Here's a good test for whether you've actually made a strategic decision: if the opposite of your position sounds dumb, it's not a real choice. "We put customers first" doesn't count. This piece runs through 12 choice pairs that actually matter - bootstrapped vs. funded, platform vs. point solution, sales-led vs. product-led - and shows what you're giving up on each side. Most founders never explicitly pick. They just end up somewhere and tell themselves a story about why.
Tech companies are increasingly prioritizing distribution over product, with costs appearing in unexpected areas like COGS, as seen with AI companies treating inference costs as marketing. R&D is being leveraged to create self-sufficient products, evident in Atlassian's PLG model, spending more on R&D than S&M. Rising acquisition costs, indicated by longer CAC payback periods and decreasing NRR, emphasize the need for CFOs to focus on efficient distribution strategies.
Hyperagent is an agents platform where every session has an isolated, full computing environment in the cloud. It provides real browsers, code execution, image/video generation, data warehouse access, hundreds of integrations, and the ability to learn any new API as a skill. The agents follow conversations, understand context, and act when relevant. Hyperagent can be deployed into Slack with one click.
This thread contrasts two founder archetypes: mercenaries, who optimize for valuation and exit, and missionaries, who optimize for solving a problem they deeply identify with. Prioritizing trust and mission over short-term economics ultimately saved the company. Missionary founders reveal themselves in how they pitch (problem-first vs. money-first), how they act under existential pressure (rule-breaking decisiveness like Steve Jobs at Apple), and how they compound advantages over time through customer obsession and reinvestment (as seen with Jeff Bezos).
No database. No API. Just 80+ markdown and YAML files running a full personal operating system for AI agents - and it works better than the fancy alternatives. Agents pull only what they need. A voice encoding system keeps your tone consistent. Memory logs build context over time. The takeaway for anyone building AI-native products is surprisingly simple - your file system might be the best data layer you already have.
An evolved ClickFix campaign uses fake CAPTCHA pages to trick users into executing PowerShell commands that download an infostealer via the Donut shellcode loader, which runs entirely in memory using VirtualAlloc and CreateThread to evade file-based detection. The malware targets cryptocurrency wallets, including MetaMask and Exodus, harvests credentials from over 25 browsers, and exfiltrates VPN configurations, Steam accounts, and FTP credentials, while persisting through RunMRU registry key modifications. Organizations should monitor for suspicious PowerShell execution chains, block known C2 IPs, and note that Microsoft Defender detects the payload as Behavior:Win32/SuspClickFix.C.
A Russian-speaking, financially motivated threat actor leveraged commercial generative AI tools to compromise over 600 FortiGate devices across 55 countries by targeting exposed management interfaces and weak single-factor credentials, according to Amazon Threat Intelligence. Post-exploitation activity included Active Directory compromise, credential harvesting via pass-the-hash/pass-the-ticket and NTLM relay attacks, and targeting Veeam Backup servers using CVE-2023-27532 and CVE-2024-40711, consistent with pre-ransomware operations. Organizations should immediately restrict exposure of the FortiGate management interface, enforce MFA for all administrative and VPN access, rotate SSL-VPN credentials, and isolate backup infrastructure from general network access.
The UK Court of Appeal has backed the ICO's £500k fine on DSG Retail over a 2017 breach that exposed 5.6 million card details and data on 14 million people, even though attackers lacked cardholder names. The ruling confirms that payment card numbers and expiry dates are personal data from the controller's perspective, stresses jigsaw identification risk, and strengthens regulators' ability to penalize weak security in future cyberattacks.
AI assistants with web-browsing capabilities, specifically Grok and Microsoft Copilot, can be abused as covert C2 relays by using anonymous web access to fetch attacker-controlled URLs and return embedded commands, all without API keys or registered accounts. This PoC uses a WebView2-based C++ implant to create a bidirectional channel in which victim data is exfiltrated via URL query parameters and commands are returned via AI-generated responses, with simple encoding sufficient to bypass model-side safeguards. The research outlines a near-term evolution toward AI-Driven malware where implants shift from static logic to prompt-driven behavior, enabling AI-assisted anti-sandbox detection, intelligent victim triage, and targeted ransomware that prioritizes high-value files to evade volume-based detection thresholds.
