The Tech Leverage. Build with AI. Audit the risk.
One AI story a week, read the way a data auditor reads it. The video, the evidence, and the one test to run.
A Trusted Security Company's Secret Key Was the Number 4
Eight eMudhra intermediate keys were small enough to guess. By my count five layers of assurance missed them for about 18 months, and an outside researcher found them.
What the file found
- Failed
A ceremony deviation created weak keys, and similar labels let them get certified without a key-to-request check.
- Failed
Failed June 2025 revocation lists were closed as a configuration error instead of asking which key signed them.
- Failed
The clean WebTrust opinion covered all eight certificates but does not say anyone tested the keys themselves.
- Held
Once reported, Chrome blocked the keys within 1 hour 40 minutes; no website certificates were logged before that.
The test to run this week
List every app, container and device with its own trust store, and confirm who patches it when a CA is distrusted.
Earlier briefs
All case files- 004 Grok Bot Wants a Photo of Your Credit Card. Who Pays If It Goes Wrong?A tweet is not a control, and on paper, today, the person who carries the risk is you. Failure Teardown
- 003 I Opened an AI Skill File. Check These 4 Things Before You Install OneThe test isn't whether a skill touches the internet. It's whether what it touches matches what it says it does. Build Lab
- 002 How to Audit a GenAI ImplementationWhatever the model says, the company said it. Audit Playbook
- 001 Claude Code Effort Levels: 0/5 to 5/5 With One Setting (and When It Backfires)More effort fixes missing edge cases. It does not fix a wrong approach. Build Lab
Is your AI system ready to trust?
Three questions from the GenAI Audit Checklist. The full check has sixteen, and every gap links to the video that closes it.
Run the full checklistThe Brief arrives the morning each video goes live: one story, the evidence, one test. Or start with the free GenAI Audit Checklist.