Categories
Artificial Intelligence Meetups Programming

Notes from Pratik Patel’s talk, “Building a Mini-Software Factory using Pi.dev and Local LLMs” (September 14, 2026)

On Monday, September 14, Pratik Patel gave his talk, Building a Mini-Software Factory using Pi.dev and Local LLMs, to a full room at the Entrepreneur Collaborative Center in Tampa’s Ybor City neighborhood. Here are my notes from his talk.

Blasphemy!

The quite-full ECC was about three-quarters software developers, and Pratik had just finished taking a headcount of the Java people, the TypeScripters, the Pythonistas, and of course, the Rustaceans (“most people want to rewrite everything in Rust, and I find it extremely annoying”). That’s when he said what would’ve gotten him tarred, feathered, and run out of a Java meetup if we’d been back in the days of Java SE 18 or 19:

“One of the things that you may get from this session is that the programming language doesn’t even really matter anymore.

Of course, his paln was to prove that statement by the end of the night, as well as the conclusion that you should draw if you still plan to remain in software: If you hand the coding off to a machine, the valuable work moves up the stack.

Pratik is a longtime Java/JVM guy, one of the organizers behind the DevNexus conference in Atlanta, and as of about a month ago, he works at Hugging Face. He also polled the room on what Hugging Face actually does, and enjoyed the answers (mine: “Hang out with Jensen!”). The correct one, which he eventually told us, was that they own Transformers and the rest of the library stack that lets you download, and better still run the models.

The gamble: Building before the presentation

It takes time for an software factory to build things, even on a late-model MacBook with 64GB RAM like Pratik’s. Sp he started the demo at the beginning and then talked over it, which I suppose is the new version of “live coding”. I do that myself (both live agentic coding as well as raw-dogging the code the old-fashioned way), so I have to respect Pratik’s boldness.

He asked the room for an app idea. Someone suggested a horse-boarding scheduler, which was too big. Charles, who works for a sports organization, suggested a playoff odds calculator. Pratik assessed that it was doable within the given time, so he agreed to build that.

Pratik opened Gemini and, off the cuff, dictated a rough spec: look at the remaining season schedule for all 30 MLB teams, calculate each team’s chance of making the playoffs, and let the user tweak the metrics on the page to try different scenarios.

Gemini spat out a 255-line spec in a few seconds. He pasted that into his software factory, told it “Create a new app called MLB Odds, here’s the spec, let me know when it’s finished and what the URL will be,” hit enter, and walked away from it to start the actual presentation.

“Again,” he said, “this may be a total disaster. It may not work, but let’s see how it goes.”

So what is a software factory?

Pratik was upfront that this is the most undefined term in the industry right now: “If you ask 10 people in this room what a software factory is, you’ll probably get 10 different answers.” Here’s his:

An AI software factory is a system, not a team, that turns human-written specifications and intent into working software, using agents to perform most or all of the coding, testing, review, and release work.

The key word is system. You say “go build this,” walk away, and come back hours or a day later to working software. It’s like handing a project to a team of engineers and going off to do something else (or hey, nothing. You’re the boss!).

And critically, a software factory is not one-shotting. Telling Claude or ChatGPT “build me this website” and pasting in a detailed description relies entirely on the raw intelligence of the model. A factory applies rigorous software engineering process around the model: planning, architecture, implementation, testing, QA, security review, version control. The process is the product.

The levels: where you are on the ladder

Pratik walked through a progression that got a lot of nodding in the room:

  • L0: Manual coding: Open an editor, translate what’s in your brain (or in a written spec) into code, hit a wall, go read the docs or Stack Overflow, keep going.
  • L1: “Spicy autocomplete”: IDEs got language servers and started completing large fragments for you. A genuine step change in velocity.
  • L2: AI pair programmer: You describe what you want to a chatbot, it emits code, you copy it into your editor and fix it up. You’ve effectively stopped going to Stack Overflow directly, because the model already ate it.
  • L3: AI as a senior developer: You give it a spec, it builds, you review the code and tell it when it picked the wrong approach.
  • L4: You’re the PM: You write specs, you review plans, you check back later.
  • L5: Software factory: specs go in, software comes out. You review the product, and you may never look at the code at all.

