Cyber (In)Security

Former NSA Hacker - Building Red Team, Cyber Threat Intel, and Defensive Ops AI Capabilties

[Cyber (In)Security @cybersec]

@jarodhitchcock Thai sentiment right here is exactly why I don’t take any golfer seriously when their first questions is “what is your handicap”? 9/10 chance you made yours up, and you asking me is your lame attempt to think you’re going to alpha me on the golf course.

[Cyber (In)Security @cybersec]

@ZackKorman The “whataboitism” that happens on LinkedIn ranks pretty high on the list of reasons I hate the platform.

[Cyber (In)Security @cybersec]

Oh no! Simply throwing more tokens for tokens sake doesn’t translate into features that users want or need - magically?

You mean #AI doesn’t magically produce value?

You still have to have a *double gasp* - strategy?

Who ever would have thought that “using AI” doesn’t just magically unlock infinite money and infinite productivity?!?

Kudos to Uber for saying the quiet part out loud.

[Hedgie @HedgieMarkets]

🦔Uber's COO Andrew Macdonald said on Saturday that the company is having a harder time justifying its AI spend. After CTO Praveen Neppalli Naga went viral in April for admitting Uber burned through its 2026 Claude Code budget in four months, senior engineering leaders concluded higher token usage was not translating into proportionally more useful product.
Macdonald said the link between AI consumption and shipped features is "not there yet." CEO Dara Khosrowshahi confirmed on the earnings call that Uber is slowing hiring to fund its AI spend. Duolingo also walked back its decision to include AI usage in performance reviews last month.

My Take
Uber is the first major enterprise where the C-suite has publicly admitted, on the record, that the AI productivity story is not closing for them. That matters because Uber is not a skeptic. The company went all-in on AI tooling, set internal targets, and burned through its annual research and development budget in four months trying to make it work. The conclusion from the people running the experiment is that tokens consumed and value shipped are not the same number, and management is finally noticing.

Duolingo's reversal lands in the same week for a reason. CEO Luis von Ahn said employees were asking whether they needed to use AI just to use AI, which is Goodhart's Law showing up in a performance review system. When usage becomes the metric, employees optimize for usage, not output. Microsoft canceled internal Claude Code licenses, Google AI Pro stripped credits from paid subscribers, and now Uber is admitting the ROI does not close at scale.
The narrative has shifted in the last 30 days from "AI productivity is here" to "AI productivity is harder to measure than we thought." The companies pushing tokenmaxxing internally are now the same companies signaling cost pressure externally. The IPO calendar for OpenAI and Anthropic is going to get a lot more complicated if the largest enterprise customers keep saying this out loud.

Hedgie🤗

[Cyber (In)Security @cybersec]

This has been the “hardest” part of understanding my equipment, as a late-blooming tournament golfer.

I picked up a second hand 9i blade that had that sweet spot wear pattern on it from someone who knew how to use it. It goes shorter than my Ping 525 9i.

For the longest time, I thought it was me. Took me a while to realize the golf equipment business is largely a marketing scam.

[Cyber (In)Security @cybersec]

100% this. The amount of “pay to play” I have turned down has changed my perspective on these things in cyber.

“CISO of the year”? I have 50 emails of people telling me I could be the next one for the low low price of $5k

“Neal it looks like you’re a leader in AI and security - we’d love to have you exclusively on our podcast….for the low low price of $3k”

“Neal - come be on our advisory board, and while you’re at it, sell out your whole network to promo our software for the low low rate of 1% preferred options in our company”.

You have no idea how much sales, marketing and the endless supply of VC money is driving the message on what is important in cyber. Not reality.

FYSA: it cost at $1m to wh0re out my network. /s

[Kim Zetter @KimZetter]

I keep getting approached by publications that want to put me in stories and lists about top security people or influencers, etc, and all of them are pay to play. So now when I see features like this I wonder how much people paid to be included.

[Cyber (In)Security @cybersec]

https://t.co/rQOrYp7NFv

[Joseph Thacker @rez0__]

The race to the bottom is here. Pentests are a commodity.

[Cyber (In)Security @cybersec]

I love Paperclip. Right up until I tried to operationalize it. Than I realized I needed to hire an HR department to manage my agents cause the lack of all these things made it a giant game of telephone. 10/10 would use again - but I’d plan the system out better for these very reasons.

[Cyber (In)Security @cybersec]

@techspence SAME! I keep dreaming of a day lol.

[Cyber (In)Security @cybersec]

@RippletideCo @TheGeorgePu If you say so. My experience seems to be different and working for me.

[Cyber (In)Security @cybersec]

@Jhaddix @AnthropicAI Second this. It’s been the same with OpenAI in their security program. I was fortunate enough to to get access, but getting anyone to actually “work” with researches has actually proved challenging.

[Cyber (In)Security @cybersec]

@roderik @zeeg This is the right answer, but only works for Claude Code. If you’re using chat or CoWork, you’re out of luck. It also doesn’t work in the desktop version of Claude code (iirc).

[Cyber (In)Security @cybersec]

@packyM I still believe there has to be a business model out there to create a signature to verify a piece of content was 100% generated by a human. Maybe an actual valuable use of blockchain?

<this post certified to be human>

[Cyber (In)Security @cybersec]

I’m in the same boat. Not really hitting these limits. I noticed the jump, but hasn’t impacted me shipping.

I’m not going to try and flex on whether I think what I’m building is “complex enough”.

There’s enough weird flexing going on in this thread about who’s “going hard” on their usage lol.

[Cyber (In)Security @cybersec]

Facts! Social media, the perpetual desire to chase clicks, and the proverbial click bait creates a lot of noise that makes understanding the market challenging.

Every VC announcement is supposed to sound awesome - they have a vested interest.

Every social media post is a race for fame - their currency is clicks.

Build it. You’ll see how real competition is a lot faster.

[Cyber (In)Security @cybersec]

Money crunches are happening all across the industry. I think a large portion is just general economic dynamics. Ive been on the economic cyber roller coaster for a while. I’m bullish on AI, but don’t think it’s the economic doom switch many paint it out to be. Go back to being a hobbyist. Pick up Claude code and start “coding”. You’d be surprised what you will build!

[Cyber (In)Security @cybersec]

@pmitu Breach before Breached.