Inverted Podcast #11: AI and Security Risks for Product Teams

AI scales both attacks and defenses. In Inverted Podcast #11, the hosts examine how generative and automated systems reshape phishing, malware campaigns, product risk, and enterprise governance.

They discuss creative phishing, AI policy and shadow AI, physical and operational risks, verifying AI use, positive defensive applications, explainability and transparency, and eliminating attack vectors rather than only detecting them.

Listen on Spotify

About this episode

A hosts-led episode on how AI changes both attacker tactics and defender playbooks. The panel covers governance, shadow AI, explainability in security decisions, and risks that spill into physical and operational systems.

Key takeaways

AI lowers the cost of convincing phishing and scalable abuse.
Enterprises need governance for approved and shadow AI use.
Explainability matters when AI drives security decisions users must trust.
AI risk is not only digital. Physical and operational systems are in scope.
Defenders can use AI for detection and triage, without ignoring new attack surfaces.
Prefer eliminating vectors where possible over endless detection arms races.

Topics covered

AI-enabled phishing and creative attacks
AI governance and enterprise challenges
Physical and operational AI risks
Governing and verifying AI use
Positive uses of AI in security
Explainability, transparency, and attack vector elimination

Chapters

00:07 Introduction & AI Risks
02:14 Creative Phishing & Attacks
05:08 AI Governance & Enterprise Challenges
09:17 Physical & Operational AI Risks
13:17 Governing & Verifying AI Use
17:38 Positive Uses of AI in Security
22:04 Explainability & Transparency
26:29 Eliminating Attack Vectors
30:33 Recap & Closing

For inverted product managers, the practical test is whether your roadmap reduces measurable damage for real users without inventing vanity metrics. Use the chapters above to jump to the sections most relevant to your team, then bring one concrete change into your next planning cycle.

For product teams, AI security is both a feature surface and a supply-chain problem. Vet models and vendors, constrain what agents can do with credentials and data, and assume attackers will use the same tools to scale phishing and fraud. Episode 11 is a primer; later episodes deepen regulation, human-in-the-loop design, and agentic identity risks.

Bring one insight from this episode into your next planning review: name the inverted outcome you care about, pick a metric that tracks damage or attacker cost rather than vanity activity, and assign an owner to validate it with real user and adversary data within a sprint or two.

FAQ

Is this episode about building AI products or defending against AI attacks?

Both. The hosts cover attacker use of AI, defender opportunities, and how product teams govern AI inside the enterprise.

What should inverted PMs prioritize first?

Threat models that include AI-scaled social engineering, clear AI use policies, and controls that remove easy vectors rather than only adding another model.

How does this connect to later episodes?

Episode 21 goes deeper on AI regulations and humans in the loop. Episode 28 explores agentic AI and digital identities.

Related on Inverted PM

Connect with the hosts and guests on the video or on LinkedIn to continue the conversation.

🎧 Find the Inverted Podcast on LinkedIn, Spotify, YouTube, Amazon Music/Audible, iHeartRadio, or invertedpm.com.

Explore more

Browse all Inverted Podcast episodes, read the blog, or meet the hosts.