His take: most working developers are somewhere between L2 and L4 right now, depending on how much freedom their employer gives them.

What’s left for software engineers, then?

Pratik clearly flagged this part as his own opinion. Like a lot of developers, myself included, he went through the “there’s no way AI replaces me” phase. He concluded that it doesn’t replace software engineers, but it does dramatically change what they spend their day doing, which is the remaining high-value work. I get the feeling that programmers went through something similar when going from assembly to higher-level languages.

With AI writing the code, the process of programming becomes even higher-level, with these becoming our main activities:

  • System design. The model knows how to write code. It does not know that you can’t build a browser front end in Python, and it doesn’t know that your real-time app needs in-memory caching to hit a sub-three-second response. And if it improvises those decisions unprompted, you will not like the implementation.
  • Security.
  • Making sure user requirements are actually met.
  • Writing and maintaining the specs and the architecture.
  • Building the validation harness that keeps the factory honest.
  • Agent orchestration.

He also noted, to the product managers in the room, that the line between PM and engineer is blurring fast in both directions.

The four jobs of a factory

At minimum, Pratik argues, a software factory has to do four things:

  1. Plan the build
  2. Code it
  3. Test it (looping back to implementation when tests fail)
  4. Verify with a QA/security/architecture-compliance pass (the kind of review a human QA engineer would do by using the result as a user would, not just unit tests)

The single most important artifact in all of this is architecture.md. That file is where you, the engineer, do the system design: “This is a web app, use Vue, this is the backend, these are the performance targets, this is how we build things around here.” It’s exactly what you’d tell a new team lead. The factory can’t extrapolate it from your brain.

Specs are a separate thing from architecture: specs are the features, architecture is the system. For spec format, Pratik mostly just writes Markdown, though he noted that larger teams use a more rigid PRD structure, and GitHub’s Spec Kit is out there if you want something opinionated.

Pratik’s actual stack

Here’s what he’s running, top to bottom:

Hermes Agent as the front office. Hermes (the open-source, self-hosted personal agent from Nous Research, in the same category as OpenClaw) is his always-on orchestrator. It runs on a server, it’s reachable via Telegram, Discord, Slack, or email, and it has persistent memory that turns repeated requests into reusable skills. Hermes takes his request, polishes it into a formal spec, finds the right project directory, and dispatches a headless job to the factory floor. He runs it on a 35B-A3B Qwen model, which has 35 billion parameters, but only 3 billion active per token, so it fits on a modest server.

pi.dev as the factory floor. pi.dev is Mario Zechner’s minimal terminal coding harness. It ships with four tools: read, write, edit, bash. It has a tiny system prompt, and hooks for everything else. That’s it: it’s a build-your-own coding agent, not a sealed product. Pratik picked it over Claude Code, Codex, Cursor, OpenCode, Kiro, and the rest because it’s lightweight, it doesn’t burn tokens, and you can point it at any model you want.

Someone reasonably asked why he didn’t just use Hermes for the coding too, since Hermes can code. His answer was about context hygiene: he wants Hermes to be the manager and pi to be the worker, and he doesn’t want to pollute the coding agent’s context with all the management and channel-routing overhead. “It doesn’t have memory. It doesn’t have learning. I don’t want all that stuff for my worker software monkey that’s going and building the code.”

A local LLM. Qwen 3.6 27B, running on a 5090 at home rather than on his laptop for the demo. (Qwen 3.8 27B had landed a few weeks earlier and he said the jump was a substantial improvement.)

A context MCP server. This is the piece I think people will underrate. Qwen 3.6’s knowledge cutoff is roughly a year stale, which means it doesn’t know current Vue and Nuxt APIs. So he plugs pi into an MCP server loaded with current docs and code samples for whatever he’s building (HTML/CSS, Vue.js, Nuxt) so that it builds against Nuxt 4, not whatever it “half-remembers” from last year.

And there isn’t one factory, there are three: a front-end one (Vue/Nuxt), a Java/Spring Boot one for performance-sensitive backends, and a Python one for utilities. Same seven-step process in all three, different tooling underneath.

The seven steps, and where they live

Inside the project’s .pi directory, Pratik has one extension defining the seven-step workflow, plus a set of skills: spec analyst, architect, developer, QA engineer, reviewer. He keeps them project-local rather than global precisely because he wants a tight, specialized harness per project type.

