It was a Tuesday. I remember because we were about to close a major customer for RemoteTeam. The contract was worth more than our last seed round. Then an email landed in my inbox that almost burned the whole thing to the ground.
It looked like it was from our CFO. The tone was right, the signature was perfect, and it referenced a confidential metric from our board meeting the previous week. It asked for an urgent wire transfer to a new vendor to finalize a critical software license we needed for the new customer. It was completely believable. And it was a complete fabrication, generated by an AI.
That was my wake-up call. The biggest threat to your startup isn't your competitors. It's not running out of cash. It's AI phishing. And if you're still relying on the old cybersecurity playbook, you're already a sitting duck.
I’ve been lucky enough to have a couple of successful exits with RemoteTeam (acquired by Gusto) and MovieLaLa (acquired by Gfycat). I’ve also been fortunate to invest in over 200 companies, including some of the foundational players in the AI space like Anthropic, OpenAI, and Scale AI. I’ve seen firsthand how fast this technology is moving. And I’m telling you, most founders are catastrophically unprepared for the new wave of threats it’s creating.
Your Old Security Blanket is on Fire
For years, we were taught to look for the obvious signs of a phishing attack. The bad grammar, the generic greetings, the sketchy domains. Those days are over. Adversarial AI can now craft flawless, hyper-personalized emails at a scale that is simply terrifying. It can scrape your LinkedIn, listen to your podcast interviews, and read your blog posts to learn how you communicate. It can then replicate your style with chilling accuracy.
Think of it like this: traditional security is like a castle with high walls. You build filters and firewalls to keep the bad guys out. But what happens when the bad guys can just teleport inside? That’s what AI phishing does. It doesn’t try to break down the door; it just walks in, looking and talking exactly like your most trusted colleague.
We saw this with one of my portfolio companies. They had a top-tier security suite, the whole nine yards. But they got hit by an AI-driven attack that impersonated their head of HR. The AI had analyzed the company’s public-facing documents and internal communications (likely from a previous minor breach) to create a fake but plausible new "employee benefits portal." It was so convincing that half the engineering team entered their credentials before anyone sounded the alarm. The damage was contained, but it was a stark reminder that the old walls are useless.
The New Playbook: Assume You're Already Hacked
After that close call at RemoteTeam, we threw out our old security model. We had to. The secret to surviving in the AI era isn’t building higher walls. It’s a fundamental shift in mindset. You have to assume the enemy is already inside your network.
This isn’t about being paranoid. It’s about being realistic. When you operate from an "assume breach" mentality, your entire security strategy changes. You stop focusing on just prevention and start prioritizing detection and response. Here’s what that looked like for us, and what I now advise every founder I work with:
1. Hunt for Ghosts, Not Goblins
Instead of just looking for known malware signatures or blacklisted IPs (the goblins), you need to start hunting for anomalies (the ghosts). This means establishing a baseline of what "normal" activity looks like on your network and for each user. When a user who normally only accesses marketing documents suddenly tries to download the entire customer database at 3 AM, that’s a ghost. Your system needs to be smart enough to flag that instantly.
This is where AI is actually your friend. We started using an internal tool that learned the behavior of every employee. It wasn’t about spying; it was about creating a digital fingerprint. When the AI-phishing email hit my inbox, the attacker’s follow-on actions—attempting to access our cap table from an unusual IP block—deviated from my "fingerprint." That’s what triggered the alert, not the email itself.
2. Build a Human-in-the-Loop System
AI is a powerful tool, but it’s not infallible. You can’t just set up an AI security bot and hope for the best. The most resilient companies I’ve seen are building human-in-the-loop systems. The AI does the heavy lifting, sifting through millions of data points to find the anomalies. But a human makes the final call.
This is critical. AI can be prone to false positives, and if your security system is constantly crying wolf, your team will start to ignore it. At RemoteTeam, we designated a rotating "security captain" on the engineering team. When the AI flagged a high-priority threat, it went to the captain, who was responsible for investigating and deciding whether to escalate. It kept our team sharp and made security a shared responsibility, not just an IT problem.
3. Turn Training into a Competitive Sport
Let’s be honest, nobody pays attention during the annual security training video. It’s a box-checking exercise. To actually build a culture of security, you have to make it real and continuous. We started running our own automated phishing simulations against our team. Every single week.
We made it a game. We had a leaderboard for who spotted the most fakes. We gave out small bonuses to the winners. It sounds silly, but it worked. People started paying attention. They started actively looking for threats. They developed a healthy skepticism that is absolutely essential in this new environment. Your team is your last line of defense, and you need to arm them with more than just a boring PowerPoint deck.
Stop Reacting, Start Anticipating
The shift from reactive to proactive security is the single most important change you can make to protect your startup. Don’t wait for the attack to happen. Don’t wait for the SEC to mandate new cybersecurity disclosures. The companies that thrive in the next decade will be the ones that see the writing on the wall and invest in AI-driven threat detection before it’s too late.
This isn’t a sales pitch. It’s a survival guide. I’ve seen too many promising startups get kneecapped by a single, sophisticated attack. The technology to defend yourself exists, but it requires a new way of thinking.
So, what should you do right now? Today?
Audit Your Stack: Go look at your security budget. How much of it is spent on building walls versus hunting for ghosts? If it’s 90% firewalls and 10% detection, you need to rebalance. Immediately.
Have the Hard Conversation: Get your leadership team in a room and ask a simple question: "What happens when a perfect, AI-generated phishing email lands in my inbox?" If you don’t have a clear, immediate answer, you have a problem.
Start Small: You don’t need to boil the ocean. Start by implementing one small part of this playbook. Maybe it’s running your first phishing simulation. Maybe it’s setting up a simple anomaly detection alert. The key is to start now.
I’ve built my career on betting on technology that changes the world. AI is that technology. But like any powerful tool, it can be used for good or for ill. The threat is real, it’s here, and it’s only going to get more sophisticated. Don’t be the founder who learns this lesson the hard way.
Frequently Asked Questions
Do all experts agree with this view?
No, and that's fine. The best ideas in business are often contrarian. I share my perspective based on my experience and data, but I encourage you to seek out opposing viewpoints and form your own conclusions.
How can I apply this thinking to my own situation?
Start by identifying the core principle behind the opinion, not the specific example. Then ask yourself: does this principle apply to my context? If yes, test it in a small, low-risk way before going all in.
What experience informs this perspective?
This perspective comes from over a decade of building companies in Silicon Valley, two successful exits (RemoteTeam to Gusto, MovieLaLa to Gfycat), and investing in 200+ startups including Anthropic, OpenAI, and Scale AI. I write about what I've lived.