Washington's top cyber official argues against AI rules, so governance lands in your contracts

Sean Cairncross, the White House National Cyber Director, opened Black Hat USA 2026 by arguing that regulating AI would both stifle innovation and development and struggle to keep pace with how fast the technology is moving, according to ESET's WeLiveSecurity account of the keynote ^[3]. For anyone buying or deploying agentic systems, the reasonable planning assumption is now that near-term guardrails come from procurement terms, contracts and internal policy, not from a federal rule.

The framing was national rather than technical. Cairncross said "AI is a tremendous story of American innovation" and made several other comments about US leadership in the field ^[4]. He also said the US government is looking at ways to build a US open-source infrastructure that the rest of the world can benefit from ^[5]. The WeLiveSecurity writer, who was in the room, noted that one of the companies named as instrumental to "AI made in America" is based in London ^[6], and characterised the keynote session overall as feeling like a party-political speech ahead of the forthcoming mid-terms ^[14].

The rest of the opening block was staffed at the same level: Nick Andersen, Acting Director of CISA; Katherine Sutton, Assistant Secretary of War for Cyber Policy; and Brett Leatherman, Assistant Director of the FBI's Cyber Division ^[7]. The FBI pointed to Operation Riptide, which it said resulted in arrests of more than 200 people allegedly engaged in cybercrime ^[8]. The panel discussed vulnerabilities now being found by AI-powered systems in large volumes and at speed ^[9], which prompted CISA's representative to call for "ruthless prioritization" and to stress industry collaboration ^[10]. Pressed on staffing, Sutton offered an analogy: you do not want a pediatrician performing heart surgery ^[11].

Read as a set of asks, that is thin. On the record in this account, the government's requests to industry were prioritisation, collaboration and an eventual open-source infrastructure play; no new federal AI rulemaking was put on the table ^[18]. The WeLiveSecurity author's objection is that without some form of regulation the boundaries on the use of AI remain blurred ^[16].

The most useful sentence of the week came from a vendor, not a podium. David Weston of Microsoft said, in summary, that AI agents authenticate, invoke tools and inherit permissions the same way a human employee does, but without the oversight, policy and governance needed to make them accountable ^[13]. That is a controls problem you already know how to price: identity lifecycle, entitlement review, least privilege, logging of tool invocation. The WeLiveSecurity view is that the technology remains within human control, and that if it is not under control the answer is to switch it off and re-task it with the correct controls in place ^[17]. Blunt, and cheaper than the alternative.

Three things to watch. Whether the promised US open-source infrastructure effort produces anything a defender can use ^[5]. Whether CISA turns "ruthless prioritization" into published guidance rather than a slogan, given the volume of AI-discovered vulnerabilities ^[10][9]. And whether the specialisation gap Sutton described gets funded or gets a training budget ^[11].