Your biggest AI security risk isn't hackers. Robert Maxwell says it's your own team.

This week on the Project Flux podcast we sat down with Robert Maxwell cybersecurity specialist, author, and a man who spends his days watching organisations defend the wrong door. Everyone is bracing for smarter attackers. Robert's argument is that the breach is usually already inside the building, quietly logged in under one of your own employees.

🎧 Short on time? Hit play — the full conversation is right here: listen to the episode.

The phrase Robert keeps coming back to is shadow AI: staff pasting contracts, client data and half-finished strategy decks into whatever free tool is open in the next tab, with nobody approving it and nobody watching where it goes. Every one of those tabs is a new way in. The attack surface isn't growing because the hackers got cleverer it's growing because your team got faster, and the tooling outran the rules.

He uses the Australian government hack as the cautionary tale: the failures that hurt most weren't exotic, they were the ordinary ones nobody owned. And ownership, for Robert, is the whole game. Too many leaders file AI under "something IT is handling," when the real gap is a management-education gap. If the people signing off on the budget can't tell a focused project from a bit of AI washing, they can't govern the risk either.

His fix is refreshingly un-technical. Start with four things, in this order: outcome, technology, people, data. Decide what you're actually trying to achieve before you fall in love with a tool. Pick the tech to serve the outcome, not the other way round. Bring the people with you. Then get the data house in order. Do it in that sequence and you sidestep both shadow AI and the analysis paralysis that freezes so many SMEs on the starting line and you keep reviewing it, because in this field "finished" is a fiction.

The closing note is the one worth pinning up. Robert's six-month read is that the pace won't let up, and the thing that protects an individual isn't a certificate, it's AI literacy. Knowing enough to ask the awkward question before the tool gives you a confident, wrong answer.

Why it matters: Your weakest security link probably isn't a firewall — it's a well-meaning colleague with an unapproved browser tab, and a leadership team that thinks this is someone else's job.

👉 Listen to the full conversation with Robert Maxwell for the four-step framework, the shadow-AI war stories, and what he thinks breaks next.

Links and Stuff

Listen on

If you have paid time left on an individual Granola plan, we'll match it with a Wispr Flow subscription that includes Notetaker and dictation, and add bonus time, up to 12 months total. Sign in or create a Wispr account and submit proof of your plan to check eligibility.

Try Notetaker Free

Enjoyed this? Project Flux breaks down the week's most important AI news for people who actually have to deliver — straight to your inbox every Monday. Subscribe to the newsletter here.

Project Flux is independently owned, funded, and operated by its founder. Any external references or features are for community benefit only and do not imply endorsement, control, or ownership.