We had a great discussion yesterday at #ZooSec. We talked about the impact of AI on the industry and how it might do newer generations a disservice, since they now have all the knowledge of the last 100 years accessible in their pockets. It feels like we were in the Information Age not that long ago, really only about 30-40 years, or so, around when the internet became accessible to the general masses. Did anyone else go dumpster diving for those 30-day free trial AOL CDs? ✋
Another topic we discussed was the proliferation of AI in vendor products, specifically, how AI features are being baked into products that may not necessarily need them, especially IoT devices like coffee makers, refrigerators, and washing machines. Questions were raised about the difference in capabilities between using an app like ChatGPT or Claude on the web versus accessing AI through a local harness such as Hermes or OpenClaw. A discussion followed about how a harness running on your own hardware can control your computer, assist you more directly, and integrate better with additional data sources. I shared that in my home lab, my AI agent can send me emails (not read my inbox) and triage security alerts and incidents in Microsoft Security.
My thoughts on the current AI landscape: individuals and organizations alike need to make a conscious effort to adopt AI capabilities thoughtfully, because doing it poorly can create more technical debt and put them at risk. For instance, the bar to create software has dropped drastically; a small organization, or even a single person, could theoretically build their own ERP or CRM software. But with software comes additional responsibility: patching it, and making sure your software bill of materials accounts for dependencies that could come back to bite you if a supplier is hit by a takeover or supply-chain incident. For this reason, I'd recommend organizations be mindful of what gets prioritized, built, and shipped, since this is a long-term commitment once a solution becomes something the business relies on. I recommend to look for local businesses that offer software maintenance services, vendors willing to maintain your code and secure the infrastructure it runs on. Or assign a small team the responsibility of developing, securing and maintaing new code.
What topic should we discuss next month? How OpenAI suddenly discovered that basic security controls matter?
🤙 Och0