AI Knowledge Circle: AI Governance, Cybersecurity and Token Economics

Organized by CTO Community India

The session covered three primary topics:

1. AI Governance — Anupama Itikirala
2. AI Security — Mani B
3. Token Economics — Richa Kumari

---

🎤 Anupama Itikirala

Topic: AI Governance

Anupama Itikirala introduced herself with around 30 years of industry experience, including experience with multinational companies such as Intel in Bangalore, and around 10 years as an AI founder in fintech and cybersecurity based in Hyderabad.

The AI governance discussion was motivated by issues such as deepfakes and the lack of sufficient discussion and frameworks in the Indian context.

What is AI Governance?

AI governance is a framework of policies, process oversight, and standards to ensure developers and architects deploy and use artificial intelligence responsibly, safely, and ethically.

The discussion covered five core pillars, including frameworks such as the NIST Risk Management Framework and the EU AI Act:

1. Accountability

There should be clear ownership and accountability.

2. Transparency and Explainability

There should be transparency around how AI systems arrive at decisions.

3. Fairness

Fairness needs to address issues such as:

• Gender bias
• Age bias
• Racial bias
• Hallucinations

4. Safety

AI systems need to be deployed with appropriate safety considerations.

5. Privacy

Privacy needs to comply with regulations such as:

• GDPR
• India’s DPDP Act

---

Transparency, Fairness, Privacy and Security

Anupama discussed the need for transparency to trace decisions and understand AI outputs.

Fairness needs to consider demographic differences such as gender, age, and racial bias.

For privacy, mechanisms such as:

• Role-Based Access Control
• Attribute-Based Access Control

can be used for APIs and access management.

Security also needs to address prompt injection, with reference to concerns covered by the OWASP Top 10.

---

Three Business Pillars: Adapt, Defend and Govern

Anupama explained the three business pillars of AI governance:

Adapt

The adapt pillar focuses on:

• Use-case value framing
• Model selection
• MLOps deployment
• Operating-model changes
• Moving from multi-tenant SaaS toward agentic architectures

The question is how organizations adapt their operating models as AI changes the way applications work.

Defend

The defend pillar focuses on identifying harms before shipping.

This includes:

• Threat modeling
• OWASP recommendations
• Runtime guardrails
• AI security controls

The discussion referenced runtime guardrails and capabilities from providers such as:

• Databricks
• Microsoft
• Google
• AWS

Govern

The govern pillar involves:

• Rigorous due diligence
• Quality audits
• IT assurance
• Board-level evidence

This becomes particularly important for regulated areas such as healthcare and fintech.

---

Building a Governance Culture

Anupama explained that companies need to establish a governance culture involving:

• Ethics Board
• AI Risk Officers
• Model Owners
• Business Unit Leads
• Deployment Engineers

The governance responsibility therefore cannot sit with only one AI team.

During the discussion, Mani B also added that many companies develop proprietary large language models in defense areas to prevent data breaches.

---

Stepwise AI Governance Implementation

Anupama described a stepwise implementation approach:

Step 1- Define purpose and scope

Step 2-Design governance frameworks

Step 3-Establish AI policies

Step 4-Create a central AI register

Step 5-Embed governance into development pipelines

The discussion also covered global frameworks and market approaches including:

• OECD guidelines
• NIST Risk Management Framework
• ISO 42001
• EU AI Act
• Singapore
• UK
• China
• Canada

An important point was that there is no single universal framework currently.

---

Regulatory Mapping and Governance Pitfalls

Anupama discussed mapping the governance pillars to regulations.

The EU AI Act was highlighted as mandatory, with particular focus on high-risk systems such as healthcare and financial applications.

The discussion also covered:

• Accountability
• Article 9
• GDPR
• DORA for the European financial sector

Some common pitfalls include:

• Undefined responsibilities
• Lack of technical documentation
• Failure to test demographic sub-performance

The point was that governance needs to be implemented technically and organizationally, not just documented.