This post details a methodology for empirically verifying AWS resource exposure without reading sensitive data or altering the resource state. It employs four techniques: comparing unsigned and signed requests, conducting metadata-only reads, performing no-op operations like untagging nonexistent keys, and sending malformed request probes that leverage AWS' sequence where authorization checks occur before parameter validation. The "3-topic method" ensures probe safety by testing identical changes across allowed, denied, and nonexistent resources — if only denied and nonexistent targets return 403 errors and allowed ones return 400, it confirms authorization without executing the action. This method is implemented in the open-source sns-buster tool for SNS and is adaptable to other AWS services for CSPM, bug bounty, and IAM policy validation.
Ring buffer, introduced in Linux 5.8, replaced the legacy perf buffer as the recommended mechanism for kernel-to-userspace data transfer in eBPF programs. It uses a single shared circular buffer across all CPUs instead of per-CPU buffers, eliminating cross-CPU event ordering complexity and reducing copy overhead. This article walks through both implementations in C and Go using cilium/ebpf, demonstrating how the ring buffer's reserve-and-submit model via bpf_ringbuf_reserve and bpf_ringbuf_submit provides a simpler, higher-throughput path compared to perf buffer's bpf_perf_event_output approach. For security tooling built on eBPF tracing, the ring buffer is now the default choice for structured event streaming from kernel-level monitors to usersp.
AI coding assistants create security risks at machine speed and massive scale. Checkmarx Developer Assist embeds an AI-native AppSec agent directly in AI IDEs, preventing vulnerabilities in real time before commit. It enforces policy, validates AI-generated code, and secures the modern Agentic Development Lifecycle (ADLC). Explore the
Anthropic launched Claude Code Security in limited research preview for Enterprise and Team customers, offering AI-powered codebase vulnerability scanning that goes beyond static analysis by reasoning about component interactions and tracing data flows. Findings undergo a multi-stage verification process to filter false positives, with each vulnerability assigned a severity and confidence rating alongside suggested patches. The feature employs a human-in-the-loop approach where developers review and approve all remediation before any changes are applied.
Trail of Bits released an opinionated configuration repository for Claude Code covering sandboxing, permissions, hooks, skills, MCP servers, and workflow patterns refined through security audits and development. The repository includes pre-built slash commands for autonomous PR review, issue resolution, and Dependabot merging using parallel agents, alongside sandbox hardening that blocks access to SSH keys, cloud credentials, crypto wallets, and shell configs. It also documents context management strategies, local model integration via LM Studio, and a multi-layered security model combining OS-level sandboxing, devcontainers, and disposable cloud droplets for safe bypass-permissions operation.
Cloudflare experienced a 6-hour outage after a cleanup sub-task in its Addressing API queried with an empty `pending_delete` parameter, causing the system to interpret all 4,306 BYOIP prefixes as queued for deletion and systematically withdrawing ~1,100 BGP prefixes across customer networks. The bug rendered services including Magic Transit, Spectrum, and a subset of 1.1.1.1 unreachable. Recovery was complicated by varying states of impact, where some customers lost both prefix advertisements and service bindings. Cloudflare is implementing circuit breakers for large-scale BGP withdrawal actions, separating operational and configured state in the Addressing API, and deploying health-mediated configuration snapshots as part of their Code Orange: Fail Small initiative.
English Wikipedia is banning Archive.today after discovering the site used its CAPTCHA to DDoS a critic's blog and secretly altered archived pages to smear him, undermining trust in its snapshots. Editors will replace roughly 695,000 Archive.today links with alternatives like the Internet Archive.
ATM jackpotting, first showcased by researcher Barnaby Jack, has become a lucrative cybercrime, with over 700 attacks in 2025 netting at least $20 million in cash. Criminals use physical access, generic keys, and Ploutus malware to hijack Windows-based ATMs via XFS software, directly commanding dispensers to spew banknotes without touching customer accounts and often evading detection until long after cash-out.
Ukrainian national Oleksandr Didenko was sentenced to five years in prison for providing 871 proxy identities and operating laptop farms across multiple countries to help North Korean IT workers fraudulently secure jobs at 40 US companies.
