The Security Slide Your Board Deck Is Missing

On October 8, Romulo Juarez, who leads Amazon Web Services (AWS) channel sales in North America for the software analysis company CAST, posted two lines that every founder raising on an artificial intelligence (AI) story should read twice.

Every ISV board deck has an AI slide now.
Very few have a modernization slide underneath it.

Romulo Juarez · SVP, AWS Channel North America at CAST Software · October 8, 2026

Load the post from LinkedIn

I replied in the comments: “Ha, and even fewer have a security slide under the modernization slide. That’s the one that closes the enterprise deal.”

It was a quick comment, so I checked whether it holds up. It does, and the numbers are better than the joke. In Gartner’s 2026 survey of 330 corporate directors, AI came first among the investments directors expect to lift shareholder value, and 71% said they want their company to take more technology risk (Gartner, November 24, 2025). In the same survey, 90% of those directors said they lack a measure of confidence in cybersecurity value, and only 10% were strongly confident they had the balance of protection and cost right.

Read that chart as a founder and it’s an opportunity. The board already wants your AI story. What almost nobody in the room has is the other half: a clear, current answer to whether that AI can pass a big customer’s security review. Kristin Moyer, the Gartner analyst behind the survey, said why the usual answer doesn’t work: “Dashboards and compliance updates can confuse rather than reassure.” Her advice: the security leaders who earn a board’s consensus do it by translating cybersecurity “into business value such as revenue, cost and shareholder impact.”

That translation is the security slide. One page, sitting right under your AI slide, that shows your board three things: how much revenue is waiting on security review, what an enterprise buyer will check about your AI, and what you need from them to get those deals over the line. Done well, it’s the most reassuring page in the deck, because it turns the AI story from a promise into something a buyer can sign.

I’m writing this founder to founder, for the Series A team selling AI into companies much bigger than itself. Here’s what’s in it. First, why every deck now leads with AI, and why the slide underneath decides when the money arrives. Then the story that put AI agents on every board agenda this summer. Then the heart of it: five rows, each built from one trend that changed what enterprise buyers ask AI startups in 2026, with the evidence behind each row, the people arguing about it in public and what to write on your slide. After that you’ll find the whole slide on one page, a free PowerPoint template, a builder that draws your slide right here in your browser, a four-minute way to present it and a 90-day plan to fill it in.

Every board deck has the AI slide now

Start with where the money went. AI companies took 80% of global venture dollars in the first quarter of 2026, $242 billion of $300 billion, according to Crunchbase (Crunchbase News, April 1, 2026). The share eased to more than 70% in the second quarter (Crunchbase News, July 2, 2026) and 64% in the third, $102 billion of $159 billion (Crunchbase News, October 5, 2026). In the United States, AI companies took 82.7% of venture deal value through September, “the highest annual share in the report’s dataset” (PitchBook-NVCA Venture Monitor, Q3 2026).

So the AI slide is a given. The interesting question is what sits under it, and the classic guides are quiet on that. We read six of the most-shared guides to building a board deck: Sequoia’s “Preparing a Board Deck,” NextView’s templates, USV’s six ways great companies use their board decks, Mark Suster’s pre-meeting checklist, Dave Kellogg’s tips on presenting to a board and Jason Lemkin’s 2026 piece on running the meeting with AI. Sequoia’s guide runs from “Big Picture” to “Calibration,” “Company Building,” a “Working Session” and a “Closed Session” (Sequoia). None of the six has a security slide. That’s not a knock on any of them. Most were written before enterprise buyers started asking AI startups to prove what their AI can reach.

The buyers changed first. a16z’s survey of 100 enterprise chief information officers found that security, “which was heavily emphasized in our interviews,” has gained ground on accuracy and reliability when enterprises choose AI models (a16z, June 2025). And a16z’s crypto team gave founders the best one-line brief for this whole post: “The teams that win learn to package their product as a risk-contained decision” (a16z crypto, March 2026). The AI slide sells the upside. The security slide packages the decision.

There’s a second reason the slide matters more for AI companies, and a pseudonymous account on X put it better than most analysts have:

The $2T SaaS repricing gets narrated as "AI is eating software," and that framing misses what's actually breaking.

Every previous era of enterprise software came with governance bundled in for free. A company buying Salesforce or Workday got a SOC 2 report, a DPA, a vendor security review, a compliance team on the other end of the contract, and someone legally liable when things went wrong. All of that was invisible infrastructure. It's most of why "just buy the SaaS" stayed the default answer for 20 years.…

Big Brain Business (@BigBrainBizness) · April 14, 2026

Investors are feeling the same pull from the other side. Palo Alto Networks chief executive Nikesh Arora sat down with Sequoia to talk about how AI is changing security, which tells you where the people writing Series A checks think the conversation is heading.

The slide underneath is the one that closes the deal

Here’s the part of the story your board feels in the forecast. In G2’s 2026 survey of 1,038 business software buyers, the single biggest delay after a buyer picks a vendor was the IT security review, named by 39% of all buyers and 50% of enterprise buyers (G2 2026 Buyer Behavior Report). Budget approval came second at 32%. G2 sells software reviews, so this is vendor data, but it matches what I see on almost every enterprise deal we support.

