How CISOs frame securing AI: Adobe, Atlassian and Synechron in their own words

What the three documents are

The question is how security leaders at Adobe, Atlassian and Synechron describe their role in securing AI adoption and AI-driven vulnerability work. The answer rests on three company-published pages. None of them states a publication date in its text.

The first is an Adobe webinar page featuring Chief Security Officer Aanchal Gupta. The second is a community post by Atlassian CISO David Cross about a security white paper for Rovo, Atlassian's AI product. The third is a Synechron article co-written by CISO Aaron Momin and a senior cyber security architect.

The three are different kinds of document. One is an event listing, one is a release announcement, and one is a thought-leadership article. What each commits its author to differs accordingly, and this guide keeps those differences visible.

Adobe: trust by design, framed as a balance with speed

Adobe's page opens with the tension it wants the session to address. The page says, "As enterprises accelerate AI across their tech stacks, leaders must balance speed with trust".

The page describes what Gupta will discuss. It says the conversation covers how leading organizations "embed governance guardrails directly into existing workflows to enable secure, scalable AI".

The page lists what attendees will learn. The first item is "How to build trust and governance into AI systems without slowing innovation."

The second item concerns agentic systems. The page promises coverage of "The new risks agentic and autonomous AI introduce , and how to validate behavior and enforce safe boundaries."

Gupta's title on the page is Chief Security Officer, not CISO. The page also lists two other people as event speakers: Lindsay Morris, Manager, Global Content Strategy, and Emily McReynolds, whose bio line begins "Emily McReynolds is Head of Global AI Strategy at Adobe".

The page is an invitation to a 42-minute on-demand session. It does not set out specific controls, dates or measurable targets. The only concrete material it points to is a downloadable presentation deck, which was not among the documents reviewed.

Atlassian: a published architecture paper and a feedback loop

David Cross introduces himself in the post as "your Chief Information Security Officer". He says the white paper update is about helping customers adopt AI. In his words, "We collaborate with security, privacy, and product experts to help customers adopt AI securely with Rovo in Atlassian apps."

The post lists what the second edition of the paper covers. On third-party model providers, it says the paper explains how they "process prompts without storing or training on your data".

On access control, the post says the paper covers how Rovo "enforces your existing access controls across Atlassian apps and 50+ Teamwork Graph connectors".

On AI-specific threats, the paper includes a section on "How Atlassian detects abuse, prompt injection, and anomalous access patterns".

The post also lists compliance items. These are SOC 2 Type II, ISO 27001, ISO 27018, ISO 22301, and "progress toward ISO 42001 (AI Management System)". The wording is "progress toward" ISO 42001, so the post does not claim that certification.

Cross frames the benefit for customer security teams in terms of control. The post says administrators can restrict AI to specific user groups, choose which third-party tools connect, and pin data to a region.

The post also makes a claim about customer data. It says "ZDR, permission checks, and tenant isolation mean your data is not used for LLM training and not exposed across customers." This is Atlassian's statement about its own design. The documents contain no independent verification of it.

Access to the paper is gated. The post says readers "may be guided through a quick, one-time access flow (one-time code, and possibly an NDA for your organization)".

Synechron: AI as a tool for vulnerability work

Synechron's article is about using AI in vulnerability detection, not about securing AI adoption in general. It is co-written by Aaron Momin, whose author bio says, "He oversees the execution of Synechron s worldwide information security strategy and information security program."

The article's opening argument is that "AI is making it easier for companies to find cybersecurity breaches." It then claims that AI-powered tools can analyze data and code faster than traditional methods. In the article's words, this reduces "false positives" and gives "more precise vulnerability detection and scoring".

The article presents Synechron's own product as the example. It calls AppSec.AI "one of our newest cybersecurity accelerators releasing in the next month". The article carries no date in its text, so the release month cannot be determined from the documents.

The article lists what the accelerator does. It consolidates data from several scanning tool types.

It also prioritizes findings using several factors. The article says the system analyzes "CVSS scores, exploit availability, and application criticality".

A conversational assistant is part of the design as well. The article describes it this way: "Helps security analysts query underlying vulnerability data to obtain relevant insights."

The article also includes a short caution about AI itself. It says, "As AI becomes embedded in digital infrastructure, it also introduces new risks and vulnerabilities."

What each publication commits its author to

The commitments differ in kind. Treat these as readings of the text, not as promises with deadlines.

• Adobe: The page commits Gupta to a stated topic list. The list is trust and governance without slowing innovation, and risks from agentic AI. The page sets no dates, metrics or controls.
• Atlassian: The post commits Atlassian to a published, versioned document. It also asks for feedback, including whether the paper saved time in a real review. The post says, "Please indicate whether the paper contributed to time savings during an actual security review." The post names specific features and certifications that readers can check against the paper itself.
• Synechron: The article commits the company to a product release, described only as "in the next month". It also states expectations for AI-driven vulnerability work, such as fewer false positives and less duplication. Those expectations are forecasts, not commitments.

What the documents leave out

None of the three pages gives incident data, audit results or outcome figures for the AI programs described. Adobe's page does not describe controls in the text reviewed. Atlassian's post summarizes a paper that sits behind a portal, and the paper was not among the documents reviewed. Synechron's article describes its accelerator's features but reports no measured results.

The documents also do not compare these companies. They show three framings. Adobe frames securing AI as governance built into existing workflows. Atlassian frames it as published architecture and customer-facing controls. Synechron frames AI as a tool for finding and prioritizing vulnerabilities.