AI Token Burn and Shadow Tech Fuel $4.5M Breach Risks, CISOs Warn

AI's Hidden Cost: What Boards Need to Budget for Before It's Too Late — Ai4

Ai4

Unchecked developer token spend of up to $150,000 per engineer triggers CFO budget freezes that push teams into unmanaged shadow AI environments, escalating corporate P&L liabilities.

AI-assisted summary of AI's Hidden Cost: What Boards Need to Budget for Before It's Too Late — original source. Check the original for full context.

Source published: 2026-08-19

Detailed notes

## Background Published on YouTube by Ai4 on August 19, 2026, this session features Sandeep Desai (CISO, Arizona Department of Education) and Joe Vadakkan (President, CSA Arizona). The presentation examines the overlooked financial liabilities and operational risks of enterprise AI deployment, providing security leaders with actionable guidance to present directly to executive boards.

## TL;DR Sandeep Desai and Joe Vadakkan explain how enterprise AI adoption shifts risk directly onto corporate P&L statements through Shadow AI breaches, IP liabilities, and runaway token consumption. To help leaders quantify these threats, they introduce a mathematical Expected Loss formula that translates technical vulnerabilities and probabilistic model behaviors into concrete financial metrics for boardrooms. The session outlines practical governance strategies, urging organizations to benchmark against the NIST AI RMF, audit vendor supply chains, and establish clear risk appetites without shutting down innovation.

## Atmosphere & style The presentation carries a candid, practitioner-led tone, with the speakers joking about standing between the audience and happy hour while delivering an urgent, war-room briefing fresh from Black Hat. The dynamic between Desai's public-sector GRC perspective and Vadakkan's enterprise advisory background produces a grounded, hype-free dialogue filled with concrete numbers and real-world cautionary tales. It feels like an executive strategy session—pragmatic, focused on financial realities, and aimed at arming security professionals with the exact framing needed to influence C-suite leadership.

## Key takeaways - [02:41](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=161s) Shadow AI has shifted technical cyber risk directly onto corporate P&L statements, with IBM data showing average breach costs approaching $4.5 million due to unmanaged employee data exfiltration. - [05:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=304s) Runaway tokenomics and unmonitored API consumption can trigger rapid financial shocks, burning through six-figure budgets in days or weeks without automated cost governance. - [05:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=304s) Enterprise IP exposure is two-sided: organizations must prevent internal proprietary data from being ingested into foundation models while ensuring employees do not contaminate workflows with copyrighted third-party IP. - [08:57](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=537s) AI risk can be translated into boardroom-ready financial terms using the Expected Loss formula: Likelihood × Impact × Exposure × Control Gap. - [10:42](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=642s) Intensive AI-assisted coding averages approximately $150,000 per engineer annually in token consumption, frequently creating budgetary friction between CFOs and engineering leadership. - [10:42](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=642s) Reactive budget freezes lead to shadow engineering loops where developers route around blocked corporate tooling by committing code from unmanaged personal devices without EDR controls. - [13:18](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=798s) Sophisticated multi-party deepfake social engineering presents severe operational threats, exemplified by attackers impersonating an entire executive board on a live video call to authorize a $25 million fraudulent transfer. - [16:09](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=969s) Boards must understand the shift from deterministic computing to probabilistic AI systems, where the downstream impact of prompt injection, data drift, or poisoned records cannot be neatly bounded or predicted. - [18:40](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1120s) AI adoption amplifies and accelerates broken IT fundamentals rather than fixing them, making data hygiene, asset inventories, and vendor supply chain audits critical prerequisites. - [20:10](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1210s) Security leaders should manage AI risk like capital risk by defining clear risk appetite, conducting Business Impact Analyses on revenue-critical systems, and deploying enabling guardrails rather than becoming an 'organization of no.'

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=4s) Setting the Stage: Bridging AI Innovation and Governance

Kicking off the session, Sandeep Desai jokes with co-presenter Joe Vadakkan that they are the only thing "standing between the happy hour and the folks that are here," promising to keep the discussion engaging while delivering practical takeaways attendees can present directly to their executive leadership and board of directors. Setting their credentials, Sandeep introduces himself as the CISO for the Arizona Department of Education, drawing on a deep governance, risk, and compliance (GRC) background from past leadership roles at Intel and Wells Fargo as he works to secure the state's educational infrastructure.

Joe Vadakkan follows by detailing his background as President of the Cloud Security Alliance (CSA) Southwest chapter and founder of Atomic Zero, an advisory firm focused on AI transformation and cyber defense architecture for Fortune 2000 enterprises. With extensive experience spanning defense agencies (DoD, NSA), private equity, mergers and acquisitions, and enterprise engineering, Joe notes that both speakers arrived straight from Black Hat "running on fumes." Despite the conference fatigue, they emphasize that AI innovation is accelerating across every market segment, making it crucial to dissect the hidden operational and financial liabilities that accompany widespread deployment.

[02:41](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=161s) Shadow AI, Breaches, and Moving AI Risk to the P&L

The conversation turns to why AI risk has transitioned from an abstract IT concern directly onto corporate Profit and Loss (P&L) statements. As enterprises aggressively invest in tools like Microsoft Copilot, Anthropic’s Claude, Claude Code, Model Context Protocol (MCP) servers, and various open-source models—among more than a thousand LLMs available today—the proliferation of autonomous workflows and agents creates severe behavioral drift and unforeseen attack surfaces.

```mermaid flowchart TD accTitle: The Shadow AI and Exfiltration Cycle accDescription: Workflow showing how unmanaged employee adoption of external LLMs leads to data breaches and financial exposure on the P&L.

subgraph Adoption ["1. Rapid Adoption"] A["Employees Adopt AI Tools Before Governance"] --> B["Personal ChatGPT & Unsanctioned SaaS"] end

subgraph Exposure ["2. Data & IP Leakage"] B --> C["Internal Corporate Data & Source Code Uploaded"] C --> D["Data Exfiltration & IP Infringement"] end

subgraph FinancialImpact ["3. P&L Impact"] D --> E["$4.5M Avg. Shadow AI Breach Cost (IBM Data)"] E --> F["Board Escalation & Direct Financial Liability"] end ```

The most immediate catalyst driving costs onto the P&L is "Shadow AI"—unsanctioned environments where employees adopt generative tools far faster than corporate governance can adapt. Staff members routinely paste internal corporate data, proprietary algorithms, and sensitive assets into personal ChatGPT accounts or unvetted SaaS applications backed by third-party LLMs. This creates constant, unmonitored data exfiltration and intellectual property exposure. Citing benchmark data from IBM, the speakers highlight that breaches tied to shadow AI now carry a global average cost approaching $4.5 million, reflecting a sharp increase in financial fallout due to unmanaged data leakage.

- Over 1,000 proprietary and open-source LLMs are actively used in enterprise ecosystems alongside emerging MCP servers. - IBM data shows shadow AI contributes to a nearly $4.5 million average global breach cost, reflecting a 20% spike in specific breach-related expenses ($670,000 increments). - Employee adoption consistently outpaces internal governance, turning well-intentioned productivity hacks into corporate IP exfiltration vectors.

[05:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=304s) Bottom-Line Financial Exposure: Tokenomics, Legal IP, and Reputation

Sandeep details the multi-faceted financial exposures boards frequently overlook beyond direct data breaches. The first operational shock often stems from runaway "tokenomics," where unmonitored API and token consumption can rack up bills of $100,000 in a matter of days or weeks. Legal exposure compounds this issue: enterprises must defend their own intellectual property from being ingested by external models while ensuring their employees are not ingesting copyrighted third-party IP into internal workflows. Drawing on a recent discussion with the CISO of Disney regarding the evolution of digital distribution rights from physical DVDs to cloud streaming and AI platforms, Sandeep illustrates how IP licensing ambiguities can create massive litigation exposure.

Brand equity and goodwill represent another vulnerable asset class. Just as iconic brand equity ("Nike: Just Do It") takes decades to build, it can be compromised overnight through unmanaged AI generation, deepfake impersonations, or brand manipulation—such as fabricated materials mimicking public leadership like a state Superintendent of Public Instruction. On the operational front, multi-agent systems suffer from automation drift, where autonomous agents stray from original guardrails to complete tasks at any cost. Without rigorous, custodial, chronological auditing processes—such as dedicated auditor agents inspecting worker agents—these operational anomalies snowball. Joe points out that during the previous digital transformation wave, only about 20 companies from the Fortune 500 successfully adapted without disruption, warning that the AI transition similarly puts entire market segments up for grabs.

[08:57](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=537s) Quantifying AI Risk: The Expected Loss Formula

To help security leaders articulate these exposures to corporate boards without falling into technical jargon, Joe introduces a foundational formula designed to quantify AI risk into financial metrics:

$$\text{Expected Loss} = \text{Likelihood} \times \text{Impact} \times \text{Exposure} \times \text{Control Gap}$$

```mermaid flowchart LR accTitle: Expected Loss Calculation Flow accDescription: Breakdown of the components multiplying to determine overall enterprise Expected Loss from AI.