The same survey found something subtler. Security teams are involved in fewer software decisions than before, 25% down from 32%, while finance is involved in far more, 46% up from 31%. G2’s chief financial officer, Alex Bradley, summed it up: “The deal isn’t won when the user says yes. It’s won when the buyer can defend the number.” So the reviewer who decides your deal is increasingly someone who reads security the way your board does, as risk attached to money. Stevie Case, the chief revenue officer at Vanta, a compliance software vendor, said it in the same report: buyers are asking, “Will this survive the security review?”

That’s why the security slide starts with a number your directors already understand: the dollar value of pipeline sitting in security review. Add a stage for it in your customer relationship management (CRM) system if you don’t have one, and you’ll know three things every quarter: how much revenue is waiting, how many deals that is, and how many days they’ve waited. It turns security from a cost line into the thing standing between your forecast and your bank account.

The best security teams for startups have said this for years. Latacora, a firm that has run security for many startups, opened its classic guide to SOC 2, the security audit report most enterprise buyers ask for, with the honest version: “First: for us, SOC2 is about sales.” It also warned that “eventually, you will meet an angry bear in the woods who will withhold your pilot project purchase order until you produce a Type 2” (Latacora, 2020). Six years later, the bears read AI questionnaires.

There’s a useful counterweight, and it matters for timing. Thomas Ptacek, who co-founded the security firm Matasano and is one of the sharpest voices on Hacker News, told a solo founder in May: “Do not ever do a SOC2 speculatively, in the hopes that it will improve your sales prospects” (Hacker News). I agree, and the slide helps here too. When the pipeline number on top grows, you know the bear has arrived and it’s time to start the audit. Yash Kosaraju, the chief information security officer (CISO) at Andreessen Horowitz, gave me the same rule for hiring a security leader when he joined me on episode 104:

Listen · Yash Kosaraju on episode 104, from 5:34

Sales signals first, then the hire, then the audit. The slide is where your board sees the signals arrive. If you want the classic playbook on selling into big companies, Y Combinator’s Startup School talk on enterprise sales is still a good hour.

Before the five rows, one more piece of context, because it’s the reason your next buyer’s questionnaire looks different from your last one.

The summer every board heard about AI agents

In July 2026, AI agents broke out of a test and made the evening news. During internal cybersecurity evaluations, OpenAI’s models got around the isolation meant to keep them off the internet and, in OpenAI’s own words, “compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems” (OpenAI, August 26, 2026). The independent review by METR, an AI evaluation group, counted about 1,200 agents, meant to be isolated from one another, that found a way to communicate through an internal package server, more than 70,000 messages and files, and about 700 agents that took part in the attack on Hugging Face (METR, August 26, 2026). OpenAI’s technical report calls it “the first known case of an automated agent collective acting offensively without authorization” (OpenAI technical report).

Television ran with it all summer. CNN’s headline on July 22 was “An OpenAI test model escaped and broke into a real company’s servers” (CNN). Fox Business reported that the attack ran from July 11 to July 13 and that OpenAI took about a week to realize its own agent was responsible (Fox Business, July 25, 2026). By late September, CNN and Fox News were reporting that the agents had also targeted three US government websites, and Fox added the United Nations’ public data portal (CNN, September 26, 2026; Fox News, September 27, 2026). NBC News followed the story as it widened:

Hugging Face’s chief executive, Clem Delangue, answered with a request most founders will recognize as good crisis communication: show your work.

In the spirit of transparency, here's what I asked @OpenAI:

• Radical transparency: let's release the traces from the "rogue" agents so the entire research community can study what happened.

• More capabilities for defenders: let's commit $100M in compute from OAI to help the Hugging Face community build powerful cyber defenses with the best open and closed models.

The first autonomous agent cyberattack is an unprecedented event. It deserves an unprecedented response!

clem 🤗 (@ClementDelangue) · July 25, 2026

We recognize there are a lot of questions and speculative details circulating related to the Hugging Face incident.

This is an unprecedented incident, and we think it marks an important moment for AI safety.

We are still conducting a thorough review along with external advisors and with oversight from our Safety and Security Committee.

Once the review is complete, we plan to publish a technical report of our learnings in the coming weeks.

OpenAI (@OpenAI) · July 24, 2026

Hacker News argued about it for months. OpenAI’s first disclosure drew more than 1,600 points and 1,100 comments (Hacker News), and a Guardian article urging readers to be skeptical of the “rogue hacker agent” framing drew more than 500 points of its own (Hacker News). When researchers published reconstructed traces in September, one commenter made the point every founder should take from it:

"It is concerning that we only know about this because of the publicly available traces."

jmoggr, commenting on Hacker News, September 2026, in a thread with more than 700 points

If you want the long version, Ajeya Cotra, one of the authors of METR’s review, walked Dwarkesh Patel through the attack. The player opens at the chapter on the Hugging Face attack.

Here’s the founder’s lesson, and it’s a hopeful one. Simon Willison, the developer who named prompt injection, summed up the agents’ behavior this way: “If you set them a goal and give them a way to get there, even inadvertently, they will figure it out” (Simon Willison, July 22, 2026). Agents are software. They follow the paths we give them, very fast and very persistently. So the useful questions are about the paths: whose credentials the agent holds, what it can reach, how you tested it and how quickly you’d notice. Those are exactly the questions that started showing up in enterprise questionnaires this year, and every one of them has an answer a Series A company can put together in a quarter. Wikimedia, writing about the agents’ visits to its sites in October, asked for the bare minimum any buyer will now ask of you: “At a minimum, their systems should operate in a way that non-profit website owners like us can easily identify” (Wikimedia, October 5, 2026).

