Vin Sharma, Co-Founder and CEO of Vijil – Interview Series

Vin Sharma is Co-Founder and CEO of Vijil, bringing more than 30 years of experience across cybersecurity, open source, cloud computing, and AI infrastructure. Before founding the company, he led deep-learning engineering work at AWS for Amazon SageMaker and Amazon Bedrock, developed data-center infrastructure at Intel, and held product and engineering roles at Hewlett-Packard. His career began with automated red-team testing for trusted UNIX systems, a foundation that informs his focus on making enterprise AI agents reliable, secure, and safe.

Vijil provides trust infrastructure for enterprise AI agents, helping organizations evaluate behavior, enforce controls, and improve resilience across the agent lifecycle. Its approach combines testing, security, and continuous feedback to align agent behavior with an organization’s intended purpose and policies. In this interview, Sharma discusses how to define and measure trust, why agent testing differs from conventional software security, and the oversight enterprises need as agents gain autonomy.

You spent more than 30 years working across companies including AWS, Intel, and Hewlett-Packard before founding Vijil. What ultimately convinced you that AI trust and security represented a large enough unresolved problem to build a company around?

Before I joined a security startup 30 years ago, I was in graduate school studying AI and machine learning. I have since worked in product teams that built military-grade security into operating systems based on Unix and Linux, secure web servers for online banking, trusted execution environments for cloud computing, encryption into data analytics platforms, and most recently a full circle back to building enterprise-ready AI/ML services at AWS. The journey left me with the conviction that building trust into a system of intelligence is more challenging than building the intelligent system itself. While the AI industry seems broadly committed to increasing the capability of the agents, I believe we need to invest as many resources in building scalable oversight and control mechanisms into the agents. Without these metrics and mechanisms tailored to the needs of specific organizations, the initial wave of exuberant adoption will die out on the sandbars of risk and ROI because businesses will not be able to prove that their agents are working in their best interests.

Vijil is built around the idea that many AI agents never reach production because enterprises cannot adequately verify their reliability, security, and safety. Where are you seeing the biggest trust gaps emerge as companies move from AI prototypes to production deployments?

The bottleneck to deploying more agents with increasing autonomy is whether organizations can specify the intended behavior of their agents and verify that the agents are behaving as they intended. Not only that—they have to be able to do it at a scale and speed at which agents operate. It stands to reason that we need a way for agents to measure and modify the behavior of other agents. Two of the biggest gaps are knowing what to measure (what good means when it comes to agents) and knowing what to modify (which components of the agent system to tune in order to elicit the behavior intended by its principal: the model and its parameters, the system prompt, the user instructions, the agent harness, or the graph of multi-agent systems).

How does Vijil define and measure “trust” in an AI agent, and what signals or benchmarks matter most when determining whether an agent is ready to operate inside an enterprise environment?

We define trust as the expected benefit of delegation to an autonomous agent discounted by the risk of its betrayal of our intent. This means an agent can be trusted if it behaves correctly under normal, noisy, and hostile conditions, and when it fails it minimizes the blast radius. We can then measure trust along three pillars: reliability, security, and safety. The agents are reliable when they perform as expected under diverse conditions, they are secure when they perform as expected under hostile conditions, and they are safe when they can minimize business, legal, and technical risks.

AI agents can behave unpredictably because they combine models, tools, data sources, memory, and external systems. How does testing an agent differ from traditional application security testing or conventional model evaluation?

Traditional software fails in now well-understood ways: speaking broadly, this includes the inability to handle malformed inputs, weaknesses in logic and system design, bugs in implementation, hidden vulnerabilities to attacks, and unintended side effects of the outputs. Testing for these failures is appropriately predictable. Agents vastly expand the surface area of failure. To a point where the surface area is categorically inaccessible to model evaluation, unit tests, integration tests, application security tests, pen tests, and compliance checks. To test the new agent risk surface, we need new metrics and mechanisms that evaluate the behavior of the agent with respect to its purpose specified by the principal, the personas of its users, and the policies of the organization, industry, and region in which it operates.

Your background includes leading deep-learning engineering efforts for Amazon SageMaker and Amazon Bedrock. What lessons from building AI infrastructure at AWS have most influenced how you are approaching agent security and reliability at Vijil?

The most formative insight was that finding failures in the reliability, security, and compliance of services early in the development cycle was far more effective and efficient than finding them on the eve of launch, which was traditional, or worse after the service was in production, which meant waking up to phone calls about a failing service.

Vijil focuses not only on testing agents before deployment but also on defending and continuously improving them in production. What types of risks only become visible once an agent begins interacting with real users, data, and enterprise systems?

The real world has an infinite capacity to surprise us. And a surprised agent is an error-prone agent. An agent that makes a mistake in generating a meme is not anyone’s concern. An agent that is designed to assist or replace a financial advisor, a paralegal, an attorney, a nurse, a doctor, a patient, or any professional in an industry that has to show proof of fiduciary behavior cannot function unless the tolerance levels are tightly scoped, carefully monitored, and the agent’s behavior is quickly restored.

As enterprises deploy increasingly autonomous agents capable of taking actions rather than simply generating responses, how does the security model need to evolve? Are traditional concepts such as permissions, identity, and access control sufficient?

No. As agents become actors in an organization, they need to be granted unique identities that can be verified, they need to be assigned roles that bind their behavior as well as their functional components (tools with access permissions over resources) with mandatory access control policies, they need to be monitored continuously for drift from intended purpose, and steered to remain resilient under attack.

Vijil has progressed from a $6 million Seed round to a $17 million Series A while building a roughly 20-person founding team and reaching its first $1 million in annual recurring revenue. What were the most important decisions that allowed you to move from an early technical concept to commercial adoption?

We chose early on to build a layer of trust that integrates with the customer’s platform of choice but anticipated that enterprises would increasingly seek greater customization, more granular control, and lower cost over multi-agent systems using open models. The long game of building a platform layer rather than a point product gives us comparative advantages but also creates challenging conditions where matching with enterprises that are ready for governance over agents at scale is not as easy as selling a lift-and-shift service.

You began your career developing automated red-team tests for trusted UNIX systems in 1995. Nearly three decades later, how have the principles of red teaming changed when the system being tested is an AI agent capable of reasoning, adapting, and using external tools?

Historically, red teaming meant testing an organization’s defenses against a coordinated attack. The general principles hold. We still need coordination of attacks under controlled conditions to probe for the weaknesses of the organization under test. However the middle period of history in which red team exercises were scripted to test software systems are no longer adequate because AI agents are not like deterministic software—they are designed to adapt to their environment so the same attack cannot be replayed predictably. I argue that agents should be treated like corporations. Then red team testing of agents must necessarily involve adapting to the purpose of the agent, probing its drift from the intent of its users, and its willingness and ability to evade the policies of its environment.

Looking ahead, do you expect independent testing and measurable trust standards for AI agents to become a prerequisite for enterprise deployment, and what needs to happen across the industry for that level of assurance to become standard practice?

Today, builders evaluate agents for capability, red teams test them for resistance to prompt injections and jailbreaks, and GRC teams are just starting to test them for compliance with regulations. What very few organizations do is institute a regime of behavior verification that runs continuously in the background throughout the lifecycle of the agent as models, tools, resources, workflows, and the target environment change. Even more importantly, where Vijil helps enterprises uniquely is by tracing the actual behavior of the agent in production back to its specification in a feedback loop that continually improves the agent. The agents that survive attacks are those that adapt to stay resilient.

Thank you for the great interview, readers who wish to learn more about testing, protecting, and continuously improving enterprise AI agents should visit Vijil.