Eric Foster

CEO @TENEXai - The AI SOC Company. The only AI-native MDR led by operators w/ founding engineers from hyperscalers + AI labs. Named #1 fastest-growing cyber co.

[Eric Foster @performify]

For decades, defenders have been outgunned. And real people paid the price. We started @TENEXai to change that: elite human expertise fused with AI, purpose-built to fight cybercrime.

We partnered with @freethinkmedia and @bigthink to tell that story.

It's Time to Protect.

[a16z @a16z]

Marc Andreessen says the gap between what AI-native startups and incumbents think AI can do is the widest he’s ever seen:

"The AI-native early stage startups have just a completely different view on what they can do with AI than the typical incumbents in almost any industry, almost without exception."

"AI is just racing ahead in capability even week by week... There are going to be a lot of industries that are really up for grabs in a fundamentally more profound way than maybe has been the case in the past."

"The founders are gonna have a level of superpowers coming from the use of these tools and these technologies that they just simply haven't had in the past... Had I had Astra and Netscape in 1994, like, oh my God. Like, Ben, what would you and I have been able to do at Netscape?"

"Those entrepreneurs are gonna color way outside the lines. We already see this. They're not gonna think of themselves as like, 'I'm just a software company,' or, 'I'm just a hardware company,' or even, 'I'm just an AI company.'"

@pmarca @bhorowitz

[DavidLinthicum @DavidLinthicum]

The Hottest Space in AI Security Is About to Get Scored, and Most Enterprises Are Racing Toward Disaster

Early next year I'm running a structured evaluation of the seven leading AI SOC platforms: https://t.co/PrQyTCgUbK, Prophet Security, Dropzone AI, https://t.co/uWTbu97P6q, CrowdStrike, Microsoft, and Google. This isn't a vendor bake-off or a sponsored ranking. It's a 20-criterion scorecard covering detection coverage, response time, agentic AI maturity, explainability, model governance, integration, compliance, total cost of ownership, and vendor viability, with critical criteria weighted two to three times and a hard disqualification rule for any platform scoring below six on a critical attribute. The goal is to produce the kind of decision framework enterprises actually need when trusting an autonomous system to make security decisions on their behalf. It'll be interesting to see who comes out on top, and I have my suspicions, but the data will decide.

Make no mistake, this is the hottest space in AI security right now. Agentic SOC platforms promise to triage one hundred percent of alerts in under sixty seconds, something no human SOC has ever achieved, and the funding numbers prove the market believes it. But here's what concerns me. Almost every enterprise I talk to is approaching this technology exactly wrong, and many are heading for a disaster that's entirely preventable. They're buying these platforms before they understand what the technology actually does, and more importantly, when not to use it.

So let me be clear about the boundary. These platforms are transformative when you have high alert volume that overwhelms your analysts, a well-instrumented environment with a mature SIEM or XDR already in place, and clear human authority over containment actions. They're a disaster waiting to happen when your telemetry is garbage, your detection engineering is immature, or you hand autonomous agents the keys to production systems without guardrails, auditability, and explainability requirements written into the contract. An AI SOC amplifies whatever security posture you already have, including a broken one. Feeding an agentic system noisy, incomplete data doesn't reduce risk, it automates your blind spots and gives you false confidence at machine speed. And an opaque agent that can't explain its verdicts will fail your first serious audit, your first regulator conversation, or your first real incident, and it will fail publicly.

There's real risk and threat out there right now, and attackers are moving faster than most defensive procurement cycles. But speed without governance is just a faster path to the wrong answer. Before you sign anything in this category, demand proof of alert coverage, red-team results against their own agents, no-training guarantees on your telemetry, and a contractual explainability standard.

[Ben is NOT "jamin" @BenjaminMuses]

Taylor Swift's silence on the PHP CVE is deafening

[David Vorick @DavidVorick]

The NSA is telling American companies to take production systems offline. The AI-era of cybersecurity has fully arrived.

[Eric Foster @performify]

@DannStupp @MMAJunkie Feels like it was yesterday. Or…

[Aaron Levie @levie]

Cyber will be one of the most defining domains for AI in the coming years, and a huge area of focus for most enterprises.

AI is going to now create a whole new level of work for security dealing with the increase of vibe coded issues, agentic attacks, and even accidental agent swarms hunting for data. OpenAI + Hugging Face is just a preview of what’s to come.

Security teams have often been the most strapped for resources teams in the enterprise, and now it’s only going to get more intense. AI agents of course become the solution to this problem as well, and we’ll see a range of new agentic products for protecting code, enterprise systems, mission critical infrastructure, and enterprise data. Huge opportunity here right now.

And it’s going to be a booming market for cyber professionals that can effectively deploy agents for security purposes in the enterprise. Great time to be in security.

[a16z @a16z]

Kevin Mandia on finding 90+ security holes at Fortune 500 companies that nobody knew existed:

"When you have an AI-based attack, it'll find logic flaws rather than code flaws in custom applications. It'll exhaust all routes all the time."

"Armadin, since January of this year, we have found over 90 zero-days at customer sites, all in production."

"We've post-trained all our models with real red teamers, real folks that actually can develop exploits."

"When we're scanning networks, we don't have source code to review. We're not finding these zero-days with source code. We're not finding these zero-days because we can log into an app and now we have access, and we can get to other things. We are black box coming from the internet."

"Over 90 zero-days in major software companies, and they're thankful. We're coming from the outside, and then we're calling a CISO, usually within 48 hours, 'Hey, we've got remote code execution in your DMZ.' And usually from there we're getting in, and they agree with us."

