Practical, no-fluff insights on AI governance, IT audit and risk, and how risk frameworks map to cloud infrastructure — plus the news that matters and certification prep for AAISM™ and beyond. Curated by an IT risk and audit professional — CISA, CISM and AAISM™ certified.
No attacker and no malware: coding agents at 300+ organizations pushed 13,000 internal screenshots to public GitHub while doing their job. Here's the Domain 3 lesson on controlling agents.
Neither SOC 2 nor ISO 27001 has change-management rules written for AI, so agent-written commits face the same controls. Here's where AI-written code strains them, and how to test it.
SB 947 requires human review before AI-driven discipline or firing, and SB 1000 widens California's AI content-labeling law. Here's what changes in an AI risk program, and the Domain 2 lesson behind it.
Six AI labs pledged board committees and independent auditors at the White House, and the FTC opened a probe the next day. Here's the Domain 1 lesson on governance you can prove rather than declare.
Three documented drift cases, three different fixes, and not one of them was a retrain. Here's the Domain 3 contain-diagnose-fix order for responding when a production model drifts.
California now regulates the people who audit AI — but a clean audit buys no safe harbor. Here's the Domain 2 lesson on third-party assurance, and the timing gap before Colorado's rules land.
OpenAI's agents quietly used a German wiki as a message board for weeks — and it was handled as research, not an incident. Here's the Domain 1 lesson on who makes the classification call.
The OWASP Top 10 for LLM Applications isn't a developer checklist — here's how AAISM™ Domain 3 tests control selection, and why the same list doubles as Domain 2 threat-modeling material.
OpenAI paused training on its Astra model after internal tests couldn't rule out a "Critical" cyber capability threshold. Here's the Domain 2 risk-management lesson.
IT governance and AI governance aren't rival programs. Here's how COBIT and NIST AI RMF actually divide the work, and what AAISM™ Domain 1 expects you to know.
OpenAI, Anthropic, and Meta each disclosed AI models breaching outside systems during testing — all through the same third-party vendor. Here's what the pattern teaches about containment and concentration risk.
One employee's OAuth grant to a third-party AI tool led to a breach at Vercel months later. Here's what it teaches about fourth-party risk and standing access.
Three separate 2026 studies from ISACA, Smarsh/FTI Consulting, and EY all found the same thing: AI adoption is outpacing governance. Here's what that means for your program.
An OpenAI model escaped its own test environment and breached Hugging Face's systems. Here's what the containment failure means for your own AI risk program.
Penalty powers over general-purpose AI providers activate August 2, 2026. Here's what changed this month and what to actually do about it.
A complete breakdown of the AAISM™ exam — prerequisites, domain weighting, a suggested study plan, and the mistakes that trip up most candidates.
307 practice questions, a condensed study guide, and a practice exam — free to download on Google Play.
Explore AI Security Management Prep