Sam Alba builds Mendral, an AI-native DevOps platform that uses agents to automate platform-engineering work, including CI maintenance and supply-chain security reviews.
Sam Alba builds Mendral, an AI-native DevOps platform focused on automating platform-engineering work.
Their posts explain how the product handles CI maintenance and supply-chain security, including a specific account of a Trivy Action compromise and checks for suspicious dependency changes.
Alba also argues for prioritizing how engineers actually work over lengthy feature checklists.
Follow their work for concrete accounts of building Mendral and arguments about safer, more automated software delivery.
Alba connects technical design to decisions engineers face in a pull request.
One post describes extra scrutiny for packages published within the previous 72 hours, alongside checks for malware, typo-squatting, and suspicious lifecycle scripts.
Another explains why Mendral treats dependency updates as untrusted code rather than routine upgrades.
The Trivy account makes the maintenance argument tangible: Alba says a customer was on the one safe version after Mendral had proactively upgraded it.
Together, these posts pair product explanation with operational examples and show how Alba’s writing addresses product judgment as well as security tooling.
Sam Alba’s posts center on a single bet: software delivery infrastructure should maintain itself.
Read more
That means moving security checks into CI before merge, treating dependency updates as untrusted code, and using always-on agents to handle routine maintenance most teams still do by hand. A separate thread focuses on product judgment: watch what users work around, not what procurement checklists demand.
Supply-chain security belongs in CI, before merge
Sam Alba argues that CI is the right enforcement point for supply-chain security: it sits between a developer opening a pull request and production shipping.
Read more
Every dependency change, new package, version bump, and action invocation passes through CI.
The described agent triggers when a pull request touches a dependency manifest, lockfile, Dockerfile, or Actions workflow.
It reads source code and transitive dependencies, flags typo-squatting, malware, and suspicious lifecycle scripts, and scrutinizes packages published in the last 72 hours more closely because that is the active attack window.
Waiting for an advisory leaves a gap a normal scanner will miss.
The agent flagged a dependency in a customer’s pull request that had been published to npm five minutes before the commit. A conventional scanner would have let it through because no advisory existed yet.
Treat dependency updates as untrusted code contributions
In a post pointing to Olivier Gambier’s argument on the Mendral blog, Sam Alba highlights the position that auto-merging Dependabot pull requests is now the leading route for supply-chain compromise.
Read more
The cited incidents include Shai Hulud, Nx, chalk/debug/qix, and tj-actions/changed-files.
The stated model is to review a dependency update like a pull request from a stranger: run the package in a sandbox, check for post-install scripts, new transitive dependencies, and behavioral drift, then approve, request changes, or block.
Separately, they describe agents that open upgrade pull requests by reading the changelog, examining how a package is used in the codebase, and making required code changes, with CI validating the result and anything unverifiable marked for human review.
The post contrasts a five-year-old view of Dependabot as real progress with today’s view that blindly auto-merging its pull requests is how malware enters a repository.
Five years ago, Dependabot was described as real progress. Now, the argument treats automatic dependency merges as a primary risk, not a convenience.
Sam Alba argues that CI pipelines are critical infrastructure, but the work that keeps them secure—upgrading pinned actions, fixing broken scans, and keeping dependencies current—is still manual at most companies.
Read more
They propose an always-on agent that treats delivery reliability as a first-class problem, catching issues before they surface rather than scrambling after a disclosure.
During the Trivy-action compromise, an attacker force-pushed malicious commits to 75 of 76 version tags, so any pipeline referencing a poisoned tag could leak secrets and credentials.
Customer Anyshift.io was on v0.35.0, the only safe version, because Mendral had upgraded them from v0.30.0 eleven days earlier after noticing the pinned Trivy binary had been deleted from GitHub Releases.
Anyshift CTO Stephane Jourdan is quoted saying the earlier fix avoided a full credential rotation across their infrastructure.
Let user workarounds—not procurement checklists—set product direction
In an early-startup post, Sam Alba warns that large enterprise prospects can hand over long requirement checklists and promise multi-year contracts if every box is checked.
