u/mike34113

It feels like a taboo to talk about such issues, and that is why relationships die

Yeah, pretty much. LLMs are poor at being security boundaries. Prompts are suggestions, not controls. You need runtime detection that works, not just guardrails that get bypassed within minutes. A good approach here would be to use third party guardrails like activefence. Started using it a month ago, pretty effective at catching prompt injection attempts

This is classic shadow IT plus zero guardrails. Lock purchasing behind one intake, require SSO for any new SaaS, and have Finance review card statements monthly for duplicate merchants. We’re using cato networks CASB and it helped us spot unsanctioned SaaS quickly so we could consolidate accounts fast.

Such a little cutie

honestly the supply chain stuff hit us hardest this year. had two incidents where dependencies pulled in sketchy code that our scanners missed initially. been looking into minimus for better sbom tracking since our current tooling is garbage at catching these early.

Block personal ChatGPT at the DNS level and whitelist only your company's approved domains. Set up web filtering rules to catch attempts at bypassing through proxies or alternate URLs.

Most firewalls can do category-based blocking for "AI/ML services" too. For tighter control, some SASE platforms like Cato have AISEC features to detect ChatGPT usage patterns in encrypted traffic and block accordingly.

We had the same overload until we started correlating vulnerability data with actual cloud context. Asset exposure, internet reachability and identity access all helped us reduce noise massively since we could see which risks were exploitable. Orca helped here since it visualized exposure across workloads not just listed CVEs.

you can create a simple checklist for each AI system: purpose, data sources, risk level, and access controls. This approach keeps things clear without drowning in paperwork. You can as well apply it consistently across all AI deployments.

looks so calm

Yep, renewal hikes like that are happening across vendors right now. Some of it is list price adjustments, some of it is partners passing along less discount than they used to. It’s worth getting a competitive quote or even pricing out new hardware plus multi-year support, since that can sometimes come in lower than just extending what you already have.

We ended up moving to Cato Networks’ SASE platform instead of riding the renewal rollercoaster. It simplified our firewall and subscription sprawl, and budgeting got easier because we weren’t dealing with unpredictable maintenance hikes every cycle.