---

Architect Responsibilities

Anupama highlighted three important areas for architects:

Model Discovery

Architects need a holistic landscape view of the models being used.

Cataloging

Cataloging helps identify:

• Shadow AI
• Models being deployed
• Deployment risks
• Resource usage

Data Inputs and Outputs

Architects also need to control what data is entering and leaving AI systems.

The discussion included model cards, which provide concise documentation around model intent.

Cataloging can also help optimize resource consumption, including GPU usage in RAG pipelines.

---

Agentic AI Lifecycle Governance

Anupama discussed lifecycle governance for agentic AI.

Program managers need to consider:

• Use-case delivery
• API consumption mapping
• Continuous monitoring
• Non-deterministic responses
• Data misinterpretation

The governance challenge increases when systems can independently perform multiple actions and interact with different APIs.

---

Discussion: Accountability and Testing

During the Q&A, Mani B and Anupama Itikirala discussed the changing role of traditional software testing.

The discussion included the erosion of traditional activities such as:

• Manual load testing
• Penetration testing

in an increasingly agile and agentic development environment.

Anupama noted that multinational corporations generally maintain rigorous governance boards and evaluation processes, while smaller startups may not have clearly separated developer and testing roles.

This means new human skills are required for:

• Code reviews
• Risk evaluation
• AI evaluation
• Governance

---

🎤 Manikandan B

Topic: AI Implications for Cybersecurity

Mani B introduced the second session on AI implications for cybersecurity.

Reflecting on an industry career beginning in 2005, Mani highlighted how rapidly technology changes, with significant changes sometimes happening every three months.

---

LLM vs Agentic AI

Mani explained the difference between traditional LLMs and agentic AI.

Large Language Model

A large language model operates primarily as a:

One-way instruction → response queue

Agentic AI

Agentic AI operates in a:

Two-way loop

The response is fed back into the inference engine, allowing the system to continue working toward an independent goal and perform parallel tasks.

This creates a different cybersecurity problem because the AI system is no longer simply generating a response. It may continue taking actions.

---

Offensive and Defensive Cybersecurity

Mani explained that the public availability of AI tools creates two dimensions.

Defensive Side

Enterprises need to protect:

• Infrastructure
• Client data
• Enterprise systems

Offensive Side

Malicious actors can use AI for:

• Unlawful harvesting
• Data collection
• Monetization
• Identity information gathering

The first stage discussed was reconnaissance.

Attackers gather information about:

• Intent
• Personnel
• Systems
• Infrastructure

before attempting system access and infiltration.

---

MITRE ATT&CK and Proactive Threat Frameworks

Mani discussed the use of the MITRE ATT&CK framework.

MITRE ATT&CK provides:

• Techniques
• Sub-techniques
• Structured identifiers
• Descriptions of attacker methodologies
• Mitigation plans

Organizations can use these frameworks to identify gaps and determine the remedial measures required.

---

Cybersecurity Mitigation and Detection

Mani discussed the need for multiple mitigation and detection strategies.

Security teams need to understand the techniques used to:

• Identify active attacks
• Address identity theft
• Detect exploitation
• Protect assets

The session emphasized that organizations need structured security approaches rather than relying on a single defensive mechanism.

---

Cyber Insurance and Cyber Kill Chain

The discussion also covered cyber insurance.

Organizations handling personally identifiable information and large enterprise environments may use cyber insurance to help mitigate the financial impact of cybersecurity incidents.

Mani also discussed the seven-step Lockheed Martin Cyber Kill Chain as a framework for defense and threat identification.

---

Log Analysis and Behavioural Monitoring

Mani emphasized the importance of analyzing:

• Delivery logs
• Network activity
• Applications
• Cloud APIs

This can help identify abnormal behavior.

For example, if a specific IP address repeatedly visits particular pages, security teams can identify the abnormal activity and potentially block malicious traffic.

The discussion therefore connected security with behavioral monitoring.

