One Search To Rule Them All: Threat Modelling AI Search
summary
Explains threat modeling for enterprise AI search with concrete findings: rollout at Canva uses Glean, connections to Slack, Confluence and other apps, and an archived-then-restored Confluence bug that wipes permissions allowing Glean to index restricted pages; a proxy misconfiguration exposed API key access even on self‑hosted setups; phones bypass managed-device controls; MCP/agents enable actions like local file saves and yolo mode risks; recommends three controls—run your own or limit integrations, control where access is allowed—and warns of service accounts acting as 1FA.
AI-written summary · about
chapters (9)
- 0:00Introduction to AI search
- 1:37Glean deep dive
- 4:01Threat modeling framework
- 5:23Integration findings
- 7:39AuthZ and access controls
- 12:07Security controls
- 13:06MCP and AI agents
- 18:04Summary and takeaways
- 21:00Q&A session
related talks
30mNavigating the New AI Security Landscape
37mFundamentals of AI safety and security
34mInvisible Infiltration of AI Supply Chains: Protective Measures from Adversari...
25mThreat Modeling for AI Apps with Attacks as Code
28mAI Under the Hood: Unmasking Hidden Threats
44mWhat Security Teams Need to Know and Do
54mA Practical Guide to AI Threats & Mitigation Strategies
14mAI Sprawl: The Hidden Risk Threatening Your Enterprise Now