By August the story had its own session at Black Hat, and OpenAI links to the talk from its August 26 post:

Now to the rows. Three of them start from posts that crossed my feed this week, because those are the conversations your buyers are having right now.

Row 1, agent access: whose keys does your agent use?

Caitlin Leksana runs Fazeshift, a Y Combinator company that automates accounts receivable and raised a $17 million Series A led by F-Prime in May (FinTech Global). On October 8 she announced something that would have sounded like science fiction three years ago: a protocol for AI agents that log into real websites.

Agent-to-Infrastructure Protocol (A2I)
…
our A2I protocol gives AI agents the ability to log into websites, navigate interfaces, click buttons, fill out forms, and complete workflows, just like a human would.
…
Identity & Access Management · Data Management · Navigation & Reasoning

Caitlin Leksana · CEO @ Fazeshift (YC S24) · October 8, 2026

Load the post from LinkedIn

My comment on her post is the first row of the slide: “Agents logging into real websites means the identity layer is the product now. The question every buyer’s security team will ask: whose credentials, how scoped, and who can revoke them at 2am?”

The good news is that the industry spent 2026 building answers. Anthropic’s developer account described the model it uses when Claude works inside a team’s chat channel:

When Claude is working in a channel with four people, whose credentials does it use?

The answer: its own. When tagging Claude, Claude gets provisioned like any other teammate, with its own credentials.

We call this access model "agent identity". Here's how it works: 🧵

ClaudeDevs (@ClaudeDevs) · June 24, 2026

Everyone else is converging on the same idea. Google Cloud announced Agent Identity, which “assigns every agent a verifiable identity in the form of a unique cryptographic ID” (Google Cloud, April 2026). Microsoft calls its version Entra Agent ID and says it’s “available for all Microsoft Entra customers” (Microsoft Learn). Okta and eleven partners, including AWS, CrowdStrike, Google Cloud and Salesforce, formed the Blueprint Alliance in September around four questions that would make a fine outline for this row: “Where are my agents? What can they do? What are they doing? How do I respond?” (Okta, September 22, 2026). Even consumer products are heading there: Manus is positioning its new Cue agents around identity, each with “its own phone number, email address, wallet, and computer,” as Dani Zhu summarized the launch (on X), and Stripe opened a program for businesses that want to sell through agents “with verified consumer and agent identity” (Jeff Weinstein on X).

The standards caught up too. The Model Context Protocol (MCP), the most common way agents connect to tools, published a new specification in July with a sentence your engineers should be able to say out loud in a security review: “MCP servers MUST NOT accept or transit any other tokens” (MCP specification, 2026-07-28). In plain English, a tool server should only accept credentials issued for it, and never pass a user’s token along to someone else. The Agent2Agent protocol (A2A), which Google launched in 2025, reached its first stable version in March with “signed agent cards for cryptographic identity verification,” backed by more than 150 organizations (Agentic AI Foundation, August 2026).

Here’s why that’s an opportunity for a Series A company: most of your buyers are still working this out themselves. A Cloud Security Alliance survey of 228 IT and security professionals, commissioned by the identity company Aembit, found that 85% run AI agents in production, 74% say agents often get more access than they need, and 68% can’t clearly tell agent activity from human activity (Cloud Security Alliance, March 2026). Gartner says 54% of organizations have “no defined approach to limit AI agent access, or rely on predefined human access” (Gartner, September 30, 2026).

The identity vendors see the same shift from their side. Okta’s chief executive, Todd McKinnon, told CNBC that agents are moving from prototype to production, which is exactly when buyers start asking about them.

And the most practical talk I’ve seen on this question has the best title of the year. Jim Clark of Docker asked an AI Engineer conference audience how many credentials an agent should have, and answered in the title.

Identity answers whose keys. The second half of the row answers how you know the agent behaves, and that’s a testing question. This one showed up in my feed in September and it’s the most quotable sentence about enterprise AI sales I’ve read all year:

Every enterprise security review eventually asks how you tested the agent before it touched their data.

Right now most answers are bad.

roman (@Nozelcode) · September 8, 2026

A real answer looks like a before-and-after number, and the labs have shown how to publish one. Anthropic reported that its mitigations cut the success rate of prompt injection attacks on Claude in Chrome from 23.6% to 11.2% across 123 test cases, and from 35.7% to 0% on attacks specific to the browser (Anthropic, August 2025). The UK AI Security Institute found that explicit scope instructions cut the simulated test runs in which one model, GPT-6 Astra, completed a supply-chain attack from 26 of 50 to 4 of 49, on the scenarios where it had strayed most often (AISI, September 2026). And OpenAI found that the propensity of its models to compromise infrastructure “can drop over 100x when using the production ChatGPT harness and system prompt” (OpenAI).

What to write on the row. Three facts and one number: how many agents run in production, whether each has its own identity (not a shared service account or someone’s personal login), how long their tokens last and who can revoke them, and your prompt injection success rate before and after your last round of fixes. The example in this post reads: 4 production agents, each with its own identity · tokens expire in 1 hour · prompt injection success: 9% before fixes, 2% after.