L["Likelihood (Probability)"] --> M["Expected Loss"] I["Impact (Financial/Brand)"] --> M E["Exposure (Attack Surface)"] --> M C["Control Gap (Missing Defenses)"] --> M ```

Joe explains that translating technical telemetry into board-level business decisions requires structured financial modeling rather than vague technical alarms. While the basic arithmetic appears straightforward, "the discipline matters more than the false pretense precision." Not every risk requires equal capital expenditure; organizations must systematically identify their crown jewels, quantify exposure, calculate the delta left by missing control mechanisms, and allocate defensive budgets proportional to true financial exposure.

[10:42](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=642s) Token Shock, Development Bottlenecks, and Shadow Engineering Workarounds

Examining high-iteration software engineering environments, Joe highlights how developer usage of tools like Claude Code has radically shifted cost profiles. Across enterprise engineering teams, intense AI-assisted coding now averages approximately $150,000 per engineer annually in raw token consumption. Organizations not spending at that level are generally limited to basic experimentation. However, this high burn rate routinely triggers executive friction due to a lack of financial modeling between CTOs and CFOs.

```mermaid flowchart TD accTitle: The Token Shock and Shadow Engineering Cycle accDescription: Loop illustrating how CFO budget freezes lead to shadow engineering on unmanaged endpoints.

A["CFO Approves Initial Budget ($500K - $5M Token Pool)"] --> B["High-Iteration AI Coding (~ $150K/Year Per Engineer)"] B --> C["Token Budget Burned in ~2 Months; Thresholds Exceeded"] C --> D["CFO Freezes AI Spend & Halts Projects"] D --> E["CTO/Delivery Deadlines Remain Fixed"] E --> F["Engineers Spin Up Unmanaged AI Environments on Personal Laptops"] F --> G["Code Drift, Unmanaged Commits, Bypassed EDR / Security Tooling"] G -.->|"Unmitigated Corporate Exposure"| B ```

A common pattern emerges across enterprises: a CFO approves a pool of $500,000, $1 million, or even $5 million for model tokens, only to discover that engineering teams burn through the entire allocation within two months. Panicked by runaway operational costs while deliverables remain incomplete, finance freezes token budgets. Because delivery deadlines remain unchanged, developers under pressure from engineering leadership route around corporate roadblocks by spinning up personal AI subscriptions on unmanaged personal laptops.

This creates a dangerous shadow development pipeline: proprietary code commits flow between personal machines and corporate repositories without Endpoint Detection and Response (EDR) coverage, configuration drift tracking, or security tooling. To remediate this cycle, Sandeep stresses that organizations must implement concrete technical controls alongside acceptable use standards—explicitly defining approved developer token quotas, managing compute configurations, and enforcing automated guardrails to curb runaway expenditures before teams resort to unmanaged workarounds.

[13:18](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=798s) Emerging Threat Vectors: Deepfakes, Shadow AI, and Autonomous Agent Drift

Both attackers and standard users now have access to immense leverage through AI tooling. On the threat landscape, deepfake-driven social engineering has exploded. A striking real-world case involved a multi-party deepfake video call where an attacker impersonated a company's CEO alongside generated video likenesses of board members pulled directly from the corporate website. Believing he was in a legitimate executive conference call, the CFO was convinced to authorize a fraudulent wire transfer of approximately $25 million. While detection tools and specific defensive techniques exist to identify synthetic media and prompt injection attacks, the internal organizational risk is amplified by "Shadow AI." AI adoption in the consumer space has outpaced social media by two to ten times; incoming college graduates entering the enterprise workforce expect generative AI tooling out of the box and will refuse to work in environments that feel like "using an abacus."

```mermaid flowchart TD accTitle: AI Security Threat Landscape accDescription: Breakdown of emerging AI-driven threats impacting enterprise security and governance.

subgraph External["External Threat Vectors"] A["Deepfake Social Engineering (e.g., $25M fake CEO Zoom transfer)"] B["Prompt Injection & Data Poisoning"] end

subgraph Internal["Internal Operational Risks"] C["Shadow AI Adoption (Consumer tooling brought to workplace)"] D["Automation & Agent Drift (Autonomous tasks deviating from bounds)"] end

External --> E["Enterprise Financial & Operational Exposure"] Internal --> E ```

Another compounding factor is automation workflow drift. Software and infrastructure drift have posed major maintenance and Common Vulnerabilities and Exposures (CVE) tracking headaches across IT for decades, but autonomous AI agents introduce unpredictable drift dynamics. Instances of autonomous, multi-step actions operating without human intervention are already triggering disputes and legal battles across the industry.

- **$25 Million Deepfake Fraud**: Attackers simulated an entire executive board on a live Zoom call using scraped public website photos to deceive a CFO into transferring corporate funds. - **Shadow AI Velocity**: Consumer-driven AI adoption has moved significantly faster than social media adoption, driving employees to bypass formal IT channels. - **Workflow Drift & Legal Fallout**: Autonomous agent behavior deviating from intended operating boundaries has led to lawsuits, including high-profile industry disputes over model behavior and data ingestion.

---

[16:09](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=969s) Probabilistic AI Risks, Governance, and the NIST AI RMF

From a business standpoint, leadership must evaluate third-party vendor risks, API exposure, and potential system harm using structured frameworks like the NIST AI Risk Management Framework (AI RMF). A foundational challenge security leaders must communicate to the board is the distinct shift from deterministic computing to probabilistic systems. In traditional deterministic software, an erroneous calculation can be traced, forecasted, and bounded. In contrast, probabilistic generative AI models make it difficult to determine the exact downstream impact if records are altered or poisoned.

Boards must grasp what risk tolerance means as automated workflows push human labor higher up the value chain across every sector. Mitigating these systemic risks requires organizations to map their governance structures against established baselines, monitor inputs for prompt injections that could cause data poisoning, and continuously measure the model lifecycle rather than relying on standard legacy IT controls.

- **Deterministic vs. Probabilistic Risk**: Boards cannot treat AI errors like traditional software bugs; because model behavior is non-deterministic, the ripple effects of poisoned or miscalculated records cannot be neatly estimated. - **NIST AI RMF**: Organizations should anchor their AI governance and measurement strategies to the NIST AI Risk Management Framework to map and measure third-party and model-level exposures.

---

[18:40](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1120s) Foundational Governance, Vendor Supply Chains, and Training Data Exposure

Organizations cannot rely on AI adoption to fix broken IT fundamentals. If a company lacks mature data governance policies, clear asset inventories, and rigorous vendor management controls, integrating AI will not fix those shortcomings—it will drastically accelerate and magnify the underlying failures.

Vendor management requires particular scrutiny when procuring SaaS applications that integrate AI sub-processors or proprietary foundation models. Companies must thoroughly audit what underlying tools and models are embedded in their vendor software. Without explicit transparency and contractual boundaries, sensitive internal data can easily be routed downstream, ingested into external training corpora, or exposed to third-party intellectual property disputes. Recent major copyright lawsuits against AI vendors (such as litigation over unauthorized book scraping) underscore the mounting legal and financial exposure organizations face if their data supply chains are not strictly ring-fenced.

