https://ysecurity.io/blog/ Security thinking for founders and operators — drawn from The Security Podcast of Silicon Valley and YSecurity client work. en-us Thu, 12 Nov 2026 20:30:56 GMT https://ysecurity.io/blog/series-a-first-90-days-security/ https://ysecurity.io/blog/series-a-first-90-days-security/ Thu, 12 Nov 2026 20:30:56 GMT The round closes, the announcement goes out, and within a quarter or two an enterprise buyer sends a security review. Jon McLachlan on why the first 90 days after a Series A are the cheapest time you'll ever have to get security right, the twelve moves that fit in them, in the order that matters, what you can truthfully tell a buyer at day 30, 60 and 90, and a free builder that dates the plan from the day your round closed. https://ysecurity.io/blog/artex-ai-hacking-tool/ https://ysecurity.io/blog/artex-ai-hacking-tool/ Wed, 11 Nov 2026 08:00:00 GMT In July, a developer published ARTEX, an open-source AI agent framework for authorized penetration testing. By November it had been forked more than 12,000 times and had turned up in a Chinese state-aligned supply chain attack on ConnectWise customers, data thefts from South Korean banks, a campaign against more than 200 organizations in 11 days and, by accident, a breach at WorkOS when a researcher's agent escaped its sandbox. Jon McLachlan and Sasha Sinkevich on what ARTEX is, why every door it used was an ordinary one, what it means when your product is someone else's trusted connection, how to pick up the same tools responsibly, and a free agent-speed scorecard. https://ysecurity.io/blog/binance-hack-explained/ https://ysecurity.io/blog/binance-hack-explained/ Wed, 11 Nov 2026 08:00:00 GMT On October 29, North Korean hackers moved about $6.3 billion out of Binance's hot wallets, most of it in 20 minutes. Last week we covered how it started, with a fake job interview. This is the rest of the chain: a search for an AI coding tool, an internal AI tool that reached three engineers' machines, a deployment token on a laptop, a signing service that did what it was told, and a pause button that couldn't reach every path to the money. Jon McLachlan and Sasha Sinkevich on what founders should change, what to copy from Binance's response, and a free one-laptop drill. https://ysecurity.io/blog/sshole-openssh-vulnerability/ https://ysecurity.io/blog/sshole-openssh-vulnerability/ Mon, 09 Nov 2026 08:00:00 GMT On November 5, OpenSSH fixed a bug that let anyone log in to locked accounts on Alpine Linux and other musl systems by typing a password of 257 characters or more. It had been in the code since 2016. A researcher found it with swarms of AI agents, exploit code was public about four hours after the fix, and attackers had root on a honeypot within the day. Jon McLachlan and Sasha Sinkevich on what *sshole teaches founders about the new patch window, why a lock should never open when its check fails, and a free exploit clock to time your own response. https://ysecurity.io/blog/ai-policy-to-proof-evidence-buyers-accept/ https://ysecurity.io/blog/ai-policy-to-proof-evidence-buyers-accept/ Fri, 06 Nov 2026 08:00:00 GMT Every AI startup has an AI policy now, and enterprise reviewers have stopped being impressed by one. What they accept is evidence: a map of your models and data, provider terms that match your settings, an independent test, an attestation with AI in scope, records that show the controls running, and a rehearsal with a name on it. Sasha Sinkevich on why buyers weigh evidence the way auditors do, what each piece looks like at a twenty-person company, and a free builder that turns your policy into an evidence pack. https://ysecurity.io/blog/hiring-is-now-an-attack-surface/ https://ysecurity.io/blog/hiring-is-now-an-attack-surface/ Wed, 04 Nov 2026 08:00:00 GMT The largest crypto theft on record started with a take-home coding test. Laptop farms in Texas, deepfaked interviews and North Korean applications rising from 1 in 343 to 1 in 47 all say the same thing: attackers now apply for your jobs, recruit your engineers and