Steve Wilson

Leading the charge in AI security. Chief AI and Product Officer @ Exabeam, Author @ O'Reilly, Project Lead at OWASP #cybersecurity #ai #cloud

[Steve Wilson @virtualsteve]

How will we use AI Agents in cyber defense? Check out this snippet from my interview in Davos.

[AndarkFomo @AndarkFomo]

Before you give an AI agent access to your files, GitHub, shell or MCP tools — run a security sanity check.

Found Praxen: an open-source AI agent behavior verifier.

It checks whether your agent’s declared policy matches reality.

Basically:

you write what the agent is allowed to do, then Praxen looks for places where the actual setup drifts from that intent.

It can flag things like:

- overbroad permissions
- credential exposure
- risky tool integrations
- config gaps
- capability drift
- MCP / supply-chain risks
- policy vs implementation mismatch

The important part:

it runs locally and doesn’t phone home.

This is not a magic “make my agent safe” button.

But if you’re running Claude Code, Cursor, MCP servers or custom agent scripts, this is exactly the kind of check you want before deploy.

Most people are giving agents way too much power and hoping nothing weird happens.

Bad strategy.

[The Cyber Security Hub™ @TheCyberSecHub]

Praxen: Open-source AI agent behavior verification https://t.co/7dtXhLCZII

[Exabeam @exabeam]

Intended behavior is not always equal to actual behavior.

Meet Praxen, the open-source reference implementation for Agent Behavior Verification (ABV). https://t.co/vMWbt4GSlL

#AI #AIAgents #Cybersecurity #OpenSource

[Sherri Douville | CEO @Medigram @SherriDouville]

1/ Honored to contribute to this launch announcement and retweeting the @exabeam announcement now. Here is why Praxen b @virtualsteve matters more than most people realize yet

🧵A thread

[Exabeam @exabeam]

A lot has changed in #cybersrecurity since 2023. As @virtualsteve explained in conversation with @ISMG_News, #AI agents are now your worst insider threat. Discover how to mitigate them by analyzing behavior: https://t.co/pQiWWPVepI

[Exabeam @exabeam]

AI agents are non-human users with legit access and machine-speed actions. That’s a new insider risk class. As @virtualsteve of @Ten18ByExabeam says, security teams have to continuously tune telemetry to keep up with evolving threats. Read our blog: https://t.co/rzmDZXMIXX

[Brandon Carl @brandonjcarl]

Earnings Before Tokens

[Ten18 by Exabeam @Ten18byExabeam]

Until last year, #AI overtaking humans was the stuff of science fiction. But now we face a grim reality: AI is now the biggest insider threat. Read how CISOs worldwide are justifying spend: https://t.co/bqOlJ2nXP9 @exabeam @virtualsteve

[ReversingLabs @ReversingLabs]

AI agents aren't just tools — they're digital workers. And like any insider, they can malfunction, misalign, or get compromised. OWASP LLM Top 10 co-author Steve Wilson breaks down the agentic insider threat and what AppSec teams need to do about it.
Read here: https://t.co/3cmqSg2yRW
#AppSec #AISecuity #ThreatIntelligence #OWASP w/ @virtualsteve

[Mo @atmoio]

Andrej Karpathy admits he’s struggling with AI

[Mario Nawfal @MarioNawfal]

Electric surfboards are about to make jet skis look ancient.

Silent, fast, and way too fun.

[Ten18 by Exabeam @Ten18byExabeam]

Gone are the days where sharing MTTR or a vulnerability patching rate will satisfy the board. CISOs must articulate how AI is optimizing security operations from a business perspective, and many struggle with that. Learn more: https://t.co/hxLnCFxLsh @virtualsteve

[Jonathan Ross @JonathanRoss321]

For 50 years, software engineering ran on code rationing. Writing code was expensive, so we rationed it carefully through roadmaps, RFCs, prioritization meetings, and scope reviews.

This created a role: the No Engineer. No, that won't scale. No, we don't have bandwidth. No, that's out of scope. No, we need a design doc first. The No Engineer was valuable for 50 years. Every "no" saved real money. Their judgment was the rationing system.

LLMs will be the end of code rationing. Code is cheap now. And while the No Engineer is explaining why something can't be done, the Yes Engineer has already shipped three versions of it.

If you're a Yes Engineer, the next decade is yours.

[Jennifer 🟥🔴🧙‍♀️🦉🐈‍⬛ 🦖 @babybeginner]

Gen Xers have a new anthem!

This is too funny. I do love the early bird dinner prices though!

Sound UP!