---

Security Decision Making

Mani described security decision-making through:

Observation → Orientation → Decision → Action

Security decisions need to consider multiple parameters, including strict government reporting timelines and rapid response requirements.

The objective is to uncover hidden compromises and respond within the required timelines.

---

Question from Selva Prakash: What About Small Teams?

Selva Prakash asked how solo developers and smaller teams can adapt to evolving AI-driven cyber threats.

Mani suggested that smaller teams can make use of:

• Free internet AI audit tools
• MITRE ATT&CK frameworks
• Security monitoring
• Dark-web data monitoring

The focus is to use available resources to improve visibility and manage security challenges even without a large security organization.

---

🎤 Richa Kumari

Topic: Token Economics

Richa Kumari -Founding member (CTO Community) The third discussion introduced Token Economics as an emerging area and part of her an upcoming book initiative.

Token Economics was described around the total lifecycle consumption cost and useful information yield of tokens when converting human language through AI models.

---

What Is a Token?

The discussion highlighted a common misconception:

Token ≠ Word

Tokens are fundamental units of AI language processing.

Their relationship with words varies depending on:

• Model
• Language
• Text

This creates confusion for non-technical IT personnel when trying to understand AI costs.

---

Token Consumption and Cost

Token consumption happens across:

• Prompts
• Context history
• Retries
• Output

The basic cost formula discussed was:

AI Cost = Input Tokens × Input Price + Output Tokens × Output Price

As interactions scale, production cost also increases.

Therefore, token consumption needs to be understood across the complete workflow rather than only looking at the user’s prompt.

---

Token Maxing and Context Optimization

The discussion introduced the idea of token maxing.

Just because a model provides a large context window does not mean we should fill that context with everything.

For example, flooding the context window with unnecessary:

• Books
• Documents
• Information

can reduce efficiency.

The focus should instead be on optimized information and structured knowledge bases.

---

Developer Token Waste

Richa talked about token waste and asked question for audience

Abhishek Nema highlighted that developers waste tokens because of:

• Context-window overflows
• Credit misunderstandings

Tripti Agarwal added that development teams need more sensitization around choosing the appropriate model.

The discussion mentioned models and variants such as:

• Claude
• Gemini
• OpenAI
• Kimi 2.7
• Kimi 3
• Fable
• Opus
• Sonnet

Teams may otherwise generate and validate redundant code across multiple platforms without calculating the return on investment.

---

Enterprise Token Limits

Mani B asked about organizational token limits.

Tripti Agarwal explained that her organization uses a manual monitoring process through IT operations.

The limits discussed were:

• $40 for AI teams
• $10 for the rest of the organization

However, challenges remain around:

• Duplicate workflows
• Manual monitoring
• Lack of organization-level governance

This raised an important question around how enterprises should move from manual token monitoring toward proper AI usage governance.

---

Model Selection and Task Matching

Sukanto Mahanti suggested using cheaper models such as Claude Haiku for simple tasks such as summarization rather than using expensive frontier models for every task.

The discussion also referenced GPT-6 Astra, launched on September 3, with the point that advanced models should not be applied universally.

The important discussion was around matching the model to the task.

---

Vendor Pricing and Model Choices

Tripti Agarwal raised a concern about technology vendors such as Anthropic and OpenAI and the guidance provided around model selection.

The discussion highlighted that organizations should not automatically select higher-tier models.

For basic work, lower variants may be sufficient.

Therefore, organizations need to understand:

Task → Model → Token Usage → Cost → ROI

rather than simply selecting the most powerful model.

---

Retry Mechanisms and Hidden Token Waste

Richa highlighted another source of token waste:

Tool retry mechanisms.

When a process fails and restarts from the beginning, the system may consume tokens again for the same context.

Production AI economics therefore include much more than model token costs.

They include:

• Embedding models
• Vectors
• Retrieval systems
• Multi-agent setups
• Tool retries
• Infrastructure

The discussion emphasized that production AI economics is an end-to-end problem.

