u/amgfcbiozo

Third-party risk here, biotech, around 300 SaaS apps in the inventory. starting to think re-reviewing a vendor every time they bolt on AI is a hamster wheel. sub processor emails come in weekly now and half of them add some AI provider. a couple vendors had the feature switched on before the notice even hit my inbox. so the app i signed off on two years ago goes right back in the queue and the re-review is a questionnaire. they write "we don't train on your data," i can't check it, it goes in a folder. rinse and repeat. If a re review ever caught something the contract wouldn't have, i'd happily eat my words. am i wrong?

So apparently the new hotness in 2026 is securing one human in Chrome like it is a national critical asset. We have a managed browser, a security extension, a desktop security agent, an SSE network plane, and now vendors pitching a GenAI gateway on top. All to stare at the exact same user session like five mall cops trying to arrest one teenager for shoplifting a Twix. Each one wants its own policy, its own console, its own sso integration and of course its own monthly bill. As the lucky security architect, I now get to explain to the CISO where the SASE policy ends, where browser isolation/CASB starts, and where the LLM control marketing snuck in as a “pilot” is supposed to fit :/ Anyone else feel like we reinvented NAC, DLP and proxies but shoved them all into the browser and called it modern zero trust? Would love to hear stories

Ok so anyone else watching this go from ppl pasting stuff into ChatGPT to business teams spinning up their own AI tools and hooking them into Jira, Slack, Drive, APIs etc?

The bit im stuck on is what controls these things should get once they start touching company data. Owner, SSO/MFA, app review, least privilege... feels like these vibe-coded apps can show up after theyre already being used and auth can be pretty questionable :/

How are you deciding what access these apps should keep once theyre already connected to corp SaaS/data? Curious what policies or tooling others are using for Shadow AI governance.