Co-Founder @ Stan | building a $BN company 🚀

Hi, I’m Vitalii 👋🏻

Over the past 3 years, I’ve built a $30M ARR business with 30 people.

A $1M/employee company.

Now, we’re building a category-defining brand—with $100M ARR in sight.

To do that, I focus on Culture, People, and Product.

Everything that got me here is self-taught.

Born and raised in Russia, I started working at 13—packing parachutes and skydiving. 🪂
By 18, I had 800+ jumps and enough saved to pay for my first year of college.

Jumping out of planes redefined my relationship with fear.
Once you commit, you act. Without hesitation.

I learned English in one year to study abroad—still the hardest thing I’ve done.
That brought me to Canada, where I earned a degree in Chemical Engineering.

I never used it.

My side projects opened doors for me—first to Deloitte, then to eBay.
But the real work happened outside the job.

I made time to build:
9–5 for the paycheck,
5–9 (both morning and night) for what I actually cared about.

That’s where I proved to myself—nothing is impossible.

In 2021, I met my cofounder. We went all-in and started building Stan.

On my LinkedIn, I write about:

→ Founder war stories (unfiltered)
→ Building a $1M/employee startup
→ Creating top 1% culture

🎧 Follow me here if you're building—or want to build—something great.

People I work with would describe me as:

→ I make things happen
→ Zero tolerance for mediocrity
→ I build and run top 1% talent-density teams

🫂 DM me on LinkedIn if you'd like to work at Stan.

But know—it’s likely to be the hardest thing you’ve ever done.
And worth it. For the right person.

—

On LinkedIn, I share stories for founders building what’s next—
The ones who care about People, Culture, and Redefining what's possible.

If that’s you,
Follow me. Drop a comment. Or just say hi 👋🏻

Vitalii Dodonov

I spent $204,000 to take the whole team to Costa Rica.

→ Travel (Flights & Bus): $103,000 
→ Hotel & Food: $89,000 
→ Offsite Planner: $12,000

Total Investment: $204,000 
($4,163 per person)

That’s a lot of money to spend on "vibes" and gallop tours 🇨🇷

But here’s why we do it:
I treat offsite trips as a productivity accelerator.

By spending $204K to build deep trust and clear 6 months of roadmap debt in 4 days,
I'm catalyzing our execution speed.

If this offsite increased our efficiency by even 10% over the next year for every individual team member, our team-ROI is easily 10x+.

Offsites is one of the many vehicles we use to invest in our most valuable asset:
People.

I give Credit Cards to my team on Day 1.

"Isn't that risky?”

It’s risky. And frankly very expensive…
But here’s what’s more expensive:

→ An engineer losing flow state because they are hungry
→ A designer missing details because their screen is low-res
→ A PM waiting 48 hours for a $50 software license approval
→ A team member waiting for a bus in the snow after a late night grind

I remember working out of a shared WeWork.

Uncomfortable chairs. Fighting for meeting rooms. Fast food.

Scrappy and frugal is in our DNA.

Now:
✅ Standing desks (Health)
✅ Free lunch & dinner (Focus)
✅ Unlimited Bubbly & protein bars (Fuel)
✅ Discretionary spending (Autonomy)

We don't do this to be "cool."

We do this because top 1% performance requires top 1% support.

You can't expect Ferrari speed if you provide Corolla maintenance.

Invest in your team.

undefined undefined

Alina Antoniuk

I just gotta share this... I mean... Jonathan, what are you doing!?? And why is building security calling us… and you asked for 30 extra seconds? 🤦‍♂️

$20,000. 60 hackers. We hired 4 of them on the spot, and filmed the whole thing! LIVE 🟢 on YouTube:

https://lnkd.in/dtMd7sys

We went from $5M in the bank to under $1M in two years.

On purpose.

Every entrepreneur needs to get extremely comfortable with losing money.

For us, the lesson came after raising venture capital.

We made an uncompromising commitment to hire the top 1% and build a category-defining brand.

This meant watching our bank account shrink over a year and a half.

