Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products. Some thoughts: - Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one. - We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week. - At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns. - Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things. - You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here). - To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity. - KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it. - Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!

Thrilled and grateful to announce our investment in @warpsciences. Warp is bringing AI and robotics into the labs, improving the very infrastructure that drug discovery runs on. Discovering new medicines gets faster and cheaper, and more of them reach the people who need them. I can't think of a better team to solve this problem. Thank you, @kevinweil, @dpatil, @manohar_paluri, and Solomon Reisberg, for giving @neon_fund the opportunity to be part of your rocketship!

The Department of Homeland Security is requiring all civilian federal agencies to remove DeepSeek products and 'any third-party services developed using DeepSeek implementations,' and to stop buying them.

beautiful explanation. this is 100% happening. xitter.cf/sotak/status/211179423…

When markets are growing quickly, moats don't really matter. It doesn't make sense for leaders to invest in new spaces. And tons of whitespace gets created. When markets slow down, most moats can't save you anyway. Don't worry too much about moats.

Blackstone is going all-in on Factory as their platform for autonomous software development. The world's most important enterprises are building software factories and accelerating.

We are aware of misinformation in the market today about our acquisition strategy. To be clear, @ServiceNow has no interest or intention of purchasing Decagon. Our approach to M&A has not changed: we remain an organic growth company first. M&A is a tool to accelerate our roadmap or open meaningful new markets, not a substitute for innovation. As we have previously noted, we do not see major strategic gaps that require large-scale acquisitions at this time