https://ysecurity.io/blog/ Security thinking for founders and operators — drawn from The Security Podcast of Silicon Valley and YSecurity client work. en-us Tue, 14 Jul 2026 00:00:00 GMT https://ysecurity.io/blog/ai-agent-governance-onboarding/ https://ysecurity.io/blog/ai-agent-governance-onboarding/ Tue, 14 Jul 2026 00:00:00 GMT Most governance tools watch agents that are already deployed and already have access. The harder gap is making agents declare what they need before they ever run. https://ysecurity.io/blog/ai-readiness-assessment/ https://ysecurity.io/blog/ai-readiness-assessment/ Tue, 14 Jul 2026 00:00:00 GMT More than 60% of AI implementations never reach meaningful ROI — usually because the enterprise was never ready to feed the agent what it needed. Run the check before you sign. https://ysecurity.io/blog/enterprise-browser-security/ https://ysecurity.io/blog/enterprise-browser-security/ Tue, 30 Jun 2026 00:00:00 GMT Users spend most of their day in SaaS and AI tools, on encrypted connections your network appliances can't see into. The browser, not the network, is where the last mile of control now lives. https://ysecurity.io/blog/shadow-ai-governance/ https://ysecurity.io/blog/shadow-ai-governance/ Tue, 30 Jun 2026 00:00:00 GMT Data you can't see is data you can't protect. When staff feed company information into unsanctioned AI tools, it can be stored, logged, or trained on far beyond your control. https://ysecurity.io/blog/ai-penetration-testing/ https://ysecurity.io/blog/ai-penetration-testing/ Fri, 19 Jun 2026 00:00:00 GMT A scanner flags an open door. An AI agent walks through it, finds your keys on the counter, and opens the safe. Here's what autonomous offensive testing can and can't do yet. https://ysecurity.io/blog/autonomous-ai-cyberattacks/ https://ysecurity.io/blog/autonomous-ai-cyberattacks/ Fri, 19 Jun 2026 00:00:00 GMT For a while, AI just wrote cleaner phishing emails. The newest tools run the whole attack — finding weaknesses, exploiting them, and moving deeper with little human input. https://ysecurity.io/blog/harvest-now-decrypt-later/ https://ysecurity.io/blog/harvest-now-decrypt-later/ Wed, 03 Jun 2026 00:00:00 GMT An adversary captures your encrypted traffic today, stores it, and waits for a quantum computer to break it. The attack works against data you already sent. https://ysecurity.io/blog/what-is-deep-tech/ https://ysecurity.io/blog/what-is-deep-tech/ Wed, 03 Jun 2026 00:00:00 GMT Deep tech is built on a hard scientific breakthrough, not on assembling parts that already exist. The core advance has to be invented and proven before there's a product to sell. https://ysecurity.io/blog/ai-data-bill-of-materials/ https://ysecurity.io/blog/ai-data-bill-of-materials/ Tue, 19 May 2026 00:00:00 GMT An SBOM tells you what code is in your software. It can't tell you which customer records ended up in your latest fine-tune. A DBOM makes the data supply chain explicit. https://ysecurity.io/blog/security-leaders-stop-saying-no/ https://ysecurity.io/blog/security-leaders-stop-saying-no/ Tue, 19 May 2026 00:00:00 GMT The fastest way to lose influence as a security leader is to be the person who says no every time the business proposes an AI use case. The fix is visibility, not courage. https://ysecurity.io/blog/iot-device-security/ https://ysecurity.io/blog/iot-device-security/ Thu, 07 May 2026 00:00:00 GMT Printers, cameras, badge readers, sensors — the devices that get attacked first are the ones nobody put in the security org chart. Most IoT failures are governance failures with technical symptoms. https://ysecurity.io/blog/printer-security-weakest-link/ https://ysecurity.io/blog/printer-security-weakest-link/ Thu, 07 May 2026 00:00:00 GMT About 20% of enterprise endpoints are printers. Roughly 99% sit at factory defaults — storing credentials for your email server, file shares, and directory at admin