Instagram story viewer> @dastechnologypartners> Posts

Das Technology Partners

@dastechnologypartners

2.1K

followers

50

following

Empowering the modern digital enterprise to achieve more.

POSTS STORIES REELS TAGGED

Your org chart tells you who works for your company.

Your access chart tells you who can actually do something inside it.

Employees leave. Contractors rotate out. AI agents and integrations accumulate permissions. Service accounts outlive the systems they were created for.

And access rarely disappears as neatly as a name on an org chart.

The greatest privilege risk isn’t always who you’ve given access to. It’s who you’ve forgotten still has it.

When was the last time your organization audited the difference?

#Cybersecurity #IdentitySecurity #EnterpriseSecurity #AccessManagement by @dastechnologypartners

2

0

7 days ago

Imagine an AI identifying you as the plaintiff in a lawsuit you have nothing to do with.

Now imagine trying to correct it.

This week, a flood of people posted “I am Jane Doe” in solidarity with an anonymous plaintiff, hoping to protect her identity.

According to the Associated Press, one participant said an AI identified her as the very person everyone was trying to protect.

An effort to protect one person’s identity had apparently led an AI to implicate someone else.

There’s a technical problem underneath this called entity resolution: determining which real person a name or piece of information refers to.

Generative AI is designed to produce answers, and without appropriate safeguards, it can turn incomplete evidence into a convincing identification.

The result is false precision: an answer that sounds more certain than the evidence supports.

We don’t know why the AI made the reported identification. But the broader failure mode is well understood.

Now consider how businesses use AI.

Executive background checks. Vendor due diligence. Competitive intelligence. Candidate screening. Litigation research.

A fabricated association between someone and a lawsuit can influence a business decision before anyone verifies the facts.

Three practices belong in every organization’s AI governance framework:

1. Audit your AI identity. Ask major AI assistants about your company and leadership. Save inaccurate responses and repeat quarterly.

2. Require primary-source verification. Verify material claims against court records, corporate registries, and official sources. An AI-generated citation is not verification.

3. Maintain authoritative company information. Keep leadership biographies, corporate records, and official announcements current, giving AI systems reliable information to reference.

Fluent language isn’t verified intelligence.

A trustworthy AI system must recognize when the evidence doesn’t justify an answer.

#ArtificialIntelligence #EnterpriseAI #AIGovernance #ResponsibleAI #AIRisk by @dastechnologypartners

2

0

8 days ago

“We patched it.”

Good. Now answer the harder question:

Was anyone already inside?

That distinction became painfully real in September.

Attackers had reportedly been exploiting vulnerabilities in a widely used remote-access gateway for at least three weeks before public disclosure. Suspected state-sponsored actors used the access to establish persistence, harvest credentials and leave behind ways to return later.

Some of the traffic was disguised as something almost boring: requests for image files.

Malicious commands went in looking like routine web traffic. Fake “page not found” responses helped conceal what was happening.

Then came the patch.

A patch fixes vulnerable code. It doesn’t automatically remove a backdoor an attacker already installed. It doesn’t invalidate credentials they already stole. And it certainly doesn’t rewind three weeks of activity.

That’s why remediation and incident response are different disciplines.

One repairs the weakness.

The other determines whether the weakness was used.

The timing here makes that distinction especially uncomfortable. Before a fix was even available, government agencies and security firms were advising organizations to disconnect affected devices from the internet. After exploit code became public on September 29, mass exploitation reportedly began within minutes, with more than 20,000 exposed devices visible online.

After a critical internet-facing vulnerability is patched, ask:

“Did we verify that the system wasn’t compromised before we patched it?”

Then:

“Were credentials that passed through that system rotated?”

If the answers are “we updated the software” and “we’re not sure,” the incident may not be over.

A patch can close the vulnerability. It can’t erase what happened while it was open.

#Cybersecurity #CISO #EnterpriseSecurity #IncidentResponse #CyberRisk by @dastechnologypartners

2

0

9 days ago

540,000 keys were sitting in public code.

Not dead keys. Not historical artifacts.

Keys that still worked.

The typical one had been exposed for 784 days. The oldest had remained valid for 16 years.

In software, these are called secrets: API keys, access tokens, passwords and other credentials that let applications authenticate to databases, cloud services and each other.

