Mistakes, Not Villains — YPO Technology Network AI Brief

Most exposure in a company comes from mistakes, not villains: access opened for a good reason and never closed. Attackers now find those leftovers in hours.

In this episode, Stephen Forte covers:

Binance. About $6.3B stolen. Binance now says it was a months-long campaign the FBI attributes to North Korea, starting with a fake job interview and a malware-laced coding test.
AI speed. Storm-0940 reached privileged cloud access in under three hours. Unit 42 saw two weeks of attack work done in under ten.
Day job. What his team finds in client tenants, and when to call a specialist.

The full checklist (ask for a number, a list, or a screenshot):

1. Global/super admins, cloud root, registrar, DNS owners, by name.
2. Standing vs just-in-time admin rights; separate admin accounts.
3. High-privilege service accounts and app registrations, with owners.
4. MFA % enforced, not registered; exceptions and approvers.
5. Phishing-resistant MFA for admins and finance; legacy auth blocked.
6. Accounts idle 90+ days, ex-staff still enabled, guests.
7. Last access review on finance, HR, CRM, customer data.
8. Project access opened in 12 months, and closed?
9. Secrets in repos and history; how many still work?
10. Where API keys live; rotation dates; revoke at the issuer.
11. Every AI-provider key and who pays.
12. Domains and subdomains (crt.sh), each with an owner.
13. Test, staging, demo servers still running with real data.
14. Old sites and WordPress installs patched or retired.
15. Shodan view of your IPs: open databases, admin panels.
16. Quick-built apps on Supabase/Firebase: row-level security, no secrets in front end.
17. Public buckets and "anyone with the link" shares.
18. Anything that can delete production databases or sites.
19. Which notetakers are in use, sanctioned or personal.
20. Transcript default sharing, who sees all, retention.
21. Board, HR, legal, M&A calls: no bot or restricted.
22. Third-party OAuth apps on mail, files, CRM; admin consent.
23. Top 10 vendors: recent breaches, tokens rotated.
24. Immutable backups and last tested restore, incl. M365/Google.
25. DMARC at enforcement, SPF, DKIM on every domain.
26. Bank-detail changes: call back a number on file, dual approval.
27. External auto-forwarding blocked; inbox-rule alerts.
28. Log retention and alerts (new admin, MFA off, mass download).
29. Endpoint protection on every laptop.
30. Written incident plan; who calls insurer, counsel, IR firm.
31. Tabletop exercise with the CEO in the last 12 months.
32. Quarterly one-page cyber report to the board.
33. Cyber insurance answers match reality.

Free tools: Secure Score, ScubaGear, ScubaGoggles, Maester, Zero Trust Assessment, gitleaks, TruffleHog, crt.sh, Shodan, Prowler, Have I Been Pwned.

Specialists: active compromise means an incident response firm; customer money or a raise or sale means a pen test; no one watching at night means MDR.

Sources:

CoinDesk on Binance (Nov 3): https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says
Microsoft on Storm-0940: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/

The AI Brief from the YPO Technology Network is a daily executive briefing on the AI developments that matter to business leaders. Hosted by Stephen Forte.