Ivan (e/acc) (@IvanMKE) header
Ivan (e/acc) (@IvanMKE) profile picture

founder/ceo - building the machine identity security layer for MSPs

Milwaukee, WI
Joined February 2013
Photo by Ivan (e/acc) (@IvanMKE)Photo by Ivan (e/acc) (@IvanMKE)Photo by Ivan (e/acc) (@IvanMKE)Photo by Ivan (e/acc) (@IvanMKE)Photo by Ivan (e/acc) (@IvanMKE)Photo by Ivan (e/acc) (@IvanMKE)Photo by Ivan (e/acc) (@IvanMKE)Photo by Ivan (e/acc) (@IvanMKE)Photo by Ivan (e/acc) (@IvanMKE)Photo by Ivan (e/acc) (@IvanMKE)
Ivan (e/acc) retweeted
The Onion Theory of Risk by Marc Andreessen: "I think the single biggest thing entrepreneurs are missing, both on fundraising and how they run their companies, is the relationship between risk and cash. The relationship between risk and raising cash, and then the relationship between risk and spending cash. So I've always been a fan of something that Andy Ratcliffe taught me years ago, which he called the onion theory of risk. Which basically is, you can think about a startup like on day one, um, as having every conceivable kind of risk, right? And you can basically just make a list of the risks. And so you've got, you know, founding team risk. You know, do the founders, are the founders gonna be able to work together? Do you have the right founders? You're gonna have product risk. You know, can you build a product? You'll have technical risk, right? Which is maybe you need a machine learning breakthrough or something to make it work. Are you gonna be able to do that? You'll have, you know, launch risk. Will the launch go well? You'll have, you know, market acceptance risk. You'll have revenue risk. A big risk you get into in a lot of businesses that have a sales force is, can you actually sell the product for enough money to actually pay for the cost of sale? So you have the cost of sale risk. If you're a consumer product, you'll have a viral growth risk. Well, you get the thing of viral growth. And so, a startup at the very beginning is basically just this long list of risks. And then the way that I always think about running a startup is also the way I think about raising money, which is it's a process of peeling away layers of risk as you go. And so you raise seed money in order to peel away the first two or three risks. The founding team risk, the product risk, and maybe the initial launch risk. You raise the A round to peel away the next level of product risk. Maybe you peel away some recruiting risk because you get your full engineering team built. Maybe you peel away some customer risk because you get your first five beta customers. And so basically the way to think about it is you're peeling away risk as you go. You're peeling away risk by achieving milestones. And then as you achieve milestones, you're both making progress in your business, and you're justifying raising more capital. And so you come in, and you pitch somebody like us, and you say you're raising a B round. The best way to do that with us is you say, okay, I raised a seed round, I achieved these milestones, I eliminated these risks. I raised the A round, I achieved these milestones, and I eliminated these risks. Now I'm gonna raise a B round. Here are my milestones, here are my risks. And then by the time I go to raise a seed round, here's the state that I'll be in. And then you calibrate the amount of money that you raise to spend to the risks that you're pulling out of the business. And I go through all this, in a sense this sounds kind of obvious, but I go through all this because it's a systematic way to think about how the money gets raised and deployed. As compared to so much of what's happening, especially these days, which is just, my God, let me go raise as much money as I can. Let me go build the fancy offices, let me go hire as many people as I can, and just kind of hope for the best."
4
21
1
140
12,273
Ivan (e/acc) retweeted
soon, your ISP and mobile operator will be hacked choose where you live wisely and find a way to communicate with your family when time comes be ready to stay offline for weeks, also without electricity when the power plants get hacked too get your starlink ready on the standby plan, activate more than one mobile eSIM on your phone learn how to produce (and stock) solar energy, make sure you know where to find drinkable water you have a few weeks left to prepare if you belong to my community, i'll happily help you with whatever you need stay safe out there
20
16
2
223
22,832
Ivan (e/acc) retweeted
The new enterprise sales playbook: - Services as the Trojan horse: companies will let a few smart humans in long before they'll buy software they don't understand. - Ground-truth data capture: capture workflows nobody wrote down. The weird exceptions and workarounds are what generic AI gets wrong. - Expand margins through software & hardware: every customer should need fewer of your people than the last. Palantir got called a consulting firm for years for doing this.
