The “S” in AI Stands for Security
Synopsis
AI promises a future in which a whole range of tedious but critical security functions can be automated by machines. In the short run, however, the rush to adopt largely unproven and often unpopular new AI functionality is exacerbating pervasive gaps in data governance, authentication and authorization. AI also is threatening the sanctity of long-held infosec mantras like the “CIA triad” of confidentiality, integrity and availability. This talk will explore how AI is accelerating many of those challenges and supercharging them with additional risk and complexity, and how attackers and defenders alike are exploiting our nascent reliance on this technology.
Brian Krebs delivered a dark but insightful keynote at the start of CyberCON2025 Day 2 - often painting AI as more threat than tool. While his skepticism may go too far, especially for those of us building secure-by-design AI, he hit on some GRC truths we shouldn’t ignore.
🔍 Key Takeaways for Risk Leaders:
- 🔐 “Most data breaches today aren’t about cracked passwords — they’re about stolen tokens.” Weak or unmonitored SSO and OAuth tokens are being leaked, stolen, and reused at scale. MFA isn’t enough - token lifecycle governance is critical.
- 🧱 “Many AI startups treat trust like a default — but they haven’t earned it.” He cited multiple examples (Snowflake, Paradox AI) where SaaS vendors leaked sensitive credentials through basic security failures. GRC teams must treat vendor due diligence and AI security posture reviews as mandatory.
- 🚨 “We’re not just putting AI into everything — we’re putting everything into AI. And that’s a problem.” The current rush to embed LLMs everywhere - without authenticating the users or hardening the backend - is already being abused by attackers.
While Krebs underplays AI’s defensive potential, his message is clear: the threat surface is evolving fast, and most orgs are still stuck solving last year’s risks.
✅ Don’t get swept up in AI hype without doing the hard work of authentication, logging, and third-party assurance.
Originally posted here: https://www.linkedin.com/posts/vohradsky_cybercon25-futureofrisk-myrisk-ugcPost-7384375199166550016-JLls?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAa6_x4BaGrQ0Mb_j9juXLWRNVijeGi0550
Brian Krebs delivered a dark but insightful keynote at the start of CyberCON2025 Day 2 - often painting AI as more threat than tool. While his skepticism may go too far, especially for those of us building secure-by-design AI, he hit on some GRC truths we shouldn’t ignore.
🔍 Key Takeaways for Risk Leaders:
- 🔐 “Most data breaches today aren’t about cracked passwords — they’re about stolen tokens.” Weak or unmonitored SSO and OAuth tokens are being leaked, stolen, and reused at scale. MFA isn’t enough - token lifecycle governance is critical.
- 🧱 “Many AI startups treat trust like a default — but they haven’t earned it.” He cited multiple examples (Snowflake, Paradox AI) where SaaS vendors leaked sensitive credentials through basic security failures. GRC teams must treat vendor due diligence and AI security posture reviews as mandatory.
- 🚨 “We’re not just putting AI into everything — we’re putting everything into AI. And that’s a problem.” The current rush to embed LLMs everywhere - without authenticating the users or hardening the backend - is already being abused by attackers.
While Krebs underplays AI’s defensive potential, his message is clear: the threat surface is evolving fast, and most orgs are still stuck solving last year’s risks.
✅ Don’t get swept up in AI hype without doing the hard work of authentication, logging, and third-party assurance.
Originally posted here: https://www.linkedin.com/posts/vohradsky_cybercon25-futureofrisk-myrisk-ugcPost-7384375199166550016-JLls?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAa6_x4BaGrQ0Mb_j9juXLWRNVijeGi0550