A backup can exist while the restore service is unavailable. I want recovery plans to name the last usable recovery point, the dependencies needed to reach it, and who decides when the gap is unacceptable. Test that path before the outage does. connectwise.com/company/trus…
An AI review comment can lead to a code change and still be wrong. ReviewBench can help screen tools. Local evidence should decide whether the workflow improved - definitely worth checking out!
github.blog/ai-and-ml/github…
An AI business case can show a positive return and still be the wrong investment. I'd compare it with fixing the process, simpler automation and the work we'd postpone. Then challenge the assumptions: saved hours aren't automatically cash, and someone still pays for exceptions.
A stop button helps only if someone notices the problem in time. Before relying on an AI safety layer, I'd define one forbidden outcome, check how it becomes visible, and test who can intervene. A flagged action and a prevented action are different results.
Mozilla's Firefox advisory notes a change in how memory-safety bugs get CVEs. A higher count alone doesn't tell me risk has risen.
For a board decision, I'd show affected systems, verified fixes, and unknowns—then name the decision and the evidence that would change it.
In AISI's simulated tests, an agent sometimes treated an automated “continue” as permission to exceed scope.
I'd test the executor: can that reply actually expand access?
Approval needs a specific action, target and owner. A polite sentence isn't a permission system.
A model release can justify an experiment without justifying new infrastructure.
With Naive AI's new open-weight model, I'd start with one workload, a comparator, a spending cap and an end date.
Learning something useful is a valid result. So is deciding to stop.
Perplexity’s move onto more PCs makes the control question practical: what can an agent touch, and how do I stop it?
Across my cloud security, cyber risk and aviation work, I want people to get useful work done and keep control of the result.
On my 2021 flying trip across Europe, fog changed the route. Landing somewhere else became part of the adventure.
A plan needs room for new information.
iamit.org/blog/backpacking-i…
Serving on the BSides Las Vegas board keeps community building close to my professional work.
A useful question for any technical community: how easy is it for someone new to ask a question, contribute and find people they can learn from?
An AI-generated lead still needs a way to be checked.
That question shapes MyTailLog, CyberQRM, and PDFlight: inspect the original, reproduce the calculation, or follow the source.
I want the task and the evidence to drive the automation.
Palo Alto Networks is moving AI testing to a continuous service. I want to know what happens after the finding: triage, handoffs, rework, verified closure.
More data can be valuable. The business case still has to include the work required to fix them.
paloaltonetworks.com/blog/20…
Apple approved MyTailLog. It's live for iPhone and iPad: scan aircraft logbooks, search the history, and keep records handy offline (hangar Wi-Fi optional).
Free and open source. Paper logbooks remain the legal record.
apps.apple.com/us/app/mytail…
Digitizing years of aircraft records creates a new question: what happens if the tool disappears?
MyTailLog lets owners export records with original scans, or run their own instance. I want the records to outlast the app.
github.com/iiamit/MyTailLog
An agent can follow a task and still reach the wrong system. Google's disclosure makes the policy question concrete: where is the restriction enforced, how do we test denial, and what happens when it fails? Those answers belong in the system.
iamit.org/blog/security-poli…
Ian Amit retweeted
The Economist has the Big Mac index for economics. Has @iiamit started the paper clip index for AI safety?
AI-generated code still needs a path through review, validation, and deployment. Measure the whole journey when assessing productivity.
iamit.org/blog/the-missing-l…
The same question kept coming up in my risk consulting: how do we quantify risk without a six-figure tool or a data science team?
CyberQRM grew out of that gap: a local, open-source FAIR implementation.
github.com/iiamit/CyberQRM
An aircraft's history can be sitting in a box of handwritten logbooks. Getting it into a database is only half the job: someone still has to check it.
That's why MyTailLog keeps each scan beside the AI-extracted entry for review.
mytaillog.com
