AI Security

Followup to Black October
Board checklist: Detect, Decide, Deploy

A working checklist for directors after Black October. Tick items as management provides evidence, not just assurance. Timeframes assume a critical flaw has just been disclosed.

Detect - First 24 Hours

Management has confirmed whether we run the affected software (PHP), directly or inside platforms such as WordPress or Drupal
We have a list of every affected internet-facing system, with a named owner for each
Critical vendors, SaaS providers and web hosts have been contacted and asked whether they are affected
Systems running unsupported versions with no available fix have been identified separately
Security has started looking for signs of compromise, not just vulnerability

Detect - Within 30 Days

A complete software inventory exists, including what vendors run on our behalf
Exposure is mapped continuously, not once a year
Critical vendors are tiered by risk, with contract terms requiring prompt notice of flaws and fixes
Management can show how quickly we mapped exposure this time, and the target for next time

Decide - First 24 Hours

One executive owns the response and reports to the board on a set schedule
The decision on whether to take any system offline has been made and recorded, with the reasoning
Legal and the disclosure committee are tracking whether any incident could be material
Customer and regulator communications are drafted and ready, even if not sent

Decide - Within 30 days

Authority to take a system offline is pre-approved and written down, including who decides after hours
A critical-patch deadline is set in hours, with an escalation path if it slips
The materiality process is documented: who decides, on what facts, and how fast, given the four-business-day SEC disclosure window for public companies
The board has agreed which committee oversees cyber and how often it is briefed
A tabletop exercise has tested these decisions with management and, ideally, the board

Deploy - First 24 hours

The security update is applied on every affected system that can be patched
Systems that can't be patched yet are offline or cut off from the internet
Temporary protections (for example, web firewall rules from cloud providers) are switched on, and everyone understands they buy time but are not a fix

Deploy - This week

Passwords for administrator and database accounts on exposed systems are reset
API keys and certificates on exposed systems are replaced, and the old ones revoked
Users have been logged out so stolen sessions stop working
Critical vendors have confirmed in writing that they patched and changed their keys

Deploy - Within 30 days

A post-incident review covers what worked, what was slow, and what it cost
Unsupported software is retired or isolated
AI tools are in use to find our own weaknesses before attackers do

Prove: what the board should see

A one-page status report: systems affected, patched, offline, and remaining, with dates
Evidence that keys, certificates and passwords were replaced, not just that patches were applied
Time from disclosure to fully patched, compared with our target
Open risks, owners and deadlines

Red flags in management's answers

"We don't think we use that." Ask how they know.
"No alerts, so we're fine." This attack leaves little trace in normal logs; ask what was checked.
"Our vendors handle that." Ask for written confirmation.
"We patched." Ask whether the locks were changed too.
"We'll have a full picture next quarter." At AI speed, the picture is needed in hours.

Standing board metrics

What it tells the board, Suggested target

Time to map exposure

Same day

How fast we know where we're vulnerable

Time to decision

Hours

How fast we decide to patch, go offline or disclose

Time to patch critical flaws

Hours to days, not weeks

How long the door stays open

Time to change the locks

Within the week

How long stolen keys keep working

Vendor confirmation rate

All critical vendors

How much of our supply chain we can vouch for

Followup to Black OctoberBoard checklist: Detect, Decide, Deploy