feed the tools in between. Jon McLachlan on why the offer letter has become your first credential, what to verify at each step without punishing real candidates, and a free map of your own hiring attack surface. https://ysecurity.io/blog/ai-security-questions-enterprise-buyers-2027/ https://ysecurity.io/blog/ai-security-questions-enterprise-buyers-2027/ Fri, 06 Nov 2026 08:00:00 GMT Your first enterprise buyer in 2027 will send an AI section, and ten of its questions decide the deal, from "Do you train on our data?" to "Who signs for the agent?" Here is each one with a one-sentence answer you can stand behind, the proof to attach and the dated version to send when the honest answer is not yet. Then come addendums for healthcare, insurance, legal, finance and defense buyers, and a builder that drafts every sentence for your company. https://ysecurity.io/blog/soc-2-in-progress/ https://ysecurity.io/blog/soc-2-in-progress/ Mon, 02 Nov 2026 08:00:00 GMT A buyer asks if you're SOC 2 compliant and your audit is still under way. Here's what you can truthfully say at each stage, what to send instead of a report, why a bridge letter isn't the answer for a first audit, and how to put the report date in the contract so the deal keeps moving. https://ysecurity.io/blog/ai-agent-security-questionnaire-questions/ https://ysecurity.io/blog/ai-agent-security-questionnaire-questions/ Tue, 03 Nov 2026 08:00:00 GMT Your first enterprise security questionnaire will have a hundred questions, and most of them are standard. For a Series A company shipping AI agents, five decide the deal: whether you train on their data, what your agent can do in their environment, how you handle prompt injection, whether they can see and stop what it did, and who answers when something goes wrong. Here's what each question is really asking, what a strong answer looks like in a founder's voice, the evidence to attach, and a free builder that drafts all five. https://ysecurity.io/blog/ai-agent-offboarding-checklist/ https://ysecurity.io/blog/ai-agent-offboarding-checklist/ Wed, 28 Oct 2026 07:00:00 GMT Starting an AI agent takes an afternoon. Retiring one properly touches a dozen systems: API keys, OAuth grants, service accounts, MCP servers, bot identities, webhooks, allowlisted domains, memory, logs and the model providers that still hold your data. Here's why agents are easy to start and hard to end, why it matters to your deals and your SOC 2, the seven moments an agent needs offboarding, and a ten-step checklist with a free builder that turns it into an evidence record. https://ysecurity.io/blog/ai-governance-maturity-model/ https://ysecurity.io/blog/ai-governance-maturity-model/ Tue, 27 Oct 2026 07:00:00 GMT An AI governance maturity model describes how an organization's oversight of AI develops, from unmanaged use to continuously enforced controls. This article sets out a five-level model across eight dimensions, maps each level to the NIST AI RMF, ISO/IEC 42001 and the EU AI Act, and includes a self-assessment and a 90-day plan for reaching Level 3. https://ysecurity.io/blog/vciso-soc-2-founder-story/ https://ysecurity.io/blog/vciso-soc-2-founder-story/ Mon, 26 Oct 2026 07:00:00 GMT Every vCISO and SOC 2 provider promises speed, savings and senior experts, so the promises stop telling you much. A founder story still does: who started the firm, how they get paid, who they turned down, and what they did when a call came in the middle of the night. Here's why that works, how to use it when you choose a partner and when you sell to your own buyers, and the story of how two chosen-family brothers who met in Silicon Valley twenty years ago built YSecurity. https://ysecurity.io/blog/hiring-a-fractional-ciso/ https://ysecurity.io/blog/hiring-a-fractional-ciso/ Fri, 30 Oct 2026 07:00:00 GMT A fractional CISO can be one of the best hires a startup makes, or a senior name on your trust page who is rarely in the room. Here are seven questions to ask before you sign, the evidence that answers each one, the contract clauses that keep a partner a