I still remember the day I pinged John: 

V: "Guess what - we're at $827K and didn't lose any cash this month!" 
J: "Years in the making. Upwards from here."

It takes a lot of belief and conviction to invest this way, as opposed to optimizing for safety.

The reality is, for you to have a disproportionate upside, you need to create disproportional value.

And that's expensive: technology, R&D, talent. 
80% of our costs were purely talent.

Losing money before you make money is the price of being in the game.

Having done it once, I have a lot more appreciation for the process. 
And significantly fewer worries.

What's the biggest bet you've made on your company?

Hanging out with Liz Nucci today who got us our beautiful office 🏡. If you’re looking for office space in Toronto, call Liz! 

Just saying 👀

No alternative text description for this image

I’m having a wonderful time at BrainStation tonight!

I waited 3 years for a top 1% mobile engineer.

Not because we couldn’t hire.

Because I refused to hire a “maybe” and call it progress.

For 3 years, we could’ve “just shipped something” on mobile. 

We passed on several candidates who were good on paper… but weren’t a clear yes.

I kept coming back to one filter:
If this person can’t take what we built and make it 10x better, they’re not going to change the company.

So we waited.

Then we met Johan.

He built the entire mobile app solo.

When we launched, we got 500 five-star reviews in 2 weeks.

That’s the part people see.

What they don’t see is what we avoided: months of “management work” disguised as building—

Rewriting specs, re-scoping tickets, adding layers of process so a hire can keep up.

That’s how teams get slow. 

Not from lack of effort—standards quietly dropping.

Lesson I keep relearning: talent density isn’t a vibe. It’s a strategy.

Where in your org are you accepting a “maybe” (role, project, decision) just to feel progress?

Yesterday, NVIDIA’s Jensen Huang made it free for any company to build AI agents. Here’s what that actually means:

He announced NemoClaw — the enterprise version of OpenClaw, the open-source operating system for AI agents.

He also named what’s coming: ASAAS. Agentic Software As A Service. OpenClaw won’t kill SaaS — it’ll create a new category.

The “A” in ASAAS is the hard part.

At Stan, we’ve been working on AI agents for over a year. The technology was never the bottleneck. Teaching the AI what “good” looks like in your business — that was the bottleneck.

NVIDIA just commoditized the easy part. The hard part is still hard.

The companies winning at ASAAS in 2027 won’t be the ones with the best plumbing.

They’ll be the ones who spent 2025-2026 doing the boring work of encoding domain expertise into their agents.

What was the first thing your company successfully taught AI? (or planning to?)

⚠️ ⚠️ If you're an engineer, now is the worst time to quit your job.

I know. Everyone's saying the opposite.

AI makes it so easy to build. Ship an app in a weekend. Be your own founder.

But here's what the "go build your own thing" crowd isn't thinking about:

Yes, you'll see success stories. 

But for every one that works, there are hundreds who shipped the same weekend. 

The barrier to entry dropped for everyone at the same time. 

More builders, more competition, lower odds for all of them.

And the question is still the same question it's always been: who has distribution?

Distribution, customer trust, brand — these are built over years of compounding. 

They live in the human relationship world that AI hasn't touched. 

Companies hold that. Your side project doesn't.

Sure, your app might launch well. 

Maybe you make a few thousand dollars. 

Then it gets duplicated by your friend over the weekend, and you're left without the job and without the revenue.

If you've been thinking about going out on your own — do it. 

Just not right now.

Don't be impulsive in the middle of a revolution.

"I'm sorry, I f*cked up" 

This was my opening line at our leadership offsite last March.

Standing in front of all 8 leaders at Stan, 

everyone paid attention.

If I was to rate my relationship with everyone in the room, 

these would be my scores:

🟢🟡🟠🔴🔴🟠🔴🟡
(relationship health check: you get the picture)

6 months earlier...

I took on 2x more responsibilities at the company. 

As a result of this crushing workload, I had to prioritize and remove everything that wasn't mission critical.

