Frank Wang

security @hellosurgeai. formerly headway, dbt labs, dell tech capital, mit, stanford.

[Frank Wang @ffwang2]

My newsletter, Frankly Speaking, is back! I'm launching a freemium version but with more consistent articles and hot takes on my experience as an engineer and former VC working in cybersecurity: https://t.co/g9dKH8DNwA

Subscribe here: https://t.co/ps7i0nTEIu

[Frank Wang @ffwang2]

yes please! no, AI didn't create this security issue. this should have always been the case.

[Malte Ubl @cramforce]

I've been cooking on this post for a bit, but with the cyber security events of this week I had to ship it:

Long-live static credentials must die. We never want to rotate API keys again.

Turns out only 8% of cloud and SaaS vendors support secure alternative. This is our call to action to change this AND our commitment to do our part:

- We are requiring vendors on our marketplace to support OIDC
- We shipped @shadcn components to make it easier to ship OIDC configuration
- We are expanding OIDC support on our own platform

The last generation got the web from HTTP to HTTPS. It is on us to move past API keys.
https://t.co/g3r5jk79U8

[Frank Wang @ffwang2]

lol awesome

[Aditya 🦀 @ItsAditya_xyz]

Well, I am safe from railway incident because I hard coded the private keys in the code instead of putting it in environment variable.

[Frank Wang @ffwang2]

@GergelyOrosz hasn't happened in the time i've been doing cybersecurity. there's been large ones like log4j, but never as many as yesterday

[Frank Wang @ffwang2]

i would argue yesterday was worse than the days of log4j.

[Frank Wang @ffwang2]

Why security teams almost never turn a tool off:

The counterfactual trap: If you keep a useless tool, nobody notices. If you turn it off and an incident happens nearby, you're on the hook. Teams keep shelfware out of self-preservation.

The clean-slate test: When you start over without many tools, you realize how much software you don't actually need. Most teams inherit bloated stacks and never reassess them.

The risk trap: If "risk management" just means avoiding all possible bad outcomes, removing any tool seems irrational.

The real definition of security: It’s not abstract risk matrices. It's introducing calculated short-term disruption to prevent catastrophic long-term disruption. If daily maintenance friction exceeds the blast radius it prevents, sunset it.

https://t.co/I7b0rjUvsS

[Frank Wang @ffwang2]

Security still has too many tools.

Two years into the AI boom, instead of consolidating our stack, we just got a dozen new AI security categories.

A few thoughts on why this keeps happening:

Theoretical risks: Teams buy products based on slick vendor demos of hypothetical attack paths, instead of looking at their own past incident data.

The SIEM myth: The pitch was "cross-source correlation." The reality is that 90% of investigations happen in a single tool (Datadog, EDR, email). SIEMs are mostly expensive workarounds for 30-day SaaS retention policies.

Cheap storage: Modern read-only analytical databases have made long-term log retention cheap. Security buyers just haven't caught up.

The engineering shift: Security was locked out of engineering tools because they couldn't be trusted with production consoles. AI makes querying those tools simple and safe.

Security work is moving into engineering platforms. We don't need another dashboard.

Full piece: https://t.co/wh7VQ9xp7A

[Frank Wang @ffwang2]

Does a CISO need to ship code?

I’ve argued that AI will favor technical, hands-on security leaders. But technical work becoming more important doesn’t guarantee the person doing it gets the CISO job.

Engineering could absorb more security work. A risk-focused CISO could remain useful alongside a strong engineering leader.

That would challenge part of my argument, and I should be willing to admit it.

Where I could be wrong: https://t.co/uzmZLf9qVy

How technical does the CISO personally need to be?

[Frank Wang @ffwang2]

lol

[Matthew Green @matthew_d_green]

OpenAI talking about rogue AIs communicating through fancy temperature side channels, when they can’t even install a recent Linux kernel on their sandboxes. 🙄

[Frank Wang @ffwang2]

@matthew_d_green prob too many traditional security people thinking risk. they prob need more technical leaders in security

[Matthew Green @matthew_d_green]

OpenAI and Anthropic need to buy themselves some better security teams ASAP.

[Frank Wang @ffwang2]

it's hard to be strategic in security or even any other part of engineering without being hands on, but it's easier than ever to be hands on.

it'll expose people who aren't strong technically. if you don't know what's technically possible, how can you be strategic?

[Frank Wang @ffwang2]

Top-down security strategy is dead. The future belongs to the technical doer. 🧵

Ten months of autonomous coding tools have completely broken enterprise annual planning. If you spent Q4 drafting a 2026 roadmap, it was obsolete by February.

Here is how the fundamental risk calculus in security has permanently shifted:

1️⃣ The Compressed Timeline: When software moves at machine speed, the luxury of finding a flaw, filing a ticket, and waiting three months for a fix is gone. Latent architectural debt compounds instantly.

2️⃣ Minimal Disruption Fixes: Historically, fixing structural security issues required high developer friction. Today, AI flips that trade-off. Armed with terminal coding agents, security can generate patches, validate against test harnesses, and draft PRs in minutes without disrupting product teams.

3️⃣ Drop the Boundaries: Security cannot be an arm's-length auditing committee. Having rigid boundaries doesn't help. Security must be part of the engineering team, taking direct ownership of code fixes.

4️⃣ Sprints Are Dumb: Tying security to rigid two-week sprints or quarterly epics is broken. Teams must be dynamic and ready to pivot monthly or weekly as models and threats evolve.

5️⃣ How Leaders Stay Technical: Stop reading executive summaries. Read systems architecture docs. Use AI coding agents to submit real PRs. Shadow how your product engineers actually prompt and build.

