigate: the team checks whether the control actually exists and applies before relying on it in an assessment.
How did the team adapt FAIR?
Justin describes a modified approach inspired by Factor Analysis of Information Risk (FAIR). His team made it more qualitative to fit its business context and pace. It used dedicated agents for research-heavy parts of the analysis, such as threat frequency and control strength, while keeping consistent scoring calculations in fixed logic. This is an account of that team’s adaptation, not a description of standard quantitative FAIR analysis.
What keeps an assessment reviewable?
An analyst needs to trace a claim back to its source, inspect it, and correct it. Justin describes human review throughout the process, with feedback on individual parts of the analysis. He also recommends changing one part at a time so the team can see whether an adjustment improves the result. Faster output is useful only if the reviewer can check the reasoning and evidence.
How should a team measure progress?
Justin starts with the time it takes to analyze a risk and give the business an informed recommendation. He discusses reducing assessment turnaround time as intake grows, while recognizing the work required to calibrate a new system. The conversation also looks ahead to proactive risk identification and vendor due diligence; those are future opportunities, distinct from the risk-analysis workflow he describes using.
Questions to ask before your first pilot
Which assessment step consumes the most time? Is the source material complete enough to support it? Can an analyst verify each material claim? Measure time to a reviewed recommendation, including corrections—not simply time to the first AI response.
Keep exploring
© 2026 Zania Inc.
1950 University Ave Palo Alto, CA 94303