Staying Sane When Everything Keeps Shifting
Security and resilience for products built on AI
Jed Tabaczynski · DCBKK, Bangkok · 25 October 2026
You open a project from six weeks ago.
You run something familiar and get a different result.
Nobody told you what moved.
What you leave with
You leave with three things, on paper.
- One risk, in plain words
- One safeguard to check
- One action, an owner and a date
The idea for this hour
Change is not a problem you solve. It's a condition you work in.
Story 1 of 3 · Dependency
The tool that vanished
One AI tool carried the daily work.
It handled the hard parts well.
Story 1 of 3 · Dependency
Then, one ordinary week, it was gone.
Story 1 of 3 · Dependency
The replacements ran. The work they produced was not usable.
A Plan B that runs is not a Plan B.
Story 1 of 3 · Dependency
Test your Plan B on real tasks, before you need it.
Keep a few real tasks. Know what good enough looks like.
Story 2 of 3 · Running fine
Running fine
A product that had run smoothly for a long time.
Underneath, some of its building blocks were badly out of date.
Story 2 of 3 · Running fine
"It's running fine."
Story 2 of 3 · Running fine
Running fine means it's up. It does not mean it's safe.
A shop can be open all day with the back door unlocked.
Story 2 of 3 · Running fine
Ask three questions when someone says it's out of date.
Story 3 of 3 · Recovery
The empty workspace
One morning, a message.
Something used every day was missing.
Story 3 of 3 · Recovery
The whole workspace was gone: files, notes, logins.
The live product kept running. The work stopped.
Story 3 of 3 · Recovery
The backups were there. The first restores failed.
Story 3 of 3 · Recovery
Restore one on purpose, on a quiet day.
One tested restore turns a hope into a plan.
If something goes wrong
The first hour, before you know the cause.
The same five steps are on the notes page.
One more lesson · Access
A fast new assistant with every key to the building.
One more lesson · Access
The door does exactly what doors do. So do your tools.
One more lesson · Access
Give your tools a visitor pass, not the master key.
Let it look. Do not let it move the furniture, open the safe, or send letters in your name.
Short lessons · 1 of 3
A stolen API key can wait a long time before anyone uses it.
Like a lost office badge. Cancel it, and the window closes.
Short lessons · 2 of 3
Everyone learned the old rule: do not click a link from a sender you do not know.
It worked because a link shows itself. You can read where it goes before you click.
Short lessons · 2 of 3
Today the link has new shapes. None of them shows you what is inside.
- A QR code on a slide or a poster
- A prompt someone pasted for you to run
- A skill or add-on from GitHub, "just install this"
Same rule. Who sent it, who made it, what will it be allowed to touch? Ask before you scan, paste or install.
Short lessons · 3 of 3
Use AI to figure out the steps once, then lock them down as normal software.
Same rules every time? Normal software is cheaper, faster and gives the same answer twice.
The moves
Four moves, four questions.
| Test your Plan B. | If this provider disappears tomorrow, what happens? |
|---|
| Check what an outsider can reach. | Are any of our building blocks badly out of date? |
|---|
| Prove the recovery. | If something disappears, can we restore it? |
|---|
| Keep the damage small. | If a tool goes wrong, what can it damage? |
|---|
That was me. Now you.
Your turn · 7 minutes
Your turn. Seven minutes, one sheet.
If technology caused a serious problem tomorrow, what would hurt most? Find one risk you can do something about.
Paper only. Nothing to hand in. Seven minutes, then three minutes with your neighbour.
Your turn · 7 minutes
07:00
Find one risk you can fix this week
| | Question | Your answer | Example, made up |
|---|
| 1 | What could go wrong? | | Our stock sync stops and orders stop with it |
|---|
| 2 | Business impact? | | A weekend of lost orders |
|---|
| 3 | What protects us today? | | The freelancer who set it up years ago |
|---|
| 4 | Tested or assumed? | | Assumed |
|---|
| 5 | Next action | | If the sync fails, we know who to call and how to restart it |
|---|
| Who | 6 | Owner: one name | | Me |
|---|
| 7 | Who does the work: a person, a role or an AI tool | | Our freelancer, with a written restart guide |
|---|
| When | 8 | Proof it is done, and the date | | One restart done on a quiet day, screenshot shared, Friday |
|---|
Stuck? Try: your main provider is gone · someone gets into a system you rely on · your files or logins disappear
Your turn · 3 minutes
Turn to your neighbour. Say what you assumed was protecting you.
Debrief
How many of you found a risk where the protection has never been tested?
Two volunteers: what you assumed was protecting you, and how you will test it this week. Lessons, not secrets.
Questions
Your questions.
The awkward ones are the useful ones.
One thing this week
You can't stop the ground moving. You can be ready for it.
Pick one risk from your sheet. One owner. One date this week.
byjed.com/dcbkk26notes
I brought coffee. Find me.
jed@byjed.com
linkedin.com/in/tabaczynski
One more thing
A new flaw was published last night in a building block many web apps share.
Which products it touches is still being confirmed.
Want a free check when the process is ready? Leave your email at byjed.com/dcaudit.
byjed.com/dcaudit