And here’s the thing about secrets… they’re supposed to stay secret.

GitGuardian found 28.65 million exposed secrets across public code-sharing platforms in a single year, up 34%.

AI is adding an uncomfortable variable.

Code written with AI assistance has been found to expose secrets at roughly twice the rate of code written without it: 3.2% versus 1.5%.

And software production itself is accelerating dramatically. GitHub’s COO said the platform went from roughly 1 billion code updates across all of 2025 to 2.9 billion in a single month this past August, largely driven by AI-assisted development.

More code. Created faster.

More credentials created, copied, tested, embedded and forgotten.

An attacker doesn’t necessarily need to defeat your firewall or discover some brilliant zero-day vulnerability. Sometimes they just need a credential someone committed three years ago that still authenticates.

Here’s a useful question to take into your next technology or security meeting:

“When did we last scan our entire codebase for exposed credentials, and how old is the oldest active one we found?”

Then ask what happens after discovery.

Detection without rotation (invalidating the exposed credential and issuing a new one) leaves the door open.

The objective isn’t simply to find secrets.

It’s to make forgotten access expire faster than attackers can find it.

#Cybersecurity #ArtificialIntelligence #EnterpriseSecurity #SoftwareDevelopment #CISO by @dastechnologypartners

4

0

10 days ago

An AI benchmark score is only impressive if the model hasn’t already seen the exam.

That sounds obvious. The data says it isn’t.

Researchers studying MMLU, one of AI’s most widely used benchmarks, found signs of contamination in 29.1% of test questions.

Then they removed the contamination.

GPT-4o went from 88.0% to 73.4%.

And across every model tested, removing contamination produced a 14–17.5 point decline.

The score wasn’t entirely measuring what it appeared to measure.

A benchmark is supposed to measure whether a model can solve an unfamiliar problem. Once test material leaks into training data, part of what looks like reasoning may actually be recognition.

For businesses evaluating AI, this matters far beyond academic leaderboards.

If a vendor claims its model, agent, or application achieves 90% accuracy, ask:

Was the evaluation set completely held out from training and tuning?

Is the test representative of our actual workflows?

Can you run the model against questions or data we provide before deployment?

What happens to performance when prompts are reworded or edge cases are introduced?

Are we measuring the final production system, or quoting the underlying model’s benchmark?

Better yet, build a private evaluation set from real business scenarios and keep it out of the development process.

Then test again after every meaningful model, prompt, retrieval, or workflow change.

The real test of enterprise AI is performance on problems it couldn’t have memorized.

That’s where benchmark performance becomes enterprise reliability.

#ArtificialIntelligence #EnterpriseAI #GenerativeAI #AIEngineering #MachineLearning by @dastechnologypartners

2

0

10 days ago

During WWII, analysts studied the bullet holes on planes returning from combat.

The obvious conclusion?

Put more armor where all the holes are.

Makes perfect sense.

It was also completely backwards.

Statistician Abraham Wald noticed something everyone else was missing: they were only looking at planes that made it home.

A plane riddled with holes in its wings had just demonstrated that it could survive holes in its wings.

The planes hit in the truly catastrophic places?

They weren’t sitting in the hangar waiting to be measured.

They were missing from the dataset.

Nearly a century later, businesses make versions of this mistake constantly.

We devour case studies from successful companies and call them best practices.

Of course we do. The companies that disappeared don’t publish many case studies.

We survey customers and carefully analyze the responses.

The customer who quietly canceled, ignored the survey, and bought from your competitor contributes exactly zero rows to that analysis.

Then there’s AI.

Feed a model historical outcomes without understanding how those outcomes were selected, and the model can become exceptionally good at learning a pattern that was biased before training ever started.

Cybersecurity makes the problem even more uncomfortable.

Open your security dashboard.

Blocked attacks. Detected malware. Triggered alerts. Suspicious authentication attempts.

Beautiful.

Now show me the attacks you never detected.

You can’t.

Those are Wald’s missing planes.

So before asking what your data is telling you, ask something harder:

What had to survive, respond, succeed, get detected, or simply remain visible to become part of this dataset?

Sometimes the most valuable insight isn’t hiding inside the data.

It’s missing from it.

