2026-09-11 14:23:14 +00:00
2 changed files with 19 additions and 0 deletions
@@ -0,0 +1,19 @@
+```json meta
+{
+  "title": "\"Make it secure\"",
+  "lead": "At KCDC, a speaker shared their team's security strategy for AI-generated hardware and access controls: simply prompting the model to 'make it secure.' A reflection on where we are with AI tooling and the vanishing bar for verifiable verification.",
+  "isPublished": true,
+  "publishedAt": "2026-09-11",
+  "openGraphImage": "posts/make-it-secure/og-image.png"
+}
+```
+
+I sat in on a talk yesterday at the Kansas City Developer Conference that was mostly about how a local small business owner was able to leverage AI tooling to advance his business outcomes.
+
+One of the things he did was incorporate hardware into his business model, including facility access and monitoring-related devices. They developed both the hardware and software using agents and off-the-shelf components.
+
+An audience member asked if he had any concerns about the security of what they were developing and deploying. The speaker's answer left me a bit stunned. I expected at least a qualified answer, or perhaps that they had red-teamed their work as part of the development process.
+
+Instead, the real answer was that they just prompt the LLM to “make it secure” and run several reviews of the implementation across a couple of different models. Surprisingly, there wasn’t much reaction from the audience. I guess this is where we are now.
+
+Honestly, I don’t really have any shade to throw at the presenter. It’s his company, and if he’s comfortable with the risk, more power to him. But I suppose I imagined more people would feel the way I do: wanting something verifiable and provable when it comes to assuring the quality, performance, and security of the platforms and products they build, with or without AI.