Your Developers Already Installed a Black Box Behind Your VPN.

Anthropic built Claude Code. Anthropic still couldn't stop its own source code from leaking straight into a competing product. If a coding tool is running behind your VPN right now with full access, this conversation names what that's already costing you. Thomas Cooper is AI Product Lead at Expedient, where he works daily with enterprises building AI governance after the fact, once a tool is already live and the CISO's original objection has already been overruled. This episode is what to check before that call happens, starting with why a SOC 2 report that only spans three months doesn't protect you, and ending with the one AI bet CIOs are making right now that they'll likely regret. If you only have ten minutes, start at 35:28. Find the Risk You're Dealing With 09:15 We just sat through another vendor demo claiming their AI is different. How do I tell if that's true? 10:54 We're juggling five AI point solutions. Should we build toward one platform instead? 14:40 Our AI pilot has run for months with no number to justify it. What should we measure? 29:20 We were told AI would just connect to our SharePoint and work. Why isn't that happening? 35:28 A vendor's SOC 2 report only covers three months. Is that a red flag? 39:43 Our AI tool pulls from SharePoint. Is it respecting who can see what? 43:58 Could our team's AI conversations be used against us in court? 49:36 A developer's coding tool has full VPN access and nobody vetted it. How exposed are we? 53:50 Is our team pasting company data into personal AI accounts right now? 1:06:51 We got hit with a surprise AI bill. How do we budget so it doesn't happen again? 1:35:20 What AI decision am I making today that I'll regret in two years? Chapters 01:38 What's actually new in AI, and what's just been relabeled 04:33 Why CEOs stopped letting CISOs say no 09:15 Why every vendor's AI slide means less than it looks like 14:40 Why most AI projects never produce a number anyone can defend 35:28 What to actually check before trusting an AI vendor with your data 43:58 Why your AI conversations may not be privileged in a legal dispute 49:36 Why black box AI shouldn't live behind your firewall 1:06:51 Why AI costs become unpredictable at scale 1:35:20 The AI bet CIOs are making today that they'll regret in two years What We Mentioned Model Context Protocol (MCP), Retrieval-Augmented Generation (RAG), Claude Code, Claude Enterprise, Claude Max, SOC 2 reporting standards, Role-Based Access Control (RBAC), MIT report on AI implementation failure rates, Uber's reported AI budget overrun, Open Code, Goose, OpenWork About Thomas Cooper Thomas Cooper is AI Product Lead at Expedient, where he's spent years helping enterprises move AI from pilot to actual production deployment. Not the version of AI that shows up in a vendor slide. LinkedIn:   / tecooper   Expedient: https://www.expedient.com/ About Signed Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who've lived inside real enterprise tech deals. New episodes weekly. Listen: https://itbroker.com/podcast Book an intro call: https://itbroker.com Follow:   / itbrokerdotcom   Buy tech without regret.