AI Governance Pressure, Cloud Identity Exposure, Open Source Supply Chain Risk & Operational Resilience

In this week’s Technology Risk Weekly Briefing, David Horn examines the latest developments reshaping the technology risk landscape, including increasing regulatory pressure on AI governance, rising identity and cloud access attacks, emerging open-source software supply chain vulnerabilities, and growing concerns around operational resilience and third-party technology dependencies.

The episode explores:

• AI governance and model risk oversight
• Cloud identity and privileged access exposure
• Open-source software supply chain vulnerabilities
• Third-party ecosystem dependency risk
• Practical resilience and control improvements organisations should implement now

Sponsored by CauTix — helping organisations strengthen secure and resilient digital operations through effective technology risk and control frameworks.

Transcript

SPEAKER_00 0:00

Hello and welcome to the Technology Risk Weekly Briefing. I'm David Horn, and each week we examine the most important development shaping technology risk: cyber resilience, cloud governance, operational controls, artificial intelligence, and third-party oversight. This podcast is proudly sponsored by Cortix, a specialist advisory firm focused on technology risk and control, helping organisations design, assess and strengthen the frameworks that underpin secure and reliable digital operations. In this week's episode, we'll explore growing pressure on AI governance frameworks, the continued escalation of cloud identity attacks, increasing concern around open source software supply chain vulnerabilities, and what recent events are teaching organisations about operational resilience and ecosystem dependency risk. As always, we'll break down what happened, why it matters from a technology risk perspective, and the practical actions organisations should be considering right now. We begin this week with the rapidly evolving area of artificial intelligence governance and model risk management. Regulators, technology leaders, and cybersecurity specialists continue to raise concerns around the speed of AI adoption compared with the maturity of governance frameworks being implemented by organizations. The challenge is no longer simply experimentation with generative AI tools. The concern, now, is operational dependency. Many organizations are embedding AI into customer workflows, software development processes, decision support systems, analytics, and internal operations, often faster than governance and control environments can mature. Recent industry commentary and regulatory discussions have increasingly focused on several key risk areas data leakage, model integrity, explainability, third-party AI dependency, bias and decision transparency, and operational resilience if AI-enabled services fail or behave unpredictably. One growing concern discussed widely within technology risk communities is shadow AI usage. Employees may be uploading sensitive data into public AI platforms without formal oversight, creating significant confidentiality, intellectual property and regulatory exposure. This becomes especially problematic in highly regulated sectors including financial services, healthcare, legal services, and critical infrastructure operations. From a technology risk perspective, organizations should now treat AI governance as an enterprise risk discipline, rather than an isolated innovation initiative. Several practical actions are becoming increasingly important. First, establish formal AI governance committees involving technology, security, legal compliance and operational stakeholders. Second, maintain inventories of AI-enabled systems and third-party AI providers. Third, define clear acceptable use standards for employees. Fourth, strengthen monitoring over data flows into external AI services. And finally, integrate AI-related risks into operational resilience and third-party risk assessments. Because as AI adoption accelerates, unmanaged governance gaps may rapidly become systematic operational risks. Our second story this week focuses on identity security and the growing concentration of attacks targeting cloud authentication systems and privileged access environments. Security researchers continue to report increasing levels of a credential theft, session hijacking, token abuse, and cloud identity compromise. The trend is clear, attackers increasingly bypass traditional malware techniques and instead focus directly on identities, privileged access paths and cloud administration environments. This is particularly concerning because many organizations continue to rely on fragmented identity governance models developed before large-scale cloud adoption. In cloud native environments, identity effectively becomes the control plane for the organization. If identity is compromised, attackers may gain access to infrastructure, applications, data automation pipelines and operational systems simultaneously. Discussions across cybersecurity communities this week also highlighted concerns around excessive standing privileged access and weak governance over contractor and third-party accounts. This creates significant exposure during instance involving outsourcing providers, software vendors and support organisations. Technology risk leaders should therefore prioritize several practical improvements. First, expand adoption of fishing resistant multifactor authentication. Second, reduce persistent privileged access through just in time administration models. Third, strengthen monitoring of abnormal authentication behaviour and privileged activity. Fourth, regularly review third-party identity access permissions. And finally, ensure identity governance metrics are regularly reported to executive leadership and boards. Because identity security is no longer simply an IT issue, it's now fundamental to operational resilience. Another major theme emerging this week is increasing concern around open source software supply chain risk. Modern organizations depend extensively on open source software libraries and components across applications, cloud infrastructure, development pipelines and AI tooling. The challenge is visibility. Many organizations do not fully understand the extent of their dependency chains. A single vulnerability or compromised package may affect thousands of downstream applications and services. Recent industry discussions have again highlighted concerns around malicious package uploads, abandoned dependencies, software maintainer compromise, and weaknesses in software integrity verification processes. From a technology risk and control perspective, this creates several important challenges. Firstly, organizations may lack accurate software bill of materials visibility. Secondly, vulnerability remediation becomes difficult when dependency chains are poorly understood. Third, development teams may unintentionally introduce insecure or unverified packages into production environments. Fourth, third-party software risk increasingly becomes systemic rather than isolated. Several practical actions are now becoming baseline expectations for mature organisations. Maintain accurate software inventories, implement software bill of materials capabilities, strengthen dependency scanning and vulnerability management processes, review software signing and integrity validation controls, and improve governance over open source software approval and monitoring. Importantly, boards and executives should understand that software supply chain risk is not solely a developer issue, it's now a business resiliency issue. Our final major topic this week focuses on operational resilience and ecosystem dependency risk. Modern organizations increasingly rely on interconnected technology ecosystems involving cloud providers, managed service providers, SaaS platforms, AI vendors, telecommunication providers and outsourced operational partners. This interconnectedness creates scale and efficiency, but it also creates concentration and cascade risk. A disruption affecting one provider may rapidly affect hundreds or thousands of dependent organizations simultaneously. Recent resilience discussions across industry forums continue to highlight several recurring weaknesses. Limited visibility into fourth party dependencies, inadequate resiliency testing, over-reliance on manual recovery assumptions, and unrealistic recovery time expectations during major ecosystem-wide incidents. Technology risk teams should therefore continue strengthening several areas. First, map critical service dependencies end-to-end. Second, conduct realistic operational resilience exercises involving third-party failure scenarios. Third, review concentration exposure across cloud, telecommunications and managed service providers. Fourth, strengthen contractual resilience obligations and instant notification requirements. And finally, ensure executive leadership understands where systemic operational dependencies exist across the organisation. Because resilience today is no longer defined purely by internal technology capability. It depends on the resilience of the wider ecosystem. As we close this week's Technology Risk Weekly Briefing, several themes remain clear. Artificial intelligence adoption is accelerating faster than governance maturity. Identity security continues to dominate the cyber threat landscape. Software supply chain exposure is increasing, and operational resilience now depends heavily on understanding interconnected ecosystem dependencies. Technology risk management is becoming one of the defining strategic disciplines of modern organizations. The organizations that succeed will be those that combine innovation with disciplined governance, strong operational controls, resilient architectures, and proactive oversight. Thank you for joining me for this week's Technology Risk Weekly Briefing. I'm David Horn, and this podcast is proudly sponsored by Cortix, helping organisations strengthen the frameworks and controls that underpin secure and reliable digital operations. Stay resilient, stay informed, and stay ahead of Technology Risk.