[llm_trw]

>- Is it reasonable to grant such privilege access to a piece of software that ultimately is a black box ?

As I said in the previous thread: explaining to execs that giving root to someone on your machines means they have root is a very difficult concept for them to understand.

[phito]

Then the exec should be held responsible?

[nichol4s]

The exec just follows the instructions provided by their CISO, who adheres to the information security standards used in audits.

These standards are influenced not only by actual threats but also by lobbying from Endpoint Detection and Response (EDR) systems like SentinelOne and Crowdstrike. For instance, in 2021, the White House issued Executive Order 14028, which mandates the Federal Government to implement a robust EDR solution. Consequently, standards such as those from NIST and ISO27001 have increasingly emphasized malware detection and response.

When onboarding any large enterprise, you will encounter these requirements before the enterprise can proceed with procuring your service. This compels B2B organizations to implement this software to be successful.

^1 https://www.opensecrets.org/federal-lobbying/clients/summary...

^2 https://www.opensecrets.org/federal-lobbying/clients/summary...

[dotancohen]

That responsibility (and associated risk) is often the justification for C compensation. Whether that is a good argument I have no opinion.

[mkayokay]

How about the good old analogy of giving your house/car/safe keys to a total stranger while going on vacation?