Danny Lieberman

How much of your value is at risk? | 5x founder, 4 exits, 1 flop.

[Danny Lieberman @flaskdata]

https://t.co/KGqSsqZCdy

[Danny Lieberman @flaskdata]

1500+ cleared AI-enabled devices.
How are you defending against this week's zero-day with a 5-year-old design?

DM me and I'll show you how

[Danny Lieberman @flaskdata]

18 FDA cybersecurity safety notifications since 2013. 94% classified high-risk.

Pacemakers. Insulin pumps. Infusion systems. Patient monitors. Devices already implanted, already in hospitals, when the vulnerability surfaced.

Not one of these was caught during clearance. Every single one was discovered post-market — after the device passed review, after it shipped, after it was already inside someone's chest or on someone's IV line.

That's not a coincidence. That's what "cleared the regulator" actually means. The review checked whether your documentation was in order. It didn't — couldn't — check whether the device would survive an attacker who shows up after launch.

Checkbox security gets your AI-device a clearance letter. Attackers get a field day.

[Danny Lieberman @flaskdata]

Invest 30' in yourself - https://t.co/2DIRmkamoI

[Danny Lieberman @flaskdata]

Time is the biggest threat to AI-devices. Not the FDA.

Attackers love FDA cyber guidance for AI-enabled medical devices — it tells them exactly how much threat surface you're exposing.

Getting through your submission without major issues isn't hard. A standard 510(k) takes 5–9 months. A De Novo takes 9–12. A high-risk PMA can run 12–24+ months — and that's before you count device development or clinical trials.

While you're in the queue, you're already losing.

An estimated 10,000–20,000+ hidden zero-days are projected to be systematically uncovered and triaged in the coming period. The broader CVE pipeline is on pace to hit 60,000–100,000 disclosures a year. Frontier models built for autonomous vulnerability discovery are why the curve just bent.

Your clearance timeline is fixed. Theirs isn't.

[Danny Lieberman @flaskdata]

The uncomfortable truth is that none of this is part of a 510(k) review.

Reviewers check whether your process is documented.

They don't check whether your device would survive contact with a model that finds your zero-day before you do.

Two different games. Only one of them is optional.

You can do checkbox security. Or you can be secure.

[Danny Lieberman @flaskdata]

1500+ cleared AI-enabled devices.

How are you defending against this week's zero-day with a 5-year-old design?

[Danny Lieberman @flaskdata]

I had a call recently with a VC who specializes in digital health. Like most VCs, one 10-year-old investment may eventually return the fund.
In the meantime, their portfolio companies skip RCT validation and default to whatever cyber and privacy portfolio is cheapest.

10 years ago, your could survive with those shortcuts.

Today AI-automated attacks exploit a 5 year old RA/QA cycle with this week's zero-day.

[Danny Lieberman @flaskdata]

And smart enough to know what they don't know

And hire people smarter than them.

1500+ cleared AI-enabled devices.

How are you defending against this week's zero-day with a 5-year-old design?

[Danny Lieberman @flaskdata]

Successful AI-device founders exactly this structure:
• Broad worldview
• Specific product
• Narrow positioning for a medical indication

[Danny Lieberman @flaskdata]

Do you know your value at risk?
If not, how do you decide where to invest next?

[Danny Lieberman @flaskdata]

Founders are paid to take risk.

Just not every risk.

Some risks create enterprise value.

Others destroy it.

The job isn't to eliminate risk.

It's to know the difference.

[Danny Lieberman @flaskdata]

That's how I try to start every conversation.
If that resonates with you, let's have one:
https://t.co/FBPSzCt7R3

[Danny Lieberman @flaskdata]

One thing I learned from Vipassana and a week volunteering at epilepsy camp.
Ask for what you want.
Learn what you can.
Listen to what you hear.

[Danny Lieberman @flaskdata]

5 years ago you had time to reflect. Go into the woods and think

In the next 12 months there will be 100,000 new AI-driven vulnerabilities.

Flip your switch from decision processes to learning processes.

1,000 experiments a year - teaching you and your team to survive the next 12 months

in the next 12 months there will be 100,000 new AI-driven vulnerabilities.

[Danny Lieberman @flaskdata]

Risk analysis doesn't create value. Decisions do.

[Danny Lieberman @flaskdata]

Your attackers, customers, and competitors are moving faster than you.
Invest 30' in yourself and speed up your decision making
https://t.co/2DIRmkamoI

[Danny Lieberman @flaskdata]

You're building an AI-enabled medical device.
FDA clearance creates value.
It also creates exposure.
Given your limited time and budget...

Where will you invest next to protect your company's value?

Hint - it isn't a fancy technical countermeasure.

[Danny Lieberman @flaskdata]

Your attackers, customers, and competitors are moving faster than you.
Invest 30' in yourself and speed up your decision making
https://t.co/2DIRmkamoI

[Danny Lieberman @flaskdata]

The product is no longer the bottleneck. Decision quality is.

[Danny Lieberman @flaskdata]

How do you execute your mission in an AI-attacker era?

[Danny Lieberman @flaskdata]

Most founders ask:

"How do we build faster?"

A better question is:

"How do we learn faster?"

Four habits worth investing in:

• Look beyond your own industry.
• Turn every customer conversation into an experiment.
• Make cyber and privacy business conversations, not IT conversations.
• Shorten the time between new information and better decisions.

Companies don't lose because they move slowly.

They lose because they keep making yesterday's decisions in today's market.

[Danny Lieberman @flaskdata]

Your attackers, customers, and competitors are moving faster than you.
Invest 30' in yourself and speed up your decision making
https://t.co/2DIRmkamoI