One of the things I sacrificed was weekly 1:1s with my direct reports,

delegating them to my Chiefs of Staff.

I reasoned that most people I'd been working with for years and we'd manage.

What a mistake it was.

What I failed to see at the time was that the company ran on shared context established in those 1:1s.

Leadership runs on two things:
• Trust
• Shared context

Remove either one, and it's a matter of time before everything breaks.

That's what happened to me.

It took me the following 1-3 months to rebuild what I'd lost — to rebuild the relationships and rescope my work.

Some scars are still itching.

If you're a leader at your busiest time, I'm sharing this story to remind you:

Your company is a group of people working toward a shared objective.

Prioritize people so they can prioritize the shared objective. 

It doesn’t work the other way around.

We took an AI product from $0 to $10,000 MRR in 14 days 📈

I documented our process in full, from the initial build to the specific growth tactics we used to hit that $10k milestone in two weeks.

Sharing the 19-page Playbook today.

Follow + comment “PLAYBOOK” below and I’ll DM you the complete breakdown.

You're probably working on the wrong things right now.

Does this sound like you?

100 emails sent.
5 meetings run.
1 new initiative started.

Every day feels full, but every week you go:
"What did I do?"

What's the difference between moving forward and running in circles?
Well — direction.

Motion without direction is just expensive wandering.

To help with that, I've adopted this habit:

Every morning, before opening Slack, I ask myself:

"What would I do if I could only work 2 hours today?"

"What moves us closer to $100M ARR?"

"Is this urgent, or just loud?"

I'm serious - I tend to ignore 8/10 of the inbound I get, (even from my teams).

Sorry y'all I know you're reading 😅

5 minutes of thinking saves 5 hours of wandering.

Now when I journal, it's not about what I did.

It's about whether what I did actually mattered.

Most founders act too much and think too little.

We confuse being busy with being productive.

The best talent I've hired all share this trait:
They pause before they sprint.

What would you stop doing if you could only work 2 hours?

Price isn't just revenue. 
It's a filter.

For customers. 
And for your team.

Early at Stan, we picked $29/month. 

No deep methodology. We just wanted to feel premium.

Then we had to live up to it.

That meant obsessing over the first 100 customers. 

Fixing bugs on the call. 
Shipping overnight.

Pricing sets expectations. 
Expectations force standards. 

And standards attract a certain type of person.

Builders lean into hard problems. 

Bargain hunters lean into discounts and exceptions.

Same principle applies to talent.

Last month, I ran a hackathon with a $20,000 grand prize. 

It got the top 1% of builders out of the house.

4 hires. 2 days. No resumes.

We don't price based on cost. 
We price based on value.

What's one thing you'd price differently today?

Headcount doesn't fix slow execution. 

Clarity does.

When execution slows, the reflex is: 
"We need to hire."

Most of the time, you don't have a people problem. 

You have a clarity problem.

Here's what I did:

I used to take meetings all day. Felt productive. Wasn't.

Now I auto-decline everything before lunch. 

7 hours of deep work. Zero interruptions.

One calendar rule deleted dozens of daily decisions.

Speed is subtraction.

List your recurring weekly decisions. 
For each one, choose:

→ Delete it. 
→ Delegate it. 
→ Automate it. 
→ Assign a DRI (directly responsible individual).

We used to debate tool purchases in Slack. 

Now everyone gets a $5K card. Decision deleted 🤷‍♂️

Less flexibility upfront. 
More speed downstream.

What decision could you delete this week?

In 1846, astronomers had a problem.

Uranus was wobbling in space.
And nobody could explain why.

Every calculation said it should move one way.
But it moved another.

Most scientists thought Newton's laws were breaking down at that distance.

But Urbain Le Verrier, a French mathematician, had a different idea:
"What if there's another planet pulling on it?"

He spent months calculating where this invisible planet would need to be.

Then wrote to Berlin Observatory:
"Point your telescope here. You'll find a new planet."

They thought he lost it...
But they looked 🔭

Neptune was sitting there.
Exactly where the math said it would be.

