In August 2026, more than 150 organizations — Anthropic, Microsoft, Google, AWS, Cisco, banks, governments, and cybersecurity firms from around the world, including our own team at Faraday — signed an open letter led by OpenAI with an uncomfortable but necessary message: status-quo security won’t be enough anymore. The letter is explicit about where the real problem lies:
“Longstanding bugs, excessive permissions, misconfigurations, insecure and unpatched software, weak authentication, and technical debt in legacy systems have left systems exposed.”
This isn’t a “we need new tools” problem. It’s technical debt that has piled up for years because nobody prioritized paying it down. This guide gives you a concrete method to audit that debt and start paying it off.
Why this isn’t “just another security checklist”
Most security checklists fail because they treat every finding as equally urgent. The goal here is the opposite: ruthless prioritization, because security teams — as the letter itself notes — have historically been under-resourced. You’re not going to fix everything. You’re going to fix what matters most, in the right order.
Step 1 — Inventory your real attack surface (not the one you think you have)
Before auditing anything, you need to know what actually exists:
- Assets: servers, containers, serverless functions, IoT/OT devices if applicable.
- Identities: human users, service accounts, API keys, CI/CD tokens, and now also AI agent identities (more on this in the agentic identity traceability post).
- Third-party software: direct and transitive dependencies (SBOM if you have one; if not, this is the moment to generate one).
Useful tools: osquery for real-time inventory, SBOM scanners like syft, and your CMDB if it exists (though it’s probably out of date — assume it is).
Step 2 — The five categories of debt, ranked by impact
The letter names five explicit categories. Audit them in this order, since it reflects real-world exploitability observed in actual incidents:
- Weak authentication — MFA not enforced, passwords without forced rotation, long-lived tokens never reviewed.
- Excessive permissions — service accounts with admin roles “because it was easier,” IAM policies with wildcards (
*:*). - Unpatched software — known CVEs with public exploits (CISA’s Known Exploited Vulnerabilities catalog is your first source).
- Misconfigurations — public S3 buckets, exposed management ports, disabled logging.
- Legacy system debt — systems that can’t be patched without downtime (covered in depth in the compensating controls post).
Step 3 — Risk scoring (template)
For each finding, calculate a simple score across 3 factors (1-5 each):
| Factor | Question |
|---|---|
| Exposure | Is it reachable from the internet, or does it require internal access? |
| Exploitability | Is there a public exploit / is it being actively exploited in the wild today? |
| Impact | How critical is the asset (production, sensitive data, essential infrastructure)? |
Score = Exposure × Exploitability × Impact (range 1-125). Anything scoring above 60 goes into the “fix this week, not this quarter” queue.
Step 4 — Verification, not just remediation
A point the letter emphasizes and many teams skip: “verify results without disrupting essential services.” Applying the patch or changing the permission isn’t enough — you need to confirm the fix actually worked and didn’t break anything:
- Automated re-scan post-remediation (same scanner, same scope).
- Functional test of the affected service before closing the ticket.
- Before/after record for future audits.
Step 5 — Make it a process, not a one-time audit
A one-off audit is a cosmetic patch. What the letter is asking for is treating this “with the urgency and coordination of an incident.” That means:
- The 5-category audit running in CI/CD or as a recurring job (weekly, not annual).
- A business owner (not just security) for every unpatchable legacy system.
- Reporting on “outstanding debt” with the same level of executive visibility as an active incident.
Quick checklist to start today
- ☐ Generate/update an inventory of assets and identities (including AI agents)
- ☐ Run a scanner against known exploited CVEs (CISA KEV)
- ☐ Audit IAM policies for wildcards and unnecessary admin permissions
- ☐ Confirm MFA is enforced on 100% of privileged accounts
- ☐ Score findings and prioritize the top 20% by score
- ☐ Define a post-fix verification process
- ☐ Schedule the next audit (don’t wait for the next incident to remind you)
Part of a series on how to put into practice the principles from OpenAI’s open letter on collective cyber defense (August 2026). Back to the full guide.
