I audited my own systems and found six open doors

Six ways a stranger could have sent email as me. I build this infrastructure for a living, and I still had to find them the hard way.

Here is the short version. In August I went through every endpoint in the Growth Rebels stack: the forms, the webhooks, the AI workers, the chat agent. Six of my automation scenarios accepted requests from anyone who knew the address. Not one of them checked who was asking. Someone who found those addresses could have used my email service to send whatever they liked, from my domain, with my name on it. I would have found out when the complaints arrived.

Nothing happened. I found them, gated them, and they are closed. But the interesting part is not the fix. It is how they got there.

The systems were built well and were still wide open #

None of this came from carelessness or from cheap tooling. The stack is deliberate: static hosting, no plugins to patch, modern infrastructure, the kind of setup I would defend in any technical review. The individual pieces were sound.

What was missing was the join. Each endpoint had been built for a specific job and tested for that job. It worked. Nobody asked the separate question of what else it would accept, because that question belongs to the system as a whole rather than to any one part of it, and the system as a whole had no owner asking it.

I had also made a quiet assumption I want to name, because I suspect it is common. I assumed that because the browser would only let my own site talk to those endpoints, only my own site could talk to them. That is wrong. Those rules govern browsers. They do not govern anything else. A script does not use a browser.

That assumption is the sort of thing you can hold for a long time without it ever being tested, right up until it is.

Building has become cheap. Running has not #

This is the part I want firm owners to take away.

AI has made building genuinely fast. I use it every day and it has changed how much one person can produce, in quality as much as in speed. Marketing infrastructure is particularly well suited to it: it is code, it is language, and it is plumbing between systems, which is three things these tools are good at. I am not going to pretend otherwise, and I am more optimistic about my own trade than I was a year ago.

But building a thing and running a thing are different jobs, and only one of them got cheaper.

Running it means knowing what each piece will accept and refuse. It means noticing when something starts behaving differently. It means someone holding the whole picture, because the gaps between the parts are exactly where nothing gets checked. That work is unglamorous, it never finishes, and no tool has made it faster.

So the risk has moved. It used to be that you could not build the thing. Now you can build it in a weekend, and the exposure sits in everything that happens after the weekend.

The floor keeps rising, which is the part nobody sold you #

There is a fair objection to all of this: fine, but can I not just do the minimum and be done with it?

You can. The trouble is that the minimum keeps moving, and it moves for a reason worth understanding.

AI lowered the cost of producing things. It did not lower the cost of being chosen. Your competitors got the same tools on the same day you did, so the average standard of what a firm puts out went up, and the reader's patience went down to match. Producing became cheap. Standing out became expensive. Those two things are not in tension, they are the same fact seen from either end.

Watch what that has done to the surface area. Three years ago a professional-services firm needed a decent website and a Google ranking. Today it needs the site, the ranking, a chance of being cited when someone asks an AI assistant for a recommendation, ads that survive rising competition for the same clicks, something that catches an enquiry the moment it arrives, and follow-up that runs whether or not anyone remembers to send it. Same firm. Same market. Same number of hours in the week. Considerably more ground to hold.

Nobody sat down and decided to make it harder. It got harder because the tools that made your side easier made everyone else's side easier at the same time, and a floor that everyone can reach stops being an advantage and becomes the price of entry.

This is why "I will just do the basics myself" ages badly. Not because the basics are hard. Because in eighteen months they will not be the basics. Here is what AI actually does for a firm in 2026, without the hype.

What this has to do with the news #

In August the US administration signed a memo letting vetted private companies conduct offensive operations against foreign criminal networks, under government oversight. Whatever you make of it, it tells you how seriously the problem is being taken at that level.

I am going to be honest about the relevance: it does not directly change anything for a firm in Perth. What it reflects is the scale of the industry on the other side, which is organised, well funded, and increasingly automated. Automated attacks do not choose targets because they are important. They sweep for anything that answers.

Closer to home, the Australian Signals Directorate reported the average self-reported cost of cybercrime per report for a small business at $56,600, up 14 per cent, across more than 84,700 reports in a year. That is roughly one report every six minutes. Those are the ones people filed.

I am deliberately not giving you a percentage for how fast AI-assisted attacks are growing. I went looking for a credible source and found a lot of confident numbers with nothing underneath them. The direction is clear enough without inventing precision.

So should you build your own? #

The honest answer, and I am aware of how it sounds coming from me: probably not, and not for the reason you would expect.

You can build it now. AI will get you a working lead system, and it may look good. The problem is not the build. The problem is that you will then own something that needs someone to run it, and that job does not fit alongside running your firm. It is not a matter of intelligence or capability. It is that this is a full attention job and you already have one.

Here is the obvious objection, so let me put it up first: I sell this, so of course I say this. Fair. Test it this way instead. If you did build it yourself, who checks the endpoints in six months? Who notices when a form starts accepting things it should not? If you cannot name that person, you do not have a system, you have a project that is still running.

The part I would genuinely hand to you rather than keep is the thinking. You know how your clients actually arrive, what they ask before they commit, which enquiries turn into work and which waste a fortnight. That knowledge is the real input, and no AI has it. It is also the part most agencies never bother to extract before they start building. This is how I run that process.

Give me that. I will handle what it is exposing.

The honest footnote #

My own work is not finished. There are items on my list I have not closed yet, and they are getting closed before I write another word about anyone else's exposure.

I am publishing this anyway, because a piece about auditing your own systems that pretends the author's are perfect would be worth nothing. The point is not that I got it right. The point is that I looked, and that looking is a job somebody has to keep doing.