Chapter 3 of 14 · Week 1
What is already shipping
- How do I find out what we actually run in production?
- Do I need a full inventory before I can start?
- What about AI features someone launched without telling security?
You cannot protect what you do not know exists. In most organisations nobody has a complete list of what is running in production. That is normal. Your job in week one is to make a list that is useful, not one that is complete.
Start with four questions
- What can someone on the internet reach? Websites, APIs, mobile back ends, admin panels.
- What handles the most sensitive data? Payments, health, identity, customer files.
- What third-party code does it depend on? Open source packages, container images, SaaS integrations.
- Which features call an AI model, and what can that model see or do?
Use what already exists. Cloud accounts list load balancers and domains. The source host lists repositories. Package lock files list dependencies. DNS records show subdomains people forgot. You are stitching together sources, not starting from nothing.
Shadow features
Expect to find things nobody told security about. A chatbot built in a hackathon that is now live. A test environment with real data. An old API version still answering requests. Treat these calmly. If the first person to tell you about a forgotten system gets blamed, nobody will tell you about the next one.
The question you might not ask out loud
What if I find something risky in my first week?
Tell the owner directly and privately, explain what you saw and ask what they know about it. If it is being exploited or exposes sensitive data right now, follow the incident process and tell your manager the same day. Otherwise, it goes on the list with everything else.
Keep the list small and alive
- One row per service or feature, with an owner name, not a team alias.
- Whether it is internet-facing, and what data it handles.
- Whether it calls an AI model or runs an MCP server, and which one.
- Last time anyone looked at it from a security point of view.
Rule of thumb:A list with an owner on every row is worth more than a long list with no owners. When something breaks, the owner column is the one you will read first.
Share the list with the engineering leads and ask them to correct it. They will. Every correction is a conversation, and every conversation teaches you which services matter most to the people who run them.