level. https://ysecurity.io/blog/neuro-symbolic-ai/ https://ysecurity.io/blog/neuro-symbolic-ai/ Thu, 23 Apr 2026 00:00:00 GMT LLMs handle the fuzzy parts — language, perception, pattern. Symbolic systems handle the parts that must be correct. The enterprises getting AI right are composing both. https://ysecurity.io/blog/why-ai-projects-fail-scoping/ https://ysecurity.io/blog/why-ai-projects-fail-scoping/ Thu, 23 Apr 2026 00:00:00 GMT MIT found 95% of integrated enterprise AI pilots delivered zero measurable P&L impact. The problem isn't the technology. It's how enterprises decide what to build, in what order, and with which tool. https://ysecurity.io/blog/deepfake-detection-vs-identity/ https://ysecurity.io/blog/deepfake-detection-vs-identity/ Tue, 07 Apr 2026 00:00:00 GMT Detection is a classification problem, and its error rate grows as the adversary improves. Cryptographic identity proof doesn't care how realistic the fake is — it never relies on what someone looks or sounds like. https://ysecurity.io/blog/device-bound-credentials/ https://ysecurity.io/blog/device-bound-credentials/ Tue, 07 Apr 2026 00:00:00 GMT 88% of web app breaches involve stolen credentials. The security industry responds with more MFA and shorter tokens. Those are mitigations. The real problem is that the secret moves at all. https://ysecurity.io/blog/vibe-coding-security/ https://ysecurity.io/blog/vibe-coding-security/ Wed, 25 Mar 2026 00:00:00 GMT AI coding agents trust what they find — in the registry, on the machine, in the context window — often without verifying any of it. That trust is the new attack surface. https://ysecurity.io/blog/why-shift-left-security-fails/ https://ysecurity.io/blog/why-shift-left-security-fails/ Wed, 25 Mar 2026 00:00:00 GMT Shift-left sounds right: find bugs earlier, fix them cheaper. It keeps failing because security teams push findings to developers who lack the context to prioritize them. https://ysecurity.io/blog/counter-drone-technology/ https://ysecurity.io/blog/counter-drone-technology/ Tue, 10 Mar 2026 00:00:00 GMT A $500 drone can destroy a $10 million tank. Small drone swarms reshaped warfare overnight, and Western nations don't yet have adequate defenses against them. https://ysecurity.io/blog/defense-tech-startup/ https://ysecurity.io/blog/defense-tech-startup/ Tue, 10 Mar 2026 00:00:00 GMT Defense tech raised $125 billion from 2020 to 2024. Reveal Technology won military contracts by inverting the playbook — building for the corporal on the ground, not the program manager at a desk. https://ysecurity.io/blog/agentic-ai-least-privilege/ https://ysecurity.io/blog/agentic-ai-least-privilege/ Thu, 05 Mar 2026 00:00:00 GMT Agents get the same broad permissions humans built up over years — without the judgment or self-control that made those permissions safe enough for people. RBAC was built for humans. It breaks for agents. https://ysecurity.io/blog/authorization-last-layer/ https://ysecurity.io/blog/authorization-last-layer/ Thu, 05 Mar 2026 00:00:00 GMT Authentication got outsourced a decade ago. Authorization — the logic that decides what a user can see, edit, or delete — is still built in-house at most companies. AI agents make that unsustainable. https://ysecurity.io/blog/building-a-cybersecurity-startup/ https://ysecurity.io/blog/building-a-cybersecurity-startup/ Wed, 18 Feb 2026 00:00:00 GMT In 2013, Rubin and PJ Kirner founded Illumio on a thesis the industry wasn't ready to hear: perimeter security alone wouldn't be enough, breaches would be inevitable, and containment needed a different approach. https://ysecurity.io/blog/immutable-backups-ransomware-recovery/ https://ysecurity.io/blog/immutable-backups-ransomware-recovery/ Tue, 17 Feb 2026 00:00:00 GMT Ransomware operators go after your backups first. The 3-2-1 rule was built for hardware failures, not for adversaries who study your infrastructure before they strike.