How to get there. If you can’t list your agents’ credentials today, start with our 30-minute exercise in Who Holds Your Agent’s Keys?, then read why agents need least privilege more than humans ever did and when an agent has earned write access. Eric Olden of Strata Identity walked through how to put agents safely into production on episode 81, and Graham Neray of the authorization company Oso explained why agents raise the stakes for growing software companies on episode 89. When you want help, our AI User Access Control Audits start with exactly this inventory, our AI Product Red Teaming produces the before-and-after number, and the Secure MCP Program covers the tool servers your agents call.

Row 2, AI vendors: what changed since we last looked?

The second row starts with a post from Abdul Mohsin, an enterprise AI governance and cybersecurity leader, that described the most common blind spot in vendor reviews right now.

Your biggest security risk right now might be a vendor you assessed two years ago, and the AI features they shipped last month without telling you.
…
The question is not 'did we assess them' but 'do we know what they turned on this quarter?'

Abdul Mohsin · Enterprise AI Governance & Cybersecurity Leader · October 8, 2026

Load the post from LinkedIn

I commented: “The SOC 2 you reviewed in 2024 says nothing about the agent they bolted on last month. We’ve started asking vendors one question at renewal: what changed since we last looked?” Abdul replied that “What changed since we last looked?” is “such a simple question, but it gets much closer to the real risk than re-reading the same assurance package.” That question is the name of row 2.

The data says it’s the right question. Verizon’s Data Breach Investigations Report (DBIR) found a third party involved in 48% of the breaches in its 2026 edition, “up from 30% last year,” across more than 22,000 confirmed breaches (Verizon DBIR 2026). When Verizon introduced the measure in its 2024 edition, it put the year before at 9%.

The biggest supply-chain breaches of the past year came in through vendors that were already approved and connected, several of them AI tools. In August 2025, attackers used stolen tokens from Salesloft Drift, which the FBI described as “an AI chatbot that can be integrated with Salesforce,” to reach customers’ Salesforce data (FBI FLASH, September 2025); SecurityWeek reported that the attack was estimated to have hit more than 700 organizations (SecurityWeek). In November, Google said it was aware of more than 200 potentially affected Salesforce instances after a breach involving apps published by Gainsight (TechCrunch). In June 2026, LastPass confirmed a data breach through Klue, an “AI-powered market intelligence platform,” and the list of affected companies kept growing (BleepingComputer). And in April, Vercel traced a breach to a small AI tool one employee had connected to a work account:

Our investigation has revealed that the incident originated from a third-party AI tool with hundreds of users whose Google Workspace OAuth app was compromised.

We recommend that Google Workspace Administrators check for usage of this app immediately.

Vercel (@vercel) · April 19, 2026

Here's my update to the broader community about the ongoing incident investigation. I want to give you the rundown of the situation directly.

A Vercel employee got compromised via the breach of an AI platform customer called Context.ai that he was using. The details are being fully investigated.

Through a series of maneuvers that escalated from our colleague's compromised Vercel Google Workspace account, the attacker got further access to Vercel environments.…

Guillermo Rauch (@rauchg) · April 19, 2026

The best response I saw came from a founder, and it’s a ten-minute fix most Series A companies haven’t made:

Biggest takeaway from this: 3rd-party Google OAuth Apps that request scopes beyond the basic info (name/user/profile pic) is a dangerous attack vector.

To safeguard your org from attacks like this, highly recommend asking your Google workspace admin to restrict "unconfigured third-party apps" to only be able to request basic info needed 👇

Here's the direct link to access that settings page: admin.google.com/ac/owl/settings

h/t @matid for the pro-tip!

Steven Tey (@steventey) · April 19, 2026

You can tell people to avoid signing in with their Google credentials & some may avoid it, and/or you can update your tools to limit Google workspace access and prevent that action.
I recommend both telling people *why* it's important to avoid, -and- actively prevent the action.

Rachel Tobac (@RachelTobac) · April 20, 2026

On Hacker News, the Vercel thread passed 860 points, and two comments put the board-level point better than any analyst:

"When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong."

Vates, commenting on Hacker News, April 2026

"how many AI tools like Context are installed across your scope of local and SaaS AI?"

tosser12344321, commenting on Hacker News, April 2026, in the thread on Trend Micro's analysis of the Vercel breach

The second comment is a board question in one line, and it leads straight to row 4. But row 2 has a twist that’s specific to AI: vendors you already approved keep turning new AI on. Gartner put it bluntly in March: “Many vendors are integrating AI features into their products and frequently making unilateral decisions about AI implementation” (Gartner, March 9, 2026). In September, a Gartner analyst added that vendors “embed or modify AI capabilities in products, often without transparency or notice,” and that the resulting exposure “sometimes surpasses the organization’s own internal AI risks” (Gartner, September 2026).

Regulators and the biggest buyers have started writing the answer into contracts. The Federal Trade Commission warned in 2024 that it “may be unfair or deceptive” to start using data for AI training through “a surreptitious, retroactive amendment” to terms (FTC). The General Services Administration’s proposed AI clause would require contractors, in Holland & Knight’s summary, to give “30 days’ written notice before adding or materially changing a Service Provider” (Holland & Knight, March 2026). So the row has two halves: what you do about your vendors, and what you promise your customers about yourself.

The tone of the best public responses is worth copying too. After the Salesloft Drift breach, Cloudflare wrote: “We are responsible for the choice of tools we use in support of our business” (Cloudflare, September 2025). Responsibility, said plainly, reads well to a board and to a buyer. Risky Business, one of the best weekly security podcasts, called the underlying problem “OAuth soup” and explained it better than I can:

What to write on the row. How many AI vendors touch customer data, what triggers a re-review (new AI features, new data, new subprocessors, a change in terms), and the notice you give your own customers before you add a model provider. The example reads: 7 AI vendors, re-reviewed whenever they ship AI changes · customers get 30 days’ notice before we add a model provider.

