I lost sleep for a week straight. It wasn’t a funding round or a product launch keeping me up. It was an email. A single, well-crafted email that almost brought RemoteTeam, a company I co-founded, to its knees.
It was a classic Friday afternoon. The team was winding down, ready for the weekend. Then, an email landed in our CFO’s inbox. It looked like it came from me, complete with my exact email signature, asking for an urgent wire transfer to a new vendor. The language was casual, the request seemed legit, and the pressure was on. He almost clicked “send.”
Almost.
A tiny, nagging feeling made him walk over to my desk instead. That short walk saved us from a six-figure mistake. This wasn’t some amateur phishing attempt; it was a sophisticated, targeted attack. And it terrified me. Not just because of the money, but because it showed me just how fundamentally wrong we, as founders, are thinking about security.
The AI Security Hype Machine
You can’t throw a rock in Silicon Valley these days without hitting a startup with an “AI-powered” solution for everything. Security is the new gold rush. Everyone is selling a magic box that promises to stop attacks and keep your company safe. As an investor in over 200 companies, including AI pioneers like Anthropic, OpenAI, and Scale AI, I’ve seen the pitch decks. I’ve sat through the demos. I’ve seen behind the curtain.
And I’m here to tell you: 99% of founders are buying into a lie. I learned the hard way what actually works, and it’s not about buying more software. It’s about a total shift in mindset.
The Wrong Way: Chasing Shiny AI Objects
So many founders fall into the same trap. They think buying the most expensive, most advanced AI security tool means they’re covered. They check the “security” box and get back to building. I saw this happen with one of my portfolio companies. A promising B2B SaaS startup, growing fast, fresh off a solid Series A.
They decided to go all-in on security, spending over $100,000 a year on a state-of-the-art AI threat detection platform. It had all the buzzwords: real-time monitoring, behavioral analysis, automated response. On paper, it was a fortress. A month later, they were breached. A simple, elegant social engineering attack tricked an employee into giving up their credentials. The hackers walked right in. The fancy AI platform didn’t even blink.
Why? Because these tools create a false sense of security. They’re reactive. They’re designed to spot known patterns. But the real threats, the ones that should keep you up at night, are the creative, human-driven attacks that no algorithm can predict. These off-the-shelf AI tools are trained on generic datasets. They don’t understand the unique context of your business, your team, or your data. They’re looking for a needle in a haystack, but they don’t even know what your needle looks like.
My Hard-Learned Lesson: The Limits of Off-the-Shelf AI
After the near-miss at RemoteTeam, we did a full post-mortem. What we found was chilling. Our expensive AI security tool, our supposed digital guardian, hadn’t flagged the malicious email. It sailed right through. The AI was looking for technical red flags – a suspicious link, a malicious attachment. But this email had neither. It was just text. The vulnerability wasn’t in the code; it was in us.
That was my “aha!” moment. We were trying to solve a human problem with a purely technical solution. The AI was looking for patterns in bits and bytes, but the real vulnerability was in the patterns of human behavior, trust, and authority. We were so focused on building a digital fortress that we forgot to train the guards.
It’s Not a Trick, It’s a Mindset Shift
What I discovered isn’t a piece of software or a new technology. It’s a mindset shift. It’s about stopping the search for a magic bullet and starting to think about security as a human-centric, data-driven process.
The right way to do this is to build a simple, in-house system that looks for anomalies within your own data. Instead of a black box you don’t understand, you build a system you own and control.
At RemoteTeam, we started by logging all access to our critical systems—our code repos, our customer database, our financials. Then, we built a simple model to flag anything that deviated from the norm. An engineer in the US logging in at 3 AM? A marketing person trying to access the production database? These were the kinds of anomalies our simple, custom-built system could flag instantly. It wasn’t fancy, but it was our data, and it worked.
How to Build a Real Defense: An Actionable Guide
So, how do you build a real defense? It’s not as hard as you might think. Here’s a simple guide for founders who want to stop buying the hype.
1. Own Your Data. Your internal data is your most valuable asset. Stop outsourcing your security to third-party vendors who don’t understand your business. Identify your most critical data, then implement robust logging and monitoring. You want a clear, auditable trail of who is accessing what, when, and from where.
2. Focus on the Fundamentals. Before you even think about AI, get the basics right. Strong password policies, multi-factor authentication everywhere, and regular security training for your team. This is the unsexy part of security, but it’s the most effective. A well-trained employee is your best defense against social engineering.
3. Build a Small, Focused Team. You don’t need a massive security department. Hire one or two smart, paranoid engineers who understand your business. Give them the autonomy and resources to build a security program tailored to your specific risks.
4. Use Open-Source Tools. The open-source community has produced a wealth of powerful, free security tools. From logging and monitoring to intrusion detection, you can build a top-tier security stack for a fraction of the cost of commercial products, and have full control over it.
5. Train Your People to be the First Line of Defense. The best threat detection system in the world is a skeptical, well-trained employee. Teach your team to be suspicious, to verify requests, and to report anything that looks off. Create a culture where everyone knows they have a role to play.
Stop Buying the Snake Oil
The AI security industry is a multi-billion dollar market, and it’s full of empty promises. Don’t be a victim. The truth is, the most powerful security tool isn’t some complex algorithm in the cloud. It’s the combination of your own data and the intelligence of your own team.
Stop buying the snake oil. Stop chasing shiny objects. Start building a real defense. It’s not as hard as you think, and it’s the only thing that will actually keep you safe.
Frequently Asked Questions
What's the most common pushback you get on this?
People often push back by citing exceptions or edge cases. And they're usually right that exceptions exist. But building a strategy around exceptions rather than patterns is a losing game for most founders.
What experience informs this perspective?
This perspective comes from over a decade of building companies in Silicon Valley, two successful exits (RemoteTeam to Gusto, MovieLaLa to Gfycat), and investing in 200+ startups including Anthropic, OpenAI, and Scale AI. I write about what I've lived.
How has this view evolved over time?
My thinking on most topics has changed significantly over the years. Early in my career, I held many conventional views that experience proved wrong. I try to update my beliefs when the evidence changes.
How can I apply this thinking to my own situation?
Start by identifying the core principle behind the opinion, not the specific example. Then ask yourself: does this principle apply to my context? If yes, test it in a small, low-risk way before going all in.