Did You Make a Security Exception for AI?

Anthropic built Claude Code. Anthropic still couldn't stop its own source code from leaking straight into a competing product. If a coding tool is running behind your VPN right now with full access, this conversation names what that's already costing you. Thomas Cooper is AI Product Lead at Expedient, where he works daily with enterprises building AI governance after the fact, once a tool is already live and the CISO's original objection has already been overruled. This episode is what to check before that call happens, starting with why a SOC 2 report that only spans three months doesn't protect you, and ending with the one AI bet CIOs are making right now that they'll likely regret. If you only have ten minutes, start with the SOC 2 check at 35:28. What You'll Learn Will AI tools train on our company data? How do we tell real AI from marketing in a vendor pitch? How do we prove ROI on an AI project? How do we stop employees from using personal ChatGPT at work? Is a three-month SOC 2 report enough for an AI vendor? Can our AI chats be used against us in a lawsuit? How do we keep AI search from exposing confidential files? Is it safe to run Claude Code inside our network? Chapters (00:00) - Intro (01:38) - What's actually new in AI, and what's just been relabeled (04:33) - Why CEOs stopped letting CISOs say no (09:15) - Why every vendor's AI slide means less than it looks like (14:40) - Why most AI projects never produce a number anyone can defend (35:28) - What to actually check before trusting an AI vendor with your data (43:58) - Why your AI conversations may not be privileged in a legal dispute (49:36) - Why black box AI shouldn't live behind your firewall (01:06:51) - Why AI costs become unpredictable at scale (01:35:20) - The AI bet CIOs are making today that they'll regret in two years What We Mentioned Model Context Protocol (MCP) Retrieval-Augmented Generation (RAG) Claude Code, Claude Enterprise, Claude Max SOC 2 reporting standards Role-Based Access Control (RBAC) MIT report on AI implementation failure rates Uber's reported AI budget overrun Open Code, Goose, OpenWork About Thomas Cooper Thomas Cooper is AI Product Lead at Expedient, where he's spent years helping enterprises move AI from pilot to actual production deployment. He's built out Expedient's own agentic AI tooling and works daily with the governance, security, and cost tradeoffs that come with running AI at enterprise scale, not the version of AI that shows up in a vendor slide. Connect with Tom: LinkedIn | Expedient About Signed Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly. Listen: itbroker.com/podcast Book an intro call: itbroker.com Follow: @itbrokerdotcom Buy tech without regret. Full Transcript Click here to view the episode transcript.