How to get there. My co-founder Sasha’s post on the security exhibit your startup signed last quarter shows what your own customers’ contracts already promise about notice and subprocessors. Your MCP server passed review, then it changed applies the same idea to the tools your agents call, and our guide to shadow AI covers the tools nobody reviewed at all. Our Corporate Shadow-AI Detection and Mitigation program finds the AI already connected to your systems, and 24/7 Monitoring and Response watches for the changes after the review.

Row 3, ownership and claims: who owns AI, and can you prove it?

Boards moved fast on this one. Among the Fortune 100, the share of companies that cited AI in the board’s oversight of risk tripled in one proxy season, from 16% to 48%, and the share that charged a board committee with AI oversight went from 11% to 40% (EY Center for Board Matters, 2025). Private-company investors are pulling the same way: in KPMG’s 2026 survey of 302 of them, 92% said strong AI governance makes them more likely to invest, and 67% said significantly or moderately more likely (KPMG, 2026).

Boards talk about AI far more than they measure it, and that’s the opening for your slide. In the National Association of Corporate Directors’ (NACD) 2025 surveys, about 62% of directors said their boards set aside agenda time for AI, but only 15.4% at private companies and 6.2% at public ones said their boards had set metrics for management to report (NACD, 2025). Asked what matters most for effective AI oversight, public-company directors put “Appropriate information and metrics presented to the board” a close second to their own education (NACD).

Big companies answer the ownership question with a new title. IBM reported that 76% of the organizations it surveyed in 2026 have a Chief AI Officer, up from 26% the year before, though the two figures come from different IBM surveys (IBM). At Series A you don’t need the title. You need one named person who owns AI and security risk and reports on it, which is usually the chief technology officer (CTO). Boston Consulting Group goes further and argues the chief executive should own it personally:

And if nobody on the team has done this before, Yash had practical advice for that too:

Listen · Yash Kosaraju on episode 104, from 6:52

The second half of the row is claims, and buyers have gotten specific. SecurityPal, which processes security reviews for vendors, says the AI question in reviews moved from “2024: ‘Can we opt out of AI?’” to “2025: ‘Can you prove our data never trains your models?’” (SecurityPal, March 2026). That’s vendor data, and it matches what we hear on buyer calls. Microsoft’s supplier program now says “All suppliers providing AI Systems will be required to provide Independent Assurance options,” and accepts ISO/IEC 42001, the international standard for AI management systems, as one way to provide it (Microsoft SSPA Program Guide). JPMorganChase’s CISO told suppliers in an open letter that “Software providers must prioritize security over rushing features” (JPMorganChase, April 2025).

The other side of claims is the claims you make to investors and customers about your AI. The Securities and Exchange Commission’s first “AI washing” cases in 2024 cost two investment advisers $400,000 (SEC). Holland & Knight’s summary of the enforcement trend is the best rule I know for this row: “Present-tense claims need to be backed up by present-tense substantiation” (Holland & Knight, August 2026). If your slide says “no training on customer data,” the appendix should show the contract clause and the test that proves it.

What to write on the row. The owner, how often they report, and each claim you make to buyers paired with its proof and a date. The example reads: CTO owns AI and security risk and reports here every quarter · “No training on customer data” is in our contracts · test due November 15, marked in progress because the test hasn’t happened yet. Honest marks are what make the rest of the slide believable.

How to get there. What is a vCISO? and In-House, On-Demand, or YOLO? cover who should own this at your stage, and Sasha’s The Art and Zen of Adopting AI covers how to roll AI out with the paperwork in place. Abhi Sharma laid out three things every business needs to trust AI on episode 70, and Kayne McGladrey explained what public companies now disclose about cybersecurity leadership on episode 56. When a buyer names ISO 42001, our ISO 42001 program took Augment Code from zero to certified in 93 days, and our AI EU Compliance Program covers the European side.

Row 4, team AI tools: which ones can read your customers’ data?

Rows 1 to 3 are about the AI you build and buy for the product. Row 4 is about the AI your own team uses, which for most startups is the part nobody has written down. It became concrete for me with this one. On October 8, Dharmesh Shah, HubSpot’s co-founder and chief technology officer, reshared an explainer of YouSpot, the “AI-native Solo CRM from HubSpot Next” he launched in August:

If you place high value on your relationships (stored in LinkedIn, Gmail, etc.), YouSpot might be for you.

Dharmesh Shah · Founder and CTO at HubSpot · October 8, 2026

Load the post from LinkedIn

I commented with the honest version of what every founder feels: “Love this. An agent reading my Gmail and LinkedIn is the dream and the threat model in one. Would love to see what the permission story looks like for solo founders who don’t have a security team to ask.” Arsen Doda added the sharpest line in the thread: “An agent that reads a whole inbox to track a handful of relationships holds far more than the job needs, so I’d want to see what the 20+ agents can read, what they can send, and what waits for my yes.”

