0:00 SecurityScorecard just found over forty thousand exposed AI instances online, and nearly thirteen thousand of them are wide open to a full takeover.0:08 This is exactly the kind of story we filter for on Tech & AI Unfiltered — moving beyond the daily Twitter pulse to find the numbers that actually define your risk.0:18 Last week we talked about the noise, but today we have the signal.0:22 It’s a number that changes the entire conversation about AI security.0:27 What we're seeing is a collision.0:29 A moment where the sheer scale of AI deployment is crashing headlong into the reality of operational security.0:35 And the fallout is all over the timeline today, if you know where to look.0:40 First up, the context for all this.0:42 Last week, on July fifteenth, Twitter—or X, as we know it—officially turned twenty years old.0:48 And the narrative being pushed is a big one.0:50 A thread from CryptoPatel frames it not as a social media company, but as a "trillion-dollar AI empire." That’s a huge mental shift.0:58 Twenty years ago, the question was "What are you doing?" Now, the platform is a foundational layer for countless other ventures, including, according to the thread, rocket-and-AI companies.1:10 The same app that started with 140-character updates is now apparently part of the training data for things that go to space.1:17 That’s the scale we're dealing with.1:20 An ambient, pervasive intelligence layer that’s just… everywhere.1:23 And when AI is everywhere, it has to be in the boardroom.1:27 That brings us to our second story, coming from a company called Diligent.1:31 They're what you call a GRC SaaS company—Governance, Risk, and Compliance.1:36 They've been posting about a new product called "AI Board Member." Now, set aside the marketing name for a second.1:43 The idea is what matters.1:44 They're building an autonomous AI specifically for corporate directors.1:49 Why?1:49 Because a typical board pack is over two hundred pages, and directors get it maybe a week before the meeting.1:56 The math is brutal.1:57 You can't possibly absorb it all.1:59 Diligent's pitch is that an AI can, giving every director instant recall and the ability to connect dots buried on page 47 and page 192.2:07 This isn't a toy.2:08 This is a direct response to the complexity that AI itself is creating in the business world.2:14 Which leads directly to the core thread of the day.2:17 The synthesis.2:18 It comes from Jo Peterson, who’s been covering enterprise tech for years.2:22 Her message, which she’s been hammering home, is that AI governance can no longer be a policy exercise.2:28 It HAS to become an enforceable operating model.2:31 That’s the key phrase: "enforceable operating model." A policy is a document you write, approve, and then file away.2:38 An operating model is something that is built into the workflow.2:42 It has teeth.2:43 It can block an action.2:44 It can raise an alarm.2:46 It can force a review.2:47 It’s the difference between a sign that says "Don't Speed" and a speed bump that makes you slow down whether you want to or not.2:55 So what does it all add up to?2:57 You have a trillion-dollar AI empire creating unprecedented scale.3:01 You have AI entering the most powerful rooms in business, the boardrooms.3:05 And you have this urgent, desperate call to move from flimsy policies to hard, enforceable rules.3:11 And now we go back to that first number.3:13 The reason why this isn't just theory.3:16 Because of those 12,812 backdoors.3:18 Let's dive deeper into that number, because it’s the most important development of the week.3:23 The thread from Rohit a verse breaks down the findings.3:27 Back on January 31st of this year, the security firm Censys did a scan and found 21,639 exposed AI instances.3:33 That was already a concerning number.3:36 But the new scan from SecurityScorecard found over FORTY thousand.3:40 The problem almost doubled in six months.3:42 This isn't a static issue; it's a rapidly expanding attack surface.3:46 Now, "exposed AI instances" can sound a little vague.3:49 What we're really talking about are things like Jupyter Notebooks, which are incredibly common tools for data scientists and AI developers.3:58 They let you write and execute code in a web browser.4:01 They are fantastic for development and collaboration.4:04 They are TERRIBLE when they are accidentally left connected to the public internet with no password.4:10 And that's what happened here.4:12 But the real danger is the specific vulnerability.4:15 Of those 40,000 exposed instances, SecurityScorecard found that 12,812 were vulnerable to remote code execution.4:22 RCE.4:22 Those three letters are the nightmare scenario for any security