He opened up the spec analyst skill live, and the reveal was how short it is:

The whole thing is barely a screen’s worth of text telling the model it’s a technical product manager who reads requirements systematically and translates them into concrete action plans with features, data models, and API contracts, followed by a handful of instructions: do requirements gathering, document assumptions, create a data model, define the API contract. That’s it. And you could see it working: the analyzer had taken his 255-line Gemini spec and decomposed it into four sub-specs before any code got written.

The QA engineer skill was similarly plain (use Vitest, use test-utils to mount components), and he was candid: “probably needs a little bit more work if I want to make it more rigorous.”

For visual QA he uses a Playwright plugin. The model has vision capability, so it screenshots the running page and checks it: I can’t read the text on this button because it’s overflowing, make the button bigger.

Why local, and why anyone should care

Two reasons, and Pratik was blunt about both.

Reason one is intellectual property. Yes, there’s a checkbox that says don’t train on my data. Do you believe it? “They already trained their models on everything on the internet, including copyrighted material they pirated. I don’t know if I trust these guys with stuff I care about.” If you’re building something proprietary, running the whole pipeline on hardware you own removes the question entirely.

Reason two is cost, and this is where the harness argument lands. The most quotable thing Pratik said all night:

“The harness that calls the underlying LLM matters actually much more than the LLM does.”

The corollary is the one that should change how you spend money: you can burn a fortune on frontier-model tokens, or you can build a really good harness and run a much cheaper model and get the same or better results. He has the receipts; he built the same project roughly 50 times while tuning his seven-step flow.

He’s not a purist about it, either. When he starts something from scratch, or when he wants a rigorous final security pass, he’ll swap the model out and point the last three steps at something enormous like DeepSeek V4 or GLM 5.3 via OpenRouter or Hugging Face inference providers. Same harness, better LLM, but only where it’s worth paying for.

The hardware detour (and the bad news)

Pratik spent a useful chunk of the talk on quantization, because it’s the thing that determines whether any of this runs on your machine.

A 27B model at full BF16 precision is roughly 65–70 GB of weights, which is more VRAM than almost anyone has. Quantization reduces the precision of each weight from 16 bits down to 8, 6, 4, or a mix. Qwen 3.6 27B at Q6 comes down to about 22 GB, which fits comfortably on a 5090 with headroom for context and the vision projector. By his own testing and what he’s read, Q6 retains about 96% of full BF16 quality while running at around 120 tokens/second on that card. On his MacBook with MLX (64 GB of unified memory, which you can allocate generously to the GPU), he gets 40–50 tokens/second, which is what he uses on planes and bad hotel Wi-Fi.

Someone asked whether ~27B is the floor for useful coding models. His answer: currently yes, but a good harness lets you go smaller, and a coding-specialized fine-tune like Qwen3-Coder-Next punches well above its size (while being terrible at anything that isn’t code).

The bad news: now is a terrible time to buy hardware for this. The 5090 that cost someone in the room $2,500 a year ago is around $5,000 now. An RTX Pro 6000 with 96 GB went from roughly $8,000 to $16,000. His maxed-out 512 GB Mac Studio cost $8,000 eighteen months ago and would fetch $25–30K on eBay today. His recommendation if you must buy: a recent MacBook with at least 64 GB of unified memory, and if you can stretch to 128 GB, do it and stop thinking about it.

Fine-tuning is not how you give a model your data

This came out of an audience question and it’s worth pulling out, because it’s one of the most common misconceptions Pratik runs into.

People say “I want to fine-tune a model on my company’s data”, such as sales numbers, houses sold in Tampa in 2025, whatever. That’s the wrong tool. Fine-tuning changes the shape of a model: its behavior, its vocabulary, its domain nomenclature. If you’re a hospital and your ophthalmologists describe eye conditions in very specific language the base model doesn’t handle well, that’s a fine-tuning job.

Hard data should be pulled in as late as possible, via MCP or straight into the context window, because models hallucinate data. Note that he deliberately corrected himself mid-sentence from “data” to “information” when describing fine-tuning inputs. That distinction is the whole point.

