CEO @Konfirmity | The only REAL compliance that helps you close enterprise deals | Turning security requirements into revenue opportunities
Singapore
Joined July 2009
- Tweets6.3K
- Following3.8K
- Followers930
- Likes7.1K
Pinned Tweet
🧵 The Power of Presence: A thread on standing tall among giants.
A tech executive friend shared this story that perfectly captures what I've been thinking about power and presence and how value should triumph the branding 1/12
If you are a tailscale user - I have a vulnerability to bring to your attention
What should you do is in link below
konfirmity.com/advisories/ta…
researcher Erica Windisch is calling it "Tailworm" and i don't think people realize how serious this is
in 3 days of testing there have been 11 Tailscale flaws found in her lab and made public before any fix. not in a year. not in a month. in 3 days
the worst ONE of these would normally be big news on its own
Tailscale SSH: in her lab, one hacked device with SSH access got full control (root) of another server in 0 seconds. it checks the device, never a user password
rogue device: in her lab she stole the key that lets new machines join the private network, then added her own device under the victim's identity
the worm: in her lab it spread on its own to every device the access rules allowed. under a second per jump. no passwords. no stolen keys
experimental app connectors: an approved user could send traffic anywhere the connector can reach, even to cloud server credentials and every Kubernetes service. the network rules never checked the real destination
headscale: if this free self-run server for Tailscale is open to the internet, anyone with no account can crash it. 1,024 tiny sign-ups stop new devices from joining
tailscale serve: one line of setup can open a device's admin controls to other devices on the network
and that's not the whole list
she didn't wait for Tailscale to fix them. she says "infrastructure is vulnerable today". 6 of the 11 are rated high severity
her report says the network turns one ordinary break-in into admin access across all your machines "at machine speed"
if you use Tailscale SSH, run your own headscale server, or use the experimental app connectors you are potentially affected
turn off SSH forwarding. give SSH access one device pair at a time. make device keys expire. lock down app connectors
11 flaws are public now, and Tailscale hasn't posted a security bulletin about them yet
follow me if your company runs on Tailscale. i'm tracking all 11 until they're fixed
The root escalation only applies to machines where Tailscale SSH has been switched on with tailscale set --ssh .
Two things worth knowing:
1. It's easy to have it on without thinking of it as "replacing SSH". It's a one-line opt-in per device, and new tailnets already ship with an SSH rule in the default policy, so many teams enable it fleet-wide for convenience. Quick check on a server: tailscale debug prefs | grep RunSSH .
2. The other Tailworm findings don't need Tailscale SSH at all: app connectors (especially via the Kubernetes operator), tailscale serve forwards to Unix sockets, and self-hosted headscale.
If you only use Tailscale as a network and SSH in with normal OpenSSH, you're not exposed to the root escalation. Turning on auto-update is still worth doing so the fix lands when it ships.
Amit Gupta | Compliance That Closes Deals retweeted
I’m LONG India.
> We will build world-class cities
> We will solve our pollution crisis
> Manufacturing will scale, and we will build indigenous solar cells, batteries, jet engines, and smartphones
> UP, Bihar, and MP will wake up and unlock their potential
> There will be reverse brain drain
> We will double per capita income in the next 10 years
> We will have 20 startup unicorns every year
No cynicism. No WhatsApp/Instagram/YouTube doomerism. No anarchy.
The world is underestimating us again.
I’m long India.
Cybersecurity is difficult to make people understand. People buy SOC 2 TYPE II , ISO 27001 , PCI DSS types of certification / attestation and go through VAPT once a year - and in turn this gives them false sense of security.
@Blazephoenix2 is creating some coffee table books in comic format to make it easy to understand and decipher.
If you as a founder are facing treat awareness as a moat - talk to him.
Hello internet friends, I’m working on a new idea and need help perfecting the pitch.
The idea is to make and sell comics as a medium to explain complex concepts as a bridge to sell products. Picture this: your product needs customer education before anyone considers buying. You come to me, I make a comic or short graphic novel about it, and you leave copies in cafes, coworking spaces, events etc. People pick one up and read it. By the time they get in touch with you, they’re already warmed up.
Comics are the starting point, probably not the endgame.
"Some products need a lot of explaining before anyone buys. Your sales team ends up spending the first meetings teaching the basics. I make comics that do that teaching for you. You leave them in cafes, coworking spaces and at events, and people pick them up because a comic is more fun than a brochure or whitepaper. They read about the problem, see how your product solves it, and by the time they contact you, they already understand what you do. Your first conversation starts further along."