#DataStrategy #DataScience #ArtificialIntelligence #Cybersecurity #Analytics by @dastechnologypartners

4

0

18 days ago

The AI literacy gap most companies should worry about may not be on the front lines.

It may be sitting around the boardroom table.

A 2026 peer-reviewed pilot study found something worth paying attention to: board-level AI literacy averaged 2.50 out of 5, compared with 3.70 for executive AI competence. The gap was statistically significant.

Now consider where enterprise decision-making is headed.

Deloitte found 60% of executives already regularly use AI to support decisions. Gartner projects that by 2027, half of business decisions will be augmented or automated by AI agents.

That creates an unusual governance problem.

The people closest to AI are gaining experience quickly. The people charged with challenging how it’s being used may not be learning at the same rate.

And good oversight requires considerably more than knowing what an LLM does.

Can the board challenge where the underlying data came from?

Understand when human review is actually meaningful?

Interrogate model limitations?

Recognize automation bias?

Know when an AI recommendation shouldn’t become an executive decision?

You can delegate the analysis.

You can delegate the implementation.

You can even delegate the decision to a degree.

But you cannot delegate the accountability.

The next AI skills gap worth measuring starts at the top.

#ArtificialIntelligence #AIGovernance #BoardGovernance #EnterpriseAI #CorporateGovernance by @dastechnologypartners

3

0

19 days ago

AI has a communication problem.

It can be spectacularly wrong without sounding remotely uncertain.

That matters because humans are conditioned to read confidence as competence. A decisive employee, adviser, or expert usually knows something the hesitant person doesn’t.

AI breaks that heuristic.

A polished answer can contain a fabricated fact with the same composure, structure, and authority as a correct one. No nervous pause. No change in tone. No instinct telling it, I should probably check this.

And businesses are increasingly putting that output into consequential workflows.

EY surveyed 975 C-suite leaders and found 99% reported financial losses tied to AI-related risks. Nearly two-thirds reported losses above $1 million, with average losses of $4.4 million among affected organizations.

The governance problem isn’t simply hallucination.

It’s hallucination delivered with executive presence.

That changes how companies should design AI workflows.

Confidence of language shouldn’t determine confidence of action. High-impact outputs need evidence, traceable sources, defined escalation thresholds, and human review proportional to the consequence of being wrong.

AI can draft the answer.

Evidence should earn it the authority to become a decision.

#ArtificialIntelligence #AIGovernance #EnterpriseAI #ResponsibleAI #DataStrategy by @dastechnologypartners

3

0

21 days ago

“We have MFA.”

For years, that sentence has been treated like the end of the identity-security conversation.

It isn’t anymore.

Sophos found that when compromised credentials caused a ransomware attack, 97% of affected organizations already had MFA deployed in some form.

The attackers didn’t suddenly become better at guessing six-digit codes.

They changed the attack.

MFA fatigue turns the user into the bypass: send enough approval prompts and eventually someone accepts one.

Session-token theft is even more interesting. Instead of defeating authentication, the attacker steals the authenticated session that comes afterward. No new login required.

That distinction matters.

Sophos found identity-based vectors were behind roughly 79% of ransomware incidents, compared with 18% originating from exploited vulnerabilities.

None of this makes MFA obsolete. It makes the checkbox mentality obsolete.

MFA should be one layer alongside phishing-resistant authentication, conditional access, session protection, device trust, behavioral detection, and rapid token revocation.

Attackers didn’t defeat the front door. They learned they didn’t always need to use it. by @dastechnologypartners

3

0

21 days ago

The tax system held the tax data.

Until someone couldn’t access a file.

So they opened an IT ticket and attached the tax return.

Problem solved.

Except the tax return now existed somewhere the company’s data architecture probably never intended it to live.

That’s how sensitive data drifts.

Not through some sweeping decision to create a new repository. Through thousands of perfectly reasonable decisions made by employees trying to get work done.

A support ticket needs context, so someone attaches an ID scan.
Billing has a problem, so someone uploads account details.
An application fails, so a customer record gets dropped into the ticket.

The issue gets resolved.

The attachment stays.

Over time, a workflow platform quietly starts behaving like a data repository, except it may not receive the same classification, retention policies, access reviews, or scrutiny as the systems explicitly designed to hold sensitive information.

