JPMorgan's CISO: evaluate taking company services off the open internet so unauthenticated agents cannot reach them
- What he is not saying: in a reply, Opet wrote that the post "says nothing about being closed nor customers agents" and is about maximizing authentication and authorization to strengthen the perimeter.
- Example he shared: a diagram of an independent "auth filter" at the edge that screens traffic, requires multi-factor authentication, then authorizes access over a verified private link. Exploit attempts, bots and anyone who cannot sign in are stopped before they reach the application, so a flaw in the app is not enough on its own to get in.
- This is distinct from JPMorgan's already-reported policy of blocking outside AI agents that log in with customer banking credentials.
Sources: Pat Opet on X (Nov 7) · Opet: identity-layer segmentation and blast radius of one · Opet: identity-aware proxy, drop anonymous traffic · Opet: not about closing services or customer agents · Opet: example diagram