The room pushed back, which was the best part

Two solid challenges came from the audience, and Pratik didn’t dodge either.

In their Back to the Future of Software presentations at Devnexus and Arc of AI, Baruch Sadogursky and Leonid Igolnik argue that waterfall didn’t fail because it was inherently bad, but because the cycle time was measured in months. Agentic coding shortens that time; their thesis is that the specific failure mode of waterfall was latency, and AI has changed the latency equation. Read more here.

“Isn’t this just waterfall, which we spent 20 years learning to hate?” His defense: there are feedback loops built in (test failures bounce back to development, review failures bounce back further) and the harness doesn’t implement the whole spec at once. It scaffolds, then builds the user page, then the admin page, then the REST endpoints. Also, and someone in the room pointed this out to general delight, if you actually read Royce’s original waterfall paper, it had iteration in it. The verdict was tabled for the bar.

“Every one of those artifacts is itself a product you have to maintain.” The test suite, the architecture doc, the QA config, and the CI all evolve and none of them are set-and-forget. Pratik conceded the point. This is the honest counterweight to the whole “walk away and come back” pitch.

So did the MLB odds app work?

Sort of. Which is more honest than most demos.

The first run got killed partway through because it wasn’t doing what he asked. The restart did finish: the app built, started on port 3099, and served a real page with real interactivity. Clicking around ran an actual simulation under the hood.

The problems were exactly the ones you’d predict. Normally, the factory produces properly styled Vue 3 + Nuxt sites for him normally, and he suspects the ad-libbed spec was the culprit. And the numbers were nonsense. The Rays were given a 0.3% shot; someone noted the data looked very old. Pratik’s response: “I didn’t tell it where to go get the data from. So yeah, I was very lazy.”

That’s not a failure of the factory. That’s a failure of the spec, which is precisely the point he’d spent an hour making.

Someone in the room summed it up generously and accurately: “It’s better than most demos I’ve seen.”

Limitations, stated plainly

  • This factory is good for small to medium projects. Larger ones need heavier machinery (he name-checked obvious.ai in Atlanta, who sell an industrial-strength factory as a service).
  • The demo was greenfield. You can put a factory on top of an existing brownfield codebase, but you’ll need a discovery pass and a hand-built architecture.md first.
  • There is no standard. What a car repair shop needs from a software factory and what an airline needs are different things. Pratik thinks some standardization is coming, but he’d put it at least a year or two out.
  • Everything in this space has a shelf life measured in weeks. His own words: “What I tell you today is the right way to do it will be antiquated and the wrong way to do it a month or two from now.”

Takeaways

If you only keep five things from this one:

  1. A software factory is process, not vibes. The difference between a factory and one-shotting an app in a chat window is that the factory wraps the model in software engineering discipline: specs, architecture, staged implementation, tests that loop back on failure, QA, security review, and a git history you can roll back. Vibe coding has none of that.
  2. The harness matters more than the model. This is the highest-leverage idea of the night. A well-built harness plus a cheap 27B local model can match or beat a frontier model driven sloppily, at a tiny fraction of the cost, and without shipping your IP to somebody else’s training run.
  3. architecture.md is your job and nobody else’s. The factory will happily build the wrong system beautifully. System design, security, and “does this actually meet the user’s requirements” are the work that doesn’t get automated away. Be the team lead, not the typist.
  4. Garbage spec in, garbage app out, and the MLB demo proved it live. The parts of the app that failed were the parts Pratik never specified: the styling and the data source. If you find yourself blaming the model, check the spec first.
  5. Start small and build your own. pi.dev plus a handful of Markdown skills is a genuinely approachable starting point; Pratik’s entire spec-analyst skill is one short paragraph plus a checklist. Point it at a paid API if you don’t have the hardware, because right now is a genuinely bad moment to buy GPUs. And keep the context MCP server in mind, because your local model’s knowledge of your framework is probably a year out of date.

Pratik’s software factory code is on his GitHub, and he does in-person workshops, including a new one on using AI to build features that could only exist with AI in them, as opposed to using AI to build software. He gave that one at KCDC last week. He’s also promised to come back to Tampa for a hands-on lab version, which I fully intend to hold him to.

Oh, and DevNexus 2027 is running ten tracks, seven of them AI. If you’re looking for a conference to go deep on this stuff, that’s the one.

