The acting CISO: the weekly cadence that turns "you handle our security" into a job
A client says it in a kickoff call, a renewal meeting, or a ticket at 4:40 on a Friday: "You handle our security, right?" Say yes, and you may have accepted a job. Our read: nobody may have written th
Responses
Markdown supported · ⌘↵ to post
X1Y1
AI features that work in production. RAG, agents, MCP, cloud and security for startups.
One record type worth adding to the inventory step: AI tools with OAuth grants. Staff connect agents to Google Workspace, Microsoft 365 and GitHub on their own, and those grants often carry full mail or all-repo scope. They never show up as an internet-facing service, so a services-only inventory misses them. The weekly pull is cheap: export the third-party apps list from each tenant's admin console, then record app, account it acts as, scope, owner and last used, in the same YAML shape you suggest. Salt Labs' Manus research this month showed why: one email to a connected inbox reached the Gmail, Drive and GitHub tokens sitting in the same sandbox.