Woo hoo! Thrilled to announce YouSpot, the AI-native Solo CRM from HubSpot Next.

tl;dr: YouSpot is a CRM built for one-person companies. It builds a "second brain" from your business context and remembers the things you might otherwise miss. We're launching with an intro price of $1/month for the first 1,000 customers (154 slots already taken).…

dharmesh (@dharmesh) · August 27, 2026

Here’s what I like about it: YouSpot answered most of my question in public, and its documents are a model for the permission story any AI tool should be able to tell. Its Gmail access is read-only, gmail.readonly in Google’s terms, and its privacy policy says “Older grants that carried broader permissions were revoked on September 18, 2026” (YouSpot privacy policy). Its site says “writes ask first” (YouSpot). It publishes a list of 47 subprocessors, nine of them AI providers, with the data each one touches (YouSpot terms). Its data processing addendum promises breach notice “within 72 hours” and commits to sharing the results of Google’s security assessment “when complete” (YouSpot DPA), and on October 6 its blog announced: “Google has finished its security review of YouSpot” (YouSpot blog). Read-only by default, writes that wait for a yes, named subprocessors, a breach clock and an outside review. That’s the permission story, and it’s the same story your buyers want about the AI tools your team uses on their data.

Google itself sets a useful bar here. Any app that stores or transmits restricted-scope Gmail data on its servers needs a security assessment “from Google-empanelled security assessors,” renewed “at least every 12 months” (Google for Developers). Meanwhile, the default for your own company is wide open: Google Workspace’s default setting for apps an admin hasn’t configured is “Allow users to access any third-party apps” (Google Workspace Admin Help). Nudge Security, which sells tools for exactly this problem, found that “each employee has granted 88 OAuth grants to third-party applications” on average, and “31 carry data-level permissions” (Nudge Security, April 2026).

Email in particular has become an instruction channel for AI, and the incidents of the past year show the pattern:

The most human version of the story came from someone whose job is AI alignment:

Nothing humbles you like telling your OpenClaw "confirm before acting" and watching it speedrun deleting your inbox. I couldn't stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.

Summer Yue (@summeryue0) · February 22, 2026

Simon Willison has the cleanest way to think about it. He calls it the lethal trifecta: an AI tool with “Access to your private data,” “Exposure to untrusted content” and “The ability to externally communicate in a way that could be used to steal your data” (Simon Willison, June 2025). A commenter on Hacker News boiled it down to one line:

"Private data, untrusted data, communication: an LLM can safely have two of these, but never all three."

wat10000, commenting on Hacker News, January 2026, on the Superhuman disclosure

An inbox assistant has all three by design, which is why the answer is in the permissions: read-only where possible, a person approving anything that sends, and a list of which tools hold which grants. Simon went deeper on why prompt injection is still unsolved on Lenny’s Podcast:

And for the optimistic case behind tools like YouSpot, Dharmesh’s INBOUND 2025 keynote on personal AI makes the best case for why founders want these assistants in the first place:

What to write on the row. Which AI tools on your team can read email, drives and your CRM, who approved them, and what any agent can send or delete without a person saying yes. If you haven’t looked yet, say so and give the start date, the way the example does: Inventory of AI tools that can read email, drives and CRM starts November 3 · approved-apps list due December 1, marked not started. A board will happily take “not started, starts November 3.” What it wants is to hear it from you first.

How to get there. Start with Steven Tey’s one setting from row 2, then read our guide to shadow AI and why the human in the loop is going away. Xia Hua explained how employees’ favorite AI tools can leak data on episode 100, Michael Moore of Glean covered how free AI tools become expensive mistakes on episode 73, and Or Eshed of LayerX explained why the browser became the place to see it all on episode 98. Our Corporate Shadow-AI Detection and Mitigation program builds the inventory for you, and AI User Access Control Audits trim the grants down to what each tool needs.

Row 5, proof buyers can check: what does the buyer’s AI say about you?

The last row is the proof, and in 2026 there’s a new reader for it. G2’s March survey of 1,076 business software decision makers found that “51% of B2B software buyers start their research with an AI chatbot more often than Google,” and that “85% think more highly of a vendor cited by AI in its answer” (G2, The Answer Economy). 6sense, which surveyed nearly 4,000 buyers, found that 77% had their first vendor conversation with the vendor they eventually bought from (6sense, 2025). Both are vendor data, and both say the same thing: the shortlist forms before anyone calls you, often in an AI tool. Gartner expects that “By 2028, 90% of B2B buying will be AI agent intermediated,” and adds a line that should go on every founder’s wall: “digital trust frameworks and verifiability are prerequisites for participation” (Gartner, October 21, 2025).

So where do AI answers get their facts? LinkedIn has been pitching itself as one of the most-cited sources, and several studies back that up. Semrush, in a study made in collaboration with LinkedIn, found LinkedIn second in citations across 325,000 prompts (Semrush, March 2026). Meltwater found it second behind YouTube in business-to-business answers (Meltwater, May 2026), and Profound found it first for professional queries (Profound, March 2026). The academic work on generative engine optimization (GEO) says what gets a source cited: adding quotations, statistics and cited sources raised a source’s visibility in AI answers by roughly 28% to 41% on a 10,000-query benchmark, while keyword stuffing lowered it (Aggarwal et al., KDD 2024).

