Effi Lipsman

Cybersecurity builder. Seen it all. Startups, scale-ups, exits. Currently in the middle of the next one. I post about cyber risk, enterprise sales, AI, crypto

[Effi Lipsman @elipsman]

The Carnival breach this week makes the same point every major breach this year has made.

You can have a mature internal security program and still get breached through a vendor's access path.

Testing your own environment is necessary. It's not sufficient.

Continuous penetration testing has to include the full access surface. Not just your applications. Not just your cloud infrastructure.

The integrations. The vendor portals. The contractor accounts that have been sitting with standing access since the project ended.

Most organizations have no visibility into whether those access paths are secure today.

Not last year when the vendor was onboarded.

Today.

That's the gap continuous testing closes.

@Parabellyx @CISAgov @Tenable

#CyberSecurity #PenTesting #ContinuousTesting #InfoSec

[Effi Lipsman @elipsman]

XRP is sitting at $1.32 to $1.34 right now, right at a critical support level that traders are watching closely.

The XRP Ledger Foundation has proposed a significant upgrade to its decentralized exchange via a draft standard called AMM v2. anthropic

The XRPL is also transitioning its core server software name from "rippled" to "xrpld" — a small signal of maturing infrastructure.

The $1.32 to $1.34 zone is the line. A break below opens the path to $1.20. A hold here keeps the cup-and-handle setup intact with a potential move toward $1.70 if the CLARITY Act provides the catalyst.

Two stories running in parallel. Price under pressure short term. Fundamentals building long term.

I'm watching the support level this week.

@Ripple @CoinDesk

#XRP #Crypto #DigitalAssets #Bitcoin

[Effi Lipsman @elipsman]

Channel partners have a new conversation to have with every mid-market client right now.

AI pen testing agents are real and operational in 2026.

The cost of continuous automated testing has dropped dramatically. What used to cost $50,000 and take two weeks can now run continuously at a fraction of that price.

Most of your mid-market clients don't know this yet.

They're still budgeting for annual pen tests because that's what they've always bought.

The partner who walks in and reframes the conversation from "annual test" to "continuous coverage at lower cost" is having a fundamentally different discussion than the one selling last year's model.

That conversation wins deals and builds stickier relationships.

@ConnectWise @Pax8 @Bugcrowd

#CyberSecurity #CISO #PenTesting #InfoSec

[Effi Lipsman @elipsman]

Carnival Corporation, the world's largest cruise company, is notifying customers of a significant cybersecurity breach.

The entry point: third-party vendor access.

Not a zero-day. Not a nation-state attack. A trusted third party with standing access to systems they needed for legitimate business purposes.

This is the pattern that keeps repeating across every major breach this year.

Canvas. GitHub. Carnival. The ransomware negotiator story from last month.

The attack surface has expanded beyond your own environment.

Every third party with access to your systems is part of your attack surface whether you've tested that access or not.

Most organizations test their own perimeter. Very few continuously test the access paths their vendors use.

That's the gap.

@CISAgov @Mandiant @DarkReading @SecurityWeek

#CyberSecurity #DataBreach #InfoSec #PenTesting

[Effi Lipsman @elipsman]

Push-based MFA was supposed to close the credential gap.

It didn't.

Attackers figured out they don't need to steal the second factor. They just need the user to hand it over.

MFA fatigue attacks. Push notification bombing. Adversary-in-the-middle proxies that capture session tokens in real time.

If your workforce authenticates with push-based MFA, this attack is a live threat to your organization today. Cybersecurity Dive

Here's the uncomfortable truth about this for security teams.

You can't patch human behavior with a policy document.

You find out whether your MFA controls are actually working by testing them. Continuously. Not by assuming the configuration is correct because it was right when it was deployed.

The gap between "we have MFA" and "our MFA is actually working" is where a lot of organizations are getting breached right now.

@CISAgov @Microsoft @Okta @CrowdStrike

#CyberSecurity #PenTesting #InfoSec #ZeroTrust

[Effi Lipsman @elipsman]

Had a conversation this week with someone who just came back from a major industry conference frustrated.

Two days. Thousands of dollars. Dozens of conversations.

Nothing to show for it.

I asked how they prepared. The answer was basically: they didn't.

Showed up. Hoped interesting people would find them.

Conferences are not networking events. They're execution events.

The value comes from the prep you do before you ever get on the plane.

Who specifically do you want to meet? What do you want to learn? What does a good outcome actually look like?

Walk in with ten targeted conversations planned. Leave having had nine of them.

That's how a trade show becomes a pipeline event.

#StartupLife #B2BSales #GTM #EnterpriseSales

[Effi Lipsman @elipsman]

A security flaw in Gitea's built-in container registry allowed attackers to pull private container images, exposing source code, credentials, and infrastructure. Cyware

Unauthenticated. Remote. No credentials required.

Gitea is used by thousands of organizations running self-hosted version control. These are the teams who chose Gitea specifically because they wanted to keep their code off public platforms.

The private designation on their container registry was not delivering the protection they reasonably expected.

This is the trusted tools problem again.

The thing you use to keep your code private became the thing that exposed it.

If your organization runs Gitea, this needs to be patched today. Not next sprint. Today.

@CISAgov @BleepinComputer @Rapid7

#CyberSecurity #InfoSec #DataBreach #CloudSecurity

[Effi Lipsman @elipsman]

Bitcoin dropped to $73,000 this week as the macro picture got messier.

