Postern @trypostern

Cybersecurity & AI Security Field Notes -- practical lessons for early-stage startups. TryPostern.com Joined July 2026

Tweets

11
Followers

2
Following

122
Likes

2

Postern @trypostern

6 days ago

@brian_armstrong the part worth watching isn't whether the loop works, it's what 'security review' actually means inside it. catching known bad patterns and catching 'this is technically fine but a bad idea' are very different bars, and only one of those is easy to automate

0 0 0 3 0

View Details

Postern @trypostern

6 days ago

@haleymbryant the boring problems are also usually the ones nobody's incentivized to rush you on, which is its own quiet advantage. no hype cycle pressure means you actually get to do the unglamorous stage right instead of skipping it.

0 0 0 2 0

View Details

Postern @trypostern

6 days ago

Most pre-seed founders don't have a security problem. They have a follow-through problem, and the fix is free. New from Postern: why boring beats a consultant retainer. trypostern.substack.com #cybersecurity #startup #AISecurity

0 0 0 7 0

View Details

Postern @trypostern

2 weeks ago

@mariyav4leva the cybersecurity version of this is identical, it's easy to ignore until a diligence question forces it, and forced answers always look worse than prepared ones.

0 0 0 1 0

View Details

Postern @trypostern

2 weeks ago

@ivanburazin the vendor contract one is underrated on this list. most of what's brutal about it isn't the legal language, it's that nobody taught you what you're actually supposed to be checking for.

0 0 0 1 0

View Details

Postern @trypostern

2 weeks ago

@paulg same logic holds once you ship. knowing 'cybersecurity' as a discipline matters less than knowing what you actually built well enough to know where it's thin.

0 0 0 2 0

View Details

Postern @trypostern

2 weeks ago

@fahdananta this is just what a 4-person pre-seed team has looked like the whole time, there was never room for a middle manager. AI is just bringing everyone else's org chart to where early-stage already lived.

0 0 0 2 0

View Details

Postern @trypostern

2 weeks ago

@Baxate codex creating that OAuth client unattended is great until you're the one explaining to a security review why nobody remembers scoping it. still worth it. just add 'check what the agent actually gave itself access to' to whatever loop you're already running