TRANSCRIPT 🔗
WEBVTT
00:00:00.000 --> 00:00:05.599
So the question here is: has cloud risk become the new concentration risk?
00:00:05.919 --> 00:00:09.759
Cloud outages aren't new, but AI changes their impact.
00:00:10.000 --> 00:00:16.480
Increasingly, organisations rely upon a handful of providers Microsoft, Google, Amazon, OpenAI, Anthropic.
00:00:16.800 --> 00:00:21.359
These aren't simply suppliers anymore, they're becoming critical infrastructure.
00:00:21.679 --> 00:00:33.359
When organizations depend on one provider for knowledge retrieval, software development, customer support, business automation, security analysis, the outage of one provider becomes an operational resilience event.
00:00:34.159 --> 00:00:38.560
Takeaway here is that AI resilience is becoming business resilience.
00:00:42.560 --> 00:00:45.840
Traditional third-party risk looked at suppliers.
00:00:46.000 --> 00:00:48.880
Today organizations depend on ecosystems.
00:00:49.119 --> 00:00:54.880
Open source, foundation models, APIs, plugins, model providers, cloud providers, data providers.
00:00:55.200 --> 00:00:59.280
One supplier failure may affect thousands of organizations simultaneously.
00:00:59.520 --> 00:01:06.000
Modern risk management programs need visibility across entire ecosystems, not simply contractual suppliers.
00:01:10.560 --> 00:01:12.640
So what should organizations do?
00:01:12.879 --> 00:01:14.480
Where should leaders begin?
00:01:14.719 --> 00:01:16.719
I'd suggest five priorities.
00:01:17.040 --> 00:01:20.879
First, treat AI governance like cyber governance.
00:01:21.359 --> 00:01:25.120
Second, extend identity governance to AI agents.
00:01:25.599 --> 00:01:29.599
Third, review privileged access and machine identities.
00:01:29.920 --> 00:01:34.480
Fourth, update operational resilience plans to include AI providers.
00:01:34.719 --> 00:01:42.319
And finally, educate boards because AI is no longer simply transforming business, it's transforming risk.
00:01:46.719 --> 00:01:53.599
This week, every board should ask management how many AI systems are making decisions inside our organization?
00:01:53.840 --> 00:01:55.200
Who owns those systems?
00:01:55.439 --> 00:01:57.359
How are their permissions controlled?
00:01:57.599 --> 00:02:04.560
Which critical business services depend upon AI, and what happens if those AI services become unavailable tomorrow.
00:02:08.719 --> 00:02:14.479
If you're an internal auditor, this week's stories point towards three excellent audit opportunities.
00:02:14.800 --> 00:02:21.360
AI governance, machine identity management, operational resilience for AI-enabled services.
00:02:21.599 --> 00:02:25.120
These are rapidly becoming areas of regulatory interest.
00:02:25.360 --> 00:02:38.080
If you're a CISO, you should be looking at reviewing AI inventory, review privileged identities, review machine identities, review AI supplier dependencies, and review AI instant response plans.
00:02:42.960 --> 00:02:49.439
So in closing, artificial intelligence is changing every aspect of technology risk.
00:02:49.599 --> 00:02:54.719
Not just cybersecurity, not just cloud, not just identity, everything.
00:02:55.039 --> 00:02:59.360
The organizations that succeed won't necessarily be those with the most AI.
00:02:59.520 --> 00:03:05.840
They'll be those with the strongest governance, the strongest resilience, and the clearest understanding of risk.
00:03:07.120 --> 00:03:08.240
Thank you for joining me.
00:03:08.400 --> 00:03:09.280
I'm David Horn.
00:03:09.439 --> 00:03:12.080
This has been the Technology Risk Podcast sponsored by Cortix.
00:03:12.319 --> 00:03:17.520
Until next week, stay informed, stay resilient, and stay ahead of Technology Risk.