AI Has Changed Technology Risk Forever: Why Every Organisation Must Adapt bölümünün tam dökümü

WEBVTT 00:00:00.000 --> 00:00:05.599 So the question here is: has cloud risk become the new concentration risk? 00:00:05.919 --> 00:00:09.759 Cloud outages aren't new, but AI changes their impact. 00:00:10.000 --> 00:00:16.480 Increasingly, organisations rely upon a handful of providers Microsoft, Google, Amazon, OpenAI, Anthropic. 00:00:16.800 --> 00:00:21.359 These aren't simply suppliers anymore, they're becoming critical infrastructure. 00:00:21.679 --> 00:00:33.359 When organizations depend on one provider for knowledge retrieval, software development, customer support, business automation, security analysis, the outage of one provider becomes an operational resilience event. 00:00:34.159 --> 00:00:38.560 Takeaway here is that AI resilience is becoming business resilience. 00:00:42.560 --> 00:00:45.840 Traditional third-party risk looked at suppliers. 00:00:46.000 --> 00:00:48.880 Today organizations depend on ecosystems. 00:00:49.119 --> 00:00:54.880 Open source, foundation models, APIs, plugins, model providers, cloud providers, data providers. 00:00:55.200 --> 00:00:59.280 One supplier failure may affect thousands of organizations simultaneously. 00:00:59.520 --> 00:01:06.000 Modern risk management programs need visibility across entire ecosystems, not simply contractual suppliers. 00:01:10.560 --> 00:01:12.640 So what should organizations do? 00:01:12.879 --> 00:01:14.480 Where should leaders begin? 00:01:14.719 --> 00:01:16.719 I'd suggest five priorities. 00:01:17.040 --> 00:01:20.879 First, treat AI governance like cyber governance. 00:01:21.359 --> 00:01:25.120 Second, extend identity governance to AI agents. 00:01:25.599 --> 00:01:29.599 Third, review privileged access and machine identities. 00:01:29.920 --> 00:01:34.480 Fourth, update operational resilience plans to include AI providers. 00:01:34.719 --> 00:01:42.319 And finally, educate boards because AI is no longer simply transforming business, it's transforming risk. 00:01:46.719 --> 00:01:53.599 This week, every board should ask management how many AI systems are making decisions inside our organization? 00:01:53.840 --> 00:01:55.200 Who owns those systems? 00:01:55.439 --> 00:01:57.359 How are their permissions controlled? 00:01:57.599 --> 00:02:04.560 Which critical business services depend upon AI, and what happens if those AI services become unavailable tomorrow. 00:02:08.719 --> 00:02:14.479 If you're an internal auditor, this week's stories point towards three excellent audit opportunities. 00:02:14.800 --> 00:02:21.360 AI governance, machine identity management, operational resilience for AI-enabled services. 00:02:21.599 --> 00:02:25.120 These are rapidly becoming areas of regulatory interest. 00:02:25.360 --> 00:02:38.080 If you're a CISO, you should be looking at reviewing AI inventory, review privileged identities, review machine identities, review AI supplier dependencies, and review AI instant response plans. 00:02:42.960 --> 00:02:49.439 So in closing, artificial intelligence is changing every aspect of technology risk. 00:02:49.599 --> 00:02:54.719 Not just cybersecurity, not just cloud, not just identity, everything. 00:02:55.039 --> 00:02:59.360 The organizations that succeed won't necessarily be those with the most AI. 00:02:59.520 --> 00:03:05.840 They'll be those with the strongest governance, the strongest resilience, and the clearest understanding of risk. 00:03:07.120 --> 00:03:08.240 Thank you for joining me. 00:03:08.400 --> 00:03:09.280 I'm David Horn. 00:03:09.439 --> 00:03:12.080 This has been the Technology Risk Podcast sponsored by Cortix. 00:03:12.319 --> 00:03:17.520 Until next week, stay informed, stay resilient, and stay ahead of Technology Risk.