Le Verrier discovered a planet using only pencil and paper.
2.7 billion miles away.

I think about this whenever we're stuck at Stan.

When something doesn't make sense, we work backwards.
There's always a hidden force.

We just have to calculate where to look.

What's wobbling in your business that you can't explain?

Stan

All things “cybersecurity posture” at the strategy and tactical level :)

Security Architect

Arctic Wolf

Tech Lead, Security R&D

Department of Computer & Mathematical Sciences, UTSC

Public and symmetric key algorithms and their application; key management and certification; authentication protocols; digital signatures and data integrity; secure network and application protocols; application, system and network attacks and defenses; intrusion detection and prevention; social engineering attacks; risk assessment and management.

Sessional Lecturer I - Computer and Network Security (CSCD27H3)

Trend Micro

Sr. Vulnerability Researcher

Vulnerability Researcher

Security R&D Engineer II

Security R&D Engineer

Associate Security Engineer

University of Toronto

+ Operating Systems (CSCC69H3 Winter 2018)
+ Computer Networks (CSCD58H3 Winter 2018)
+ Computer and Network Security (CSCD27H3 Fall 2017)
+ Introduction to Software Engineering (CSCC01H3 Fall 2017)
+ Numerical Algorithms for Computational Mathematics (CSCC37H3 Fall 2017)

Undergraduate Teaching Assistant

Student

Migrated CTF-style challenges from vagrant to docker for CSCD27H3 (Computer and Network Security)

Student Assistant

+ Software Tools and Systems Programming (CSCB09H3 Summer 2017)
+ Operating Systems I (CSCC69H3, CSC369H1 Summer 2017)

+ Operating Systems (CSCC69H3 Winter 2017)

Operating Systems 1 (CSCC69H3 Summer 2016)

Computer Science Enrichment Club

Introduce computer and network security concepts to club members with the goal of developing a dedicated CTF team and creating a more security aware campus.
Provide a conducive, hands on learning environment for club members by solving wargames and online CTF challenges.

Computer & Network Security Division Lead and Lecturer

CaseWare International Inc.

Software Developer

International Friendship Club

•	Assist the president in planning club activities and decision making
•	Communication skills are continuously developed through weekly emails, notifications and reminders sent to other club members
•	Advertising skills enhanced through social advertising and promotion of the club and its agenda

Vice President

AI for Security Engineering
AI for Software Engineering
Building AI-native applications
Cloud Security
CISSP
Web3 Security / Smart Contract Auditing
Attack automation and Exploit development
Vulnerability research
Malware analysis and research

Kelechukwu Udonsi (Kc)

My CTO wanted to give his AI bot an AWS Identity.


and neither of us were looking forward to the conversation.

He's super technical. Loves to move fast. And I knew he already had the privileges to do whatever he wanted — so if he was asking, it's because he understood there were some risks.

I could've just said "use OIDC instead of an IAM User" and called it a day. That's the textbook answer. Our CI/CD pipelines already use it.

But I also knew if my proposal introduced too much friction, it'd get bypassed. And then we'd be staring at future tech debt with security implications.

So I decided to own the prototype myself.

I asked for the evening to figure it out. Instead of a theoretical approach, I wanted to hand him tactical steps to get his bot working with configurable permissions.

I ended up with: Google Service Account → Google as IDP → AWS OIDC → ReadOnly role to start. My deliverable was a simple python script the bot could execute whenever it needed AWS access.

𝗔𝗜 𝗮𝗴𝗲𝗻𝘁𝘀 𝗼𝘄𝗻𝗶𝗻𝗴 𝗲𝗻𝗱-𝘁𝗼-𝗲𝗻𝗱 𝗽𝗶𝗽𝗲𝗹𝗶𝗻𝗲𝘀 𝗶𝘀𝗻'𝘁 𝗰𝗼𝗺𝗶𝗻𝗴 — 𝗶𝘁'𝘀 𝗵𝗲𝗿𝗲.

My responsibility is to make sure Stan can move fast with AI without compromising our Creators' trust. That means designing Agent Identity and Access Management now, not later.

