Data & AI Mastery podcast

From Six Months to Three Hours: How AI Has Shrunk the Attack Window

0:00
42:38
Rewind 15 seconds
Fast Forward 15 seconds

👉 Discover how Cambridge Spark helps organisations build the data and AI capabilities needed to turn strategy into measurable impact: [cambridgespark.com](https://www.cambridgespark.com/?utm_campaign=6955829-Podcast%202024%20-%20Onwards&utm_source=Podcast&utm_medium=RSS)

Attackers now exploit a newly public vulnerability in under three hours. Six months used to be normal.

Your developers are shipping code with Claude Code and Codex. Your security teams were trained to look for error messages, and in some companies the AI security budget now sits with a chief AI officer rather than the CISO.

Ashish Rajan is CISO at TechRiot and author of AI Security Engineering, published by Wiley. He hosts the Cloud Security Podcast and the AI Security Podcast, and advises Fortune 500 companies on security.

Ashish gives you a practical way to decide which AI risks to accept, where to focus first, and what skills your security teams need next. You'll hear why the confidentiality, integrity and availability principles still hold. You'll also hear why a vibe-coded tool needs the same security thinking as any application once it touches production data.

This episode is for CISOs, CIOs, Chief Data and AI Officers, and the L&D leaders responsible for workforce upskilling during AI transformation. It suits anyone who wants an honest read on enterprise AI security from someone working inside it. If you want a vendor shortlist, this one isn't for you.

## Key Takeaways

- An agent asking for a password throws no error code. Ashish explains why judging intent in plain English breaks the traditional security playbook.

- A bank with 400+ applications can't secure them all on day one. Ashish shares how to pick the crown jewels and where compensating controls fit.

- Building your own security tool in two hours with Claude Code is easy. Maintaining it after the builder leaves for a better offer is the cost few teams plan for.

- A framework like NIST shows you have the basics covered. Ashish argues boards should ask their CISO a harder question: could you patch a critical flaw in under three hours?

## Chapter Markers

00:00 The three-hour exploit window

01:13 Ashish's start: a hacked Hotmail account

03:08 Why he wrote AI Security Engineering

05:28 Rewriting the book when agents arrived

07:02 Launching the AI Security Lab

08:08 First principles versus new AI risks

12:48 Who owns AI security

17:29 Advice for CEOs: protect the crown jewels

20:21 Workforce upskilling and build versus buy

23:52 Cross-functional security teams and harnesses

28:52 Personal apps versus enterprise tools

30:14 Offensive AI and the agentic SOC

33:39 Why frontier red-team models need a harness

35:57 From six months to three hours

37:00 Reasons for hope

37:34 The wake-up call that came and went

38:27 What boards should ask their CISO

41:28 Wrap-up

## Useful Links & Resources

- AI Security Engineering by Ashish Rajan (Wiley)

- Cloud Security Podcast and AI Security Podcast, hosted by Ashish Rajan

- Cambridge Spark data and AI training: https://www.cambridgespark.com

- Dr. Raoul-Gabriel Urma on LinkedIn: https://uk.linkedin.com/in/raoulurma

## Connect With the Show

- LinkedIn: https://www.linkedin.com/school/cambridge-spark/

- Website: https://www.cambridgespark.com

Who owns AI security in your organisation: the CISO, the CIO or a Chief AI Officer? Tell us in the comments. If your team has built its own security harness or tackled agent risk head on, we'd like to hear how it went.

Visit cambridgespark.com to transform your workforce with cutting-edge data and AI training. Subscribe so you never miss an episode.

#DataAndAIMastery #AISecurity #EnterpriseAI #CyberSecurity #CambridgeSpark

More episodes from "Data & AI Mastery"