
CUO @solvecyberrisk - I help build the future of cyberinsurance . ex CEO/Founder @binaryedgeio (acquired) - Opinions=mine.
Switzerland
Joined November 2008
- Tweets27.5K
- Following1.1K
- Followers3.3K
- Likes468
Pinned Tweet
New Episode out: Shit I found on the Internet - Episode 1 youtu.be/5B5GYN3rqIQ via @YouTube
Tiago Henriques retweeted
Serious answer is that we’re going to have fast defenders and slow defenders. The fast defenders will fix things quickly and add AI to their CI quickly, and their software will be very strong. Unfortunately everything below them will still be vulnerable until someone figures out how to turn every third-tier org’s security team into Apple or Google.
Tiago Henriques retweeted
The economics of the cybersecurity attack/defense game have clearly changed when researchers are dropping what appears to be KVM/firecracker 0day on a max $50k bug bounty:
xitter.cf/PaulosYibelo/status/21…
I really don't think people are understanding the @HacktronAI HEIF Heist moment properly.
Before AI, what class of attacker do you think would be capable of discovering a silently fixed upstream image parser vulnerability w/o a CVE assigned nor patched in distro packages, exploiting against modern Linux w/ ASLR, and then using it to pop top-tier tech companies w/o them noticing?
I have *never* seen bug bounty researchers land something like that. Have you?
Tiago Henriques retweeted
Holding cybersecurity vendors accountable for their claims is a critical part of improving security.
I'm not a troll. I'm not lying. And I'm not harassing you. But since that's your response: Here we go again.
If you give it right skills, context and tools, LLMs can absolutely find new vulnerabilities. And Reproduce/test them and give you full write ups with reproducible environments
someone at ANTHROPIC just showed CLAUDE finding ZERO DAY vulnerabilities in a live conference demo
claude has found zero day in Ghost, 50,000 stars on github, never had a critical security vulnerability in its entire, history...
it found the blind SQL injection in 90 minutes, stole the admin api key, then did the exact, same thing to the linux kernel
I fucking love @im_roy_lee
Tiago Henriques retweeted
Reverse Engineering.
Guess My RGB - 2026-02-01
Score: 52/100
🟩🟩🟩🟩🟩⬜⬜⬜⬜⬜
Can you visualize RGB values? Try it!
rgb.day
Guess My RGB - 2026-01-30
Score: 83/100
🟩🟩🟩🟩🟩🟩🟩🟩⬜⬜
Can you visualize RGB values? Try it!
rgb.day
Tiago Henriques retweeted
As a former PM,
We will never hire a PM
Three roles and nothing else:
Designers, engineers, teachers
Cursor scaled to $29B without any full-time PMs.
Ryo (Cursor's Head of Design) walked me through how they work and it's the opposite of every big tech best practice:
1. Roles are muddy
PM work is spread across designers and engineers. Everyone does what fits their strengths and uses AI to fill the gaps.
2. Most designs start with code directly
Ryo barely uses Figma except for initial exploration. Most features start as live Cursor prototypes because "it feels more real than pictures."
3. No annual roadmap theater
Just a "fuzzy direction" and features shipped to concentric circles (e.g., staff, nightly beta users, consumers, enterprises) to polish.
Ryo also showed me exactly how he designs and codes new features using Cursor and how he avoid creating generic purple AI slop.
📌 Subscribe to watch our full tutorial tmr: youtube.com/@peteryangyt?sub…
Tiago Henriques retweeted
Cursor scaled to $29B without any full-time PMs.
Ryo (Cursor's Head of Design) walked me through how they work and it's the opposite of every big tech best practice:
1. Roles are muddy
PM work is spread across designers and engineers. Everyone does what fits their strengths and uses AI to fill the gaps.
2. Most designs start with code directly
Ryo barely uses Figma except for initial exploration. Most features start as live Cursor prototypes because "it feels more real than pictures."
3. No annual roadmap theater
Just a "fuzzy direction" and features shipped to concentric circles (e.g., staff, nightly beta users, consumers, enterprises) to polish.
Ryo also showed me exactly how he designs and codes new features using Cursor and how he avoid creating generic purple AI slop.
📌 Subscribe to watch our full tutorial tmr: youtube.com/@peteryangyt?sub…
I've been playing with trying to build prompts injections to influence AI Browser Agents (@OpenAI Atlas and @perplexity_ai Cosmos), in doing so I've seen all sorts of weird behavior but also having LLMs themselves competing to trick those agents linkedin.com/pulse/breaking-…
Tiago Henriques retweeted
Our tech headcount strategy in a nutshell
1. Hire any engineer that clears our (extremely high) bar
2. Maintain ratios with xfunctional team ~1:5 design, ~1:10 PM, ~1:10 DS, ~1:30 PMM, ~1:20 POPs
3. Cap growth rate (<50% YoY) to maintain culture, onboarding productivity, and resource scarcity mindset
4. Revisit single prioritized list of placement across existing & new bets (80/20) quarterly
Tiago Henriques retweeted
🚨CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974: PoC code to exploit the IngressNightmare vulnerabilities
GitHub: github.com/hakaioffsec/Ingre…
Tiago Henriques retweeted
Arguably the most brilliant engineer in FFmpeg left because of this. He reverse engineered dozens of codecs by hand as a volunteer.
Then security "researchers" and corporate employees came along repeatedly insisted "critical" security issues were fixed immediately waving their CVEs.
This was hugely demotivating to the fun and enjoyment of reverse engineering.
Tiago Henriques retweeted
🚨CVE-2025-33073: PoC Exploit for the NTLM reflection SMB flaw
GitHub: github.com/mverschu/CVE-2025…
▪️GUI (Screenshot 1)
▪️CLI (2)
▪️Custom command (3)
▪️SOCKS (4)
Tiago Henriques retweeted
At a past company, the head of engineering and the principal engineers decided to break our Ruby on Rails application into a Go microservices mesh.
They created very detailed design documents and architecture diagrams. They went all out and used Kubernetes, gRPC, service templates, the whole shebang.
The whole senior engineering leadership came from Amazon, where they were used to each team owning a distinct service. They tried to apply that model directly. But our issues were with code ownership and poor domain modeling.
The entire application could have run on just a handful of EC2 instances.
What was the result?
Five years later, 70% of the application is still running on the Ruby on Rails monolith. Never completed the migration. But now they have to maintain two systems.
None of the original leadership works there anymore.
Tiago Henriques retweeted
This is so typical of eng leadership coming from Big Tech:
"The whole senior engineering leadership came from Amazon, where they were used to each team owning a distinct service. They tried to apply that model directly."
Copying *exactly* what they are used to. Though (cont'd)
At a past company, the head of engineering and the principal engineers decided to break our Ruby on Rails application into a Go microservices mesh.
They created very detailed design documents and architecture diagrams. They went all out and used Kubernetes, gRPC, service templates, the whole shebang.
The whole senior engineering leadership came from Amazon, where they were used to each team owning a distinct service. They tried to apply that model directly. But our issues were with code ownership and poor domain modeling.
The entire application could have run on just a handful of EC2 instances.
What was the result?
Five years later, 70% of the application is still running on the Ruby on Rails monolith. Never completed the migration. But now they have to maintain two systems.
None of the original leadership works there anymore.




























