Will DeepSeek force us to take application security seriously?
The rise of DeepSeek has prompted the usual well-documented concerns around AI, but also raised worries about its potential links to the Chinese state. The Security Think Tank considers the steps security leaders can take to counter threats posed by nation state industrial espionage?
By
- Mike Gillespie and Ellie Hurst
Published: 24 Mar 2025
DeepSeek, the Chinese chatbot launched in January 2025, has made waves across the tech and security world. With over 10 million downloads, its rapid adoption raises an important question: How much of this was driven by genuine interest, and how much was simply curiosity, without fully understanding the implications? Could this widespread use be quietly introducing Chinese source code into corporate networks?
The initial outrage surrounding DeepSeek wasn’t just about its capabilities, it was about its cost. The software shocked the market by delivering high-level mathematics, coding, and reasoning skills comparable to ChatGPT and other top-tier AI models, but at a fraction of the cost and with significantly fewer resources.
What can CISOs do? The answer is simple: what they should already be doing when introducing any new software, hardware, or AI. The core of cyber security remains the same – raising awareness, educating employees, and implementing fundamental security measures. But with Chinese technology already deeply embedded in government, critical infrastructure, and businesses, are we trying to fix a leak after the dam has already burst? The reality is, we lack the time, skills, and resources to untangle the extent of Chinese tech in our systems.
So what makes DeepSeek different? Is it truly a unique risk, or is the media frenzy simply reminding us of the security concerns we’ve been aware of all along? After all, businesses have long been integrating technology from multiple nation states – including Russia – without fully questioning the long-term consequences. Only now are we stepping back to ask: Was this a good idea?
A knee-jerk, unilateral response from security leaders – while well-intentioned – fails to account for the deeply interconnected nature of modern business ecosystems. Practical security steps, such as risk assessments, network segregation, vendor due diligence, and access controls, should already be standard practice. But these measures should never be reactive; they should be part of an ongoing conversation before any new technology is introduced.
Consider the compromised federal phone system during the Obama administration. A lack of due diligence meant officials believed they were purchasing an American-built system – only to later discover it had been assembled in the US from Chinese components. The lesson? Due diligence matters, and it costs money.
If security is a priority, then we must be willing to invest in it – not just in tools and technology, but in continuous education and awareness. The question isn’t whether DeepSeek is a risk. The real question is: Are we finally ready to take security seriously?