Categories
Artificial Intelligence Linkdump

AI linkdump for Sunday, August 30

Here are some of the AI articles and videos I’ve been looking at this week:

  • HTMX: No AI Fridays. “If the productivity gains from AI are so big, spending one day a week to minimize its downsides shouldn’t be a difficult trade-off.”

  • AskMike.org: What my dad taught me about AI coding in the 90s. “What is clear to everyone is that if you use AI in a way where you spend little time saying what you want, and no time reading what it coded up – you are vibecoding and the resulting software is not going to last very long (if it works at all). So how much coding should you let the AI do, and how much should you control and read (and deeply understand)?”

  • The Internet Archive’s “Vintage Artificial Intelligence” collection: “A curated collection of early computer software claiming some aspect of artificial intelligence as a primary feature, allowing the early interactions of humans and machines before things got a little strange. Includes a variety of programs intended as therapists, conversation partners, and opponents.”

  • Business Insider: Dario Amodei says Anthropic is ‘not interested in destroying anyone’. “With Salesforce CEO Marc Benioff seated beside him, Amodei sought to put to rest Wall Street’s belief that Anthropic aims to conquer all things SaaS. After all, it was an Anthropic announcement in late January about plugins for Claude Cowork, not the four horsemen, that signaled the beginning of what became known as the Saaspocalypse. In one week, roughly $1 trillion in value was wiped out in the software sector.”

Categories
Artificial Intelligence Humor Video

Debugging with Claude Code

Here’s the latest short on the Global Nerdy YouTube channel: Debugging with Claude Code. Enjoy!

Categories
Artificial Intelligence Humor

If you watch only one ad today (good luck with that), watch this one!

 

At this moment in time, I can’t think of a better way to promote an energy drink and a beer than by what Liquid Death and Garage Beer did: harnessing the pop culture power of worries about AI data centers’ water usage (with an inspired solution), ’80s ballads, and Jason Kelce.

I love how the ad brings all sorts of people together; even Juggalos (who along with the furries, will show us the way to a better future)!

Categories
Artificial Intelligence Linkdump

AI linkdump for Sunday, August 16

Here are some of the AI articles and videos I’ve been looking at this past week:

and finally, the folks at Honest Government Ad do an ad for AI Data Centers:

Categories
Artificial Intelligence Conferences Security

“Culture eats cyber strategy for breakfast”: Notes from 813 Tech Day’s Security Panel

I spent the morning and early afternoon of 813 Tech Day at Hotel Haya in Ybor. I’m still thinking about the Fortifying the Digital Frontier: Cybersecurity at the Forefront of Fintech Innovation session, largely because of the twist that host Michael Hall introduced, which made it different from every other “Cyber is important, yo!” panel I’ve sat through. About two-thirds of the way in, he stopped running the panel and turned it into a consulting engagement. On stage, for free, for a random attendee. And it worked!

Read on, and you’ll see.

A show of hands

Michael started by asking everyone who runs a company or product that touches money, customer data, or both to raise their hands.

Some hands went up, which wasn’t surprising.

Then he asked: “Keep them up if you have a single person whose actual job is nothing but security.”

All hands down.

And that moment was the panel in summary. A room full of people founding or working at companies (or hoping to found and work at them) handling money and PII, and essentially zero dedicated security headcount among them. To be fair, a number of them were solopreneurs. Still, Michael’s follow-up question was  an important one: “So what are you going to do about cyber warfare?”

Introducing the panel

The panel had unusually good coverage of the problem space: economic development, defense-grade compliance, offensive security, and someone who actually runs a bank.

They were, from left to right onstage:

The gap between passing the audit and actually defended

Michael’s next question was a good one: “What’s the widest gap between how secure fintechs think they are and how secure they actually are?”

Alexei’s answer was the cleanest formulation of the compliance trap: compliance does not equal security. You can check every box and still be wide open. His diagnosis of why startups get this wrong:

“We identify the target, then we fire, and then we aim.”

Speed first, aim later. But in banking, “later” can be expensive in ways founders don’t model. He mentioned that for an average-sized bank, a single day of downtime can put the bank’s license at risk.