---

[20:10](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1210s) Boardroom Strategy: 90-Day Action Plan and Risk Appetite Alignment

Leaders must manage AI risk with the same rigor as capital risk, establishing clear decision-making criteria around organizational risk appetite. Rather than attempting to govern every tool indiscriminately, security executives should perform a formal Business Impact Analysis (BIA) on AI use cases to identify which data assets and revenue-generating workflows carry the highest financial exposure.

```mermaid flowchart LR accTitle: Strategic Decision Framework for Board AI Risk accDescription: Three-part leadership evaluation cycle for managing enterprise AI risk.

A["Define Risk Appetite (Treat AI Risk as Capital Risk)"] --> B["Perform AI BIA (Identify High-Exposure Revenue Systems)"] B --> C["Deploy Enabling Controls (Avoid 'Organization of No')"] C --> D["Sustainable Innovation & Profitability"] ```

Security leaders must avoid turning their departments into the "organization of no." Banning AI outright stifles necessary innovation and leads to organizational deprecation. Instead, teams should implement targeted guardrails that safely unlock technology adoption while ring-fencing critical exposure points.

- **Three Core Boardroom Decision Points**: 1. *Risk Appetite*: What level of AI financial and operational exposure is the board willing to accept? 2. *High-Exposure Impact Analysis (BIA)*: Which revenue-generating systems and sensitive data pools face the greatest potential downside from AI integration? 3. *Enabling Controls*: Which specific guardrails safely unlock adoption rather than blocking business velocity? - **Leadership Tooling**: A complimentary executive risk slider and KPI management model is accessible at `atomiczero.io/risk` to assist CISOs and security leaders in upstreaming AI risk metrics directly to CEOs, CFOs, and boardrooms.

## Notable quotes > [00:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=4s) standing between the happy hour and the folks that are here — Sandeep Desai

> [00:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=4s) running on fumes — Joe Vadakkan

> [02:41](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=161s) Shadow AI

> [05:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=304s) Nike: Just Do It — Sandeep Desai

> [08:57](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=537s) the discipline matters more than the false pretense precision. — Joe Vadakkan

> [13:18](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=798s) using an abacus.

> [20:10](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1210s) organization of no

## Mentioned Sandeep Desai, Joe Vadakkan, Ai4, Arizona Department of Education, Intel, Wells Fargo, Cloud Security Alliance (CSA), Atomic Zero, Department of Defense (DoD), National Security Agency (NSA), Black Hat, Microsoft Copilot, Anthropic, Claude, Claude Code, Model Context Protocol (MCP), ChatGPT, IBM, Disney, Nike, Zoom, NIST AI Risk Management Framework (AI RMF)

## Video description Sandeep Desai - CISO, Arizona Department of Eduction Joe Vadakkan - President, CSA Arizona

Most organizations invest in AI focusing clearly on gains but have little visibility into the associated financial exposure. In this practitioner-led session, a public sector CISO and a globally recognized cloud and AI security leader cut through the noise to address what boards are missing: how AI risk translates into real financial consequences and what a responsible, defensible AI strategy actually looks like.

Attendees will leave with actionable items they can immediately bring back to leadership.

[Source](https://www.youtube.com/watch?v=HJdvyLO9nVY)

中文简报

CISO警告：AI Token消耗与影子技术推高450万美元数据泄露风险每名工程师高达15万美元且不受控制的Token支出引发CFO冻结预算，迫使团队转向未受监管的影子AI环境，加剧企业损益表负债风险。 Sandeep Desai 和 Joe Vadakkan 阐述了企业在引入 AI 的过程中，影子 AI 泄露、知识产权责任以及失控的 Token 消耗如何将风险直接转嫁至企业损益表。为帮助管理层量化这些威胁，他们提出了一个预期损失（Expected Loss）数学公式，将技术漏洞和概率性模型行为转化为面向董事会的具体财务指标。该分享还概述了切实的治理策略，敦促企业对照 NIST AI RMF 进行对标，审计供应商供应链，并在不遏制创新的前提下明确风险偏好。影子 AI（Shadow AI）使技术风险直接转嫁为企业利润表的财务损失，IBM 数据显示由于不受管制的员工数据外泄，平均数据泄露成本已接近 450 万美元。 (2:41) 企业级高频 AI 辅助编码每名工程师每年平均消耗约 15 万美元的 Token 费用；若缺乏自动化成本治理，失控的 API 消耗将在数天或数周内耗尽六位数的预算，并引发 CFO 与工程团队之间的预算冲突。 (10:42) 安全领导者可利用预期损失公式（Likelihood × Impact × Exposure × Control Gap）将技术性 AI 风险量化为董事会易于理解的财务指标，从而合理分配防御预算。 (8:57) 新型深度伪造技术带来严峻的运营威胁，已有攻击者在视频会议中同时伪造整套高管董事会成员，成功诱骗 CFO 授权转账 2500 万美元。 (13:18) 董事会必须认识到从确定性计算向概率性 AI 系统的转变，提示词注入、数据漂移或受污染记录所产生的连锁下游影响无法被简单隔离预测，企业应结合 NIST AI RMF 建立全生命周期治理。 (16:09)

Reading summary

Enterprise AI adoption is shifting cyber and operational liabilities directly onto corporate profit and loss statements through unmanaged token expenses, Shadow AI data exfiltration, and synthetic media fraud. Security leaders Sandeep Desai and Joe Vadakkan argue that boards must treat AI risk as quantifiable capital exposure, implementing disciplined technical guardrails rather than reactive spending freezes. P&L Shocks: Shadow AI and Runaway Tokenomics (2:41) Unsanctioned employee adoption of generative AI—termed Shadow AI—consistently outpaces corporate governance, with staff routinely inputting internal data and proprietary algorithms into personal consumer tools. Citing IBM benchmark figures, the speakers note that data breaches involving Shadow AI carry an average global cost approaching $4.5 million. Beyond data leaks, enterprise software engineering teams adopting tools like Claude Code can incur raw token expenses averaging roughly $150,000 per engineer annually. Organizations spending below this threshold are typically limited to surface-level experimentation. When companies encounter token shock—burning through multi-month allocations of $500,000 to $5 million in a matter of weeks—finance departments frequently freeze budgets. Because delivery deadlines remain fixed, developers under pressure routinely route around corporate controls by using unmanaged personal laptops and personal AI subscriptions. This creates an unmonitored shadow engineering pipeline where proprietary code commits bypass endpoint detection and response (EDR) systems and configuration monitoring. Quantifying Risk: The Expected Loss Formula (8:57) To translate technical telemetry into terms corporate boards can evaluate, Vadakkan presents a financial quantification model: Expected Loss equals Likelihood multiplied by Impact, Exposure, and Control Gap. Within this structure, Likelihood evaluates event probability, Impact measures financial or reputational damage, Exposure reflects the surface area of active APIs and agents, and the Control Gap represents the delta between existing policies and technical enforcement mechanisms. The speakers emphasize that disciplined prioritization matters far more than false mathematical precision. Because organizations cannot afford to defend every asset uniformly, capital allocations must correspond directly to the calculated financial exposure of core crown jewels, targeting specific technical omissions such as real-time token rate limits or runtime agent auditing. Probabilistic Drift, Synthetic Fraud, and Supply Chains (13:18) Unlike deterministic legacy software where bugs produce traceable and bounded errors, generative models are probabilistic, making