u/alex_baeg

We went from "not using AI" to "we have 12 different AI tools" in just 6 months. Zero governance. Zero visibility. One person even had their ChatGPT account hooked up to our shared Slack.

Read this article afterwards and it basically validated every panic attack I had during that audit.

Here's the 5-point checklist I'm now forcing on every team before they spin up another AI tool:

1. Map the actual threat landscape - CISA breaks AI threats into three buckets: attacks using AI, attacks targeting AI, and plain old design failures. Most people only think about the first one. But prompt injection and training data poisoning? Those are happening now, and your traditional firewall isn't catching them.

2. Stop improvising and pick a framework - I used to wing it with a "common sense" approach. Don't. NIST's AI RMF (Govern → Map → Measure → Manage) gives you a structured way to evaluate risk instead of making it up as you go. Org respect a methodology, and more importantly, it covers your ass when something goes wrong.

3. Secure by Design, not by panic - Apply least privilege to AI agents like you would to any user account. If an AI tool gets compromised, how much damage can it do? Limit API access, define security requirements before deployment, and test before production. The number of clients I've seen give an AI tool full admin access "because it was easier" is terrifying.

4. You need AI-aware detection, not just rules - Rule-based tools can't catch AI-driven attacks. I'm not saying buy any specific product—do your own eval—but you need something that learns normal behavior and flags anomalies. Static rulesets will drown your SOC in false positives while the real threats slip through.

5. This isn't a "set it and forget it" thing - AI evolves weekly. I now schedule quarterly AI policy reviews with teams and reassess risk every time they add a new model or vendor. Each new tool brings unique security considerations that your existing policy probably doesn't cover.

Org are going to ask you about AI security. Having a real strategy beats throwing buzzwords at them.

What's the worst AI security gap you've found in a client's environment? I'm betting someone here has a story that tops mine.

Industrial contracting, somewhere between 800-1000 users and roughly 1200 devices. Hybrid Exchange environment, and I need to confess something: we're still doing manual PST-based contact syncing across 400+ accounts.

It started as a temporary workaround in 2019 (scheduled task, script written by a guy who left in 2021) and it never stopped being temporary. On-call rotations are where it really hurts - the on-call sheet changes Friday, the export doesn't, and two techs end up calling the wrong duty manager Saturday night. Ask me how I know.

At our scale it's genuinely unmanageable, and after-hours scenarios are a recurring nightmare.

For the other hybrid shops: what does your contact distribution to mobile actually look like in 2026? Syncing from on-prem AD attributes, cloud-side, are you also doing the PST walk of shame and just haven't been caught yet?

Every few months I get the same ticket: "My shared calendar disappeared from my iPhone again."
Re-accept the invite. Toggle sync. Remove and re-add the account. Sometimes it works for a week, sometimes a day, sometimes it breaks after the next iOS update.

Desktop Outlook? Fine. iPhone? Randomly empty. I've told users "it's an Apple/Microsoft thing" about 40 times now and I'm starting to feel like I'm making excuses for two billion-dollar companies.

The Outlook mobile app is the "official" answer but half my users refuse to switch because they want everything in Apple Calendar. So I'm stuck troubleshooting the same issue for the same people, repeatedly.

Q is anyone else facing this loop? Have you actually found a way to make shared calendars stick on iPhones, or is this just the eternal tax of managing a mixed ecosystem?

We’ve got people constantly calling/texting from mobile and it’s becoming obvious that “just search Outlook” is not a real solution for them.

We inherited a setup that mostly works, but every few weeks something breaks and somebody has to go babysit it. Starting to wonder if this is one of those things that just isn’t worth DIY-ing anymore.