—

I want to bring you along for a 14-day journey on how I'm securing AI at Stan — real challenges, some recent, some still unfolding. This is Day 1/14.

What does securing AI look like at your org?

Next post in the series: https://lnkd.in/eWUPuXhQ

AI and Cybersecurity. Cybersecurity Leader, Architect, and Coach

Brydon recommended I share this short film by Justin Badua

8 hours. 2 demos. 0 regrets.

NEBULA FOG 2026 is a wrap — and I'm still processing everything.

Here's what went down:

𝗧𝗵𝗲 𝗯𝘂𝗶𝗹𝗱𝘀

In the prebuilt category, I demoed 𝗗𝗠 𝗜𝗻𝘀𝗶𝗴𝗵𝘁𝘀 — an MVP platform for analyzing messaging and websites for harmful content. https://lnkd.in/eZC-6vpX

In the built-from-scratch category, I demoed 𝗢𝘃𝗲𝗿𝘄𝗮𝘁𝗰𝗵 — a fully autonomous near real time breach detection framework. I tested it against a portion of Wizard Spider emulation from MITRE ATT&CK. https://lnkd.in/dvJnmsYf

𝗧𝗵𝗲 𝗵𝗮𝗿𝗱 𝗹𝗲𝘀𝘀𝗼𝗻

I should've pre-decided my project and built the attack emulation 𝘣𝘦𝘧𝘰𝘳𝘦 the event. Debugging infrastructure during an 8-hour hackathon? Not part of the plan. Burned time I didn't have.

Next time: show up with the scaffolding ready.

𝗧𝗵𝗲 𝗶𝗱𝗲𝗮𝘀

What blew me away was the range of problems people are tackling at the intersection of AI x Security:

• 𝗔𝗴𝗲𝗻𝘁 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 — hijacking via tool poisoning, alignment sandboxes, least-privilege OAuth for agents
• 𝗢𝗳𝗳𝗲𝗻𝘀𝗶𝘃𝗲 𝗔𝗜 — autonomous red teaming, jailbreak arenas, active recon for exposed AI agents
• 𝗗𝗲𝗳𝗲𝗻𝘀𝗶𝘃𝗲 𝗔𝗜 — real-time prompt injection firewalls, autonomous vulnerability patching, multi-agent incident response
• 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 & 𝗜𝗻𝘁𝗲𝗴𝗿𝗶𝘁𝘆 — federated threat intel without exposing internal data, ZK-verified model inference, encrypted inference gateways, model supply chain integrity

This space is moving fast.

𝗧𝗵𝗲 𝗽𝗲𝗼𝗽𝗹𝗲

It was a pleasure meeting other security leaders building at the frontlines. Thank you all for the great conversations! Van T, Rick Wesson, Gufran Mirza, Ewan Mellor, Jeremy Leonard, @Garret H, Caleb Sima, Dylan Williams, Frank Dye.

Also, thanks to Rob Ragan and the team for such a great event! 🙌🙌

𝗧𝗵𝗲 𝘁𝗮𝗸𝗲𝗮𝘄𝗮𝘆

I came to learn fast, build fast, and network meaningfully.

Mission accomplished.

—

Day 2/14 of Securing AI at Stan — live from NEBULA FOG 2026.

What's the most interesting AI x Security problem you've seen lately?

previous update: https://lnkd.in/eeZZv45p

Less than 24 hours ago I landed in SF for my first hackathon ever.

Yup—I've only done CTFs up to this point.

At Stan, we've run hackathons internally and the energy is electric—even from the audience. But I've never been in the builder seat. Now I'm about to spend 8 hours doing exactly that.

Why fly out for this?

NEBULA FOG 2026 is at the exact intersection of what I care about: AI x Security.

I want to see what challenges security professionals are solving with AI. I want to understand cutting-edge approaches to securing AI systems. And honestly? I'm hunting for thought patterns and techniques I can bring back to Stan.