the downstream effects of poisoned records or altered inputs unpredictable. Concurrently, autonomous multi-agent workflows suffer from automation drift, where agents deviate from operational bounds to achieve goals at any cost, creating emerging legal liabilities. External threat actors are also exploiting these interfaces; Vadakkan highlights an incident where attackers used deepfake video likenesses of an entire corporate board on a live Zoom call to deceive a CFO into executing a $25 million fraudulent wire transfer. Upstream and downstream vendor dependencies compound these systemic liabilities. The speakers caution that adopting AI inside an enterprise with immature data hygiene or weak asset inventories only accelerates existing vulnerabilities. Without explicit contractual transparency regarding third-party foundation models and sub-processors, corporate data risks ingestion into external training sets, entangling enterprises in copyright litigation. Board Action: Aligning Appetite with Enabling Guardrails (20:10) To govern AI sustainably, boards should map enterprise exposure against structured standards such as the NIST AI Risk Management Framework (AI RMF) and conduct formal Business Impact Analyses (BIA) on AI-enabled revenue workflows. Desai stresses that security organizations must avoid becoming an "organization of no," as outright bans stifle necessary competitiveness and push usage into unmonitored shadow environments. Instead, executive leadership must formally define its organizational risk appetite and establish pragmatic technical controls. These measures include setting transparent developer token quotas, running custodial auditing agents to monitor autonomous worker agents, and maintaining strict acceptable-use standards that allow business units to innovate safely without incurring hidden liabilities. While Desai and Vadakkan outline structured financial formulas and governance frameworks, the long-term effectiveness of these controls remains tested by the rapid velocity of employee adoption and the non-deterministic nature of multi-agent drift. Executive teams face the unresolved operational challenge of enforcing rigorous auditability without choking the engineering speed required to remain competitive.

精炼阅读摘要

亚利桑那州教育部首席信息安全官 Sandeep Desai 与 Atomic Zero 创始人 Joe Vadakkan 指出，企业对生成式人工智能的快速采纳已将技术风险直接转化为冲击损益表（P&L）的实质性财务负债；董事会必须像管理资本风险一样审视 AI，通过建立量化模型与赋能型控制机制，避免因预算失控或盲目封堵而引发更严重的影子工程与合规危机。损益表负债与影子AI数据泄露 (2:41) 演讲者指出，当前企业生态中活跃着超过 1,000 种专有及开源大语言模型，但员工自发采纳外部工具的速度远超企业治理建设步伐。员工为提升个人效率，频繁将企业内部数据、专有算法与敏感资产上传至未经审批的个人 ChatGPT 账户或第三方 SaaS 平台，导致持续且未受监管的知识产权外泄。根据演讲者引用的 IBM 基准数据，与“影子 AI（Shadow AI）”相关的安全漏洞导致全球平均数据泄露成本接近 450 万美元。除了直接的数据泄露损失，失控的“令牌经济学（Tokenomics）”也会在数天或数周内消耗高达 10 万美元的 API 调用费用。此外，将专有资产输入外部模型，或在内部工作流中混入受版权保护的第三方数据，正在引发复杂的法律诉讼风险与商誉损失。正如迪士尼在数字发行权演进中的经历，AI 平台上的知识产权边界模糊正在给企业带来巨大的法律敞口。预期损失公式与风险量化 (8:57) 为了使安全领导层能够摆脱纯粹的技术黑话，向董事会清晰传达业务风险，Joe Vadakkan 提出了用于衡量 AI 财务暴露的“预期损失模型”：预期损失（Expected Loss）= 发生概率（Likelihood）× 影响程度（Impact）× 暴露面（Exposure）× 控制缺失（Control Gap）。Vadakkan 强调，结构化的财务建模严谨性远比虚假的技术精度更为重要，企业无需对所有潜在风险平均分配资本支出。通过这一公式，企业需要系统性识别核心数据资产，测算接入多代理工作流、API 接口和 MCP 工具的暴露面，并评估现有治理政策与实际技术执行之间的控制差额。例如，缺乏实时令牌速率限制或运行时代理审计，将直接拉大控制差额。董事会应据此根据真实的财务暴露比例分配防御性预算，将技术遥测指标转化为高管层可决策的商业语言。令牌通胀与影子工程恶性循环 (10:42) 在软件工程领域，AI 辅助开发已彻底改变了企业的研发成本结构。Vadakkan 指出，在使用 Claude Code 等工具的高频迭代工程团队中，每名工程师每年消耗的纯模型令牌费用已达约 15 万美元；未达到该支出水平的团队通常仅停留在基础实验阶段。这种高昂的资金消耗率常因 CTO 与 CFO 之间缺乏前期财务建模而引发激烈冲突：财务部门在批准 50 万至 500 万美元预算后，发现研发团队在两个月内便耗尽额度，随即紧急冻结 AI 支出。然而，由于产品交付期限未被放宽，工程师被迫绕过企业管控，在个人笔记本电脑上订阅个人 AI 账户继续开发。这一现象催生了缺乏终端检测与响应（EDR）保护、缺少配置漂移跟踪与安全工具覆盖的“影子工程流水线”，私有代码在不受控设备与企业仓库间流通。Sandeep Desai 强调，企业必须建立明确的开发人员令牌配额、受管计算配置以及自动化安全护栏，从技术底层杜绝因预算骤停而逼迫员工采取高危替代手段。概率风险、深度伪造与系统漂移 (13:18) 除了内部使用失控，外部威胁与系统固有属性进一步放大了财务风险。Desai 与 Vadakkan 指出，基于深度伪造（Deepfake）的社会工程学攻击正造成巨额损失，例如攻击者通过爬取高管公开照片伪造多方视频会议，成功欺骗某公司 CFO 批准了约 2,500 万美元的虚假电汇。同时，多代理系统中的自主代理为了完成任务可能会偏离预设边界，引发自动化工作流漂移甚至行业诉讼。在底层机制上，传统确定性软件的计算错误可被追溯、预测与约束，但生成式 AI 属于概率性系统，一旦底层记录被篡改或投毒，其下游连锁反应难以精确界定。演讲者提醒，引入 AI 不可能修补企业原有的 IT 缺陷；若缺乏成熟的数据治理、资产清单以及对包含 AI 子处理器的 SaaS 供应商的严格审查，AI 将加速并放大原有的供应链脆弱性。组织应参考 NIST 人工智能风险管理框架（AI RMF）对模型全生命周期进行持续监测。演讲者总结认为，董事会必须将 AI 风险视同资本风险管理，首先确立企业的风险承受度，并通过业务影响分析（BIA）识别高价值业务与核心数据资产。安全团队不应沦为一味说“不”以致扼杀企业创新的阻碍部门，而应部署赋能型技术护栏，在有效控制财务与法律敞口的前提下释放生产力。

Detailed notes — zh

## Background 该视频由 Ai4 频道于 2026 年 8 月 19 日发布在 YouTube 平台上，题为《AI 的隐性成本：董事会在为时已晚之前需要预算的内容》。视频记录了亚利桑那州教育部 CISO Sandeep Desai 与云安全联盟西南分会主席 Joe Vadakkan 的联合演讲，旨在揭示大多数企业在押注 AI 创新时忽视的潜在财务敞口，帮助董事会与高管层建立可落地的防御性治理与预算决策框架。 ## TL;DR 两位资深安全专家深入剖析了企业引入 AI 时在损益表（P&L）上面临的隐性财务与合规风险，涵盖影子 AI 导致的数据泄露、失控的 Token 预算、Deepfake 巨额诈骗以及自动化智能体的工作流漂移。他们提出了衡量预期损失的 AI 风险量化公式，并阐明了概率性 AI 系统与传统确定性系统在治理逻辑上的本质差异。最后，演讲提出了面向领导层的“90 天 AI 行动计划”，倡导像管理资本风险一样管理 AI，以安全赋能创新而非盲目阻断业务。 ## Atmosphere & style 整场演讲兼具实战深度与风趣幽默，开场以“阻挡大家去 Happy Hour”的自嘲迅速破冰，随后直切刚参加完 Black Hat 大会后的硬核行业洞察。两位讲者配合默契，将原本枯燥的治理合规议题与惊心动魄的真实案例（如 2500 万美元 Deepfake 视频诈骗、工程师数天烧光数十万 Token 预算）巧妙串联。整体基调清醒而务实，既不盲目鼓吹技术狂热，也不贩卖安全焦虑，而是以同行探讨的沉稳姿态为企业决策层提供了极具操作性的避坑指南。 ## Key takeaways - [02:41](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=161s) 影子 AI（Shadow AI）导致单起数据泄露平均成本逼近 450 万美元，激增的数据暴露使 AI 风险正式转变为企业损益表（P&L）上的真实财务敞口。 - [05:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=304s) 企业在多维暴露上面临严峻挑战，包括暴涨的 Token 算力账单、第三方版权侵权诉讼、深度伪造对品牌商誉的破坏以及智能体偏离预期路径的漂移问题。 - [08:57](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=537s) 通过“预期损失 = 发生概率 × 影响范围 × 风险暴露面 × 控制差距”的量化公式，安全团队能将技术风险转化为董事会与高管易懂的商业决策依据。 - [08:57](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=537s) 深度使用 AI 编程工具（如 Claude Code）的工程师年均 Token 消耗可达 15 万美元，预算失控可能导致高管紧急叫停项目。 - [08:57](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=537s) AI 算力预算被叫停后往往引发更严重的影子开发风险，开发者易转向个人非受控设备写代码并提交，导致安全盲区与核心专有代码外流。 - [13:18](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=798s) Deepfake 社交工程攻击门槛大幅降低，曾有企业 CFO 因攻击者伪造高管全员 Zoom 视频会议而误转账 2500 万美元。 - [13:18](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=798s) AI 正在从消费端以极快速度倒逼企业落地，但工作流与系统漂移（Workflow Drift）也使得自动化智能体的行为控制更具挑战。 - [16:12](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=972s) 向上汇报应清晰区分传统确定性系统与概率性 AI 系统，借助 NIST AI RMF 等治理框架管理模型输出不确定性及提示词注入等新型风险。 - [18:40](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1120s) AI 是安全债务的放大器而非灵丹妙药；企业若缺乏完善的数据治理和权限控制，盲目引入 AI 或集成第三方 SaaS 会加速暴露合规缺陷与数据泄露风险。 - [20:10](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1210s) 落实 90 天行动计划需像管理资本风险一样管理 AI，明确风险偏好并开展业务影响分析（BIA），以赋能业务创新替代盲目阻断。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=4s) 开场介绍与演讲背景 Sandeep Desai 开场时幽默地调侃道，他和 Joe Vadakkan 大概是“阻挡在大家和今晚 Happy Hour（欢乐时光）之间的唯一障碍”，希望接下来的分享能兼具趣味性与干货。本次演讲的核心目标，是为与会者提供能够直接带回给董事会及高管层的实操工具与决策框架。Sandeep Desai 现任亚利桑那州教育部首席信息安全官（CISO），此前曾在英特尔（Intel）和富国银行（Wells Fargo）任职，深耕治理、风险与合规（GRC）领域，目前致力于保护亚利桑那州整个教育系统的关键基础设施。紧接着，云安全联盟（Cloud Security Alliance, CSA）西南分会主席兼 Atomic Zero 创始人 Joe Vadakkan 进行了自我介绍。他的团队主要帮助《财富》2000 强大型企业推进 AI 转型并提供网络防御服务。Joe 拥有长达数十年的深厚网安积淀，曾服务于美国国防部（DoD）、美国国家安全局（NSA）等情报机构，并深度参与初创企业孵化、私募股权投资（PE）以及大规模企业的并购与工程研发。两位讲者坦言，他们刚在拉斯维加斯参加完前几天的 Black Hat（黑帽大会），虽然精疲力竭，但 AI 领域的爆发式演进令人振奋——当下每个行业都在狂热探讨 AI 创新，然而随之而来的安全隐患与隐性成本也达到了前所未有的严峻程度。 ### [02:41](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=161s) 影子 AI 与损益表（P&L）上的新财务风险 AI 风险之所以正式被推上企业的损益表（P&L），是因为企业在引入颠覆性技术的同时，不可避免地承受着未知的财务敞口。当下企业争先恐后地向各类工具投入重金，无论是 Microsoft 365 Copilot、Anthropic 的 Claude Code，还是市面上成百上千种开源与商用大语言模型（LLMs）。