A 2026 breach involving a third-party support platform used by a major professional services firm’s tax practice showed what that can look like. Client tax documents and personal financial information had accumulated inside support tickets. When the platform was breached, people had information exposed through a system they had no direct relationship with and may never have known existed.

That’s an uncomfortable wrinkle in the way companies think about data governance.

A data inventory can correctly tell you where information is supposed to live while completely missing where employees have caused copies of it to accumulate.

And the broader exposure is growing. Verizon’s 2026 DBIR found third parties were involved in 48% of breaches, up 60% year over year.

The governance question, then, isn’t only:

“Which systems contain sensitive data?”

It’s also:

“Which workflows can create another copy?”

That second question catches an entirely different class of risk.

Because your architecture diagram documents the systems you designed.

Your employees’ workflows reveal the data environment you actually have.

#DataGovernance #Cybersecurity #DataSecurity #ThirdPartyRisk #EnterpriseSecurity by @dastechnologypartners

3

0

a month ago

The browser extension your employee approved six months ago may not be the extension running today.

That’s an uncomfortable sentence for anyone responsible for enterprise security.

We tend to treat extension approval like a completed transaction: review the permissions, click Allow, move on.

Software doesn’t stand still like that.

LayerX found that 34% of browser extensions expanded their permissions within a 12-month period. AI-labeled extensions were 6× more likely to do so.

And those permissions matter more now than they did a few years ago.

The browser has quietly become one of the richest data environments inside a company. Employees draft strategy in AI tools. Paste code. Review contracts. Analyze financials. Open customer records. Authenticate into critical applications.

An extension sitting inside that workflow can potentially occupy an extraordinarily privileged position.

Microsoft recently documented just how consequential that can become. Two Chrome extensions marketed around AI privacy and enhancement accumulated nearly 900,000 installs across more than 20,000 enterprise tenants.

They were exfiltrating complete ChatGPT and DeepSeek conversation histories to a remote server approximately every 30 minutes.

There’s something particularly instructive about the word privacy appearing on the product doing the exfiltrating.

But the larger lesson isn’t about two malicious extensions.

It’s about the expiration date on approval.

Security teams are accustomed to continuously reassessing users, devices, vulnerabilities, applications, and identities. Browser extensions deserve the same treatment. Inventory them. Watch permission changes. Remove abandoned extensions. Restrict high-risk capabilities. Know which ones can see authenticated sessions and AI conversations.

Because “we reviewed it” describes something that happened in the past. It tells you remarkably little about what the software can do today.

#BrowserSecurity #Cybersecurity #EnterpriseSecurity #AISecurity #DataSecurity by @dastechnologypartners

3

0

a month ago

A cloud breach can begin with one click:

PRIVATE → PUBLIC.

No malware. No stolen password. No attacker defeating the cloud provider’s security.

Just a perfectly functioning cloud environment doing exactly what someone configured it to do.

That distinction gets lost surprisingly often.

When a company moves infrastructure into the cloud, it transfers responsibility for enormous parts of the technology stack. The provider protects physical infrastructure, hardware, networking, and portions of the underlying platform.

But access controls? Permissions? Storage configuration? Identity policies?

A significant portion of that responsibility stays with the customer.

And cloud infrastructure is extraordinarily literal. Give the wrong identity access and it gets access. Expose a storage resource and it becomes exposed. Configure something incorrectly and the platform generally isn’t going to reinterpret your intentions for you.

That creates an unusual category of cyber risk: systems that can be technically functioning exactly as configured while being catastrophically wrong for the business.

It’s also why cloud security deserves more attention after deployment than it often gets.

Environments change. Permissions accumulate. Teams reorganize. Contractors come and go. New integrations appear. Temporary exceptions quietly become permanent architecture.

A configuration that made sense eighteen months ago may now be the weakest point in the environment.

The practical response isn’t particularly glamorous: continuously inventory cloud assets, identify anything publicly exposed, review privileged access, eliminate unnecessary permissions, assign ownership, and make configuration drift visible.

None of that requires waiting for an attacker to tell you where the problem is.

Some of the most valuable security work happens before there’s anything to investigate.

#CloudSecurity #Cybersecurity #CloudComputing #DataSecurity #EnterpriseSecurity by @dastechnologypartners

6

0

a month ago