From Six Months to Three Hours: How AI Has Shrunk the Attack Window

👉 Discover how Cambridge Spark helps organisations build the data and AI capabilities needed to turn strategy into measurable impact: [cambridgespark.com](https://www.cambridgespark.com/?utm_campaign=6955829-Podcast%202024%20-%20Onwards&utm_source=Podcast&utm_medium=RSS) Attackers now exploit a newly public vulnerability in under three hours. Six months used to be normal. Your developers are shipping code with Claude Code and Codex. Your security teams were trained to look for error messages, and in some companies the AI security budget now sits with a chief AI officer rather than the CISO. Ashish Rajan is CISO at TechRiot and author of AI Security Engineering, published by Wiley. He hosts the Cloud Security Podcast and the AI Security Podcast, and advises Fortune 500 companies on security. Ashish gives you a practical way to decide which AI risks to accept, where to focus first, and what skills your security teams need next. You'll hear why the confidentiality, integrity and availability principles still hold. You'll also hear why a vibe-coded tool needs the same security thinking as any application once it touches production data. This episode is for CISOs, CIOs, Chief Data and AI Officers, and the L&D leaders responsible for workforce upskilling during AI transformation. It suits anyone who wants an honest read on enterprise AI security from someone working inside it. If you want a vendor shortlist, this one isn't for you. ## Key Takeaways - An agent asking for a password throws no error code. Ashish explains why judging intent in plain English breaks the traditional security playbook. - A bank with 400+ applications can't secure them all on day one. Ashish shares how to pick the crown jewels and where compensating controls fit. - Building your own security tool in two hours with Claude Code is easy. Maintaining it after the builder leaves for a better offer is the cost few teams plan for. - A framework like NIST shows you have the basics covered. Ashish argues boards should ask their CISO a harder question: could you patch a critical flaw in under three hours? ## Chapter Markers 00:00 The three-hour exploit window 01:13 Ashish's start: a hacked Hotmail account 03:08 Why he wrote AI Security Engineering 05:28 Rewriting the book when agents arrived 07:02 Launching the AI Security Lab 08:08 First principles versus new AI risks 12:48 Who owns AI security 17:29 Advice for CEOs: protect the crown jewels 20:21 Workforce upskilling and build versus buy 23:52 Cross-functional security teams and harnesses 28:52 Personal apps versus enterprise tools 30:14 Offensive AI and the agentic SOC 33:39 Why frontier red-team models need a harness 35:57 From six months to three hours 37:00 Reasons for hope 37:34 The wake-up call that came and went 38:27 What boards should ask their CISO 41:28 Wrap-up ## Useful Links & Resources - AI Security Engineering by Ashish Rajan (Wiley) - Cloud Security Podcast and AI Security Podcast, hosted by Ashish Rajan - Cambridge Spark data and AI training: https://www.cambridgespark.com - Dr. Raoul-Gabriel Urma on LinkedIn: https://uk.linkedin.com/in/raoulurma ## Connect With the Show - LinkedIn: https://www.linkedin.com/school/cambridge-spark/ - Website: https://www.cambridgespark.com Who owns AI security in your organisation: the CISO, the CIO or a Chief AI Officer? Tell us in the comments. If your team has built its own security harness or tackled agent risk head on, we'd like to hear how it went. Visit cambridgespark.com to transform your workforce with cutting-edge data and AI training. Subscribe so you never miss an episode. #DataAndAIMastery #AISecurity #EnterpriseAI #CyberSecurity #CambridgeSpark