OpenAI paid to get hacked. Steal the idea.

Here's a story from this week that sounds like it has nothing to do with your business. It has everything to do with your business. OpenAI, the company behind ChatGPT, invited a three-person security team to try to break into its systems. Not criminals. Invited guests, under a standing offer called a bug bounty. Find a way in, show us how you did it, and we'll pay you.

It reportedly took them about three hours. They found a sign-in flaw, worked their way to employee credentials, then reached the company's private code. One of the most security-conscious companies on the planet opened up in an afternoon. The payout was US$6,500.

The move worth stealing

The headline everyone ran with was the hack. The idea worth stealing is why it happened at all. OpenAI paid people to attack it, on purpose, so it could find the weak point before someone with worse intentions found it for free. That's the whole play. Pay a small, controlled price now instead of an uncontrolled one later.

I spent six years in Fire and Rescue NSW, and we never drilled for the calm Tuesday. You drill for the night it goes wrong. A system you've never stress-tested is a guess wearing a uniform.

Your version of the drill

Your business doesn't have a code repo to defend. It has something just as exposed. The path a customer takes to give you money. Most owners have never once walked that path themselves. So run your own bug bounty this week. No hackers required.

• Ring your own business after hours. Listen to what a new customer actually hears.
• Fill in your own enquiry form on a Saturday. Time how long the reply takes, if a reply comes at all.
• Ask a mate to try to book you in, then get them to tell you honestly where they got stuck.
• Take the 7-day test. If you switched your phone off for a week, name what breaks first.

The $6,500 lesson

The number worth sitting with isn't the three hours. It's the US$6,500. That flaw, sold to the wrong buyer, was reportedly worth millions. OpenAI got it for the price of a used trailer because it asked first. Your weak point works the same way. A missed after-hours lead costs you quietly, every week, for years. Finding it on purpose costs you an hour and a bruised ego.

Every business gets stress-tested eventually. The only choice you get is whether it happens on your terms.

Where to start

Pick one drill from the list and run it this week. Don't fix anything yet. Just watch what actually happens when someone tries to become your customer. The gap you find is your first system to build. Every business has the flaw. The only question is who finds it first. You, or the customer who never calls back.