Stop typing AI prompts. Start talking.
You think 4x faster than you type. So why are you typing prompts? Wispr Flow turns your voice into ready-to-paste text inside any AI tool. Speak naturally, tangents and all, and Flow cleans it up. Available on Mac, Windows, iPhone, and Android.
Disclaimer: All views presented here, in this newsletter, are my own, or are either researched using internet and AI (using LLMs) search and referenced accordingly.
Author or the newsletter are not liable for any actions taken by any individual or any organization / business / entity. The information provided is for information, education and awareness purposes only and is not specific to any business and or situation.
This publication does not constitute legal, regulatory, or professional advice.
Hi Securing Things family,
Hope you are doing well and had a great weekend.
In edition ST #89 we walked the plant floor and asked who approved the AI running there.
This time, we go take the lift upstairs to the offices.
AI that screens your job applicants, scores your suppliers and approves your customers' credit never touches a PLC. It can still land your company in front of a regulator and cost you money.
So here is the question for any AI system you run:
how much trust have you given it, and how much proof do you hold that it deserves that trust?
↪️ In this newsletter edition ✍️ we extend ST #89 from plant to rest of enterprise (whole business), and I share a method I have been building.
🏭 The Digital Factory lifecycle: 7 stages and AI in each one
🏷️ Two labels for every system, and the role flip under EU AI Act
🎭The role flip: when an AI user becomes the AI maker
📚 EU AI Act, ISO/IEC 42001 and NIST AI RMF, one sentence each side by side.
📊 SANS AI Security Maturity Model: what it measures well and what it misses - Weighted comparison
📒 ST AI Autonomy Ledger: every AI system gets an account
⚖️ ST AIAL head-to-head with SANS AIMM, my losses included, and a Monday-morning plan. ✅
Now, instead of 3 doors, we’ve 4 doors, my previous method failed my own scrutiny, and it lacked in several aspects.
Companion resource: the webinar is not a reading of this newsletter. Here you get the map. There, we take one fictional manufacturer through four AI systems and score them live. Link to be updated near the end.
Think of it this way: the newsletter is the map, and the workshop / webinar is the walk:
one fictional manufacturer, four AI systems, the books kept live. Link near the end.
Same topic, different depth, no repeats (well some recap).
But before we begin, do me a favor and make sure you “Subscribe” to let me know that you care and keep me motivated to publish more. Thanks!
Ready? let’s dig in.
Your’s truly.
Yousuf.
♻️if you know someone in your professional circle who will benefit from these resources and interested in learning. Thanks 🌟
Covered below - once you register with your e-mail, you can access for free:
🎯 The 60-Second Version
(For leaders e.g. CISO, CIO, CTO, CDO, with a board meeting in ten minutes.)
AI is now in every stage of manufacturing, not just "make", from design to invoicing.
In OT (plant), a wrong answer is a physical event. In office (enterprise IT), it is a people, money or legal event.
The EU AI Act's "high-risk" list is mostly about the office: hiring, worker management, credit. Not the plant.
A maturity score is an average. An average hides the one system that could hurt you.
You are probably a deployer. Change a tool's purpose and you can become its provider, with far heavier duties.
EU AI Act is the law. ISO/IEC 42001 is the management system. NIST AI RMF is the way of thinking. SANS's model tells you how far along you are.
My proposal: give every AI system an account. On one side, the trust it demands. On the other, the oversight you can prove. The gap is the overdraft.
You can fix an overdraft by adding proof or by removing autonomy. Removing autonomy is often cheaper.
The plant rule was - advise, don't actuate. The enterprise rule is recommended, don't decide about people alone.
🏭 The Digital Factory Lifecycle: Seven Stages
"Digital Factory" simply means every stage of making a product is connected by data, from the first sketch to the final invoice.
Here is where AI shows up in each stage.
# | Stage | Typical AI | What goes wrong |
|---|---|---|---|
1 | Design | Generative design, engineering copilots | Design IP leaks. AI ends up inside a regulated product. |
2 | Plan and source | Demand forecasting, supplier scoring, purchasing agents | Unfair supplier exclusion. Fraud through manipulated documents. |
3 | Make | Predictive maintenance, vision inspection | Covered in ST #89. |
4 | Deliver and sell | Pricing, chatbots, customer credit checks | Customers misled. Credit refused with no explanation. |
5 | Service | Field-service copilots, warranty triage | Wrong repair advice. Claims wrongly rejected. |
6 | People | CV screening, shift allocation, performance scoring, worker monitoring | Discrimination. Banned practices. |
7 | Finance and admin | Invoice matching, forecasting, contract review | Bad numbers reach the board. Payments go to fraudsters. |
Notice something.
Stage 3 is the one most OT security programs cover. Stage 6 is where the law bites hardest, Annex III of the EU AI Act is most specific: it names hiring, task allocation and performance monitoring.
ST #89 described three doors AI uses to get in: vendors ship it, your teams build it, people use it quietly.
Upstairs there is a fourth door: you build AI into a product you sell. That makes you a provider from day one.
Upstairs the worst case is a rights, money or legal event. The plant rule was advise, don't actuate.
The office rule is recommend, don't decide about people on your own.
(Quick refresher: the Purdue model is the layered map of an industrial site. Level 0 is the physical process, Levels 1 to 3 are control and site operations, and Levels 4 and 5 are the enterprise network. The lower the level, the more a mistake turns physical).
In OT (downstairs) you ask, "what can this AI touch?"
In IT (upstairs) you also ask, "who is this AI deciding about?"
SPONSOR
Events, embeddings, analytics: three databases for one app? TimescaleDB does all three in Postgres. Hypertables, pgvector, continuous aggregates. One system, no pipeline. $1000 to start. Get $1000 Credit
🤝 How We Help
I've spent few years working across IT and OT security with global asset owners / manufacturers, and the pattern is consistent:
fundamentals decide whether AI becomes an advantage or a liability.
"I enjoyed working with Yousuf with his extensive IT and OT cybersecurity knowledge."
An “AI-in-OT Readiness Assessment” from Securing Things gives you what this newsletter can only describe:
A complete inventory of AI across your three doors
Zone and conduit mapping for every AI system
Risk-tiering by consequence and autonomy (green, amber, red)
A gap analysis against the CISA-led principles, IEC 62443, NIST AI RMF and ISO/IEC 42001, mapped to your regional obligations
A prioritized roadmap your board can approve.
Companion resources (if you'd rather watch or listen): Join us on
🎥 Live🎧WORKSHOP REGISTRATION + 26 Nov. 12-13.30 pm (GMT +8). (I’ll add link soon, do check the live page for this or your inbox later)
👉 Book AI-for-Digital Factory Strategy Call →
(Reply to this e-mail, Or write to [email protected], or reach me via Linkedin).
To continue reading rest of the sections - subscribe below to get free access.
