Self-hosting an open-weight model transfers six security jobs to the buyer

The sequencing has a mechanical reason behind it. Tharippala's test list runs to nine classes of agent attack, then adds seven more, which is sixteen distinct things to exercise before production ^[9][10][18]. Sixteen classes against an agent population nobody has enumerated produces findings without owners, which is why inventory sits first and blast radius reduction second in his ranking ^[7]. He does not allocate days; split evenly, three workstreams across 90 days is 30 days each ^[19]. Permission scoping also pays earlier than the test does, because narrowing what a compromised agent can reach lowers the value of a successful injection whether or not you have yet proved the injection works ^[8].

The ring around the model is where the money goes. He counts twelve operational items, including GPU infrastructure, power and cooling, capacity planning, orchestration, audit evidence and ongoing optimization ^[2][15]. Licensing and compliance review is the line he says rarely makes the budget at all: open weights are not unrestricted, many licenses carry usage restrictions, and the EU AI Act adds obligations for larger models ^[3]. That review recurs, because every model or adapter update needs re-validation ^[4].

Utilization is the other number that moves. Poor workload management leaves idle GPU capacity or unpredictable performance during demand spikes, and the levers he names are scheduling, quotas, batching, caching, model routing and demand forecasting, with quantization and multi-tenant GPU sharing changing the economics further ^[6]. That work is operational, not security work, and it draws on the same people security needs. The skill set he describes spans platform engineering, MLOps, GPU and Kubernetes expertise, site reliability, AI security and red-teaming, identity and data governance ^[16]. Where an organization assumes its existing infrastructure or security team can absorb the load, he reports significant delays and, in some cases, projects that never deliver the expected business value ^[5].

Read the source with its position in view. This is one interview, Tharippala is a field CISO at a vendor ^[12], and his stated conclusion is that build versus buy is the wrong axis, with a hybrid split between in-house workloads and managed services often the practical answer ^[17]. The part that stands independent of that position is the responsibility transfer: six duties move to whoever runs the weights, and none of them arrive staffed ^[1][14]. The threshold itself is missing from the material available here. The interview is summarized as covering what counts as a failing result and five questions buyers should ask agent platforms ^[11]. Without those, the acceptance gate on any red-team engagement is yours to draft, which is another argument for spending the first thirty days counting agents rather than buying tooling.