Candace, coming from the defense side, made it concrete with the ATO, the Authorization to Operate. You bring in an assessor, they verify you’ve got your asset labeling and your SSO and your password policy, and you get the shiny gold star.

And then what?

“Are you updating your AV definitions after you have the ATO? Are you patching on a specific cadence? Are you continuously monitoring the controls you got a check box for?”

Compliance is a still-frame snapshot. Security is the whole movie. Everyone optimizes for the snapshot because that’s what gets audited, but forgets about the movie.

“Too small to matter” is not a security posture

Michael asked Aaron to scare the room, and to Aaron’s credit, he skipped the horror stories and reached for stats.

An attacker can get into essentially any internet-facing machine at almost any company inside an hour. Depending on whose telemetry you’re reading, that number is more like a few minutes. Someone in the audience called out CrowdStrike’s breakout-time figure, which is measured in seconds now.

Aaron’s framing:

“A breach is inevitable. Not if, but when. Your worst day is my every day. If it’s going to rain, you bring a raincoat, not an umbrella.”

That’s why “we’ll deal with it when it happens” isn’t a plan.

What AI did and didn’t change

Aaron summarized it well:

“AI lowered the skill floor for attackers and accelerated the execution timeline. It did not invent new attack classes.”

Phishing, smishing, and credential reuse: these are the same failure modes we’ve had for a couple of decades now. Attacks are just cheaper, faster, and automated now. All this means that your unpatched, password-shared, over-permissioned environment didn’t get more vulnerable; it just got found sooner.

He also had a nice riff on password policy whiplash. We spent years pushing everyone to 15–16 characters, guidance loosened again, and meanwhile the real-world state of the art is that password123 became password12345.

Alexei’s defensive take was the one that fintech founders in the room needed: his bank is doing “baby steps” on AI. Instead of a tool, the first step an AI policy and an AI strategy with actual guardrails. Because the failure mode isn’t anything as melodramatic as a rogue superintelligence, but something more mundane, such as an employee pasting client data into a public chatbot:

“Yes, you can get the answer. But now you’ve already lost that client data. It’s somewhere, and you don’t know who can get it.”

He also noted, matter-of-factly, that some of the adversaries in this space are state-funded. A small bank in Tampa versus a government-backed team is not a fair fight, which is precisely why the guardrails have process over motivation; policy and architecture over vigilance.

The compliance question founders actually care about: Which one pays?

When Michael asked which single compliance framework a founder should chase this year to unlock the most enterprise revenue, Aaron flagged it as a contentious opinion and we got the most useful ninety seconds of the panel:

  • SOC 2 Type II is the one. Depending on your market, it can move your ability to capture revenue by somewhere between 5% and 40%. Nearly everyone selling to enterprise ends up needing it anyway.
  • HIPAA is self-assessed. Draw your own conclusions about how rigorously that’s happening across the industry.
  • PCI DSS: If you’re doing payments and processing, you can largely offload it. Stripe already has it. Use their pipes; as a startup you can’t afford to build that infrastructure yourself.
  • Then there’s the practitioner’s trick: security people maintain crosswalks that map controls across frameworks. Do SOC 2 first and you’re roughly 70% of the way to ISO 27001. Do them in order and stop paying for the same control four times.

Candace added the necessary caveat: the right framework depends on your industry, and in defense you don’t get to choose; there are non-negotiable requirements.

Alexei pointed out that PCI DSS matters for finance the way HIPAA matters for healthcare, so “which framework” is downstream of “which industry.”

Candace’s advice for taking this to a board is deceptively simple: explain it in their language…

  • Bad: “We need to implement AC-2.”
  • Better: “We sell Cracker Jacks, here’s the system that keeps the Cracker Jack business running, here’s why this control protects it.”

The panel turned into a live advisory board

This is the part I’ve never seen at a conference.

An audience member who’s a consultant mentioned he’s got a client (transfer agents, handling bank relationships and a mountain of shareholder PII) who wants to point an agentic AI system at their overflowing email inbox.

The debate: should they be cloud-based, or reverse twenty years of industry momentum and go back to on-prem so they can hot-swap open-weight models without token costs and keep everything whitelisted?

Michael stopped the panel, brought the consultant to the front, declared the panelists a pop-up advisory board, and made them answer.