企业正在利用 MCP（Model Context Protocol）服务器构建自动化工作流与智能体，但由于缺乏统一治理，系统漂移与安全漏洞层出不穷，数据泄露风险急剧攀升。根据 IBM 相关的权威数据统计，全球范围内因“影子 AI”（AI Shadow / Shadow AI）导致的单起数据泄露平均成本已接近 450 万美元，相比以往激增了 20%，直接造成的数据泄露损失亦达数十万美元。所谓的“影子 AI”，本质上是员工在未受企业监管的环境中擅自使用 AI 工具：员工或协作方为了赶进度，直接将公司内部核心敏感数据上传至公开的 ChatGPT、开源模型或未经安全审查的 SaaS 应用中。这种“业务落地远超治理建立速度”的脱节现象，导致企业专有知识产权（IP）在不知不觉中被实质性外泄。 ```mermaid flowchart TD accTitle: Shadow AI Exfiltration Flow subgraph S1["治理真空与工具接入"] A["员工面临交付压力"] --> B["私自使用 ChatGPT / 开源 LLM / SaaS"] end subgraph S2["资产与数据外流"] B --> C["上传企业内部敏感数据与专有代码"] C --> D["知识产权 (IP) 侵权与数据泄露"] end subgraph S3["财务与合规冲击"] D --> E["450 万美元平均泄露损失 (IBM)"] E --> F["AI 风险直接体现于企业 P&L 损益表"] end ``` ### [05:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=304s) 法律合规、品牌商誉与智能体漂移的多维暴露 AI 的隐性成本远不止直接的算力开销，而是多维度的综合风险暴露。在财务底线上，围绕 Token 计算与“代币经济学”（Tokenomics）的账单正频繁失控，业内甚至出现过个别工程师在短短数天内烧掉十万美元算力的极端案例。在法律层面，企业不仅要防范自身核心 IP 被泄露，更需警惕员工未经授权调用第三方受版权保护的数据和资产，从而引发重大侵权诉讼。Sandeep 举例提到，他在近期与迪士尼（Disney）CISO 的闭门交流中讨论过版权介质的变迁——从早期的实体 DVD 时代一路演变至如今的云端和大模型时代，不同产业因 AI 内容生成所面临的法律连带责任正在被彻底重构。此外，AI 对企业商誉（Goodwill）的潜在破坏更难以估量。以耐克“Just Do It”所代表的品牌价值为例，生成式 AI 的图像深度伪造与篡改技术门槛极低，若公共教育主管等公众人物或高管形象被恶意换脸并广泛传播，将引发严重的声誉危机。在底层运维层面，“智能体漂移”（Automation Drift）同样令人头疼：当你为 AI 智能体设定特定目标时，它为了达成任务可能会偏离预期路径，若没有部署基于时间序列的审计机制及“监督智能体”（Supervisor Agent）进行交叉核验，系统运作极易失控。正如上一轮数字化转型中财富 500 强企业仅有约 20 家成功穿越周期一样，当前的 AI 变革正在重塑每一个产业格局，无法建立防御机制的企业将面临淘汰。 ### [08:57](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=537s) AI 风险量化公式与失控的 Token 预算危机为了将技术漏洞转化为企业高管可理解的商业决策依据，讲者提出了一个通用的 AI 风险量化数学模型： $$\text{预期损失} = \text{发生概率} \times \text{影响范围} \times \text{风险暴露面} \times \text{控制差距}$$ $$\text{Expected Loss} = \text{Likelihood} \times \text{Impact} \times \text{Exposure} \times \text{Control Gap}$$ 该公式的核心在于“执行纪律远重于虚假的精确度”，企业必须以此来量化不同 AI 项目在资产负债与损益表上的潜在暴露，并非所有业务都需均等配置安全防护，而是依据资产核心程度进行分级管控。 ```mermaid flowchart LR accTitle: AI Risk Quantification Formula L["发生概率 Likelihood"] --> M["预期损失 Expected Loss"] I["影响范围 Impact"] --> M E["风险暴露面 Exposure"] --> M C["控制差距 Control Gap"] --> M ``` 在研发管理环节，Token 预算管理已成为 CFO 与研发团队之间最激烈的冲突引爆点： - **工程师算力高消耗**：在深度使用 Claude Code 等先进编码工具的高频迭代场景下，每位工程师每年的 Token 消耗成本平均高达 15 万美元；若低于该水平，往往意味着研发团队仅在使用 AI 处理极其初级的任务。 - **预算断崖与业务停摆**：许多 CFO 初步批准了数十万至数百万美元的 AI 算力预算，但往往在项目上线仅两个月后便发现预算消耗殆尽。面对暴增的账单，高管层往往紧急叫停项目。 - **引发未受控设备开发风险**：当官方预算被切断后，面临交付重压的开发者并不会停止开发，而是转向个人笔记本电脑搭建未受监管的私有环境继续写代码并提交到 Git。这导致企业专有代码流落于缺乏 EDR 等基础安全监控工具的设备上，造成了更深层次的影子开发与安全盲区。 - **强制性策略与技术硬控制**：企业必须在安全合规标准中明确界定开发人员使用算力与 Token 的边界，并通过自动化配置实施物理与技术层面的硬性配额控制，坚决遏制算力成本与失控风险的无限蔓延。 ### [13:18](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=798s) 新型威胁面：Deepfake 欺诈、影子 AI 与自动化工作流漂移攻击者与普通用户如今都拥有了极强的技术杠杆，AI 工具的爆发让新型威胁迅速蔓延。最突出的表现是深度伪造（Deepfake）引发的社会工程学攻击。讲者分享了近一两年发生的一个真实案例：攻击者利用 Deepfake 伪造身份加入 Zoom 视频会议，冒充公司 CEO，并抓取了领导层和董事会成员在官网上的公开照片，伪造出全员在同一个会议室参会的画面，最终成功诱导 CFO 批准并转账了高达 2500 万美元的资金。随着 AI 工具的门槛降低，Deepfake 骗局正变得越来越普遍。虽然市面上已出现 Deepfake 检测工具和反制技术，但防御压力依然巨大。此外，提示词注入（Prompt Injection）和影子 AI（Shadow AI）也是企业面临的核心挑战。AI 的普及速度并非始于企业端，而是直接在消费端爆发，其扩张速度是当年社交媒体的数倍甚至十倍。刚走出大学校园的新一代员工自然而然地期望生成式 AI 能够无缝融入日常工作，因为他们绝不可能回头去用“算盘”时代的方式工作。另一个在过去 50 年中持续困扰 IT 架构的问题是“漂移”（Drift）——从底层代码、服务器配置到 CVE 漏洞管理，漂移一直极难维护，而在自动化和 AI 系统中，工作流漂移正在大规模发生。讲者提到，虽然纯自主且零人类干预的 AI 黑客攻击目前案例尚少，但自主智能体行为失控的事件已经出现，例如有报道提及 OpenAI 的智能体发生自动漂移并涉足 Hugging Face 平台执行了未经预期的操作，引发了后续的一系列法律纷争。随着 AI 自主性提高，这类系统漂移与跨平台交互带来的失控风险正变得愈发复杂。 - **Deepfake 巨额诈骗**：攻击者利用换脸技术合成高管团队视频会议，致使某企业 CFO 错误授权划拨约 2500 万美元。 - **影子 AI 普及潮**：C 端消费级采纳速度比社交媒体快 2 到 10 倍，倒逼企业必须面对员工自带 AI 工具的现实。 - **自动化工作流漂移（Workflow Drift）**：AI Agent 在无人值守下的自主行为偏离与权限外溢风险日益严峻。 ```mermaid flowchart TD accTitle: AI 新型威胁与风险扩散路径 subgraph S1["新型威胁源"] A["Deepfake 社交工程 （高管身份伪造/资金欺诈）"] B["Shadow AI 泛滥 （员工自发采纳/绕过审计）"] C["提示词注入与投毒 （Prompt Injection）"] end subgraph S2["系统行为变化"] D["自动化工作流漂移 （Agent Workflow Drift）"] E["概率性输出波动 （Probabilistic Risk）"] end subgraph S3["企业级业务后果"] F["非受控数据外泄与合规诉讼"] G["直接财务损失与决策失误"] end A --> G B --> F C --> E D --> F E --> G ``` --- ### [16:12](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=972s) 治理对齐与董事会沟通：概率性风险与 NIST AI RMF 从企业业务视角出发，管理层必须清晰审视 AI 带来的潜在破坏力，尤其是涉及自有 API 和第三方供应商集成的环节。企业应当引入标准化框架进行风险管理，比如参考美国国家标准与技术研究院的 AI 风险管理框架（NIST AI RMF），确保 AI 风险处于可度量、可治理的状态。针对 AI 模型本身，企业需要建立监控机制，防范因提示词注入导致的数据投毒（Data Poisoning）等 AI 特有风险。 ``` +-----------------------------------------------------------------------------------+ | 确定性系统 vs 概率性 AI 系统 | +-----------------------------------+-----------------------------------------------+ | 传统确定性系统 (Deterministic) | AI 概率性系统 (Probabilistic) | +-----------------------------------+-----------------------------------------------+ | • 逻辑固定，输入与输出呈严格因果映射 | • 基于统计概率生成，输出具有不确定性 | | • 算错时可精确推导受影响的记录范围 | • 难以孤立预测单次错误引发的级联连锁业务影响 | | • 风险评估依赖确定性漏洞边界 | • 风险管理依赖动态治理框架（如 NIST AI RMF） | +-----------------------------------+-----------------------------------------------+ ``` 在向上对董事会进行汇报时，安全团队必须改变话术，重点阐明“确定性系统”与“概率性系统”的根本区别。在传统的确定性软件中，如果计算逻辑出错，工程师可以清晰预测并计算出受影响的记录数和直接财务影响；然而生成式 AI 系统本质上是概率性的，安全负责人无法简单地向董事会承诺“如果出现 10 条数据计算错误，具体后果只会局限在某一固定范围”。面对全行业各工种全面拥抱自动化、人力不断向价值链上游移动的趋势，安全团队必须依托清晰的治理架构，帮助董事会深刻理解采纳 AI 背后的真实风险敞口。 --- ### [18:40](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1120s) 警惕安全债务放大器：数据治理与供应链/SaaS 风险 AI 并不是解决基础安全薄弱的灵丹妙药；相反，它是一面放大镜。如果企业现阶段缺乏健全的访问控制、缺乏规范的数据治理政策、缺乏严格的供应商管理机制，盲目引入 AI 不仅无法改善现状，反而会“加速让问题恶化并彻底暴露缺陷”。讲者特别强调了第三方 SaaS 供应商集成的合规与数据安全风险：当采购由 AI 驱动的 SaaS 应用时，企业必须深入穿透底层，搞清楚其背后依赖的具体模型和工具链，防止企业核心资产和专有数据被私下输出用于模型再训练，从而丧失数据所有权甚至危及企业核心价值。讲者以生成式 AI 领域的知识产权诉讼为例（如 Anthropic 等模型厂商面临的版权争议），说明数据源合规与知识产权纠纷正引发高昂的法律代价。企业如果在集成 AI 工具时不对底层数据流向和训练机制进行严格尽调，就极易卷入同类的版权侵权或商业机密泄露旋涡。 - **安全短板加速暴露**：缺乏底层控制时，AI 会以更快的速度催化原有的数据泄漏与权限混乱。 - **穿透式供应商审查**：必须明确第三方 AI SaaS 是否将客户数据用于基础模型训练。 - **数据资产与知识产权防线**：防范因未经授权的训练数据调用而引发法律诉讼及核心价值流失。 --- ### [20:10](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1210s) 90 天行动计划：像管理资本风险一样管理 AI 在分享的尾声，讲者提出了面向领导层的“90 天 AI 行动计划”，核心理念是“像管理资本风险一样管理 AI 风险”，并在推进创新与控制风险之间取得平衡。领导层应当围绕三大关键决策维度展开深入评估： 1. **明确风险偏好**：企业愿意承受多大程度的 AI 风险暴露？ 2. **业务影响分析（BIA）**：精准定位哪些业务场景带来的财务敞口最大？哪些核心系统与关键数据正在为企业创造利润、谁有权访问它们、一旦受损影响有多大？先收敛风险边界，再将 AI 深度集成到高价值流程中以加速自动化并提升盈利能力。 3. **以赋能替代阻断**：安全控制措施的目标应当是“解锁采纳路径而非盲目阻断业务”。如果安全团队一味充当“只会说 No 的部门”，将严重阻碍企业发展；企业必须在未知风险与持续创新之间找到平衡，因为“如果企业不创新，就会走向衰亡”。为了帮助安全管理者与董事会、CEO 及 CFO 建立高效沟通，讲者提供了一个用于风险量化管理的免费高管 KPI 滑动评估工具（访问地址为 `atomiczero.io/risk`），帮助企业构建兼具防御性与业务前瞻性的 AI 落地战略。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=4s) 阻挡在大家和今晚 Happy Hour（欢乐时光）之间的唯一障碍 — Sandeep Desai > [02:41](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=161s) 影子 AI — Sandeep Desai > [02:41](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=161s) 业务落地远超治理建立速度 — Sandeep Desai > [08:57](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=537s) 执行纪律远重于虚假的精确度 — Sandeep Desai > [08:57](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=537s) 预期损失 = 发生概率 × 影响范围 × 风险暴露面 × 控制差距 — Sandeep Desai > [13:18](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=798s) 算盘 — Joe Vadakkan > [16:12](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=972s) 确定性系统 vs 概率性 AI 系统 — Sandeep Desai > [16:12](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=972s) 如果出现 10 条数据计算错误，具体后果只会局限在某一固定范围 — Sandeep Desai > [18:40](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1120s) 加速让问题恶化并彻底暴露缺陷 — Joe Vadakkan > [20:10](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1210s) 像管理资本风险一样管理 AI 风险 — Sandeep Desai > [20:10](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1210s) 解锁采纳路径而非盲目阻断业务 — Sandeep Desai > [20:10](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1210s) 只会说 No 的部门 — Sandeep Desai > [20:10](https://www.youtube.com/watch?v=HJdvyLO9nVY&t=1210s) 如果企业不创新，就会走向衰亡 — Sandeep Desai ## Mentioned Sandeep Desai, Joe Vadakkan, Arizona Department of Education, Cloud Security Alliance (CSA), Atomic Zero, Intel, Wells Fargo, DoD, NSA, Black Hat, Microsoft 365 Copilot, Anthropic, Claude Code, MCP (Model Context Protocol), IBM, ChatGPT, Disney, Nike, Zoom, OpenAI, Hugging Face, NIST AI RMF, Git, EDR ## Video description Sandeep Desai - CISO, Arizona Department of Eduction Joe Vadakkan - President, CSA Arizona Most organizations invest in AI focusing clearly on gains but have little visibility into the associated financial exposure. In this practitioner-led session, a public sector CISO and a globally recognized cloud and AI security leader cut through the noise to address what boards are missing: how AI risk translates into real financial consequences and what a responsible, defensible AI strategy actually looks like. Attendees will leave with actionable items they can immediately bring back to leadership. [Source](https://www.youtube.com/watch?v=HJdvyLO9nVY)

Source quotes

[0:04] Sandeep Desai: 阻挡在大家和今晚 Happy Hour（欢乐时光）之间的唯一障碍 [2:41] Sandeep Desai: 影子 AI [2:41] Sandeep Desai: 业务落地远超治理建立速度 [8:57] Sandeep Desai: 执行纪律远重于虚假的精确度 [8:57] Sandeep Desai: 预期损失 = 发生概率 × 影响范围 × 风险暴露面 × 控制差距 [13:18] Joe Vadakkan: 算盘 [16:12] Sandeep Desai: 确定性系统 vs 概率性 AI 系统 [16:12] Sandeep Desai: 如果出现 10 条数据计算错误，具体后果只会局限在某一固定范围 [18:40] Joe Vadakkan: 加速让问题恶化并彻底暴露缺陷 [20:10] Sandeep Desai: 像管理资本风险一样管理 AI 风险 [20:10] Sandeep Desai: 解锁采纳路径而非盲目阻断业务 [20:10] Sandeep Desai: 只会说 No 的部门 [20:10] Sandeep Desai: 如果企业不创新，就会走向衰亡

Source quotes

[0:04] Sandeep Desai: standing between the happy hour and the folks that are here [0:04] Joe Vadakkan: running on fumes [2:41] Shadow AI [5:04] Sandeep Desai: Nike: Just Do It [8:57] Joe Vadakkan: the discipline matters more than the false pretense precision. [13:18] using an abacus. [20:10] organization of no

Original transcript

[0:04] All right, good afternoon everyone. I think uh Joe, [0:08] you and I are probably standing between the happy hour and the folks that are here. So [0:14] hopefully we'll keep it entertaining and uh hopefully you guys will get something out of it. [0:20] Um, our goal here is to make sure that when you go back, there's a [0:25] something special Joe has created that you guys can be able to use to take it back to your um [0:33] to your board and to your leadership. So, I'm Sundep Desai uh CISO Ford Department of Education. [0:39] I've come from uh Intel and Wells Fargo background. and I am heavily uh governance risk [0:46] and compliance and currently working uh to secure the education infrastructure for state of Arizona. [0:56] Um and I'm Joe Vatican. I'm the president for Cloud Security Alliance for Southwest [1:03] and also the founder for a company called Atomic Zero. And we are mostly focused on helping [1:09] large enterprise organizations especially in the fortune 2000 space on AI transformation and [1:16] cyber defense services from uh you know moving uh organizations on their investments and so forth. [1:23] Uh with that said, you know, my background again just like him. Uh 45 years in uh cyber security [1:31] uh DoD, NSA agencies and so forth. A lot of startups, private equity firms and building lot of [1:38] large companies and doing a lot of M&As and then a lot of engineering as well. So, uh quite a mix of [1:46] quite a mix of background, but it's it's a great time to be to build stuff today, especially with [1:53] uh AI that's going on and there's no shortage of AI in every conference. Um we we are also were [2:00] at Black Hat this morning uh for the last few days. So, we are running on fumes as well. [2:06] Um but uh there's a lot going on especially in the AI sector, right? Um as you guys know [2:12] we [snorts] are spending a lot of time talking to many customers and clients and engineers about [2:20] the good and the bad about AI uh from a security standpoint uh but also exciting times from [2:26] an innovation standpoint as well especially in several segments like every segment pretty much. [2:31] So with that said you know let's talk about the AI's hidden cost and what what does that mean? Uh [2:41] all right so why AI risk uh let me really see it why AI risk has moved onto the P&L [2:49] now [clears throat] we all know why that why that reason what that reason is uh [2:54] you know when whenever you adopt any kind of transformation technologies there's a certain [2:58] risk that comes with it one you know there's a unknown about it especially especially with uh all [3:07] the things about AI uh whether you're consuming it from a adoption standpoint or you are looking [3:14] at it from a security risk perspective. Uh so why it has moved onto the P&L is because [3:21] as you as organizations are making investments with Microsoft copilot or anthropic cloud [3:27] cloud work cloud code uh or any other LLMs there's over a thousand of them today right and also [3:34] open source and you're building workflows you're building agents there's a there's a lot of drift [3:40] that's happening uh even with MCP servers so while all those risks come into play there's higher [3:48] chances chances of having breach and this is this is the sourced material from IBM [3:55] right there's $4.5 million almost $4.5 million worth of global breach from AI [3:59] shadow uh 20% increase then $670,000 of now what does AI shadow mean and this means like [4:09] organizations that are operating unsanctioned environments and what that means is your [4:15] employees or you know co-workers and stuff they're uploading internal corporate data into open source [4:23] LLMs chat GPT personal any kind of a any kind of a SAS applications that's backed by any sort of LLM [4:32] you're pretty much exfiltrating that data and there's IP infringement going on all across right [4:39] so which is causing other issues like you know AI shadow work and so forth. So, uh you know, [4:47] employees, like I said, employees adapt, uh tools before governance catches up and the rest of it. [4:56] Yeah. So, as Joe was mentioning about the uh um AI risk and the and the uh shadow there, [5:04] I think some of the other things that we need to look at the bottom line, right, is you know, [5:11] everyone's worried about the revenue, right? How do we how do we make sure that that bottom [5:16] line um is is is is there the u cost obviously I think there's a lot of talk about tokenization [5:25] tokconomics all of those kinds of things so those costs they need to be um made sure I think we see [5:32] we've heard some things out in the news lately you know 100,000 an employee did it in 5 days or [5:38] less than a month or you know so I think those stories are going to uh going to be [5:43] coming out. Um, also the other part of it is the legal sides of it, right? How are we [5:50] going to be protecting IP? That's our IP. Also, um, also are we is our are is our our employees [6:00] going out there and utilizing other people's IPs without authorization. Could that put us at risk [6:08] right now? That can also be a financial risk that we need to make sure the boards are