Most Security Controls Assume a Team You Don't Have
Security checklists only ever grow, because nobody who writes them pays the cost of a control a small team cannot staff. Which to defer, and which never wait.
Writing · Tag
Posts tagged security
31 posts on security, page 2 of 3. Or browse the full writing index →
Posts tagged security
Phoenix Secrets: runtime.exs, Fly.io, and LLM Keys
The compile-time trap in config.exs, why System.fetch_env! should crash your boot, and how to actually wire Fly secrets and LLM keys through a Phoenix release.
Multi-Tenant AI SaaS in Phoenix: Isolation That Holds
Tenant isolation for AI SaaS in Phoenix: per-tenant API key tradeoffs, Ecto context scoping, and the pgvector bug that leaks one tenant into another.
Jose Valim Is Right: Anthropic's Incentive Problem
José Valim says Anthropic hasn't separated its security case from its commercial interest. He's right, and it's every frontier lab's problem.
Detection Got Cheap. Remediation Didn't.
Microsoft just made vulnerability detection cheaper and more accurate. For a 12-40 person AI startup, that was never the bottleneck.
What a 96% Security Benchmark Actually Measures
Microsoft's security system hit 96% on a benchmark this week. Here's what that score actually measures, and how to read any vendor's benchmark claim.
Shadow AI at a Startup That Can't Buy a CASB
The enterprise shadow-AI playbook assumes a CASB budget you don't have. Here's the free, no-blame version for a 5-15 person team: three steps, zero procurement.
Security Engineer or vCISO? Your First Hire, by Stage
A security engineer builds and a vCISO decides. Which one your startup needs first, stage by stage, and the cases where the answer is neither.
Secrets Management for AI Agents on Small Teams
Your agent's tools need your production keys; the agent itself never should. The broker pattern, per-tool scoping, and what a five-person team can skip.
A Scared Team Is Your Biggest Attack Surface
A scared employee hands over access to avoid a manager's wrath, the exact move social engineering exploits. Why psychological safety is a security control.
What Cyber Insurance Underwriters Ask AI Startups
The cyber insurance application is a security audit in disguise. What underwriters check in 2026, the AI exclusions creeping in, and when coverage is real.
Why Auto-Filled Security Questionnaires Kill AI Deals
Why auto-filling an enterprise security questionnaire backfires on an AI startup: the answers that kill deals, and the questions your SOC 2 won't cover.