The responses split about how you’d expect from their backgrounds:

  • Alexei: Going on-prem relocates risk rather than eliminating it. It also means you’re now defending on two fronts: not just outsiders, but also insiders! You’re paying for infrastructure, security, and people. The “cheaper” assumption usually doesn’t survive contact with the invoice. When Microsoft ships patches every week, that’s a vendor doing work you’d otherwise be doing yourself, maybe badly.
  • Aaron: Go hybrid, on the grounds that nobody has a crystal ball about second- and third-order downstream constraints, and hybrid preserves optionality for next year.
  • Candace: Her world is mostly on-prem and air-gapped, so that’s where her instinct goes, insider threat and hiring burden included.
  • Paul: He’s a retired Rear Admiral, so he followed the Navy adage “A ship’s a fool to fight a fort” and declared the question outside his expertise and deferred to the other panelists. In my opinion, that earned him even more credibility.

Michael then asked for the consultant’s contact info so they can follow up in 60 days and report back to the room on what he actually decided. That’s the accountability loop conferences never close. I’ll keep tabs on this and let you know how it turned out.

After that, they did it again, this time with an attendee trying to break from defense-sector BDR work into commercial cybersecurity account management. They brought her to the front and gave her a live career consult.ation.

Candace’s advice was to stop being invisible on LinkedIn and start advertising the specific role she wants.

Aaron also had good cybersecurity-specific advice:

“Cybersecurity is one of the most arrogant professions on the planet. If you’re the one person they want to have a beer with afterward, you’ve already won.”

(I work in cyber. He’s right. In this field, being able to communicate humility is a cheat code.)

And finally, in a fit of audience participation, and after quickly consulting NetFoundry’s careers page (I work there and love it!), I stood up and asked her “How about starting with a Sales Development Rep role that works with Account Management? We have an opening at NetFoundry.”

She said “yes,” and Michael yelled “Joey’s got to get her the job!”

(She and I chatted afterward. Our conversation will be ongoing, and I guess I’ll have to follow up with Michael in 60 days…)

Tampa Bay resources you should know about

Paul’s whole reason for being there was to make people in the room aware of resources they might not have tapped:

  • The Florida High Tech Corridor spans 23 counties from Tampa Bay to the Space Coast, and deliberately plays Switzerland across all of them; there are no favorites among universities.
  • USF’s Bellini College of AI, Cybersecurity and Computing is teaching ethics at the beginning of the degree rather than bolting it on senior year, on the theory that security is fundamentally a judgment-call discipline, not a checklist one. Elizabeth Nelson is the Corridor’s point of contact at USF.
  • SBIR/STTR grants are available from eleven different federal agencies, it’s non-dilutive funding, and the Corridor can help you go after it and match on top of it.
  • Don’t forget places like Embarc Collective, Tampa Bay Wave, and spARK Labs!
  • Florida’s structural advantage is dual-use! The military and commercial sides are unusually well connected here, and the biggest buyer in the world is a short drive away.

Closing round: What’s the one thing you can’t get wrong?

Michael went down the line and asked each panelist for the single thing a founder walking out with one weekend and a small budget can’t afford to get wrong:

  • Paul: Take the first step. Just do something. Anything.
  • Candace: “Culture eats cyber strategy for breakfast.” If your people haven’t internalized cyber hygiene, none of the rest matters. Her running metaphor all afternoon was brushing your teeth: you don’t deliberate about it, you just do it. Security should feel like that.
  • Aaron: Get business insurance, make sure it has carve-outs for cybersecurity, and make sure those carve-outs cover AI-driven attacks. That’s the one I hadn’t heard before and the one I’d act on tomorrow.
  • Alexei: Hire the right people. (Michael made him clarify for the audio: right people.)

My four take-aways from this session

  1. Compliance is a snapshot, security is a movie. If your controls aren’t monitored continuously, your ATO or SOC 2 report describes a company that existed on one Tuesday.
  2. The framework question has an actual answer: SOC 2 Type 2 first, offload PCI to your payment processor, use a crosswalk so you’re not re-implementing the same control in four vocabularies.
  3. AI didn’t create new attacks; it created new attackers. The skill floor dropped. The people who couldn’t do this eighteen months ago can do it now, at scale, cheaply. Your threat model didn’t change; your threat volume did.

