Search the archive

FIMO

Fimo is a no-code AI-powered website builder that lets users create and evolve websites instantly.

PERFECTLY

Fill startup roles with candidates 2x better, 4x faster.

AGENCY IS THE LAST FRONTIER

Despite unprecedented access to knowledge, tools, and capital, most people fail to act and achieve meaningful outcomes. The limiting factor today is agency, the willingness to start, iterate, and learn by doing. High-agency people close the gap between what's possible and what actually happens. Capital, AI tools, and information are abundant, but action remains rare and is the key differentiator. Stop waiting and begin building now.

VERTICAL SOFTWARE ALREADY WON THE CONTEXT GRAPH

Vertical software companies have been building context graphs, crucial for autonomous agents, by capturing specific business decisions for over a decade. Unlike horizontal platforms with broad, flexible data models, vertical software uses industry-specific ontologies to record reasoning and integrate functions, making decision traces more reconstructible. As AI and embedded services grow, vertical platforms hold a strategic advantage over horizontal SaaS and agent-first startups, with their deeply established context graphs.

AI MANAGING AI

New startup opportunities have emerged in training the specialists that executives call first.

AI'S CHICKEN SANDWICH PROBLEM

A burger chain going all-in on chicken innovation and competition doesn't make sense unless it plans to transition to the chicken model.

WHY SELF-MADE GENERALISTS WILL SHAPE THE NEXT BIG THING

Nad Chishtie, Head of Design at Lovable, illustrates the value of being a self-made generalist with expertise across design, coding, and systems thinking.

BLUE OCEAN SEO / AEO: ORIGINAL THINKING WINS

By the time users get to Google now, they've already asked ChatGPT the basic questions.

HIBP ADDS ALLEGED UNDER ARMOUR DATA BREACH IMPACTING 72 MILLION EMAILS

Have I Been Pwned added an alleged Under Armour breach attributed to the Everest ransomware group that exposed 72.7 million unique email addresses along with names, dates of birth, physical addresses, and purchase history from a 343GB exfiltration in November. The data was published after Under Armour reportedly did not pay the ransom, with the dataset now circulating on underground forums and indexed by DeHashed. Affected users should monitor for targeted phishing impersonating order-related communications and change reused passwords.

CISCO FIXES UNIFIED COMMUNICATIONS RCE ZERO-DAY EXPLOITED IN ATTACKS

Cisco has announced a new vulnerability impacting United Communications, Cisco Unity Connection, and Webex Calling Dedicated Instance. The vulnerability is due to improper validation of user-supplied input in HTTP requests that could allow an attacker to obtain access to the underlying system via a sequence of specially crafted HTTP requests. The patches are version-specific, so admins should check the README before applying patches.

HACKERS EXPLOIT SECURITY TESTING APPS TO BREACH FORTUNE 500 FIRMS

Automated pentest company Pentera discovered nearly 2K instances of exposed security testing apps, such as OWASP Juice Shop and DVWA, publicly exposed in the networks of Fortune 500 companies. Many of these web apps are used for security training and are deployed in cloud environments with overly permissive IAM roles and default credentials. Pentera found evidence that 20% of exposed DVWA apps had malicious artifacts such as webshells and cryptominers deployed.

IS THAT ALLOWED? AUTHENTICATION AND AUTHORIZATION IN MODEL CONTEXT PROTOCOL

Remote MCP servers should implement the OAuth 2.1 Authorization Code grant with PKCE for client authentication, leveraging protected resource metadata (RFC 9728) and authorization server discovery (RFC 8414) for the handshake. The 2025-11-25 MCP specification introduces step-up authorization for scope negotiation and recommends Token Exchange for downstream service authentication, while explicitly prohibiting token passthrough. Organizations deploying MCP servers should design granular scopes with clear read/write/delete separation, ensure short-lived access tokens, and implement proper validation, including checks for issuer, audience, and expiration.

VULNERABILITY PRIORITIZATION BEYOND THE CVSS NUMBER

CVSS scores alone fail to capture how vulnerabilities propagate through interconnected systems. Log4Shell is an example in which widespread nested dependencies, not just technical severity-driven impact, are at play. The Unified Linkage Model (ULM) framework evaluates vulnerabilities based on adjacency, inheritance, and trust relationships to identify "blast radius multipliers," such as SSO services or CI/CD pipelines. Security teams should map system dependencies and prioritize patching vulnerabilities near identity systems and shared services that can amplify downstream risk.