"That's not a pen test. That is like a real adversary coming at you."

@ArmadinSecurity @DavidGeorge83

[PandaRE 🐼 🇺🇦 @PandaRE__]

GUESS WHAT?!!

I've joined the Threat Intelligence team at @TENEXai

First weeks were lively 🐼

Two Citrix NetScaler zero-days dropped, and hunting across our clients' appliances turned up exploitation attempts. That became our first blog!

- The payload was Platypus, an open-source Go C2. The agent binary has no C2 address at all; the bootstrap script supplies the server at install time.

- One self-signed cert turned a single C2 address into a four-node cluster.

- The operator's signing key is identical across every build, so it identifies them however often the hashes change.

Full write-up 👇
https://t.co/nYS827kk62

[Armadin @ArmadinSecurity]

Armadin raises $255.5M in Series B funding co-led by @a16z and @accel to bring proof, not assumptions, to the organizations that need it most.

Read more: https://t.co/KhgZSDI3pe

[Eric Foster @performify]

read more: https://t.co/GmQl3l18h0

[Eric Foster @performify]

I've believed for a long time that the hardest part of agentic security is running agents you can trust, at a cost that makes sense, against attackers actively trying to manipulate them. That's the principle we built @TENEXai on, from day one.

In case you missed yesterday's important launch of the @nvidia Agent Safety Platform by @JensenHuang and @sasazdjelar, it is a critically important step for the whole industry, and more importantly for defenders. Agents that are contained, observable and auditable at the infrastructure level is exactly where the future of cybersecurity is going.

Congrats (again) to Sasha and the NVIDIA team. Great step for defenders everywhere. We're honored and excited to do our part.

[NVIDIA @nvidia]

AI agents are taking on more critical work.

The security behind them needs stronger boundaries.

We’re building the NVIDIA Open Agent Safety Platform with partners across the industry to help people put agents to work with greater confidence.

Hear from @JensenHuang:

[Eric Foster @performify]

@bgurley

[Eric Foster @performify]

Ridiculously excited to reveal @TENEXai as one of the Nvidia Open Agent Safety Platform partners. Much appreciation to the incredible leadership of @JensenHuang and the entire @nvidia team. Standby for more on our role and what this means shorty!

[Jensen Huang @JensenHuang]

Today, with over 100 industry partners, we introduced the NVIDIA Open Agent Safety Platform, bringing together OpenShell and Sentry.

Artificial intelligence is extraordinary technology that will advance discovery, productivity, security, health, and prosperity for generations to come.

But its full promise can only be realized when people have confidence that AI is being built to be safe and deployed with wisdom and responsibility.

This is bigger than a single product. It's the beginning of an open ecosystem to build the trust layer for safe agent systems.

Together, we are building the foundation of the AI economy.

Trust and innovation are not in conflict. Safety is how trust is earned. We must build not only the most capable AI, but the most trusted AI, so that this extraordinary technology can realize its enormous promise for the world. https://t.co/ugYWQ1MyRi

[Eric Foster @performify]

@RoundTableRye

[Steven Pinker @sapinker]

Is AI really going to kill us all? The scenarios are preposterous, and the presumption of inevitability encourages fatalism, panic, and distraction from the more mundane and realistic safety challenges. By @clairlemon https://t.co/QFkwoRNHmP

[David Sacks @DavidSacks]

The solution to AI-powered cyberattacks is AI-powered cyberdefense.

[DHH @dhh]

The p(doom) discussion gets all the headlines, but the p(abundance) scenery is far more like and deserves much more engagement.

[Marc Andreessen 🇺🇸 @pmarca]

What Is To Be Done?

I propose a simple plan:

Big AI companies should be allowed to build AI as fast and aggressively as they can – but not allowed to achieve regulatory capture, not allowed to establish a government-protect cartel that is insulated from market competition due to incorrect claims of AI risk. This will maximize the technological and societal payoff from the amazing capabilities of these companies, which are jewels of modern capitalism.

Startup AI companies should be allowed to build AI as fast and aggressively as they can. They should neither confront government-granted protection of big companies, nor should they receive government assistance. They should simply be allowed to compete. If and as startups don’t succeed, their presence in the market will also continuously motivate big companies to be their best – our economies and societies win either way.

Open source AI should be allowed to freely proliferate and compete with both big AI companies and startups. There should be no regulatory barriers to open source whatsoever. Even when open source does not beat companies, its widespread availability is a boon to students all over the world who want to learn how to build and use AI to become part of the technological future, and will ensure that AI is available to everyone who can benefit from it no matter who they are or how much money they have.

To offset the risk of bad people doing bad things with AI, governments working in partnership with the private sector should vigorously engage in each area of potential risk to use AI to maximize society’s defensive capabilities. This shouldn’t be limited to AI-enabled risks but also more general problems such as malnutrition, disease, and climate. AI can be an incredibly powerful tool for solving problems, and we should embrace it as such.

To prevent the risk of China achieving global AI dominance, we should use the full power of our private sector, our scientific establishment, and our governments in concert to drive American and Western AI to absolute global dominance, including ultimately inside China itself. We win, they lose.

And that is how we use AI to save the world.

It’s time to build.

[Joe Lonsdale @JTLonsdale]

The world is going to be alright, guys.

Keep having kids, loving your family, and starting and building businesses and institutions. Don’t live in fear.

Leaders have big responsibilities and challenges ahead, but it doesn’t help to scare everyone. We are on top of it.