Post by SANS Institute

Most organizations do not have a full picture of where AI exists in their environment. That gap is the problem Zakery Stufflebeam, Owner of Spartan Cyber Consulting, wanted to address at the SANS Institute AI Cybersecurity Summit 2026. Shadow AI is coming before most security teams are ready for it, and Stufflebeam's first action item is the unglamorous one: audit. Understand where AI actually lives in your environment. He is clear that this does not require expensive tooling. Basic auditing gets you there. From there, the conversation moves to third party risk. A full asset inventory of software and libraries is not a new concept, but AI introduces a wrinkle most organizations are not catching. When you sign a contract with a vendor, do you know where AI sits in their stack? Do you know which models are touching your data? Most organizations are aware of what AI can do in the abstract. Fewer are reading their contracts carefully enough to know what their vendors are actually doing with it. What are three things your organization is doing right now to improve its AI security posture? Drop them in the comments.

Video Content