[Exabeam @exabeam]

AI agents are turning into insiders, fast. In new coverage from @ISMG_news, @virtualsteve sat down with @UnderArmour #CISO Alex Attumalil at #GoogleCloudNext to get blunt about why security teams must treat agents less like apps and more like employees. https://t.co/ypzTGviklk

[Lenny Rachitsky @lennysan]

My biggest takeaways from Claude Code's Head of Product @_catwu:

1. Anthropic’s product development timelines have gone from six months to one month, sometimes one week, sometimes one day. Part of this acceleration is access to the latest models (i.e. Mythos). Another is shipping new products into “research preview,” making clear it's early, experimental, and might not be supported forever. Another is an evergreen "launch room "where engineers post ready features and marketing turns around announcements the next day.

2. The PM role is shifting from coordinating multi-month roadmaps to enabling teams to ship daily. As Cat puts it, “There should be less emphasis on making sure you are aligning your multi-quarter roadmaps with your partner teams and more emphasis on, OK, how can we figure out the fastest way to get something out the door?”

3. The most efficient shipping unit is an engineer with great product taste. On Cat’s team, many engineers go end-to-end—from seeing user feedback on Twitter to shipping a product by the end of the week—without a PM involved. Also, almost all the PMs on the Claude Code team have either been engineers or ship code themselves, and the designers have been front-end engineers. The roles are merging, and the most valuable skill is product taste, not job title.

4. Build products that are on the edge of working. Claude Code’s code review product failed multiple times because earlier models weren’t accurate enough. But because the prototype was already built, they could swap in Opus 4.5 and 4.6 and immediately test whether the gap was closed. Teams that wait for the model to be ready will always be a cycle behind.

5. The most underrated skill for building AI products is asking the model to introspect on its own mistakes. Cat regularly asks the model why it made an unexpected decision. The model will explain that something in the system prompt was confusing, or that it delegated verification to a subagent that didn’t check its work. This reveals what misled the model so the team can fix the harness.

6. Every model release forces their team to revisit existing products and audit their system prompt to remove features the model no longer needs. Claude Code’s to-do list was a crutch for earlier models that couldn’t track their own work. With Opus 4, the model handles it natively. Features built as scaffolding for weaker models become debt when the model catches up—so the team actively strips them.

7. Anthropic employees build custom internal tools instead of buying SaaS products. A sales team member built a web app that pulls from Salesforce, Gong, and call notes to auto-customize pitch decks—work that used to take 20 to 30 minutes now takes seconds. Their core stack is Claude Code, Cowork, and Slack. No Notion, no Linear, no Figma.

8. People underestimate how much Claude’s personality contributes to its success. As Cat describes it, “When you reflect on everyone you’ve worked with, there’s just some people where you’re like, I really like their energy, their vibe.” Claude is designed to be low-ego, positive, competent, and earnest—qualities that make it feel like a great coworker, not just a tool. This isn’t cosmetic; it’s what makes people want to use Claude for hours every day. The team has a dedicated person, Amanda, who “molds Claude’s character,” and it’s one of the hardest roles at the company because success is so subjective.

9. The future of work is managing fleets of AI agents, not doing the work yourself. Cat sees a clear progression: first, individual tasks become successful. Then people start running multiple tasks at the same time (multi-Clauding). Next, people will run 50 or 100 tasks simultaneously, which will require new infrastructure—remote execution, better interfaces for managing tasks, agents that fully verify their work, and self-improving systems that incorporate feedback. The human role shifts from doing the work to knowing which tasks to look into, verifying outputs, and giving feedback that makes the system better over time.

10. Hire people who lean into chaos and face every challenge with a smile. At Anthropic, there are weeks when a P0 on Sunday becomes a P00 by Monday and a P000 by Monday afternoon. If you get too stressed about any one thing, you’ll burn out. Their team looks for people who can look at a hard challenge and say, “Wow, that’s gonna be hard. But I’m excited to tackle it and I’m gonna do the best that I possibly can.” This mindset—optimism, resilience, and comfort with constant change—is increasingly essential as the pace of AI development accelerates.

Don't miss the full conversation: https://t.co/1wOUHcdYQN

[Exabeam @exabeam]

What a moment for Exabeam. Accepting the 2026 Google Cloud Partner of the Year Award for Security: Analytics & Operations on stage is powerful recognition of the leadership, innovation, and momentum driving our business forward.

Read the press release: https://t.co/3LVKu8YAKP

[TED Talks @TEDTalks]

“The lobster is loose, and it’s not going back into the tank,” says @openclaw founder @steipete. In this brand new talk from #TED2026 he shares why AI agents — built by you — are the future: https://t.co/GnR6fTeRKw

[Viktor Oddy @viktoroddy]

Claude Design is insane.

❤️‍🔥Just recorded a 18-min tutorial on how to build animated, award-winning websites with Claude Design + Opus 4.7!

[Ronald van Loon @Ronald_vanLoon]

Don't Confuse #Automation For #Innovation: Why Security Needs Accelerated Operations
by @virtualsteve @Forbes

Learn more: https://t.co/Xl5OxrBa3q

#EmergingTech #Innovation #Technology