If you can't read the code, you can't calculate the risk.

Full analysis on the practitioner's edge: https://t.co/jqA55W0VvB

[Frank Wang @ffwang2]

@ClickHouseDB just acquired @RunReveal. It might be a blueprint for the future of cybersecurity. 🧵

1️⃣ The Operational Tax: In a traditional SIEM (or heavy platforms like Panther), every question requires writing complex SQL or Python scripts and waiting on analysts. With RunReveal on ClickHouse, plain-English questions turn into instant answers in minutes.

2️⃣ Security is a Data Problem: Security telemetry is the most demanding data workload in tech. Traditional SIEMs charging by the gigabyte are dead walking.

3️⃣ 1 + 1 = 3: To scale independently, a modern SIEM startup would have to spend millions building its own analytical database. By merging with @ClickHouseDB, RunReveal gets raw columnar speed at native cost, while ClickHouse gains an AI-driven security application layer.

4️⃣ The Platform Wars: Databricks bought Panther. ClickHouse bought RunReveal. The battle to displace Splunk is being fought at the data infrastructure layer, not by legacy security vendors. The clock is ticking on what Snowflake does next.

5️⃣ The AI-Native Playbook: RunReveal won by building for lean, AI-forward teams who refuse to click through bloated 2010s dashboards. If you want to build a venture-scale security company today, win the AI-native customer first.

Full breakdown on why security tooling is collapsing into data infrastructure: https://t.co/dLSNUIFavd

[Frank Wang @ffwang2]

Enterprise cybersecurity is no longer one market. 🧵

The biggest takeaway from @blackhatevents US 2026 is that the industry has permanently split in two:

1️⃣ The Infrastructure Divergence: When everyone had on-prem servers and corporate laptops, security was predictable. Today, an AI-native company deploying code at machine speed has completely different risks than a legacy firm managing physical infrastructure.

2️⃣ Dashboards vs. Platforms: Risk managers at legacy firms want visual dashboards and compliance reports. Technical leaders at AI companies want programmable APIs and open context layers that integrate directly into their CI/CD pipelines. One product cannot serve both.

3️⃣ The GTM Mismatch: Sales reps running 2010s playbooks (headcount qualification, 8-week procurement cycles, gated pricing) fall flat with AI startups that want a 3-day self-serve PoC.

4️⃣ The Booth Illusion: Spending $100k+ on trade show booths made sense when software required in-person installations. Today, pipeline moves over Zoom and Slack via API keys. The opportunity cost of booth spend is massive compared to investing in product velocity.

5️⃣ The Rise of Specialized Events: Catch-all conferences are losing relevance. High-signal, practitioner-driven events (like @unpromptedconf and @defcon villages) are replacing monolithic trade shows.

Stop trying to build security products for "everyone." The future belongs to specialized architectures.

Full analysis on the fragmentation of defense: https://t.co/HS2TWUtwOK

#Cybersecurity #Infosec #SecurityEngineering #AI #Startups #TechStrategy #DevSecOps

[Brenner @BrennerSpear]

Has anyone from Anthropic commented on how common of a sentiment this is?

[Frank Wang @ffwang2]

@moizali this is the weirdest take. also the difference is that one is a small startup and another is a large company.

loyalty isn't that black and white. maybe AI thinks it is :)

[Frank Wang @ffwang2]

@rogerdickey i bet random retail investors make more than most VCs

[Alex Atallah @alexatallah]

1/ Stripe has signed an agreement to acquire OpenRouter.

OpenRouter will continue to operate as it is: same name, same product, same roadmap, same mission. But now, we will do it faster, and with Stripe's unparalleled excellence and reach.

[Frank Wang @ffwang2]

Field notes from Hacker Summer Camp 2026. 🧵

After surviving Black Hat and DEF CON, here are eight takeaways on where enterprise security is actually heading:

1️⃣ The Dinners vs. Keynotes: The vendor floor was talking about high-level "strategy." Private dinners with AI security leaders were focused on tactical execution and runtime code. Traditional leadership is out of touch due to a lack of hands-on doing.

2️⃣ The CISO Split: Boards have unrealistic expectations of CISOs (engineer + big org leader + risk manager). The role is splitting into peer positions: a Trust/Compliance Officer and a true Head of Security Engineering.

3️⃣ Cost vs. Workflow: The vendor obsession with raw LLM compute costs is misplaced. The real issue is misuse, untrusted sources, and process design.

4️⃣ The Dashboard Trap: Most tools on the floor are still stuck selling 2010s dashboards. Winning products will eliminate UI friction entirely.

5️⃣ The End of "One Size Fits All": Black Hat used to be one conference for everyone. Today, security is fragmenting into specialized markets for different customer personas.

6️⃣ The Agent Maintenance Reality: Autonomous agents are software. They require continuous tuning, context pruning, and maintenance.

7️⃣ Expensive GTM: Startup marketing remains noisy and expensive, but real thought leadership is rare.

8️⃣ Talking vs. Doing: Black Hat is a lot of talking; DEF CON is a lot of doing. AI security problems will be solved by practitioners in the runtime, not by executives building slides.

Full debrief and field notes here: https://t.co/4KN4phwHh5

[Frank Wang @ffwang2]

@RobTerrin yeah but vendors and strategy powerpoints aren't going to solve this problem

[Frank Wang @ffwang2]

i'm going to write a longer post or several of course, but my main learning is from blackhat/defcon, if your security leader/CISO and team aren't effective at using AI for defense, your org has a problem.