Sep 3, 2026 · 30 min
AI expands the attack surface faster than security practices adapt
Who’s watching the AI watchers?
AI-generated code, shadow AI, and open-source dependencies are changing how organizations must verify software, manage vulnerabilities, and prepare for incidents.
- 1AI-assisted development increases the need for explicit requirements, verification, and security controls around generated code.
- 2Security leaders can make AI risk legible to executives by grounding budget requests in prominent incidents and public examples.
- 3As roles and skills shift, adaptable professionals with broad knowledge and one deep specialty may be better positioned for uncertainty.
Don't miss
Rob van der Veer lays out the case for building a security harness around AI-generated code, rather than treating it as ordinary software.
The brief
The episode frames AI as an expanding attack surface: shadow AI, open-source dependencies, and AI-assisted software engineering are changing how vulnerabilities enter organizations.
Rob van der Veer argues that AI-generated code needs a security harness, with clear requirements, verification, stronger controls, and incident-response practices that can keep pace with discovery.
The wider briefing connects that challenge to secret AI safety reviews, attacks involving METR, Russian cyber training, worm-like ScreenConnect activity, breaches, phishing, and urgent software vulnerabilities.
Van der Veer’s practical advice is to use prominent incidents to explain AI risk to leadership, learn through peer roundtables, and avoid overly narrow career bets.
His closing prescription is a T-shaped skill profile: stay agile as workforce structures shift, while building enough depth to contribute meaningfully in cybersecurity.