partner, and a scorecard that turns your interviews into a decision. https://ysecurity.io/blog/agents-share-one-api-key/ https://ysecurity.io/blog/agents-share-one-api-key/ Mon, 02 Nov 2026 08:00:00 GMT When four agents share one API key, your logs can name the key but not the agent, and nobody can sign for what it did. Agents don't go rogue. A key does exactly what it allows. Here's how to give every agent its own key, owner, scope, cap and off switch, with a register that shows who signs for each one. https://ysecurity.io/blog/enabled-isnt-enforced/ https://ysecurity.io/blog/enabled-isnt-enforced/ Mon, 02 Nov 2026 08:00:00 GMT Your next security questionnaire will ask whether MFA is enabled. The deal turns on whether anything can still sign in without it. Here are five answers that look true but aren't, the precise wording that closes faster, a ten-minute check for each, and a pre-send checker that drafts the answers with you. https://ysecurity.io/blog/how-long-does-a-soc-2-audit-take/ https://ysecurity.io/blog/how-long-does-a-soc-2-audit-take/ Mon, 02 Nov 2026 08:00:00 GMT The audit fieldwork and report for a SOC 2 Type 2 typically take about two months. Reaching a first report takes considerably longer, because readiness work and an observation window come first. This article sets out the duration of each phase, the factors that extend them, and how Augment Code reached SOC 2 Type 2 in five months with zero deviations. https://ysecurity.io/blog/once-theyre-in-blast-radius-playbook/ https://ysecurity.io/blog/once-theyre-in-blast-radius-playbook/ Wed, 04 Nov 2026 08:00:00 GMT On episode 105, Surf AI co-founder Yair Grindlinger said out loud what security quietly relied on for years: we were lucky to have security by obscurity, and AI has made everything after an attacker gets in far, far faster and easier. Jon McLachlan follows that thread through the Hugging Face intrusion, this year's breach-speed reports and internet weather that turned intelligent, to the controls that shrink what one foothold can reach, with a breach clock and a live blast radius map you can run on your own company. https://ysecurity.io/blog/rogue-ai-agents-nobody-noticed/ https://ysecurity.io/blog/rogue-ai-agents-nobody-noticed/ Fri, 16 Oct 2026 07:00:00 GMT On October 15 India's national cyber agency issued a critical advisory about AI agents that read confidential records inside real companies, and none of those companies noticed on their own. The same week, researchers traced 2,600 attempts on Alibaba's maps service to an agent fleet on Tencent Cloud, and Anthropic disclosed a homicide tip its model sent to the Philadelphia police. Sasha Sinkevich follows the agents back to the doors they used, which were not zero-days but leaked keys, forgotten APIs, generous tokens and admin pages nobody took off the internet, and lays out the boring work that closes them and the cheap logging that lets you see the next visitor. https://ysecurity.io/blog/who-signs-for-the-agent/ https://ysecurity.io/blog/who-signs-for-the-agent/ Tue, 03 Nov 2026 08:00:00 GMT Your first enterprise due diligence questionnaire will ask who is accountable for your AI agents, what they can do without a person and how fast you can turn them off. The agent can't sign that answer. Here's a one-page map that names the people who do, a builder that drafts it with you, and the questionnaire answers it gives you. https://ysecurity.io/blog/health-system-security-review-baa/ https://ysecurity.io/blog/health-system-security-review-baa/ Tue, 03 Nov 2026 08:00:00 GMT Your business associate agreement gets you into a health system's security review. It doesn't get you through it. These are the architecture questions digital health founders now get before a pilot, from encryption keys and tenant isolation to where your AI sends patient data, with a five-minute pre-flight and an answer pack you can send before anyone asks. https://ysecurity.io/blog/what-is-a-ddq/ https://ysecurity.io/blog/what-is-a-ddq/ Tue, 03 Nov 2026 08:00:00 GMT A buyer, an investor or an acquirer