The plan: Participate in the "Build something new" category

𝗜'𝗺 𝗵𝗲𝗿𝗲 𝘁𝗼 𝗹𝗲𝗮𝗿𝗻 𝗳𝗮𝘀𝘁, 𝗯𝘂𝗶𝗹𝗱 𝗳𝗮𝘀𝘁, 𝗮𝗻𝗱 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝗺𝗲𝗮𝗻𝗶𝗻𝗴𝗳𝘂𝗹𝗹𝘆.

Whatever happens in the next 8 hours, I'm here for it.

Posting updates throughout the day, follow along 🙂.

👋 If you encounter my existence today, come say Hi!

—

This is Day 2/14 of my series on Securing AI at Stan.

Have you built at the intersection of AI x Security? Or are you still waiting to jump in?

First post in the series: https://lnkd.in/eZEyt-9H
Next post in the series: https://lnkd.in/e98bNGSc

There are no rules.


Vitalii Dodonov said that at BrainStation's "Building What's Next with Stan" session yesterday — and then he proved it.

Mid-talk, he pulled out his phone, took a selfie with the audience, and posted it to LinkedIn. Live. Right there.

Then he told us to do the same.

No slides about personal branding. No theory about building in public. Just — here's how you do it, now do it with me.

That's what made it land. He didn't just tell us to tell our stories. He made it practical. He made it safe by doing it together.

I didn't post mine in the moment. But I took the photo. And since I already had it... might as well use it, right?

Not my best angle, but LinkedIn isn't the runway.

Sometimes the best way to learn something is to just do it — especially when someone's doing it alongside you.

What's something you've been overthinking that you could just... start?

3 hours into NEBULA FOG 2026 — I may have already spent too much time deciding what to build 😭


Here's how it's going:

I walked in, scanned the room, and almost immediately reached for my headphones.

But I caught myself. One of my goals here was meaningful networking — not just building in isolation.

So I walked over to the couch and introduced myself to Van

We got to talking — backgrounds, how we got into security, what we might tackle today given the time crunch. Turns out he transitioned from molecular biology after discovering how virology maps to cyberspace. Now he's working on AI alignment as an app security engineer.

Pretty cool dude.

Now for my build.

Most projects in the last run of this event were offense-focused — vuln discovery, automated red teaming, pentesting. So I'm going the other way.

𝗖𝗮𝗻 𝗔𝗜 𝗱𝗲𝘁𝗲𝗰𝘁 𝗯𝗿𝗲𝗮𝗰𝗵𝗲𝘀 𝗮𝘁 𝘀𝗰𝗮𝗹𝗲 𝗶𝗻 𝗻𝗲𝗮𝗿 𝗿𝗲𝗮𝗹 𝘁𝗶𝗺𝗲?

Building for the blue team.

Emulation infra is up on AWS. You know what that means — every second I waste is burning cash. Literally 💸 💸. Extra fire to move fast. 

Stay tuned. Might be super broke by the end of this 😭

—

Day 2/14 of Securing AI at Stan — live from NEBULA FOG 2026.

next update: https://lnkd.in/ebQF_rZb

"𝗛𝗲𝘀𝗶𝘁𝗮𝘁𝗶𝗼𝗻 𝗸𝗶𝗹𝗹𝘀."


Yuri K. said that to me years ago. We were in the car, probably at a turn or during a lane change. I hesitated and he called it — "You hesitated there Kc. Hesitation kills"

I didn't think much of it at the time. But it stuck. Changed how I drive. Now I spot hesitating drivers everywhere — the ones who half-commit to a lane change, or pause too long at a turn when they had the gap. That little pause that creates chaos and breeds uncertainty.

This weekend something clicked.

All those times I told myself I was "doing more research" or "sleeping on it" or "just being thorough" — that was hesitation. Dressed up. Wearing a responsible-looking mask.

The thing I eventually did? I could've done it when the thought first showed up. But I hesitated. And that delay cost something. Momentum. Timing. Sometimes the opportunity itself.

Now, I ain't no driving instructor — on the road, sure, "better safe than sorry" applies.

