Greetings,
Even before the recent CrowdStrike debacle, I was pondering the trusted role that security software plays in our ecosystem and the many ways where the security solution can become the problem.
Some of the most notable breaches of the last year came about through the compromise of security software including Barracuda's Email Security Gateway, Cisco's Adaptive Security Appliance, Ivanti's Endpoint Manager Mobile and Sentry, and Trend Micro's Apex Onesecure.
I've recently spent quite a bit of time giving talks and briefing enterprises on the lesser understood risks that come with these new GenAI systems. Everyone talks about deep fakes and fraud, but few people are looking at these systems in a more comprehensive way and, critically, the adoption of these new AI systems has far outpaced the adoption of security for them.
In fact, 20 of the top 20 SaaS companies have announced new AI features using LLMs. And 20 of the top 20 security companies have also announced new AI capabilities.
Whether you realize it or not, your data is being splintered into multiple shadow copies across almost all of your service providers and chances are they haven't secured that new data or the systems around it. Even your security vendors are adding these risks to your company. It's alarming.
If you'd like to understand these risks better, I talked about six specific risks and six mitigations in a talk I gave to RMISC last month (linked below). Those who have seen it tell me it was the most impactful talk they've seen on AI security. It's likely well worth your time.