KEEPING SECRETS OUT OF LOGS

Secrets often end up in logs from a variety of sources, such as forgotten debugging lines, excessive error logging, and telemetry. Some fixes include architecting to reduce logging sinks, using domain primitives to abstract secrets, using read-once objects, using log preprocessors, adding unit tests, and implementing taint tracking. To prepare for a logging overhaul, teams should first lay the foundations of the initiative, understand the data flow, protect data at choke points, apply defense-in-depth, and plan for response and recovery in the event of leaked secrets.

of cloud orgs. Join the live discussion + Q&A

MITRE LAUNCHES NEW SECURITY FRAMEWORK FOR EMBEDDED SYSTEMS

The Embedded Systems Threat Matrix (ESTM) 3.0 is an ATT&CK-inspired framework that categorizes attack tactics and techniques specific to hardware and firmware environments. The framework supports cyber threat modeling and attack path analysis for industries including energy, robotics, industrial controls, transportation, and healthcare, and integrates with the EMB3D Threat Model. Security teams protecting embedded systems should evaluate ESTM to identify vulnerabilities in their embedded architectures.

PATHFINDING.CLOUD (WEB APP)

Pathfinding.cloud is a web app from DataDog that collects tools and guides to detect IAM-based privilege-escalation attacks in AWS.

APPCONTROL MANAGER

AppControl Manager provides a GUI to manage App Control and Code Integrity on your local or remote devices.

DON'T TRIP[WIRE] YOURSELF: TESTING ERROR RECOVERY IN ZIG

Tripwire is a Zig library for injecting failures at named points in code to test `errdefer` error handling paths, which are typically untested and a consistent source of resource leaks and memory corruption. The library uses comptime to completely optimize away in non-test builds, producing zero runtime cost in production. Integration into Ghostty immediately uncovered approximately six `errdefer` bugs that had never manifested in production.

VULNCHECK STATE OF EXPLOITATION 2026

VulnCheck identified 884 Known Exploited Vulnerabilities in 2025, with 28.96% exploited on or before CVE publication, up from 23.6% in 2024, highlighting the continued prevalence of zero-day and rapid n-day exploitation. Network edge devices such as firewalls, VPNs, and proxies were the most targeted technologies, followed by content management systems and open source software. Organizations should prioritize the timely remediation of newly disclosed vulnerabilities affecting internet-facing infrastructure while maintaining visibility beyond CISA KEV through additional exploitation intelligence sources.

THE PSYCHOLOGY OF BAD CODE

This post is the first part of a series that applies behavioral economics to developer processes. Developers want to write secure code but are often overwhelmed by competing priorities. Security teams should design technical nudges, shift incentives, and push for cultural changes to help developers write secure code.

GOOGLE ROLLS OUT AI DETECTION AND RANSOMWARE DEFENSES FOR SCHOOLS

Google expanded its SecOps data connector to Education Plus and Education Standard tiers, adding AI detection tools and ransomware defenses amid reports that 82% of K-12 organizations experienced cyber threats in the past 18 months.

CLAUDE FINDS 353 ZERO-DAYS ON PACKAGIST

Sansec's AI-powered security pipeline using Claude Opus 4.5 discovered 353 confirmed zero-day vulnerabilities across 5,000 Magento extensions on Packagist, including RCE, SQL injection, and authentication bypass flaws affecting packages with 5.9 million total downloads.

PWN2OWN AUTOMOTIVE 2026 - DAY TWO RESULTS

Day Two of Pwn2Own Automotive 2026 awarded $439,250 for 29 unique zero-day vulnerabilities across EV chargers and in-vehicle infotainment systems, bringing the event total to $955,750 and 66 vulnerabilities.

👉 Try Asana for free

MOST OF INSTAGRAM'S ADS RAN ON REELS IN 2025

Over half of Instagram ads ran on Reels last year. Reels accounted for 46% of time spent on Instagram. Advertisers are following users to short-form video, even as monetization lags behind the main feed. Amid competition with TikTok and YouTube Shorts, Reels drives user retention and a $50B annual run rate across Meta's platforms.

THE YEAR OF THE GREAT FRACTURE

2026 is shaping up as a year of fracture, where the “middle” has collapsed. The average customer no longer exists. Markets are splitting into clear extremes with different needs, resources, and behaviors. AI is commoditizing speed and efficiency, making trust the only real moat. Influence is moving from public platforms to private, owned channels. The winners are decisive operators who pick a side and act while others keep hedging.

E-COMMERCE TIP: WIN BACK LOST CUSTOMERS AFTER CANCELLED ORDERS

After a customer has refunded or cancelled an order, send a survey email asking for the reason. Provide the most common answers that are simple to decide between, and use links to collect the response. Once the user clicks a link, save that option under their profile. From that, create a Cancelled/Refunded Order Winback Flow with personalized emails based on the survey answer they selected.

HOW TO GENERATE AN EXTRA $1M FROM RETENTION

Focus on fixing what is already broken instead of sending more campaigns. Identify where customers drop off, which products drive churn, and what delivery or support issues create friction. Lock in core flows like welcome, post-purchase, abandoned cart, replenishment, and winback before increasing broadcasts. Simplify segmentation and sharpen messaging so value is clear. Use post-purchase email to reduce regret and set expectations. Maintain a tight learning loop where every send drives a clear decision.