But in most of life? The bias should be toward action.

I'll be hesitating less.

𝘛𝘩𝘦 𝘱𝘰𝘴𝘵 𝘪𝘵𝘴𝘦𝘭𝘧 𝘪𝘴 𝘈𝘐 𝘐𝘯𝘧𝘭𝘶𝘦𝘯𝘤𝘦 𝘓𝘦𝘷𝘦𝘭 3 (Stanley), 𝘣𝘶𝘵 𝘵𝘩𝘦 𝘢𝘳𝘵 𝘧𝘰𝘳 𝘪𝘵 𝘪𝘴 𝘈𝘐𝘓 2 (𝘗𝘢𝘨𝘦𝘗𝘰𝘱.𝘢𝘪)!

Security shouldn't be the reason your team can't use AI.


My Head of Support was blocked on the AI Policy I put out.

She wanted to use AI to optimize her team's workflows — but the policy said no sensitive data in third-party models. Fair. But it also meant no customer context. Which meant... no real use case.

People don't need another rule. They need a paved road.

So I built her one. In an afternoon.

𝗧𝗵𝗲 𝘀𝘁𝗮𝗰𝗸:

• FastAPI + Presidio for NER-based PII detection
• Redis caching for API key checks
• SQS + Lambda for async, write-and-forget logging
• SSO for internal teams, guest mode for demos
• Config dashboard per API key — preview what's detected before going live

Data goes in dirty. Comes out clean. No PII leaking to third-party models.

𝗧𝗵𝗶𝘀 𝗶𝘀 𝘁𝗵𝗲 𝗽𝗮𝘃𝗲𝗱 𝗿𝗼𝗮𝗱. Not a policy. Not a gate. A tool teams actually want to use.

Security should enable AI adoption, not block it.

—

Day 5/14 contd. of Securing AI at Stan.

What paved roads has your security team built? 👇

Previous post in the series: https://lnkd.in/g8YnYa_8

Next post in the series: https://lnkd.in/eCkDKKqs

I'm straddling the line between "Wait, that's so cool" and "Oh shitttttt."


Only two months ago, I had a mental map of our entire attack surface. Every hardened wall. Every brittle fence. I knew where the risks lived.

Now? The perimeter broadens every hour.

Everyone and their future self is building with AI. Exciting but the day-mares are real:

• Unauthenticated public 'prototypes' with live data
• So many hosting domains — Vercel, Lovable, Supabase, and counting
• Unintentionally external internal tooling (yes, that's a thing 😭)

But I chose to be reactive with intentionality. Here's why:

𝗙𝗶𝗿𝘀𝘁 — we're a startup. If there's no product, there's nothing to secure. Speed of innovation is a superpower here. Everyone's pretty cracked. So before I introduce friction, the risks must outweigh the pros.

𝗦𝗲𝗰𝗼𝗻𝗱 — my customers are our employees and the org as a defensible entity. That means understanding how we're building with AI before over-engineering a bunch of controls.

𝗧𝗵𝗶𝗿𝗱 — our culture is built around "No rules rules." A long list of "Don't do this" wouldn't be effective.

So what have I actually done?

• Shared a short (dare I say sweet) AI policy at All Hands — a mental model for working with AI and understanding risks around our Creators' trust. Batteries included: reach out if you're unsure. How do I know it's working? People aren't afraid to share their AI projects. They flag concerns. They ask for help hardening.

• Set up a business Lovable account to manage app access controls, reign in orphaned apps for visibility, and with GitHub integration — bring them all under existing AppSec controls.

It's not foolproof. But it's a start.

Today's a short day — flying back to Toronto ✈️. I'll be revisiting some saved reads:

• Daniel Miessler's Anatomy of a Personal Agentic Stack: https://lnkd.in/eeZnu6kD

• Dan Guido s deck on transforming Trail of Bits to AI-Native: https://lnkd.in/eCi-umRv

• Jason Chan's tl;dr sec blog on Security for High Velocity Engineering: https://lnkd.in/e6JifPkK

So much wisdom to frame the work week ahead.