---

Cost of Successful Tasks

Richa kumari explained that Token Economics needs to be evaluated based on the cost of successful tasks, rather than only raw request costs.

The analysis should consider:

• Long-term business value
• ROI
• Productivity
• Resource balancing

This is relevant across:

Students → Developers → Founders → Program Managers → CTOs

The focus is not simply:

How much did this request cost?

but:

What did we successfully achieve with that cost?

---

Infrastructure Costs

Anupama Itikirala raised the underlying infrastructure problem.

Organizations often focus on AI models and tokens while overlooking the infrastructure underneath them, including the bits and bytes running on Nvidia chips.

As organizations scale AI, they are already spending significant amounts on infrastructure.

The discussion therefore raised the need to properly utilize those resources and understand the complete AI cost.

---

Token Economics and Future Roles

Richa also discussed AI and job-security concerns.

The discussion encouraged collaborative learning and emphasized that the next generation of AI roles will require an understanding of Token Economics.

Companies are exploring roles around:

• Token analysis
• Token optimization
• AI architecture
• Production infrastructure

The focus is moving beyond basic coding toward production-level AI infrastructure integration.

---

Enterprise AI Adoption and Resource Concerns

Sukanto Mahanti highlighted that AI governance, security, and token economics are important reasons why enterprise AI adoption remains limited.

The discussion pointed to:

• Lack of visibility
• Lack of control
• Governance gaps
• Security concerns
• Resource concerns

CTO Community India emphasized that senior leadership also needs greater understanding of these areas.

The approach therefore needs to be horizontal, involving:

AI Engineers + Architects + CTOs + Business + Security + Product

rather than relying only on a traditional hierarchy.

Sukanto also raised concerns around the electricity requirements of AI data centers and Nvidia-based infrastructure, reinforcing why optimal and responsible use of AI resources matters.

---

Connecting the Three Topics

The session brought together three topics that are closely connected:

AI Governance

Responsible use of AI

AI Security

Protection of AI systems, infrastructure and data

Token Economics

Understanding AI consumption, optimization and business value

Together:

Governance → Security → Economics

These are becoming important parts of enterprise AI adoption.

---

Key Takeaways from the Session

AI Governance

• Define accountability.
• Improve transparency and explainability.
• Address fairness and bias.
• Build safety into AI systems.
• Protect privacy.
• Map governance to applicable regulations.
• Maintain an AI register.
• Catalog models.
• Include governance in development pipelines.

AI Security

• Understand the difference between LLM and Agentic AI.
• Monitor reconnaissance and attack techniques.
• Use MITRE ATT&CK.
• Use threat modeling.
• Monitor logs and behavior.
• Control identity and access.
• Prepare mitigation and detection strategies.

Token Economics

• Understand what tokens are.
• Measure input and output consumption.
• Optimize context.
• Avoid token maxing.
• Select models according to the task.
• Reduce unnecessary retries.
• Understand infrastructure costs.
• Measure the cost of successful tasks.
• Connect AI consumption with business value.

---

🙏 Vote of Thanks

A sincere thank you to Anupama Itikirala for sharing her experience and insights on AI Governance, including governance frameworks, five pillars, regulatory mapping, model cataloging, agentic AI governance, and the role of architects.

Thank you to Mani B for the discussion on AI Security, LLM versus Agentic AI, reconnaissance, offensive and defensive cybersecurity, MITRE ATT&CK, cyber kill chains, behavioral monitoring, and security decision-making.

Thank you to Richa for bringing the discussion on Token Economics and connecting token consumption with model selection, context optimization, retries, infrastructure, production cost, ROI, and successful business outcomes.

A special thank you to Selva Prakash, Abhishek Nema, Tripti Agarwal, Sukanto Mahanti, and participants who asked questions and shared their experiences.

The session was concluded with an invitation for participants to continue engaging with the CTO Community, nominate themselves for future speaking opportunities, and continue contributing to the community.

Thank you everyone for being part of the AI Knowledge Circle Event

Keep learning. Keep sharing. Keep building.