professional.4:27 This isn't just about someone seeing your data.4:30 It’s not a leak.4:31 Remote code execution means an attacker can run their code on your machine.4:35 Think about that.4:36 It means they can take over the server completely.4:39 They can steal the AI model you've spent millions developing.4:43 They can steal the proprietary data you trained it on.4:46 They can use your server to launch attacks on other people.4:50 They can install ransomware.4:52 It's not just leaving the front door unlocked; it's giving a criminal a key and a construction permit to do whatever they want with your house.5:00 And there are almost thirteen thousand of these wide-open doors right now.5:05 This is the consequence of the speed and scale of AI development.5:09 Everyone is in a rush to build.5:11 To deploy.5:11 To get the next model out.5:13 And in that rush, basic security hygiene is being forgotten.5:17 A developer spins up a notebook to test something, they forget to secure it, and suddenly a core piece of your intellectual property is flapping in the wind, waiting for the first automated scanner to find it.5:29 This isn't a sophisticated, nation-state-level hack.5:32 This is the digital equivalent of leaving the company jewels on a park bench.5:37 So.5:37 Here's the thread that ties it all together.5:40 The security disaster is the symptom.5:42 The disease is a failure of governance.5:45 This is why Jo Peterson's post is so critical.5:47 Her argument for an "enforceable operating model" is the ONLY sane response to the reality of 12,812 open backdoors.5:54 A policy document that says "Developers should secure their notebooks" is useless.5:59 It didn't stop this from happening, and it won't stop it from happening again.6:04 What does an enforceable model look like?6:07 This is where the posts from Diligent become so illuminating.6:10 They're not just making a philosophical point; they're building the tools.6:15 They published a list of five questions every director should be asking their management team about AI.6:21 These questions ARE the building blocks of an enforceable operating model.6:26 Question one: "Which AI systems are material to our risk profile?" This forces the company to even know what they have.6:33 You can't protect what you can't see.6:35 Question two: "What policies govern employee use?" Okay, that's the policy part.6:40 But then...6:41 Question three: "How are AI risks tracked in our ERM framework?" ERM is Enterprise Risk Management.6:47 This question forces the company to connect the AI-specific risk to the overall business risk framework.6:53 It takes AI out of the IT nerd corner and puts it on the Chief Risk Officer's desk.6:58 And here are the two most important ones.7:00 Question four: "What safeguards protect privileged communications?" This is about the data going INTO the models.7:07 If your board is using an AI to analyze M&A strategy, that is arguably the most sensitive data in the company.7:14 How do you ensure that data isn't being logged somewhere, or used to train a future model?7:20 And finally, question five: "How are we ensuring our AI use aligns with our ethical guidelines and brand promises?" This is the ultimate backstop.7:28 This forces the entire process to be accountable to the company's values.7:33 This isn't about slowing down innovation.7:35 It's about creating the conditions for sustainable innovation.7:39 You can't build a skyscraper on a foundation of sand.7:42 The rush to build models has created a massive, insecure, and un-audited digital infrastructure.7:48 The work of the next five years won't be about making models that are five percent more accurate.7:54 It will be about building the systems, the guardrails, and the operating models that let us use these incredibly powerful tools without setting the whole world on fire.8:04 It's a fundamental shift in focus.8:06 We've moved from the phase of invention to the phase of industrialization.8:11 And industrialization requires standards.8:13 It requires safety protocols.8:15 It requires governance that isn't just a piece of paper, but is coded into the machine.8:20 This week's chatter on X shows us the two sides of that coin.8:24 On one side, a trillion-dollar AI empire.8:27 On the other, thirteen thousand unlocked doors.8:29 The challenge is closing those doors without shutting down the empire.8:34 And the only way to do that is to stop writing policies and start building systems.8:39 The conversation has changed.8:40 The real work isn't just about making AI work; it's about making it work SAFELY.8:45 The age of AI governance as a suggestion is over.8:48 The age of AI governance as an engineering discipline has just begun.