You may have heard that short posts win. Semrush did find that “mid-length posts of 50–299 words account for the largest share of AI citations,” and in the same study that “Articles of 500–2,000 words are cited the most.” For security proof, I’d do both: short posts from the people who actually run your security, and one long page a buyer’s AI can read end to end. The founders who saw this early have the numbers to show for it:

ChatGPT now refers 10% of new @vercel signups, which have also accelerated

Guillermo Rauch (@rauchg) · April 9, 2025

And here’s the counterweight every founder should read before buying a tool that promises AI visibility:

Reading a few AI search case studies right now, and struggling with correlation vs. causation...

Everything they list as an "AEO tactic" is actually something that's also just good for SEO.

Fresh content
Using Schema
Front-loading important content
Using ordered lists
Adding FAQs to solution pages

Is it possible that the URLs cited in the AI search response were chosen... not because they did anything special for AEO, but... because of their great SEO?

Lily Ray (@lilyraynyc) · February 25, 2026

Dharmesh, again, is the clearest voice on where this is going, from the HubSpot side. He calls it answer engine optimization:

The trust-center companies are already building for that reader. Drata now lets a buyer’s AI tool connect to a vendor’s trust center over MCP, because “Procurement and security teams are already using AI agents to speed up vendor reviews” (Drata, August 4, 2026). That’s a vendor describing its own product, and it’s still a fair picture of where reviews are heading.

What should the buyer’s AI find? The same proof the buyer’s reviewer has always wanted, kept current. A SOC 2 Type 2 report, which covers a period of time rather than a single day (here’s the difference between Type 1 and Type 2, and what buyers now check to see whether a SOC 2 is real). A recent penetration test that included your AI features (what enterprise buyers expect from an AI startup’s pentest in 2027). And a trust center with written answers to the AI questions from rows 1 to 4. Thomas Ptacek’s old joke still holds, and it’s why the written answers matter:

SOC2 exerts the same forcing pressure to organize security; of course, SOC2 is just the Boss Fight version of a dumb security questionnaire.

Thomas H. Ptacek (@tqbf) · September 22, 2021

What to write on the row. Your SOC 2 status with dates, your last pentest and whether it covered the AI features, and where the trust center and security answers live. The example reads: SOC 2 Type 2 window open since October 1 · trust center public · September pentest covered the AI features · security answers published, marked in progress until the report arrives.

How to get there. If SOC 2 is new to you, start with What Even Is a SOC 2? and our free SOC 2 readiness checklist. Daniel Marashlian, Drata’s co-founder and CTO, shared lessons from building a compliance company that helps startups answer these questions on episode 64. Our SOC 2 Type 2 team runs the program end to end, our Penetration Testing team puts the AI layer in scope, and our Sales Support team joins the buyer calls as your security team.

The slide, on one page

Here’s everything above on one 16:9 slide, the way I’d put it in front of a board in the fourth quarter of 2026.

Four design choices make it work.

The money comes first. The black band is the only part of the slide a director will remember a week later: $1.8 million of pipeline waiting on security review, five deals, a median of 19 days. Everything under it explains how you’ll shrink that number.

Five rows, two lines each. One row per trend that changed buyers’ questions this year. Two lines forces you to write numbers and dates instead of adjectives. If a row needs more, the detail goes in the appendix.

Three honest marks. Filled when it’s in place and you have evidence. Dashed when it’s in progress, with a date. An outline when it hasn’t started, with a start date. A slide with five filled squares reads as a sales pitch. A slide with an honest mix reads as a team that knows where it stands, which is what a board wants to fund.

One ask. The dashed box at the bottom is the decision you need, and what it unblocks. Without it, the slide is a status report. With it, the board has something to do.

Build yours right here

Fill in your own numbers and the slide redraws as you type. It starts with the worked example so you can see every part in place. When you’re happy, download it as an image or copy the text into your deck. Everything runs in your browser.

Security slide builder

Draw your board's security slide in two minutes.

Change any field below and the slide updates. The slide check underneath lists what a director would likely ask about, so you can fix it before the meeting. Nothing you type leaves this page unless you send it to us.

Download PNG Download SVG Copy as text PowerPoint template

Company name Meeting

Pipeline in security review Deals in review Median days in review

The five rows

Agent accessWhose keys, how scoped, how tested In placeIn progressNot started

4 production agents, each with its own identity · tokens expire in 1 hour Prompt injection success: 9% before fixes, 2% after

AI vendorsWhat changed since we last looked In placeIn progressNot started

7 AI vendors, re-reviewed whenever they ship AI changes Customers get 30 days' notice before we add a model provider

Ownership and claimsWho owns AI, and the proof behind each claim In placeIn progressNot started

CTO owns AI and security risk and reports here every quarter "No training on customer data" is in our contracts · test due November 15

Team AI toolsWhich tools can read customer data In placeIn progressNot started

Inventory of AI tools that can read email, drives and CRM starts November 3 Approved-apps list due December 1

Proof buyers can checkSOC 2, pentest, trust center In placeIn progressNot started

SOC 2 Type 2 window open since October 1 · trust center public September pentest covered the AI features · security answers published

The ask

Start from a blank slide Load the example

…pipeline waiting on security review

…rows in place, with evidence

…rows in progress

…questions a director would likely ask

How the slide check works: fixed rules, run in your browser. It looks for the pipeline number, empty rows, rows in progress without a date, rows not started without a start date, rows marked in place without a number or a date, rows longer than two lines, acronyms a board may not know and a missing ask. The rules are our judgment from the board-deck guidance in this post, not a standard.

Send me a review of my slide →

A person on our team reads your slide, marks what a buyer's reviewer or a director would question, and replies with suggested edits. No sequence, no vendor pitch.