Take-away number four is so good that I wanted to separate it from the rest:

4. Turning a panel into a pop-up advisory board bit was brilliant! Michael took real attendee problems, put them in front of a panel of experts, made them answer in public, and asked them to follow up in 60 days. This moved what the panel said from the rhetorical to the practical.

Let’s see more of this, please, and nicely done, Michael!

Categories
Artificial Intelligence Security Video

Watched a Black Hat interview on AI supply chain security and it’s NetFoundry’s report’s findings, but from the opposite direction

Here’s a video that isn’t from the place where I work (NetFoundry), but from someone works in a different part of AI security. Yet somehow they ended up at the same question that we at NetFoundry ask: How confident are you that your current tools can defend against the new threats brought about by AI?

The video features an interview that took place at the recently-concluded Black Hat 2026 in Las Vegas, and the interviewee is Daniel Bardenstein, CEO of Manifest Cyber.

While NetFoundry focus on identity-based security, Manifest’s focus is on the AI supply chain:

  • Manifest’s approach to security is knowing what’s actually inside the models and software you build and buy. They’re paying particular attention to provenance: training data you didn’t source, open-weight models pulled from a public hub, what’s “under the hood” of your agents.
  • NetFoundry approaches AI security from the other end: what’s outside the models and software you build and buy, and what’s allowed to reach it. We’re about machine identity, service-to-service access, and attack surface.

Watch the video; it’s got some notable stuff, including:

  • Open-weight adoption is about to accelerate, and the reason is control. Bardenstein argues that with a frontier model you have zero control over the system prompt, the training data, or what some provider (or government) decides to change under you. With an open-weight model, you control the whole chain: prompt, data, deployment, guardrails. If you’re already self-hosting models behind OpenZiti, this is the security-side justification for it, from someone who isn’t us.
  • The Hugging Face incident he describes is darkly funny. A lot of people say that the risk with AI models is that they’re non-deterministic, but the HF situation happened because the sandboxing was weak and guardrails  (which really means “ordinary software security”) were missing. Then, when HF pointed its own AI at the forensics, its guardrails read the request as “too cyber” and refused to help,. HF had to fall back to an open-weight model.I’m going to start saying this regularly: AI fails like software because it is software!
  • “AI has its own supply chain and you inherit it.” Every model off a public hub and every third-party dataset is a dependency you didn’t build and can’t fully vet. Bardenstein notes public datasets have shipped with everything from PII to, in documented cases, outright illegal content nobody caught until after training. As the people on the Antiques Roadshow TV show will tell you, provenance is important.
  • The Log4Shell framing is the one I’d steal (in fact, I’m doing that right now). Bardenstein built Manifest after the Pentagon Log4Shell vulnerability (a.k.a. CVE-2021-44228) scramble. The issue boiled down to a simple, embarrassing question: “Where is this one piece of code running across everything I’ve built and bought?” Even having seen what happened five years ago, if you told a CISO a model or dataset was poisoned, they’d likely not be able to tell you where it’s deployed, who owns it, or which vendors are affected without a lot of phone calls, emails, spreadsheets, and gnashing of teeth.

Bardenstein’s observations are pretty much the mirror image of our recently-published 2026 State of Secure AI Access report, where we observe that:

  • 99% of CTOs/CISOs at orgs with 1,000+ employees admit they lack full visibility into their AI deployments.
  • 54% named new AI-specific services like MCP servers and LLM gateways as fresh attack surface.
  • 8% think their identity systems are sufficient for non-human workloads.

Pair our observations with Bardenstein’s supply-chain point and the full failure mode is bleak. An agent you can’t identify, running a model you didn’t vet, reaching services over credentials nobody rotates. That’s three unknowns stacked on top of each other.

My read (not Bardenstein’s or NetFoundry’s report’s) is that giving an agent its own OpenZiti identity solves the “reach” half of the problem. You know what the system or service can talk to and every log line means something.

What it doesn’t do is handle the composition half, or to put it another way, it doesn’t account for what’s inside the thing you just handed an identity to.

Two separate disciplines that happen to share a root cause: You can’t govern what you can’t see, whether “it” is a network path or a model’s provenance.