Agents and fintech: if an AI agent can initiate a transfer, it needs its own identity, a hard limit, and a human approval above a threshold. Same rules as a new staff member, not fewer.

"Please send the OTP, I am from the bank." No, you are not. The bank already knows. That is the whole point of the OTP.

Plain words: "MFA" means logging in needs two things, something you know (password) and something you have (phone or key). Stealing one is not enough.

Friday fix: list every third-party tool connected to your Google Workspace or Microsoft 365. Remove the ones nobody can explain. That list is usually longer than you think.

Friday morning nudge: check which apps have access to your Google or Microsoft account. Remove the ones you do not use.

Currently building the next gen Cybersecurity learning platform. Waitlist coming soon 🔥

You do not need to know everything to start in security. You need to be careful, curious, and willing to write down what you find.

Midweek honesty: most breaches are not genius. They are a default password, an old account nobody switched off, and a team too busy to check.

Question: does your team have a written plan for "we have been hacked", or would you figure it out on the day?

Myth: "We use HTTPS, so we are secure." HTTPS protects the road. It does nothing about who you let into the house.

Founder checklist #5: you have tested what a logged-in user can do to another user's data. Not just what a stranger can do.

Refunds, reversals and chargebacks get less testing than checkout. Fraudsters know this. If your refund can be triggered twice, it eventually will be.

Danfo rule for security: if everybody can enter through the back door, the conductor collecting money at the front is just for show.

Plain words: "least privilege" means each person and each system gets only the access it needs to do its job. Nothing extra "just in case".

Logs you never look at are just storage costs. Pick one alert that matters (new admin created, MFA disabled, big export) and actually send it to someone's phone.

Morning nudge: log out of accounts on devices you no longer use. Old phones and shared laptops remember more than you think.

Security work is mostly asking calm questions about things everyone assumed were fine. That is a skill anyone can learn.

When did @opay start failing transactions 😭😭

Security is not the team that says no. It is the team that tells you which yes will hurt later.

Question: when your app sends an OTP, how long does it stay valid? If you do not know, find out tomorrow.