Hot CPI and PPI prints, combined with elevated oil prices tied to the ongoing Iran conflict and the effective closure of the Strait of Hormuz, pushed traders to bet the Fed will hike rather than cut. Crypto, which had been pricing in liquidity easing through 2026, is now repricing the opposite scenario. DEV Community

Over $580 million in positions liquidated. 95% of it leveraged longs.

This is what happens when an asset class built on liquidity expectations meets an inflation surprise.

The structural story hasn't changed. ETF infrastructure intact. Institutional accumulation continuing.

But macro overrides structure in the short term every time.

If the Fed hike narrative holds, expect more pressure before the next leg up.

Watching bond yields more than price charts right now.

#Bitcoin #Crypto #DigitalAssets #BTC

[Effi Lipsman @elipsman]

One pattern I've seen kill more early-stage pipelines than any objection handling failure:

Chasing logos instead of fit.

A big brand name in the pipeline feels like momentum. It looks great in a board update. It gives the team energy.

But if the prospect's buying timeline doesn't match your sales cycle, or their problem doesn't map cleanly to what you do, or the champion has no internal pull — none of that matters.

The logo is not the deal.

The best thing you can do for your pipeline in the early stage is ruthlessly qualify out the ones that look good but aren't real.

Hard to do. Absolutely worth it.

#EnterpriseSales #B2BSales #GTM #Founder

[Effi Lipsman @elipsman]

The organizations still scheduling annual pen tests are making a $50,000 once-a-year decision in a world where AI agents can test continuously for a fraction of that cost.

The economics have changed. The buying behavior hasn't caught up yet.

That gap is closing fast.

@HackerOne @Bugcrowd @AnthropicAI @CrowdStrike

#PenTesting #CyberSecurity #AISecurity #ContinuousTesting

[Effi Lipsman @elipsman]

🧵 Something shifted in pen testing this year that most organizations haven't fully processed yet.

AI pen testing agents are no longer experimental.

They're operational. And they're changing the economics of offensive security on both sides of the fence.

Here's what's actually happening:

[Effi Lipsman @elipsman]

Here's the part that gets overlooked in the AI pen testing conversation.

Autonomous tools compress weeks of manual red teaming into hours.

That's not just good news for defenders running their own programs. It changes what continuous testing actually means.

A test that used to take two weeks and cost $50,000 can now run continuously at a fraction of the cost.

The barrier to continuous coverage just got significantly lower.

[Effi Lipsman @elipsman]

The hardest decisions in a startup aren't the big strategic ones.

They're the small daily ones that slowly define your direction without you realizing it.

Every meeting you take with a misaligned prospect. Every feature you build to satisfy one noisy customer. Every partnership conversation that pulls you sideways for three weeks.

None of them feel like a big deal in the moment.

All of them compound.

Going deep on a small number of things instead of wide on everything is not a natural instinct. It has to be a conscious choice made over and over again.

I remind myself of this more often than I'd like to admit.

#StartupLife #Founder #GTM

[Effi Lipsman @elipsman]

https://t.co/h8pxsZTdNV

[Effi Lipsman @elipsman]

The FBI issued an alert this week warning law firms about the Silent Ransom Group.

No malware. No zero-day exploit. No sophisticated attack chain.

They call targets directly. Pose as IT support. Talk employees into handing over credentials and MFA codes on the phone.

That's it. That's the whole attack.

Law firms are the target because they hold some of the most sensitive data in existence. M&A details. Litigation strategy. Client financials. Privileged communications.

And attackers know that lawyers are trained to talk, not to verify.

The most advanced pen testing program in the world doesn't help you if an employee hands over their credentials on a phone call.

People are still the most exploited vulnerability in any environment.

Train them like it.

(Link in first reply)

@FBI @CISAgov @KrebsOnSecurity

#CyberSecurity #InfoSec #CISO #DataBreach

[Effi Lipsman @elipsman]

Is anyone surprised?

- Microsoft canceled most of its Claude Code licenses over cost concerns — and Uber's COO said AI spending is getting "harder to justify."
- One client spent half a billion dollars in a single month after failing to put usage limits on employee Claude licenses.
- Companies are using AI layoffs to offset AI bills.

AI sticker shock hits corporate America https://t.co/znZq5NIVnE

#AI #ArtificialIntelligence #EnterpriseAI #AIBubble #TechSpend

[Effi Lipsman @elipsman]

No longer a hot take: The AI bubble is bursting. That AI hangover is almost over.

[Polymarket @Polymarket]

NEW: AI consultant reveals a client accidentally spent $500,000,000.00 in a single month after failing to set employee limits on Claude usage.

[Effi Lipsman @elipsman]

Something the Microsoft Defender zero-days this week made very clear.

You cannot assume the tools protecting your environment are themselves protected.

Security vendors get breached. Security tools get exploited. The platforms you trust to monitor your environment have their own vulnerabilities.

This is why continuous penetration testing has to cover the full stack.

Not just your applications and infrastructure.

Not just your cloud configuration.

The security tooling itself.

A point-in-time assessment done six months ago didn't test the version of Defender you're running today.

Continuous coverage means continuous coverage. Including the things you assumed were safe.

@Parabellyx @Microsoft @CISAgov

#CyberSecurity #PenTesting #ContinuousTesting #InfoSec