---
title: JPMorgan's CISO: evaluate taking company services off the open internet so unauthenticated agents cannot reach them | ctxsec
url: https://ctxsec.com/items/jpmorgan-ciso-opet-abstract-services-from-internet-nov-7
description: "Pat Opet, who lists himself as security at JPMorgan and Chase, posted that cybersecurity teams should be evaluating how to abstract company services from the internet. His question: why allow an unauthenticated, anonymous agent of an attacker to interact with your systems? Follow-ups the same day say this is about authentication and authorization at the perimeter, not shutting services or blocking customers' own agents. He pointed to identity-aware proxies that drop anonymous internet traffic before it reaches applications, identity-layer segmentation so an authenticated attacker only sees specific pages or endpoints, and automated account suspension with a failure blast radius of one."
status: "opinion (Pat Opet, JPMorgan Chase CISO, on his own X account, Nov 7); architectural guidance, not a new incident or a change to the bank's published policy"
published: 2026-11-07
---

> Pat Opet, who lists himself as security at JPMorgan and Chase, posted that cybersecurity teams should be evaluating how to abstract company services from the internet. His question: why allow an unauthenticated, anonymous agent of an attacker to interact with your systems? Follow-ups the same day say this is about authentication and authorization at the perimeter, not shutting services or blocking customers' own agents. He pointed to identity-aware proxies that drop anonymous internet traffic before it reaches applications, identity-layer segmentation so an authenticated attacker only sees specific pages or endpoints, and automated account suspension with a failure blast radius of one.

[← Context & Harness Attacks](/context) · [markdown](/items/jpmorgan-ciso-opet-abstract-services-from-internet-nov-7.md)

opinion (Pat Opet, JPMorgan Chase CISO, on his own X account, Nov 7); architectural guidance, not a new incident or a change to the bank's published policy

2026-11-07

### JPMorgan's CISO: evaluate taking company services off the open internet so unauthenticated agents cannot reach them

- **What he is not saying:** in a reply, Opet wrote that the post "says nothing about being closed nor customers agents" and is about maximizing authentication and authorization to strengthen the perimeter.
- **Example he shared:** a diagram of an independent "auth filter" at the edge that screens traffic, requires multi-factor authentication, then authorizes access over a verified private link. Exploit attempts, bots and anyone who cannot sign in are stopped before they reach the application, so a flaw in the app is not enough on its own to get in.
- This is distinct from JPMorgan's already-reported policy of [blocking outside AI agents that log in with customer banking credentials](/items/jpm-outside-ai-agents).

Sources: [Pat Opet on X (Nov 7)](https://x.com/patopet/status/2119119940036800520) · [Opet: identity-layer segmentation and blast radius of one](https://x.com/patopet/status/2119187501134807121) · [Opet: identity-aware proxy, drop anonymous traffic](https://x.com/patopet/status/2119206056744374335) · [Opet: not about closing services or customer agents](https://x.com/patopet/status/2119208610769297647) · [Opet: example diagram](https://x.com/patopet/status/2119149168589750396)