20
13
8
283
24,201
It's not everyday when the CEO of the top cybersecurity firm calls out what you've been building for the last two years as the number one step to take.
Attacks will accelerate from here on - We are there: Six months ago I said Mythos like capability will be widely available. It's happening. A critical vulnerability, a social engineering attack that looks innocuous, or daisy chaining publicly available vulnerabilities and conducting a sniper strike is all being witnessed in the wild. Incident responders have never been busier. Some key points: - attacks are not becoming more sophisticated, it's the same attacks, faster and by a lot more people. - attack path discovery which took trial and error and multiple attempts is now trivial, open source LLMs are here to help - you are as secure as your supply chain, insecure down or upstream players who have access to your infrastructure could be the next attack path, marketplaces and supply chain is an easier vector The increase in activity is a result of more people becoming better at hacking due to the ease of being able to attack. Had not contemplated that in my calculus. Please: 1. Test your infrastructure for accessible vulnerabilities and misconfigurations 2. Fix your code and demand your vendors do. 3. Old infra, or insecure infra at the perimeter needs to be updated first 4. New AI tools, especially coding need a security framework. Your developers will do more with code, new skills, and more automation. Don't forget the coding models have trained on human code. Stay safe this Halloween :)
1
23
Ivan (e/acc) retweeted
A CVE (Common Vulnerabilities and Exposures) is a publicly disclosed security flaw. They increased following a slight upward slope all the way to early 2024, when there was a sudden small increase... then starting in 2026, we went full exponential. In most instances, the vulnerabilities were pre-existing, so much of the increase is just our better ability to find the faults. This is of historical importance. We have never witnessed anything of the sort.
35
155
36
725
46,814
Ivan (e/acc) retweeted
October in a nutshell: - PHP got hacked - Railway got hacked - OpenCode got hacked - Binance got hacked - Polymarket got hacked - GitHub Actions got hacked - SoftBank got hacked - Cursor marketplace got hacked - Coinbase vendor got hacked - Fireworks AI got hacked - LiteLLM got hacked - Capcom got hacked - npm packages got hacked - TiDB Cloud got hacked - Warp's vendor got hacked happy cybersecurity awareness month
393
2,983
329
16,090
529,946
Ivan (e/acc) retweeted
Coding agents on employee or contractor laptops are a massive cyber and national security risk
Massively underreported: an official Claude Code extension was compromised and installed backdoors on developer machines. Could it be behind the Binance hack?
Readers added context they thought people might want to know
The post misstates the facts: a tampered copy of the Claude Code extension was published briefly to Cursor's marketplace only and was not developed by Anthropic; official channels and distributions were unaffected. cursor.com/blog/claude-co… x.com/cursor_ai/stat… x.com/felixrieseberg…
125
29
18
453
44,443
Sad reality of our digital world.
18
Ivan (e/acc) retweeted
AI's cyber skills have taken a huge leap in about two years In a test that simulates a 32-step cyberattack on a company network, tracking how far each model gets as it uses more tokens: - GPT-4o, a 2024 model, stalled at step 2 and never improved with more tokens - Today's top models kept improving all the way to 100M tokens, getting about three-quarters of the way through on average - The best attempts finished all 32 steps and took over the entire network From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-security…
25
30
3
225
25,942
I tried to warn people. I work at one of the largest AI labs in the world. We are currently helping combat hundreds to thousands of agent swarms on our electrical grid infrastructure in the United States. The labs won’t tell the truth but I will.
JUST IN: 🇺🇸 US military is preparing for the possibility of a major war that could cripple power grids, disrupt supply chains and threaten critical infrastructure on American soil, NYPost reports.
147
434
24
4,625
477,545
When I worked at @NM_Financial this type of data was gold. Insane that we can have it all in a single dashboard now. Thanks for sharing @jasonfurman @erikbryn
An amazing resource, courtesy of @jasonfurman
1
29
Ivan (e/acc) retweeted
Here’s an interesting counterpoint to my concern that our economic institutions are not keeping up with rapidly changing technology. I don’t agree, but I’ll do what I can to make @larrywabrams point of view more true by encouraging, dynamism, entrepreneurship, and innovation in our institutions.