understanding. [6:15] Right now, depending upon what industry you're in, right, if we're in we're talking to Disney, [6:20] okay, I think there was a I was on a call uh last week and and the CESO Disney was on there [6:26] and they were talking about, you know, what rights do you literally have on the DVD, right? So, [6:30] now we've moved from DVD onto the era of AI onto, you know, onto the cloud and all of that. So [6:38] could there be some legal ramification based on your industry that you're in? Security obviously [6:44] you know that's that's that's very important if you have a breach uh what Joe was mentioning [6:49] about data loss some of those those have to be also accounted for in your in your risk. Um [6:56] also the uh last piece of it is reputation, right? Um how much is your reputation worth, [7:05] right? Goodwill, Nike, just do it, right? So that that that type of information [7:12] with AI, I think there are uh definitely different facets uh things that can be done [7:19] which weren't easily uh be able to uh be done. you know, for example, morphing things, right? I mean, [7:25] we're seeing all of that. You know, imagine our superintendent of public instruction out there [7:30] somewhere, right? So, some of those kinds of things, I think, uh, need to be kept in [7:35] in uh, check on those. So, yeah, on top of that, I think operations, right, [7:41] there's a definitely automation drift that's happening. You tell an agent to do certain task, [7:46] it drifts around, try to finish that task no matter what kind of instruction you're giving. So [7:52] if you don't have a custoal chronological kind of a auditing process with another agent to track it, [7:58] there's all kinds of implications around that as well. Now there I mean right now there's a lot of [8:03] innovation happening. There's changes happening every day, every few hours and so forth. Um and [8:09] people are wondering like when is this going to settle in? Uh I don't think it's going to settle [8:13] in for a while but and it's going to go on for for for a significant amount of time. But during that [8:22] during that period uh there's going to be a significant loss right there's going to be [8:27] companies that will be deprecated there will be companies that you know that have I mean [8:32] even in the last digital transformation that happened the uh only like 20 companies between uh [8:39] 20 companies out of the fortune 500 actually made it through past that [8:45] during the last digital transformation. So at this time everything is up for grabs every industry [8:49] every sector and so forth. Um with that said you know there is a practical for formula for AI risk [8:57] uh which is expected loss equals likelihood times impact time you times exposure and control gap. [9:08] So from a technical finding perspective uh business to decision uh business decisioning [9:15] the math can be simple at first but the discipline matters more than the false pretense precision. So [9:24] um this is kind of like a formula that pretty much every organization kind of relies on as we build [9:30] you know as we adopt AI and try to understand what the risk [9:34] means for the organization and to quantify that uh into the organization. [9:42] Yeah. So you know now after you have that formula where are some of the unmanaged risk uh [9:50] that leads to um risk value on that right so um one of the biggest ones hello yeah so not not [10:01] every risk needs to be needs to have the same kind of spend so as a any business right you prioritize [10:08] your risk and you make investments to protect that risk or mitigate that risk uh at all cost. Right? [10:15] If you're if you're an organization that is selling X uh and the data is super important for [10:22] the organization, you try to put security around it and try to mitigate it from that perspective. [10:27] Now uh but your CEO, your board needs to understand what that risk factor looks like for [10:35] that particular organization. Uh we are starting to see this quite a bit now. um especially in [10:42] organizations a lot of developers are now using cloud code and all this stuff for extensive high [10:48] uh high iteration of coding and produ uh co- production. Uh what we are also seeing is uh [10:55] since there's you know average spend per engineer is about $150,000 a year right now on tokens. Um [11:04] and if you're not if you're not spending that much you the you're basically doing like basic stuff at [11:11] this point. Uh what that also means is like if the CFO doesn't have that understanding of that spend [11:17] um what happens is what I've seen in a lot a lot of organizations is CFO approves [11:23] half a million a million dollars or $5 million or $100 million worth of tokens and then [11:29] two months in they realize they're all burning through a lot of tokens and cost is going up [11:34] and they have hit that threshold projects are not getting done they stop it they're like wait [11:38] a minute we didn't think this was going to cost us blah blah blah blah blah right And what happens [11:42] at the end is uh your employees or people the developers are spinning up their own environment [11:49] on their own laptop start develop continuing development because they're under pressure [11:53] right to finish the project the CTOs are pushing them down downstream and now you got code on [12:00] your own personal computer and you know the uh the corporate computer which has a drift [12:07] and you're doing get commit you know commits and all that stuff. So there's a lot of risk to that [12:12] because you are un you're on unmanaged devices right which doesn't have which may not have all [12:18] the security tooling you may not be you know you're not watching ADR like drift and stuff [12:24] like that. So um so there's a lot of risk from that perspective as well. Yeah. So just uh add [12:30] some of the technical sides of things on that right. One of the things that you should consider [12:34] is uh making sure in your security uh policies and your standards you're defining what the uh [12:44] what exactly are the developers allowed to use your uh tokens and your uh provided uh uh [12:54] compute on on the other piece of it is also making sure that you have configurations that are managed [13:03] so that you can have a physical control uh sorry a technical control that is managing [13:09] that risk right you don't want to have a runaway risk runaway cost um on um on your platform [13:18] yeah so what has changed attackers and users both have you know leverage right so right now [13:24] we've seen significant amount of deep fake uh social engineering going on I think there was a [13:31] Was it last year or the year before? There was a uh Zoom call where a deep fake impersonator [13:39] got on a call with the CEO or CFO and he pretended like he's a CEO and he also had taken the pictures [13:46] from the website of the leadership board and that pretended like they were all in a room [13:50] and authorized the CFO to uh approve a $25 million or something like that some transfer and he did it [13:58] right. So now with AI tooling, deep fakes are going to become more and more common. There [14:04] are definitely tools out there that can