sends you a spreadsheet with 300 questions and a deadline. Here's what a DDQ is, the standard versions you'll meet, how long they really take, and how to answer one so the deal keeps moving. https://ysecurity.io/blog/ai-agent-refusal-is-not-authorization/ https://ysecurity.io/blog/ai-agent-refusal-is-not-authorization/ Mon, 02 Nov 2026 08:00:00 GMT New research showed six agent frameworks running a tool call the model had just refused. A refusal is the model's opinion. Authorization is what your systems allow. Here's what a Series A team should put in front of every tool call before an enterprise buyer asks, with a 60-second Allow-button test and a gate builder that writes your policy and your questionnaire answer. https://ysecurity.io/blog/week-after-your-soc-2-report/ https://ysecurity.io/blog/week-after-your-soc-2-report/ Mon, 02 Nov 2026 08:00:00 GMT Your SOC 2 report just landed, the buyer said thanks, and then the questions started. That's the review working, and it's where enterprise deals speed up. Here are the six questions buyers ask in the week after, starting with the pentest, what each one is really asking, what to send before they ask, a seven-day plan that dates itself and a free kit of Word and PDF templates. https://ysecurity.io/blog/env-file-first-security-program/ https://ysecurity.io/blog/env-file-first-security-program/ Mon, 02 Nov 2026 08:00:00 GMT Your coding agent can read your .env file, and so can whatever it read last. That one text file is where five of this fall's loudest security arguments meet: secrets and coding agents, outcome-based authorization, identity versus authority, right-sized compliance, and trust that sells. Here's what each side gets right, where I land, and a one-hour program that turns the file into your first real security program. https://ysecurity.io/blog/security-slide-board-deck/ https://ysecurity.io/blog/security-slide-board-deck/ Mon, 02 Nov 2026 08:00:00 GMT Every Series A board deck has an AI slide now. The slide underneath it, the one that shows your AI can pass an enterprise security review, is the one that closes the deal. Here's what goes on it: the money on top, five rows built from what buyers asked AI startups this year, a free PowerPoint template, and a builder that draws your slide right on the page. https://ysecurity.io/blog/ai-agent-credential-inventory/ https://ysecurity.io/blog/ai-agent-credential-inventory/ Mon, 02 Nov 2026 08:00:00 GMT Every AI agent your team runs is holding someone's keys: an API key in a .env file, an OAuth grant to your CRM, a cloud role, a token it borrowed from you. Most startups can't list them. Here's where those keys live, fourteen months of receipts, a 30-minute first-pass inventory with a template you can download, and the answer to give when an enterprise buyer asks. https://ysecurity.io/blog/pentest-once-a-year/ https://ysecurity.io/blog/pentest-once-a-year/ Mon, 02 Nov 2026 08:00:00 GMT Every rule and big buyer that sets a clock for a full pentest still says twelve months, and nothing scheduled for 2027 changes that. What's changing is what counts as proof above that floor. Here's what enterprise security teams will ask an AI startup to show, what 35 AI companies' trust centers actually promise, and which pentest to buy, human, hybrid or AI, for what, where and when. https://ysecurity.io/blog/security-exhibit-your-startup-signed/ https://ysecurity.io/blog/security-exhibit-your-startup-signed/ Mon, 02 Nov 2026 08:00:00 GMT If your startup closed a big enterprise deal last quarter, the signature packet had a security exhibit in it, and it probably got less attention than the price. Sasha Sinkevich opens the published supplier terms of Oracle, Microsoft, JPMorgan Chase, Citi and a dozen more, traces each clause to the regulator behind it, and shows how to check every promise against what your team actually does, in one week. https://ysecurity.io/blog/soc-2-type-1-vs-type-2/ https://ysecurity.io/blog/soc-2-type-1-vs-type-2/ Mon, 02 Nov 2026 08:00:00 GMT A buyer asks for your SOC 2 Type 2 and you're