A thousand days since ChatGPT launched, the coverage hasn’t slowed down. What has changed is the quality of the question being asked. Early on, the question was whether AI was real. Then it was whether AI would take everyone’s jobs. Now — at least in the places that are thinking about it seriously — the question is: what did this actually do, and what does it mean for us?

This session started as a customer-exclusive conversation. We’re publishing it because the questions that came up in it are the ones we hear most often, and the honest answers to them don’t fit neatly into a short post.

The short version: “AI makes attacks more sophisticated” is the wrong frame. The sophistication was already there. What changed was scalability, speed, and cost. That shift matters more than the scary headline version, and it changes what a practical response looks like.

The full version is below.

What’s Covered

The headlines that stopped us cold: What the rogue AI incidents of the last two years actually showed, including the case where a model lied to the people who were investigating it, and what that tells you versus what the coverage told you.

“More sophisticated” is the wrong word: Why that framing leads smaller businesses toward the wrong defenses, and the three things that genuinely shifted: scalability (attackers can run operations at scale that previously required large teams), speed (the time between discovery and exploitation collapsed), and cost (the barrier to running a capable attack dropped to nearly nothing).

The AI-written internet problem: How much of what you’re reading online has been generated since 2023, why that number is higher than most people expect, and what it means for your employees’ ability to tell real from fabricated.

Why the law can’t keep up: Where the regulatory and legal frameworks stand, what’s still unresolved, and the specific issue of AI note-takers and attorney-client privilege that nobody saw coming until it was already a problem.

Where smaller businesses should actually focus: Not the enterprise playbook. What makes sense given your size, your budget, and the reality that the tools being marketed at large organizations don’t translate directly to a team of 20 or 200.

The Q&A: Four questions from the live session that we’ve heard in some form from nearly every customer: what to do this week if half your team is already using AI tools you never approved; whether AI-generated information is discoverable in a lawsuit; what an AI policy actually looks like for a smaller organization; and what threat we’ll be talking about a year from now.

Chapters

0:00 — Welcome
0:52 — Fair warning, this one’s a rant
3:35 — What’s coming in October, November, and January
5:00 — A thousand days since ChatGPT
6:21 — The headlines that stopped us cold
10:02 — When a model lied to the people investigating it
11:37 — What these incidents actually teach us
13:21 — The backlash against AI, by the numbers
16:13 — How much of the internet did AI write?
18:16 — One word for the last three years
18:53 — Does AI really make attacks more sophisticated?
20:15 — Sophistication, part one: scalability
21:44 — Sophistication, part two: speed
24:20 — Sophistication, part three: cost
29:04 — Why the law can’t keep up
32:51 — The pen testing tool that finds every vulnerability
34:31 — Why the economics don’t work for smaller businesses yet
35:31 — 33 million small businesses, 500 Fortune 500s
37:44 — “I’m not even sure what to think”
40:42 — The Jurassic Park problem
44:37 — The more you know, the more you know how little you know
47:01 — Where to start: the AI risk assessment
48:21 — Q&A: half my team is using AI tools. What do I do today?
53:05 — Q&A: is AI-generated information discoverable in a lawsuit?
54:40 — Q&A: what does an AI policy look like for a smaller company?
57:50 — Q&A: what AI threat will we be talking about a year from now?

If the Q&A raised questions for your own organization, the AI Readiness Assessment is a good next step. It’s a structured conversation built on the NIST AI Risk Management Framework, scoped for smaller businesses.