#econtwitter There is starting to emerge within economists circles two schools of thought on the ability of economic institutions to adapt to transformative AI (TAI) - what I call “The Stanford School” and “The Hayek School” Below is lede to @DigEconLab recent post announcing new monograph. Here is my reply A counterfactual to @DigEconLab @erikbryn premise that “TAI advances faster than economic institutions can adapt”>> rapid rise in startups success of @OpenRouter @baseten offering auction market design routers-harnesses-post-training low transaction cost competition between frontier LLMs and open weight LLM.
4
1
19
5,865
Ivan (e/acc) retweeted
Three cybersecurity incidents in one week: ➡️ AI agents are accessing bank accounts. Major U.S. banks, including JPMorgan, Morgan Stanley and Bank of America, are reportedly grappling with third-party agents accessing customer accounts, with some appearing to act beyond users’ instructions. Banks are restricting access, with read-only permissions emerging as a possible compromise. The question: what should an agent be allowed to do on your behalf? ➡️ A weakness in the certificates that secure internet traffic - potentially affecting everyone online Cloudflare reported that affected eMudhra root TLS certificates had a trivially guessable private key: literally the number 4. An attacker positioned to intercept traffic could use that weakness to impersonate websites or services and potentially read or alter communications. The fix: remove trust in the affected roots. For most users, that means updating their browsers and operating systems. ➡️ PHP vulnerabilities that could expose servers to takeover - affecting companies running servers PHP powers an estimated 70% of websites, according to the post. The vulnerabilities dubbed “php2shell” could allow attackers to send crafted requests to vulnerable servers and potentially take control. That could mean reading, modifying or deleting data—or repurposing the server for further attacks. Cloudflare deployed free mitigations, but urged operators to upgrade PHP or remove it if unused. Protection at the network edge doesn’t replace fixing the underlying vulnerability. These stories expose different problems: agent permissions, broken trust and vulnerable software. AI adds another layer to an already demanding security challenge. As agents move from answering questions to taking actions, organizations need to know: ▪️ Which agents can access their systems? ▪️ What are they authorized to do? ▪️ How are their actions monitored—and stopped? Network security, identity and access management, and application security all have a role in the AI value chain. For investors, the question is which companies can turn those security needs into durable demand and revenue. Not every cybersecurity company will benefit equally. That’s where the investment analysis gets interesting. $NET $JPM $MS $BAC
3
7
2
32
4,495
Ivan (e/acc) retweeted
Replying to @sama
Best friends
17
37
6
2,461
165,585
Ivan (e/acc) retweeted
SITUATION DETECTED: A highly sophisticated wave of coordinated cyberattacks has targeted multiple Wall Street hedge funds, including Point72 Asset Management, Citadel, and Two Sigma Investments, per Bloomberg.
82
134
125
2,328
490,793
Ivan (e/acc) retweeted
Be careful what you post anonymously. New research shows AI can find who you are solely from your posts. It's rare to see ~500x research improvements, but they went from mapping <0.1% to 54% of HackerNews profiles to their LinkedIn. It's so over, u/throwaway4927.
186
408
146
3,282
429,251
84% of AI tools have already been breached. Over 51% face credential theft risks right now. This isn’t just a cybersecurity issue - It’s a leadership failure in AI risk strategy. ▶️Most AI rollouts skip secure integration. ▶️Security isn’t a feature - it’s the foundation. ▶️Future-ready firms build AI with risk, compliance, and trust by design. 🔁 Repost if this feels true 💬 Would you trust your AI stack under attack? 📌 Follow @sijlalhussain for more AI + strategy insight Source: SNS Insider globenewswire.com/news-relea… #AIStrategy #CyberSecurity #AILeadership #RiskManagement @drsharwood @sulefati7 @timo_vi @RLDI_Lamy @bbailey39 @JoannMoretti @Nicochan33 @TysonLester @NigelTozer @bimedotcom @jenstirrup @ramonvidall @mvollmer1 @EstelaMandela @RedBlockchain @Fabriziobustama @phverhaeghe @PVynckier @AnthonyRochand @Shi4Tech @BridgeworksLtd @FutureOurWork
3
12
1
16
8,070
Ivan (e/acc) retweeted
Pace of innovation is the only moat.
21
9
4
115
9,029