The AI Vendor Security Questions Worth Asking
Most security questionnaires are long and answer nothing. Twelve questions get you further, if you read the replies properly.
Read essayField notes from real engagements. Frameworks, postmortems, and the unglamorous discipline of shipping AI in production.
Showing 1–8 of 8 essays
Most security questionnaires are long and answer nothing. Twelve questions get you further, if you read the replies properly.
Read essayThey are not being reckless. They are responding rationally to how your company treats the answer.
Read essayEvery AI system will produce a bad output eventually. The difference between an incident and a crisis is whether anyone decided in advance.
Read essayEnterprise risk registers are theatre for a 60-person company. Here is the version that actually gets used.
Read essayMost AI policies are copied from enterprise templates, filed, and ignored. A page that staff actually read prevents more incidents.
Read essayIT, legal and security all have a claim. Giving it to any of them produces a predictable failure, and so does giving it to all three.
Read essayYour staff are already using AI you did not approve. Here are four ways to find out what, without turning it into an investigation.
Read essayMost AI governance committees are formed to look responsible and end up slowing decisions without reducing risk. Here is what to do instead.
Read essay