Does this make you want to know more? What would you add? Any feedback is welcome!
@amitpgupta @enoughtanu @ImAshutoshPS @AmeeStelloAI @zarazhangrui @udayan_w @CreativeGracey @kamath_sutra @tankots @ayushagarwal
Amit Gupta | Compliance That Closes Deals retweeted
Years after Fastag implementation but still these jams happen daily on Ecity flyover because many people (mostly busses) don't use Fastag.
Also busses queue after the flyover making the whole point of flyover irrelevant by causing queues. This happens on both directions. In the night the outstation buses just stop in front of the Ecity toll and block all the lanes.
@NHAI_Official @krishnabgowda
Joel de la Garza at a16z just told portfolio CEOs to patch or die. He's right, and this week proved it:
- PHP2Shell was exploited four days before a fix existed.
- LiteLLM's release pipeline was hijacked with developer tokens pulled from an internal AI gateway's logs.
- AWS's AgentCore image ships its own LiteLLM, invisible to your SBOM.
The gap we see most often: companies proving security with a compliance dashboard instead of practising it. What leadership teams should own: a risk register reviewed every month, a real view of dependencies fixed by severity, an AI-assisted SOC with humans in the loop, and a CISO with authority.
Full list in our reply to Joel. What to check for each incident: konfirmity.com/advisories
Patch or Die!
Today we sent the following out to the CEOs in our portfolio regarding the widespread vulnerabilities that have been detected by AI agents:
The previous week should make it obvious that things have changed. Vulnerabilities are being discovered and exploited at a rate that has never been seen before. While there has been a flood of new vulnerabilities AI agents are being adopted at scale multiplying the potential risk. Agents not only help automate the attacker lifecycle, every ai agent is an insider threat. Your environments are designed to withstand attacks from the outside, not from within. As such, we are suggesting company leaders consider the following changes:
1 - Ensure you're sufficiently staffed for security. The average enterprise allocates roughly 10% of its tech spend to security. Consider doubling that. There are likely thousands of vulnerabilities that need fixing in your environments. Security through obscurity no longer works, all that can be exploited will be exploited.
2 - Establish a zero tolerance policy for secuirty bugs in new features and product releases. Re-examine launch and release schedules and consider delays to ensure all vulnerabilities are patched before deploying new features or products.
3 - Double tap the zombies. Find all old legacy environments that have been neglected and turn them off. Labs, test environments, zombie CI/CD projects etc. Turn it off for now. If it isn’t tied to revenue, kill it.
4 - End the risk acceptance process. Over the last 10 years the risk acceptance process has morphed from a way to accept risks to enable the business, to a way to justify never fixing security issues. Adopt a zero tolerance policy for security issues and risks.
Amit Gupta | Compliance That Closes Deals retweeted
DAMN! The goosebumps! 🥶❤️🔥
THE ENTRY OF ANJANI PUTRA 🚩🙏
Jai Bajrang Bali!
Companies have survived worst. My only hope is that they learn - be secure, be slow and become compliant as a result.
I have asked this question to a SF based security company and they were like we are on Vanta and that secures us. I had to ask - I want to drink what you are drinking - the cool aid.
If this current scenario and incident does not make people who subscribe to modern GRC shit in their pants - they are running on luck and auto.
xitter.cf/amitpgupta/status/2112…
If you are losing your sleep over security issues - we have the answer.
@konfirmity
Yegor’s right about the psychology. Wrong about the method - atleast in security.
Nobody will pay you to fix their security if buying from you means admitting their SOC 2 was hollow.
I learned this the hard way. For a year I posted about “fake compliance.” Founders liked every post, then went quiet on the call.
Because what they heard was: you were negligent, and you misled your customers.
No Series B founder says that out loud. Especially with the CTO who set up the compliance program sitting next to them. Or worse, when the founder is the CTO.
But here’s where the scapegoat playbook breaks:
In security you can’t invent a villain. You’d be lying about risk, and trust is the only thing we sell.
You don’t need to invent one. The real one is in plain sight:
1. At seed, getting SOC 2 fast was the right call. It unblocked deals. Six months of deep security work before revenue would have been worse.
2. Modern GRC sold “SOC 2 in 2 weeks” as security. Founders bought exactly what was marketed. SOC 2 checks that you follow the controls you wrote, never whether they’re any good. And some modern GRC bundles the auditor with the software. The report comes out clean because the same deal produces it.
3. Then the company changed. Enterprise buyers now send 200-question security reviews and ask for your last pen test. The report doesn’t answer those.
