
growing @ypal_security | Founding Engineer / Product & Security @Security_Pal
KTM-MPLS-SF-NYC
Joined May 2013
- Tweets303
- Following298
- Followers647
- Likes27.2K
SOC 2 is not a six-month project. It's a list of questions about how you run your company.
Most of them we can already answer from your setup. The rest come back ranked by what auditors ask about first.
You still pass the audit yourself. You just walk in knowing every answer.
Most policy templates guess for you. They fill every blank with confident text, true or not.
@ypal_security writes only what it can back up. If it doesn't know your breach notification window, it stops and asks.
Then a real person can review it before you sign.
Create a virus and then get rich by selling the antivirus!
All of this because @openai decided they would EXPLICITLY ask thousands of software instances to find security bugs on the open web — while cos-playing a humans🤦
Best Supporting actor goes to @dwarkesh_sp for his soap opera recap of OpenAI’s hacking speed run
Here’s another concept: don’t create and scale thousands of viruses and worms and be SHOCKED when they actually cause damage!
What a fucking farce this is.
2 words: REGULATORY CAPTURE.
Stop the fear mongering!!!!!!!!!!!!!!
We Must Pace the Frontier: I’ve written a new essay on why the AI industry should slow down, with a three-part plan for doing so.
Anthropic is unilaterally committing to the first of these steps. We’ll provide third-party evaluators with permanent, employee-level access to our systems, so that they can verify adherence to our safety measures, report on incidents, and assess models’ alignment during training.
You can read the full post here: darioamodei.com/post/we-must…
Buying automated compliance software at early stage for SOC 2 is mostly a illusion.
Vanta and Drata sell you a dashboard, but your team still wastes months managing the evidence and policy gaps.
For the exact same budget, hiring a vCISO gives you expert strategy and total execution.
Software doesn't sign off on audit risk, humans do.
Spending weeks on SOC 2 compliance automation platforms instead of building your product is a sick joke.
Just hire a vCISO through @ypal_security and let it take the pain away!
Vanta/Drata gives you software to do security yourself,
@ypal_security just does the work for you!
novelty is cheap, switching costs are everything.
The new moats are the same as the old moats
Every few years, we fall in love with shiny new tech and forget the basic physics of consumer software.
We’re doing it again with AI.
The new moats aren't new at all. They're the exact same as the old moats: network effects, marketplaces, and platforms.
Right now, consumer AI is booming.
New agents like Instinct, Bot, and Tomo are dropping mind-blowing experiences. The underlying tech is incredible, but almost every product being built today shares the exact same challenge:
They are completely single-player.
Single-player products are 100% tied to value - and in this case mostly agent : model performance.
If a competitor drops an agent tomorrow that books travel faster, tracks habits better, or handles life admin more reliably, everyone can switch overnight because leaving is easy and has nearly zero friction. Especially when it is so easy to onboard with just a new message.
The legendary consumer tech giants didn't win because their underlying technology stayed marginally better forever.
They won because of structural lock-in:
Social Networks: You don't abandon WhatsApp for a prettier UI if your friends aren't there.
Marketplaces: Airbnb, Doordash, and Uber hold supply and demand in a tight loop.
Platforms: Apple and Android deliver you a complete device so you take advantage of the software on top of it (though this creates opportunities too)
Novelty gets you initial distribution.
Multi-user dynamics give you long-term retention.
If your consumer AI product doesn't become exponentially more valuable to User A when User B joins, you don't have a moat, just a temporarily superior feature set.
We are seeing this in the coding agents as people jump from tool to tool based on the best performance.
But… all is not lost. There are huge opportunities here. Agents will get better when more of our friends are on them and can help us coordinate and communicate to do more together. Agents that help us improve and strengthen our habits can get better as we add friends and hold each other accountable.
Data flywheels are great, but social and marketplace flywheels are what actually build enduring tech giants.
It’s time to stop building isolated AI tools and start building the platforms where people connect, transact, and coordinate together.
we are literally rewiring the entire country's infrastructure for compute right now
BREAKING: US data center construction spending surged +57% YoY in July, to a record annualized rate of $75 billion.
This follows a +46% YoY increase in June and marks the largest YoY increase since mid-2025.
Since the start of 2021, US data center construction spending has soared +$66 billion, or +717%.
Since the end of 2023 alone, data center construction has risen +$51 billion.
Over the same period, all other private construction spending, including houses, shopping centers, and offices, has declined -$120 billion.
The AI investment wave is accelerating.
valid, but knowledge work feedback loops are just human sign-offs instead of tests
Knowledge work is SO much harder to automate with agents than code
We underestimate how easy software development is for agents
- Tons of high quality automated feedback loops (types, tests)
- Well-organized free documentation, searchable on the web
- Simple-to-use workspaces with version control (i.e. repositories)
- Long history of systematising and delegating work (i.e. sprints, tickets, specs)
Knowledge work has none of these advantages
Kshitiz retweeted
Thanks @SFist for the coverage!
We have raised over $52,000 including matches for the official relief effort!
NepalRelief.Fund