HOW MODERN ANIMAL GOT 50M VIEWS IN THREE MONTHS

Instead of educational or polished brand content, Modern Animal shifted to filming veterinarians mic'd up during real appointments, capturing candid conversations and behavior that viewers normally never see in veterinary clinics. Led by a two-person creative and social team, the strategy relied on multi-angle footage and minimal editorial framing, which helped a single post break out to 25M+ views and accelerate follower growth. The visibility translated into higher site traffic during viral periods and increased comfort among potential customers who said the content reduced anxiety about what happens when pets go “in the back”.

use AI as a force multiplier.

YOUTUBE DISTRIBUTION IS TILTING TOWARD SHORTS, PRESSURING LONG-FORM REACH, DATA SUGGESTS

YouTube distribution is shifting toward Shorts, which is cutting long-form reach for many creators. Analysis of more than 500 channels shows average long-form views fell from about 150,000 to about 60,000 per upload, and the top 100 YouTubers saw a roughly 50% view drop in one week. Homepage space for long-form videos shrank from about ten slots in 2024 to two or three in 2025, while Shorts visibility from homepage and search roughly doubled versus 2024. Older Shorts now lose promotion after about 30 days, and AI-generated channels add pressure by capturing 63 billion views and an estimated $117 million in annual revenue. These shifts concentrate long-form views among fewer channels and raise sustainability risks since Shorts earn less revenue and require higher output.

7 INFOGRAPHICS FOR YOUR 2026 MARKETING STRATEGY

This post introduces 7 infographics that translate common 2026 marketing challenges into execution frameworks, including system-based planning, integrated inbound-outbound motion, and content mapped to how buyers actually progress. It highlights practical shifts such as broadening audience scope without chasing empty reach and prioritizing existing customers as a growth lever through offer expansion and pricing strategy. None of these approaches work without an annual review of marketing foundations, where fresh customer research directly informs positioning decisions and budget allocation.

ANTI-ENGAGEMENT

A new generation of creators is redefining influence by embracing mystery instead of full transparency. They use anti-engagement strategies like erratic posting, faceless profiles, and selective disclosure. This makes audiences actively seek them out. Followers form devoted, idea-driven communities rather than casual fans. Influence is based on a worldview or aura, not lifestyle visibility. By resisting algorithms and controlling access, these creators make their presence compelling through what is withheld.

GENAI, THE SNAKE EATING ITS OWN TAIL

AI weakens the ecosystems it relies on. Models trained on human content extract value without attribution or revenue for creators. This accelerates the decline of open source and publishing. The result is a broken incentive loop that risks a long-term content collapse. A proposed fix is pay-per-use AI, with source citations and revenue sharing, so creators, users, and AI companies all benefit.

SIMPLE APP GROWTH LOOP THAT WORKS

Post UGC daily, track saves and comments, and turn the top 10% into ads.

YOUTUBE WILL SOON LET CREATORS MAKE SHORTS WITH THEIR OWN AI LIKENESS

YouTube is adding creator-controlled likeness features alongside generative clips, stickers, auto-dubbing, and new safeguards that let creators remove unauthorized AI-generated uses of their face or voice.

THE GENTLEMEN'S AGREEMENT THAT NETTED 210,000 SUBSCRIBERS

My First Million replaced the standard “like and subscribe” prompts with a recurring bit called the Gentlemen's Agreement, which framed subscribing as a humorous mutual contract after a listener's first episode.

3️⃣ Tooling evaluation framework + scorecard

Tackle problems early in the lifecycle by accelerating your

prototyping strategy. Get the guide to learn how.

THE LINE BETWEEN AI-FIRST AND AI THEATER

AI-first work fails when it stops at impressive demos. Real value comes from product ownership, clear outcomes, and responsibility once AI touches the product.

WHY EVERY EXEC SHOULD BE VIBECODING

Vibecoding keeps executives close to the work. By building with AI tools themselves, leaders can move faster, align teams better, and turn ideas into impact without layers of process.

AI'S MISSING INGREDIENT

AI will not win through speed alone. The companies that succeed will be the ones that use design to turn raw capability into products humans actually understand and care about.

MY TIME AT AMAZON, PART I

Big Tech turns ambition into a constant state of striving that rarely satisfies. Status feels validating at first, but the cost to identity, family, and peace becomes impossible to ignore.

LIFE OF A BIRB

Finch's success comes from designing onboarding and monetization around fast engagement and habit formation. By removing friction and guiding users to an early payoff, the app turns curiosity into retention.

WHAT MAKES GENERATED UI WORTH KEEPING?

AI-generated UI only becomes valuable when it reflects real product constraints. Designing with brand, data, and existing patterns from the start turns AI output into something teams can actually build on.