Nobody was stupid. They outgrew their stage.
And outgrowing it hurts twice: you fix the security, and you rip out the tool you started with.
So we now start earlier. Fast to SOC 2 at seed, on controls that actually run, so the first program is the one you keep.
Change the framing, never the findings. Every gap still goes in the report, described as what the business has outgrown, not what it was hiding.
That’s Konfirmity: security that holds up in a CISO’s review, with compliance evidence generated along the way (konfirmity.com)
Your first SOC 2 should be the last one you rebuild.
@ShagunOhri @enoughtanu @NikitaBatr56147
Nobody will ever pay you $20,000 to fix their problem if buying from you forces them to admit they were stupid
Rich guys will happily lose $50,000 a month doing the wrong thing rather than sit on a Zoom call & admit to a 24-year-old that they suck at running their business
Look at how divorce lawyers, TRT clinics & cult leaders close people in 10 minutes:
They hand the buyer a scapegoat before they ever ask for money
The TRT clinic tells him his low energy comes from microplastics in the tap water, never his 4 hours of sleep. The divorce lawyer tells her the ex-husband is a clinical narcissist, never that she picked wrong
How to weaponize "Ego Absolution: on high-ticket buyers:
1. Tell the prospect his offer & his work ethic are elite so his ego relaxes
2. Blame an external enemy he already resents ("Your funnel would be doing $300k/mo right now, Meta's ad auction is just taxing you 80% because their algorithm punishes high-ticket offers")
3. Show him the escape hatch once he realizes the failure wasn't his fault
Once his ego is off the hook, his psychological defense drops to zero
When we publish posts on X breaking down how ad platforms rob high-ticket businesses & how we pull $0.25 webinar opt-ins & $5-50 booked calls organically instead, burned founders wire $15k on the first call (yegor. com)
Enjoy Bucko!
Amit Gupta | Compliance That Closes Deals retweeted
They keep promising India a “Gen Z revolution.” I keep thanking Indian voters for choosing stability.
In France, protests that began over school conditions have widened into mass unrest, with arson and looting accompanying Saturday’s marches.
Watching those scenes deepens my respect for Modi and Amit Shah. Governing a country as vast, diverse and politically combustible as India takes more than a stirring speech.
It takes political resolve, public trust and institutions that hold under pressure.
Students deserve answers. Sure but violence deserves no space here.
You can demand better from India and still feel profoundly grateful to live here. I do.
Keeping this republic moving is an achievement. Those forever waiting for it to fall should acknowledge that.
Tarini is on a mission. LFG
today we're opening @DetectIfAI to every developer.
real-time voice deepfake detection, 24 ms per check.
#1 in latency on Podonos' independent benchmark, ahead of companies that raised hundreds of millions.
97.3% of cloned voices caught.
API + MCP. link in the comments.
The playbook and what it took to clean a spot. It's not magic and its not difficult - just how badly you want to live in clean and ever improving Bangalore. Do not wait for someone else to do it for you - claim a spot - iknowaguy.help/bangalore/
I've spent the time reading every thread and post-mortem on the @opencode breach. Here's what actually happened, and what every AI builder should take from it:
What broke: not the open-source agent you run in your terminal. It was a legacy Console system they were already shutting down, which held the OpenAI/Anthropic/Google keys users had linked. 1.4% of Console users were hit. The system you're "about to turn off" is the one nobody is watching.
Why your keys: a real customer's key is verified, already paying, and has a normal usage history. That makes it perfect cover for quietly pulling outputs from a frontier model to train a competitor. Your API key isn't just money. It's camouflage.
The damage: users saw $168 to $1,700 in charges they never made, and some got their provider accounts banned. The attacks didn't stop for 48 hours.
The twist: mid-incident, the frontier models ( or atleast one - you fav one - @claudeai ) OpenCode was using to investigate started refusing to help, because analysing the attack tripped their cyber guardrails. Defenders need a lane too. We have seen this story too many times as running a cybersecurity company (@konfirmity ) ourselves.
What went right: affected users were emailed the same morning, and OpenAI, Anthropic and Google revoked keys and started refunds within about two days.
My takeaways:
→ Put a spend cap on every key. No exceptions.
→ Kill legacy systems faster than feels comfortable.
→ Every tool you paste a raw key into is a vault you never audited.
→ No matter who you are - you will get hacked if you keep doing what you are doing - it's a question of when and not if. Only one way to come out of it is to hire a partner, enable a SOC ( security operations center - not traditional ones but new age ) where you need to look at signals - AI assisted but humans in the loop
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