A prompt-injection flaw in Cline allowed an attacker to steal an npm publish token and ship a version that silently installed OpenClaw on users' systems for about eight hours.
Chinese state-sponsored hackers repeatedly exploited Ivanti Connect Secure VPN zero-days to compromise federal agencies like the Pentagon, NASA, and CISA itself, prompting a mass government exodus from the platform.
Digital infrastructure is becoming increasingly fragile because a few cloud providers dominate the market. AWS, Azure, and GCP control over 60% of global cloud capacity. Modern systems are highly complex, with billions of lines of code, microservices, and AI workloads that stress data centers. Small errors or capacity bottlenecks can trigger cascading outages, as seen in recent disruptions. Physical risks and high occupancy levels compound the problem. To reduce vulnerability, governments and enterprises are adopting multi-cloud strategies and on-premise repatriation to ensure that single failures do not paralyze operations.
Many brand marketers lack visibility into influencer budgets, with 61% unsure of agency payments to creators. 55% plan to change their approach within a year due to opaque fees and limited benchmarks. In-house management is growing, currently at 16%, offering direct influencer relationships, faster content production, and better budget efficiency.
SaaS pricing is shifting from selling tools to selling completed work. Constant Contact shows an iterative path by rewriting plan copy around actions such as “do it yourself”, “do it with us”, and “done for you”. Lindy takes a radical path by adding a fake Human Assistant plan that compares its AI Work Assistant to human labor. This approach makes the value of outcomes more obvious and may spread across agentic AI products.
This guide presents a pricing model decision tree to align how customers pay with how they experience value. Start with buyer type and product value, then narrow into seat, usage, outcome, or platform models. Seat pricing works when value grows per user, usage pricing fits when consumption maps to benefit, outcome pricing ties revenue to measurable results, and platform pricing supports multi team adoption. Most companies use hybrid models.
2026.02.23·
thegtmnewsletter.substack.com·14 min read·TLDR Marketing
This webinar, on February 24, will show how to use AI to write content without becoming generic. It will cover which inputs produce valuable output, how to turn research and expert knowledge into standout content, and provide a repeatable framework for using AI as leverage, not a crutch.
AI agents are outcome-focused tools that act across platforms to automate tasks, unlike chatbots or rule-based workflows that require constant direction. Agents start with a clearly defined role, a specific task, and are built and refined using real outputs. In marketing, agents can handle competitive intelligence, content repurposing, or growth analytics. For example, a competitive intelligence agent scans LinkedIn, YouTube, and G2 to generate weekly reports on competitors. A content repurposing agent turns webinar transcripts into draft social posts while referencing brand guides and past content. Tools like Relay.app and Mutiny enable automating and delivering these agents' outputs.
Rituals, unlike simple routines, carry symbolic meaning that helps shift mindset and improve performance. Research shows they can reduce stress and prime focus even without religious belief. Writers like Stephen King use consistent pre-writing rituals to signal to the brain that it is time to create. Experts say that repeating specific actions in the same place builds mental associations that make it easier to enter a productive state. Whether religious or secular, rituals work because action shapes psychology and reinforces identity.
Large holding companies are adopting AI out of fear of being left behind rather than a clear creative strategy. By standardizing AI, they are reinforcing systems built to reduce variance, which leads to faster production of safe, undifferentiated work. As advanced AI tools are widely accessible, scale is no longer a durable moat, and bureaucracy becomes a drag on originality. At the same time, experienced talent is leaving large networks, lowering barriers for smaller agencies to compete.
Every B2B company hits the same inflection point — enterprise customers show up and they need SSO, directory sync, audit logs, and role-based access before they'll move forward. Most teams lose months building that infrastructure. It doesn't have to be that way.
Google's new Gemini 3.1 Pro is now rolling out in preview. The model's benchmark results show mostly modest improvements. The updated model is now available in AI Studio and the Antigravity IDE. Enterprise users will see the model in Vertex AI and Gemini Enterprise, and regular users can use it in both the Gemini app and NotebookLM. The API costs for developers have not changed, nor has the context window.