Nick Smit

Product, growth, startups. Cofounder & Chief Product Officer @safetycli. Prev. Amazon EventBridge @awscloud, @kickstarter & Co-founder @Huzza_Live.

[Nick Smit @nickste]

@joshua_guinness @ShortJared @MarcJBrooker +3

[Nick Smit @nickste]

@danilop Really enjoyed working with you at AWS, and you always delivered such great work. Excited to see where you land next!

[Nick Smit @nickste]

That’s what we built https://t.co/vHIFcrdmYw for. It scans the workstation and uncovers every AI assistant, MCP server, package, and IDE extension your developers are actually running. First scan in under 30 seconds. Worth knowing your baseline before the weights drop and this gets weirder.

[Nick Smit @nickste]

Kimi K3 is the biggest shadow AI event since DeepSeek R1, and most security teams have zero telemetry that would show it. Thread on why this one is different and what to actually check.

[Nick Smit @nickste]

The artifact that does exist lives on the workstation: the extension, the MCP server config, the key itself. That’s enumerable. If you can inventory what’s resident on dev machines, this whole class of problem becomes visible instead of theoretical.

[Nick Smit @nickste]

@d1ngbat_ @techspence @tuckner 🎯 packages downloaded from GitHub repos instead of via Artifactory. AI assistants with personal accounts. MCP servers via proxy packages to get around disabled official versions. We’re seeing very creative workarounds. It’s the messy reality of Enterprise IT in the AI world.

[Nick Smit @nickste]

@mattjay Super interested in your take on the developer endpoint space @mattjay? Seeing any approaches that are working for companies trying to secure dev. machines?

[Nick Smit @nickste]

@tuckner @techspence +1 and there's so many different ways for developers to do things. Difficult to expect them to change their muscle memory to use some different workflow/tool to remain secure. The way we solve this has to meet developers where they are without requiring changes to their tools.

[Matt Johansen @mattjay]

good article by spencer here.

[Nick Smit @nickste]

Great write up @techspence! I think it's such an important point that the principles we've relied on in the past are still relevant today. Firewalls and EDR are a pattern that worked well for malware. And the same concepts are relevant today - we just need to adapt them to the AI world.

[Nick Smit @nickste]

Super important conversation everyone in IT/AppSec needs to be having today. Great post @techspence

[spencer @techspence]

https://t.co/3OiLcdCfng

[Nick Smit @nickste]

https://t.co/4vdnqAtAyH

[Nick Smit @nickste]

@steipete Current generation of EDR (Crowdstrike et al) isn’t anywhere near sufficient for the new generation of software dev. Zero visibility into packages, skills, MCP, or IDE Extension. And no protection/governance. I wrote more about it here: https://t.co/UwVta3NNrR

[Nick Smit @nickste]

@QuinnyPig And the keynote wasn’t the only talk that was a thinly veiled vendor pitch. And most of us paid $900 for the pleasure 😩.