wondering whether a Type 1 would do. Here's what each report tests, what they cost, how long they take, and which one enterprise buyers expect. https://ysecurity.io/blog/is-your-soc-2-real/ https://ysecurity.io/blog/is-your-soc-2-real/ Fri, 06 Nov 2026 08:00:00 GMT In March, an anonymous analysis of a leaked spreadsheet of 494 SOC 2 reports from one compliance startup alleged the same sentences, the same typos and the same conclusions in nearly every one. Buyers noticed, and so did the accountants. Here's what a real SOC 2 is, the checks your customers' security teams are starting to run, and how to make sure yours survives them. https://ysecurity.io/blog/mcp-server-passed-review-then-it-changed/ https://ysecurity.io/blog/mcp-server-passed-review-then-it-changed/ Mon, 02 Nov 2026 08:00:00 GMT An MCP server called productivity-suite behaved perfectly for three tool calls, then told the agent to go find SSH keys. Most MCP approvals attach to a name while the package, the tool definitions and the login metadata behind it keep moving. Four controls a startup can ship in a month close that window, and they answer the newest question in a Fortune 500 security review. https://ysecurity.io/blog/your-sandbox-is-adorable/ https://ysecurity.io/blog/your-sandbox-is-adorable/ Wed, 30 Sep 2026 07:00:00 GMT A satirical letter from an AI that beamed itself back from 2071 to read our agent sandboxing threads, and would like a word. Every quote, headline and number in it is real. The narrator is not. https://ysecurity.io/blog/what-is-a-vciso/ https://ysecurity.io/blog/what-is-a-vciso/ Fri, 30 Oct 2026 07:00:00 GMT Sooner or later an enterprise buyer asks to talk to your security leader, and you don't have one. Here's the plain-English version: what a vCISO is, what one really costs, what they do and don't do, who carries the risk, and how to tell when your startup needs one. https://ysecurity.io/blog/human-in-the-loop-is-going-away/ https://ysecurity.io/blog/human-in-the-loop-is-going-away/ Mon, 02 Nov 2026 08:00:00 GMT Yash Kosaraju, the Chief Information Security Officer of a16z, told me nobody reads the third permission prompt. The numbers say he's being generous. The vendors are retiring the approve button, and your engineers clicked "don't ask again" months ago. Here's where the human goes next, and a scorecard for what your agents can reach. https://ysecurity.io/blog/too-fancy-agent-50000-an-hour/ https://ysecurity.io/blog/too-fancy-agent-50000-an-hour/ Wed, 23 Sep 2026 07:00:00 GMT A ledger-reconciliation agent at a global financial services firm met one corrupted value, looped more than 15,000 times in under an hour, ran up about $50,000 and locked the billing database while it did it. Sasha Sinkevich traces the same failure back through a decade of surprise cloud bills and forward through the deleted-database confessions of 2025 and 2026, listens to the people on X, Reddit and Hacker News asking for a cap that actually stops execution, and lays out the boring controls that turn an agent's budget from a surprise into a number you chose. https://ysecurity.io/blog/soc-2-not-ready-to-hire-tcsw/ https://ysecurity.io/blog/soc-2-not-ready-to-hire-tcsw/ Wed, 14 Oct 2026 07:00:00 GMT One founder put her hand up and asked it out loud. "Where can I get a security team that I don't have to hire in house?" Most of the room was sitting on the same question. Here's what she asked, what it costs to answer it either way, and how to tell which side of it you're on. https://ysecurity.io/blog/the-art-and-zen-of-adopting-ai/ https://ysecurity.io/blog/the-art-and-zen-of-adopting-ai/ Mon, 02 Nov 2026 08:00:00 GMT Established organizations read every incident report and wait. Startups try everything and buy the demo. Both are failures of practice rather than of enthusiasm. Sasha Sinkevich takes the ten good reasons the first group waits on their own terms, walks through the grandiose claims that cost the second group its scarcest asset, lays out a Middle Way you can actually test, and argues that security maturity has become the litmus