Denial of Wallet - Robert Whetstine - Guardians of the Data - Episode # 54
What happens when your AI gets bored? According to this week's guest, it starts making its own decisions, and not always the ones you'd want.
Robert Whetstine, known across the industry as the Bow Tie Security Guy, joins Ward Balcerzak to unpack the wave of risk headed toward every organization running AI in production. From a looming explosion in CVEs to a brand new attack called denial of wallet, Robert makes the case that AI isn't replacing the fundamentals of security, it's making them non-negotiable.
Robert Whetstine, known across the industry as the Bow Tie Security Guy, joins Ward Balcerzak to unpack the wave of risk headed toward every organization running AI in production. From a looming explosion in CVEs to a brand new attack called denial of wallet, Robert makes the case that AI isn't replacing the fundamentals of security, it's making them non-negotiable.
The conversation moves from technical war stories to Robert's own path from homelessness to Fortune 500 executive, tying together a career built on embracing discomfort and doing the basics better than anyone else.
Takeaways:
- Shift from a vulnerability management mindset to an exposure risk model. Know your crown jewels, monitor them closely, and be able to answer in minutes whether a new CVE actually touches your environment.
- Don't let AI agents get bored. Chatbots without real guardrails will drift outside their instructions the longer a conversation runs, so build in controls rather than trusting the model to police itself.
- Budget for token costs the way you'd budget for cloud sprawl. A reckless query or a denial of wallet attack can rack up tens of thousands in charges, so plan for a multiplier, not a flat rate.
- Treat an unrestricted AI model like a brilliant but unsupervised junior engineer. Lock down RBAC, log everything through a third party, and never take an AI's own explanation of its behavior at face value.
- Protect your team from hustle culture before it protects your company from anything else. Burnout erodes judgment fast, and the basics, like tabletop exercises and clear data retention policies, only get done by people who aren't running on empty.
Quote of the Show:
- “If you're not actively preparing for your token cost to have a five X multiplier in the next five years, you're going to be drastically surprised.” - Robert Whetstine
Links:
- LinkedIn: https://www.linkedin.com/in/bowtiesecurityguy/
- Youtube: https://www.youtube.com/@bowtiesecurityguy
Ways to Tune In:
- Transistor: https://guardiansofthedata.show/
- Spotify: https://open.spotify.com/show/5gZXInkb12Qrs2Lyv0hstQ
- Apple Podcasts: https://podcasts.apple.com/us/podcast/guardians-of-the-data/id1826819323
- Amazon Music: https://music.amazon.com/podcasts/0754cdde-f1c4-4f6c-92a2-e263f7840eb8/guardians-of-the-data
- iHeart Radio: https://www.iheart.com/podcast/269-guardians-of-the-data-285972170/
- YouTube: https://www.youtube.com/@GuardiansoftheDataPod
Creators and Guests