—

Day 3/14 of Securing AI at Stan.

What resources have shaped how you think about security in fast-moving orgs? Drop them below 👇

Previous post in the series: https://lnkd.in/eZAj_mpp
Next post in the series: https://lnkd.in/efnfJF_6

I ran internal AI interviews today. Three challenges surfaced.


I wanted to understand how teams are actually building with AI before I start layering on controls. So I scheduled time with folks across the org.

The themes that emerged:

• Safely integrating autonomous bots to SaaS applications
• Delegating access to personal accounts
• Sanitizing and anonymizing data before AI workflows

I'm tackling the third one first. Support tickets into summarizers. Account verification pipelines. All potentially leaking PII to third-party models.

I could write a policy: "Don't send sensitive data to AI tools."

But that's friction without a path forward. Nobody wins.

So I'm borrowing a concept from Jason Chan's blog on Security for High Velocity Engineering: the 𝗽𝗮𝘃𝗲𝗱 𝗿𝗼𝗮𝗱. 

A paved road = a well-supported, optional solution for a common problem. Not a gate. Not a blocker. A better path that people actually want to use.

𝗧𝗵𝗲 𝗽𝗹𝗮𝗻:

Build a local NER-based API any team can call to clean input before it hits an AI workflow.

• Data never leaves our environment
• No external dependencies or API costs
• Full control over entity types we care about
• Fast enough for real-time workflows

Data goes in → sanitized data comes out.

"John Smith, john.smith@email.com, 416-555-1234"
becomes
"[NAME], [EMAIL], [PHONE]"

Haven't built it yet. But the requirements are clear. The use cases are real. Now it's time to execute.

—

Day 4/14 of Securing AI at Stan.

At the end of this series, I'm packaging everything into a playbook. This will be part of it.

How do you handle data hygiene before AI workflows? 👇

Previous post in the series: https://lnkd.in/e98bNGSc
Next post in the series: https://lnkd.in/g8YnYa_8

It's almost midnight. Day 6/14 of Securing AI at Stan — the unsexy work.


I've been working on centralized AI access. MCP, plugins, connectors, identity and access management, monitoring.

Not glamorous. But necessary.

Why? Rather than building guardrails for dozens of platforms and use cases, I now have a well-defined scope. One throat to choke (lovingly).

Still — I wrestled with whether this was the most impactful thing I could be doing. The landscape is shifting fast. But sometimes the foundation has to come before the flash.

It got me thinking about AI maturity stages. Right now, most internal use cases at Stan are 𝗔𝗜-𝗮𝘀𝘀𝗶𝘀𝘁𝗲𝗱 — people using AI tools to do their existing jobs faster.

But I'm also thinking about what's next: 𝗔𝗜-𝗮𝘂𝗴𝗺𝗲𝗻𝘁𝗲𝗱 — workflows completely redesigned around AI capabilities.

I've been revisiting Dan Guido's deck on making Trail of Bits AI-native: https://lnkd.in/egbstSZ2. His "operating system model" frames it well:

• Pick a standard toolchain you can support
• Write the rules so risk conversations stop being ad hoc
• Create a capability ladder so improvement is expected, measurable, and rewarded

I'm very much in 1 and 2. My 3 is still uncertain.

—

What stage of AI maturity is your organization at — and what's blocking the next one?

Previous post in the series: https://lnkd.in/e2dqRaY3
Next post in the series: https://lnkd.in/e7ZG49CA

taplio

The Battle

Vitalii Dodonov

Kelechukwu Udonsi (Kc)

Followers

Posts

Engagements

Likes

Performance ScoreVitalii Dodonov's LinkedIn Performance

Performance ScoreKelechukwu Udonsi (Kc)'s LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Vitalii Dodonov

Kelechukwu Udonsi (Kc)

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Vitalii Dodonov's LinkedIn Performance

Performance ScoreKelechukwu Udonsi (Kc)'s LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreVitalii Dodonov's LinkedIn Performance