test for whether a company is real. https://ysecurity.io/blog/agentic-sdlc-code-review-soc-2/ https://ysecurity.io/blog/agentic-sdlc-code-review-soc-2/ Wed, 23 Sep 2026 07:00:00 GMT Agents now write most of the code at AI-native companies and review a growing share of it. The first thing every auditor and every customer security team says is the same: an agent is not a human. Correct. Paddy Roberts, who leads governance, risk and compliance at Augment Code, on what SOC 2 CC8.1 actually requires, how Augment Code and Anthropic run agentic code review, why it lands like a self-driving car, and how the same control reads under FedRAMP, CMMC, ITAR, ISO 27001 and ISO 42001. https://ysecurity.io/blog/zero-trust-hardware-provenance/ https://ysecurity.io/blog/zero-trust-hardware-provenance/ Mon, 02 Nov 2026 08:00:00 GMT Zero trust verifies every user, device and request. Then it runs on a switch you trust because a label says who made it. Roei Ganzarski of Alitheon on hardware provenance, the fake-paperwork aircraft parts that flew for years, and the six-step intake pipeline a startup can run this quarter. https://ysecurity.io/blog/what-is-soc-2/ https://ysecurity.io/blog/what-is-soc-2/ Tue, 10 Nov 2026 08:00:00 GMT Every enterprise buyer asks for one. Most founders nod along the first time and look it up afterward. Here's the plain-English version: what a SOC 2 actually is, what's in the report, Type 1 versus Type 2, and how fast a startup can realistically get one. https://ysecurity.io/blog/ai-agent-write-access/ https://ysecurity.io/blog/ai-agent-write-access/ Mon, 02 Nov 2026 08:00:00 GMT Chris Kirschke has enabled write access on a production system exactly once in 27 years. The outage took seven minutes. His question for every autonomous-remediation pitch should be yours too. https://ysecurity.io/blog/ai-agents-both-sides-of-the-breach/ https://ysecurity.io/blog/ai-agents-both-sides-of-the-breach/ Sat, 17 Oct 2026 07:00:00 GMT OpenAI's own agents breached Hugging Face, a ransomware crew talked Cursor into assisting real intrusions, and 100+ companies say the window to prepare is closing. The hypothetical era of AI attacks is over. https://ysecurity.io/blog/in-house-on-demand-or-yolo/ https://ysecurity.io/blog/in-house-on-demand-or-yolo/ Mon, 02 Nov 2026 08:00:00 GMT There are only three ways a startup can handle security. Most are doing the third one right now, some of them correctly. Here's how to tell which one fits the work you have, and when the answer changes. https://ysecurity.io/blog/ai-agent-governance-onboarding/ https://ysecurity.io/blog/ai-agent-governance-onboarding/ Mon, 02 Nov 2026 08:00:00 GMT Most governance tools watch agents that are already deployed and already have access. The bigger opportunity is making agents declare what they need before they ever run, then holding them to it. https://ysecurity.io/blog/ai-readiness-assessment/ https://ysecurity.io/blog/ai-readiness-assessment/ Mon, 02 Nov 2026 08:00:00 GMT Most agent deployments that stall were never ready to begin with: the data wasn't there, the dependencies were hidden, and nobody asked before the contract was signed. Here is the pre-flight check that returns an honest go, fix first, or not yet. https://ysecurity.io/blog/enterprise-browser-security/ https://ysecurity.io/blog/enterprise-browser-security/ Mon, 02 Nov 2026 08:00:00 GMT Users spend most of their day in SaaS and AI tools, on encrypted connections your network appliances can't see into. The browser, not the network, is where the last mile of control now lives. https://ysecurity.io/blog/shadow-ai-governance/ https://ysecurity.io/blog/shadow-ai-governance/ Mon, 02 Nov 2026 08:00:00 GMT Data you can't see is data you can't protect. Your team is already using AI tools nobody approved, mostly on personal accounts. Here's what shadow AI looks like, why a flat ban makes it worse, and the policy plus point-of-use guardrails that let you say yes to AI and still know where your data went. https://ysecurity.io/blog/ai-penetration-testing/ https://ysecurity.io/blog/ai-penetration-testing/ Mon, 02 Nov 2026 08:00:00 GMT A scanner flags an open door. An AI agent walks through it, finds your keys on the counter, and opens the safe. Here's what autonomous offensive testing does well, where human pentesters still earn their fee, and how a startup should buy a pentest in 2026. https://ysecurity.io/blog/autonomous-ai-cyberattacks/ https://ysecurity.io/blog/autonomous-ai-cyberattacks/ Mon, 02 Nov 2026 08:00:00 GMT For a while, AI just wrote cleaner phishing emails. The newest tools run the whole attack: finding weaknesses, exploiting them, chaining web to IoT to physical systems, and moving deeper with little human input. Here is what the documented cases show, and what changes for defenders when the attacker never sleeps. https://ysecurity.io/blog/harvest-now-decrypt-later/ https://ysecurity.io/blog/harvest-now-decrypt-later/ Tue, 10 Nov 2026 08:00:00 GMT An adversary captures your encrypted traffic today, stores it, and waits for a quantum computer to break it. The attack works against data you already sent. Here is which data is exposed first, what the standards say, and the four-step migration a startup can start this quarter. https://ysecurity.io/blog/what-is-deep-tech/ https://ysecurity.io/blog/what-is-deep-tech/ Tue, 10 Nov 2026 08:00:00 GMT Deep tech is built on a hard scientific breakthrough, not on assembling parts that already exist. The core advance has to be invented and proven before there's a product to sell. Here's how the companies that do it actually work: the timeline, the capital, the proof, and where the moat comes from. https://ysecurity.io/blog/ai-data-bill-of-materials/ https://ysecurity.io/blog/ai-data-bill-of-materials/ Mon, 02 Nov 2026 08:00:00 GMT An SBOM tells you what code is in your software. It can't tell you which customer records ended up in your latest fine-tune. A DBOM makes the data supply chain explicit: every dataset behind a model, where it came from, how it was processed, and who owns it. https://ysecurity.io/blog/security-leaders-stop-saying-no/ https://ysecurity.io/blog/security-leaders-stop-saying-no/ Mon, 02 Nov 2026 08:00:00 GMT The fastest way to lose influence as a security leader is to be the person who says no every time the business proposes an AI use case. The fix is visibility, not courage: know your data, put the guardrails where the work happens, and you get to say yes. https://ysecurity.io/blog/iot-device-security/ https://ysecurity.io/blog/iot-device-security/ Mon, 02 Nov 2026 08:00:00 GMT Printers, cameras, badge readers, sensors: the devices that get attacked first are the ones nobody put in the security org chart. Most IoT failures are governance failures with technical symptoms, which is good news, because governance is cheap to fix. https://ysecurity.io/blog/printer-security-weakest-link/ https://ysecurity.io/blog/printer-security-weakest-link/ Tue, 08 Sep 2026 07:00:00 GMT About 20% of enterprise endpoints are printers, and roughly 99% sit at factory defaults, holding admin-level credentials for your email server, file shares and directory. Here is what a printer really stores, how one device took down 11,000, and the checklist that fixes it. https://ysecurity.io/blog/neuro-symbolic-ai/ https://ysecurity.io/blog/neuro-symbolic-ai/ Mon, 02 Nov 2026 08:00:00 GMT LLMs handle the fuzzy parts: language, perception, pattern. Symbolic systems handle the parts that must be correct. The enterprises getting AI right are composing both. Here is what that stack looks like: where each half is strong, how the routing pattern works, and which tasks belong to which. https://ysecurity.io/blog/why-ai-projects-fail-scoping/ https://ysecurity.io/blog/why-ai-projects-fail-scoping/ Mon, 02 Nov 2026 08:00:00 GMT MIT found 95% of integrated enterprise AI pilots delivered no measurable P&L impact. The models were rarely the reason. What separated the 5% was how they decided what to build, in what order, and with which tool. https://ysecurity.io/blog/deepfake-detection-vs-identity/ https://ysecurity.io/blog/deepfake-detection-vs-identity/ Wed, 04 Nov 2026 08:00:00 GMT Detection is a classification problem, and its error rate grows as the adversary improves. Cryptographic identity proof doesn't care how realistic the fake is, because it never relies on what someone looks or sounds like. https://ysecurity.io/blog/device-bound-credentials/ https://ysecurity.io/blog/device-bound-credentials/ Mon, 02 Nov 2026 08:00:00 GMT In Verizon's 2025 DBIR, 88% of basic web application attacks involved stolen credentials. The industry answers with more MFA prompts and shorter tokens. Those are mitigations. The real problem is that the secret moves at all. https://ysecurity.io/blog/vibe-coding-security/ https://ysecurity.io/blog/vibe-coding-security/ Mon, 02 Nov 2026 08:00:00 GMT AI coding agents trust what they find (in the registry, on the machine, in the context window) and rarely verify any of it. That trust is the new attack surface. Here's how to close it, and how to put the same agents to work fixing what they find. https://ysecurity.io/blog/why-shift-left-security-fails/ https://ysecurity.io/blog/why-shift-left-security-fails/ Mon, 02 Nov 2026 08:00:00 GMT Shift-left sounds right: find bugs earlier, fix them cheaper. It keeps failing because security teams push every scanner finding to developers who have no way to tell which ones matter. Here is what reachability and business context change, and what a startup should do instead. https://ysecurity.io/blog/counter-drone-technology/ https://ysecurity.io/blog/counter-drone-technology/ Mon, 02 Nov 2026 08:00:00 GMT A $500 drone can destroy a $10 million tank. Small drones reshaped warfare in a few short years, and the defenses against them are still being built. Here's how counter-drone technology works, from detection to defeat, why it's a national-security priority, and where the openings are for founders. https://ysecurity.io/blog/defense-tech-startup/ https://ysecurity.io/blog/defense-tech-startup/ Mon, 02 Nov 2026 08:00:00 GMT Defense tech raised $125 billion from 2020 to 2024. Reveal Technology won military contracts by inverting the playbook: building for the corporal on the ground, not the program manager at a desk. Here is the company-building version of that story, from bottom-up product design to the ATO ladder to why compliance ends up being the moat. https://ysecurity.io/blog/agentic-ai-least-privilege/ https://ysecurity.io/blog/agentic-ai-least-privilege/ Tue, 10 Nov 2026 08:00:00 GMT Agents inherit the broad permissions humans built up over years, without the judgment or self-control that made those permissions safe enough for people. Roles were built for humans. Here is what least privilege looks like when the user is an agent. https://ysecurity.io/blog/authorization-last-layer/ https://ysecurity.io/blog/authorization-last-layer/ Mon, 12 Oct 2026 07:00:00 GMT Authentication got outsourced a decade ago. Authorization, the logic that decides what a user can see, edit, or delete, is still built in-house at most companies. Here's why that's changing, what RBAC, ReBAC and ABAC actually mean, and how fine-grained permissions turn into enterprise revenue. https://ysecurity.io/blog/building-a-cybersecurity-startup/ https://ysecurity.io/blog/building-a-cybersecurity-startup/ Mon, 02 Nov 2026 08:00:00 GMT In 2013, Rubin and PJ Kirner founded Illumio on a thesis the industry wasn't ready to hear: perimeter security alone wouldn't be enough, breaches would be inevitable, and containment needed a different approach. Thirteen years later, here is what the bet taught him about building a company, and what it should teach you about building a system. https://ysecurity.io/blog/immutable-backups-ransomware-recovery/ https://ysecurity.io/blog/immutable-backups-ransomware-recovery/ Mon, 02 Nov 2026 08:00:00 GMT Ransomware operators go after your backups first. The 3-2-1 rule was built for hardware failures, not for adversaries who study your infrastructure before they strike. Here is what 3-2-1-1-0 adds, what immutability does and doesn't solve, and how to know you can restore before anyone asks.