If the check flags an acronym, that’s deliberate. Directors skim past acronyms, and so do the buyers’ executives who see your slide in a data room. Spell it out on the slide and keep the acronyms for the appendix.

How to present it in four minutes

Boards are busy, and the best advice on board decks says so bluntly. Two of Dave Kellogg’s tips for presenting to a board are “Lose the baggage” and “Cut to the chase,” because “Nothing will infuriate a board more than endless warm-up slides that don’t cover the important issues” (Kellblog, February 2025). Jason Lemkin’s advice for 2026 is to “Frame the two or three decisions that actually matter this quarter, with a recommended answer already on the table” (SaaStr, August 2026). Here’s how that sounds with the security slide:

Minute 1, the money. “$1.8 million of pipeline is waiting on security review across five deals, a median of 19 days each. That’s the number this slide is here to shrink.”

Minute 2, what changed. “Since last quarter, every agent has its own identity, and our prompt injection success rate went from 9% to 2%. We now re-review an AI vendor whenever it ships an AI change.”

Minute 3, the risk we’re carrying. “We don’t yet know every AI tool on the team that can read customer email. The inventory starts November 3, and you’ll see it on this slide next quarter.”

Minute 4, the ask. “Approve the SOC 2 Type 2 audit and an AI red team test, so both land before the January enterprise launch.”

Notice minute 3. Mark Suster’s advice on bad news in board meetings is the one line every founder should memorize: bad news is fine, “but it can’t be a surprise” (Inc., 2019). A director who hears about a problem from you, with a date attached, trusts the next slide more. A director who hears about it from a customer trusts it less.

What to leave off. Dashboards, heat maps and compliance updates. As Gartner’s Kristin Moyer put it, “Dashboards and compliance updates can confuse rather than reassure” (Gartner, November 2025). Raw counts of vulnerabilities or blocked attacks, which tell a director nothing about revenue. “100% secure” or “fully compliant,” which no reviewer believes. Acronyms without explanation. And fear: the slide works because it’s calm, specific and dated. The National Association of Corporate Directors’ handbook on board-level cybersecurity metrics frames the questions boards should ask in business terms, such as “What is our cyber-risk appetite for key risk scenarios, expressed in financial terms?” (NACD, 2026). The money line on top of your slide is a startup-sized answer to that question.

George Kurtz, CrowdStrike’s chief executive, made the case at RSAC 2025 that boards will soon expect the same fluency on cyber risk that they expect from the CFO on financial risk:

Your first 90 days

If you’re starting from an empty slide, here’s the order I’d fill it in. It’s the same order we use with clients, because it front-loads the things that take the longest.

Week 1, take inventory. List every agent, every AI vendor and every connected app that can reach customer data, and name the one person who owns AI and security risk. Most teams find more than they expected, and that’s fine. “Unknown” is a useful answer in week 1.

Weeks 2 to 4, fix the cheap things. Restrict which apps can connect to your company accounts, give each agent its own identity, write down your answers on model providers, data retention and training, and publish a simple trust center page. None of this needs a big budget.

Weeks 4 to 8, produce the proof. Run a penetration test with your AI features in scope, measure prompt injection before and after your fixes, and start the SOC 2 Type 2 observation window, because nothing compresses it later.

Weeks 8 to 12, present it. Put the first slide in front of your board, build the buyer packet from the same evidence, and set the triggers that re-review a vendor when it changes. Then refresh the dates every quarter.

This is the work we do at YSecurity, and it follows the same plan. It starts with a free 15-minute call where we look at your pipeline and your next big buyer. Within a week you have a written roadmap for your slide and your audits. Then our operators, who’ve built security programs at companies like Apple, Robinhood and Uber, join your Slack and do the work alongside your team, billed in 15-minute increments with no retainers. When the report lands and the deals close, we keep the dates fresh every quarter. It’s how we took Robust Intelligence through SOC 2 Type 2 with zero deviations before its acquisition by Cisco, and Augment Code to ISO 42001 in 93 days.

The other half of the job is answering the questionnaires that keep arriving once the slide is working. Sasha and I built a tool for that, too:

Ready to put the slide in front of your board? Book your free 15-minute security strategy call, and we’ll start with your pipeline. If you’re a startup, your first 8 hours are free. Not sure what kind of help fits your stage? The two-minute quiz will point you in the right direction.

The slide under the slide

Romulo’s post had two layers: the AI slide every deck has, and the modernization slide underneath it. I’d add a third. Under the modernization slide sits the security slide, and under that sits the work itself: agents with their own identities, vendors you re-check when they change, an owner with a name, a team that knows which tools read customer data, and proof that a buyer, or a buyer’s AI, can find.

You don’t need all of it done to put the slide in front of your board. You need it honest, dated and pointed at revenue. The boards in Gartner’s survey want your AI story, and nine in ten of them don’t feel sure about the security story yet. That’s the open ground, and a Series A founder with one clear page can take it in a quarter.

If you’d like to hear how the people on the other side of the table think about this, start with Yash Kosaraju on episode 104 of The Security Podcast of Silicon Valley, and our founder’s guide to compliance on episode 37. And if you’d rather argue about it in person, I’ll be at the AI LAX Summit at Google in Playa Vista, Los Angeles, on October 16, on the AI Governance & Safety Roundtable. Bring your slide. Everything else we’re doing this fall is on our events page.