#19 — AI Doom Can Wait. Your Security Alerts Can’t

Security alerts keep piling up while AI doom dominates the headlines. LLMs can help sort the queue, but useful triage depends on evidence, limited access and spending controls. Andrey Devyatkin and Fernando Gonçalves discuss GuardDuty findings, live AWS policies, read-only permission traps and tool guards, explaining why assisted investigation and batch analysis should come before unattended agents. What you will learn: How batching a week of alerts reveals rules worth tuning Why a CI/CD escalation finding needs live policy evidence Why ReadOnlyAccess can expose S3 objects and DynamoDB data How tool guards catch calls that IAM policies still allow Why separate invocation limits cannot cap spending across repeated triggers Maybe try B.O.R.I.S, our context layer for AI agents: https://www.getboris.ai Episode page, show notes and links