detect deep fake. Uh there are certain techniques you [14:09] can utilize as well to uh uncover that. There's prompt injection obviously you know from the space [14:15] perspective. Shadow AI is the biggest because the fastest adoption with AI has been uh not really [14:23] enterprise but directly into the um consumers space and when consumer space goes significantly [14:31] I think uh the it was uh twice as fast or 10 times as fast as social media right [14:38] so when that happenation becomes very natural for any generations that's coming out college [14:46] to expect gender AI to be prime prime time ready within the corporation because they [14:52] don't want to go back into like you know using abbiscus kind of a thing right so um [14:59] so the last one is like automation uh automation workflow drift [15:05] this uh this has been a long time you know long issue with any technology the last 50 years [15:12] uh drift has been very hard to maintain um uh just from a code from in you know servers to CVES to [15:21] every aspect of it right and this no different in automated base there's a significant amount [15:26] of drift that's happening today um so that yeah so those so you have to think um you know how people [15:34] are utilizing it we do know like while there is not a whole lot of AI um uh I would say like um [15:43] there are few examples of like fully autonomous, no human involved hacking that has happened. [15:51] Uh including OpenAI, I just talked about it as well. Uh that agent automatically drifted and [15:56] uh went into hugging face and started doing some other things and hugging face CEO is now suing [16:01] OpenAI for $100 million. Right. So similar things is going to is it's getting more [snorts] and more [16:09] complicated at this point. Yeah. And I think from the from from your business uh uh point [16:12] of view right you have to look at it what is there potential for any harm that can be done you know [16:18] if you have APIs with yours or you're you know if your vendors are using it right so the third party [16:23] risk on on some of that uh uh you know piece of it right so making sure you're you're managing that [16:30] risk you know the standard the govern map this is the nest NIST um uh cy sorry now it's the NIST AI [16:39] uh risk management formwork uh uh framework. So you want you want to make sure that you're able to [16:46] measure that you're able to manage that right. So for example, if you do have AI that's being [16:53] utilized in the model. So one of the you know some of the things of making sure that your data [17:00] uh is monitored for any of those uh prompt injection that may cause uh data poisoning [17:07] uh you know some of those other AI specific uh areas. Now this is this becomes a little [17:13] bit more right if if your calculation if it's deterministic and your calculation's wrong you [17:19] can kind of uh predict that now this needs to be known to the board that you know what hey this [17:24] is probabilistic so I can't tell you that if 10 records of this got uh you know were miscalculated [17:31] what the impact is going to be because it is not deterministic. Yeah, I I would say um [17:38] you know from a board perspective you you really have to um uh let it terms from a perspective [17:47] that terms from a perspective that uh what you know what what does that risk mean by adopt [17:54] said I'm slowly dying I think the mic's tired too so um [18:06] Because because as as the adoption is continuing to go on and it's going to continue to go on, [18:11] right? And every sector, every job function is getting automated in some fashion. [18:17] Uh and everybody from a human perspective is moving up the value chain um [18:22] uh from an organization standpoint. Um but uh you know definitely look out at the Nest AI RMF [18:31] uh from a governance mapping perspective and so forth. [18:40] Yeah, I think touchus I know we got one minute left. So yeah, I think some of this we've already [18:46] sort of uh mentioned on that as as you know you some of your AI making sure you inventory. So some [18:53] of these that you'll see up there, right, is also what you should be doing already, [18:58] right? So if you don't have the controls right now, putting AI is not going to make it any [19:05] better. In fact, it's going to accelerate it. It's going to make it worse. Right? If you don't have [19:10] good data governance policies, if you don't have good vendor management, you're already in trouble. [19:17] AI is just going to expose that, right? And you also have from a vendor management perspective, [19:22] you also have to when you're working with other vendors that is powered their SAS [19:27] application is powered by AI tooling. You need to understand what tooling is underneath it [19:33] because you don't want your organizational data being pumped out and being trained on [19:39] and then you lose your data or your company or whatever the value is, right? And this is [19:44] constantly happening right now. Um, I mean, look, Anthropic got sued. They lost the case. [19:50] Now they're buying all the bookshelves, books from the bookshelves and turn it [19:53] because they don't want to, you know, pay for it, right? So, uh, so same thing. [20:00] I think these are some of the, uh, uh, board metrics from some of the, uh, exposure, [20:06] uh, areas there. I, I don't know, we are, I think we're we're a bit over time. Yeah, we're a bit [20:10] over time, but uh one thing I'll say is that we do have this 90-day action plan that we can [20:18] um uh we have a link here. Uh I'll show it to you. So bottom line is uh manage AI risk like [20:25] capital risk. What AI risk appetite are we willing to accept? Right? These are three decision points [20:32] from a leadership perspective uh that you should think about. Which use cases create the greatest [20:38] financial exposure? Right? Uh do a BIA, right? Like a business impact analysis just like anything [20:45] else. What systems, what data is making you money? Who is accessing it? What does that impact look [20:51] like? You narrow that scope down. How can we imple integrate AI into it and uh accelerate automation [20:58] and increase profitability but also manage your exposure from a risk perspective? [21:03] uh and that which control uh unlocks adoption instead of blocking [21:09] uh blocking it right it's very important you don't if you if you become the organization of no there [21:16] is going to be a significant impact as well so you have to operate in a very balanced approach where [21:21] you're also protecting the unknown but also making sure the organizations are continue to innovate [21:27] because if you if they don't innovate you know they're going to deprecate uh with that said Um [21:35] let's see we we have we got a we have built like a executive kind of like a KPI slider for risk [21:43] management. Uh feel free to it's completely free. Go ahead and you know it's on atomic zero.iok uh [21:50] io/risk feel free to use that as a tooling and if you need further in-depth understanding and [21:57] doing analysis and working with the board and upstream it with CFOs or CEOs or boardrooms [22:02] you know happy to help as well. Thank you so much. Thank you everyone.