Posts

AWS, Google, and Vercel patched flaws that let attackers fire AI agent tools without the model ever running. What CoreBreak changes in your AI vendor diligence.

MCP's biggest revision is dated July 28: sessions gone, Logging deprecated, client registration replaced. What it changes for your AI vendor diligence.

The AI notetaker that joined your call. The core system that flipped on a new feature. Your third-party AI surface is expanding silently, and the diligence is yours.

What point-in-time AI evidence looks like when it's done right — the inventory, the shadow-AI findings, the diligence records landing in binder shape instead of on your to-do list.

Your firewall watches where people go. Shadow AI is about what people granted. The inventory that matters is your OAuth grants, not your network traffic logs.

The 2026 problem every credit union and RIA compliance officer feels but can't name: you'll be asked about AI, and you have no evidence to hand over.

Read-only means read-only. Why we publish the boundary of what an AI vendor-risk scan can and can't see — and why, for a trust brand, that candor is the product, not a disclaimer.

The table of contents for an examiner-ready AI evidence binder, section by section — the inventory, diligence records, policies, and monitoring trail. A 1–2 person build.

What to write and what to collect for your Reg S-P service-provider oversight file — the AI vendor evidence an examiner expects, before your next exam. RIA-built checklist.

12 AI vendor due-diligence questions that hold up at an exam — and how to tell a real answer from a marketing one. Built for a 1–2 person compliance program.

How to pull and read third-party OAuth app authorizations in Google Workspace and Microsoft Entra — where to look, what a risky grant looks like, and what to do about it.

Take a raw AI finding and map it to NCUA's 07-CU-13 diligence language and the NIST AI RMF's Govern/Map/Measure/Manage functions. A reusable crosswalk with a worked example.