Read more
Teams can spend months building role-based access controls and custom corporate networking for purchasing managers who will never use the software, then still lose the deal—while making the product harder for actual engineering teams to use and slower to onboard.
They argue that product direction should come from watching where users expend their own energy.
In this view, user workarounds are the roadmap.
The post describes teams building complex access controls and networking configurations for procurement departments, only to find the product too complicated for the engineers who would actually deploy it.
Keep the agent harness outside the sandbox to limit token bleed
Sam Alba describes a technical priority behind Mendral’s autonomous work: a tiered model strategy and an agent harness kept outside the sandbox to avoid token bleed.
Read more
The goal is to make autonomous CI investigations practical at scale without treating every task as an expensive model call. The company describes connecting an agent to ClickHouse for a SQL interface across terabytes of raw logs, ingesting over a billion log lines a week, and handling 16,000 autonomous CI investigations a month.
In a timeline post, Sam Alba’s April milestone pairs a published framework post on keeping the agent harness outside the sandbox with a tiered model strategy for running autonomous CI investigations at volume.
This answers the first question a newcomer has: what has this person built, and how far along is it?
Read more
It puts the whole product on one timeline, naming the integrations, scale figures, and shipping dates other posts assume.
A dated recap of building Mendral from nothing.
Sam Alba and Andrea left Dagger in September 2025; a working MVP existed by December; the company entered Y Combinator's W26 batch in January 2026.
The post lists concrete milestones: a ClickHouse-backed SQL interface over terabytes of raw logs, ingesting more than a billion log lines a week (February); a tiered model strategy handling 16,000 autonomous CI investigations a month (March); a Slack integration and an argument for keeping the agent harness outside the sandbox to avoid token bleed (April); a supply-chain agent in the GitHub pull-request workflow, a two-way Linear integration, and self-configuring automations (May); and a reported case in which the PostHog engineering team merged 104 autonomous fix pull requests in a single month (June).
For brands planning a campaign
A platform or tooling company weighing Mendral as a partner or integration target gets a checkpointed delivery history for diligence: what shipped when, which systems it connects to, and the scale the company says it handles.
This shows what an always-on maintenance agent is worth in practice.
Read more
It is the clearest illustration of the company's core claim, and shows the evidence Sam Alba uses: a named customer, a specific version number, and a near-miss outcome rather than a general pitch.
A supply-chain incident story.
An attacker force-pushed malicious commits to 75 of 76 version tags of Aqua Security's trivy-action, so any CI pipeline referencing a poisoned tag could leak secrets, cloud credentials, and SSH keys.
Customer Anyshift.io ran v0.35.0, the one safe version, because Mendral had upgraded them from v0.30.0 eleven days earlier after noticing the pinned Trivy binary had been deleted from GitHub Releases.
The post includes a quote from Anyshift's CTO saying the earlier fix avoided a full credential rotation.
For brands planning a campaign
For a security or DevSecOps brand, this is the most narratively useful piece: a concrete near-miss with version numbers, suited to case studies, webinars, or co-marketing about proactive dependency maintenance.
This shows where the team stands on a tool used by millions of repositories.
Read more
It is the shortest route to the company's technical position and points to a longer piece for readers who want the full argument.
A short pointer to an argument by Olivier Gambier on the Mendral blog: auto-merging Dependabot pull requests is now the leading route for supply-chain compromise, following incidents such as Shai Hulud, Nx, chalk/debug/qix, and tj-actions/changed-files.
The post argues that a dependency update is an untrusted code contribution and should be reviewed like a pull request from a stranger.
Mendral's agent reviews each dependency pull request inside CI, runs the package in a sandbox, checks for compromise markers such as post-install scripts, new transitive dependencies, and behavioural drift, then approves, requests changes, or blocks.
For brands planning a campaign
A vendor in this space can use this to assess Mendral's positioning: the company defines itself against Dependabot, not alongside it, shaping whether a partnership looks complementary or competitive.
This shows how the product makes decisions, not just what it claims to catch.
Read more
Readers assessing whether the approach is substantive rather than marketing should start here: it names the triggers, checks, and time window used to assess suspicion.
The most specific explanation of the agent's behaviour.
It describes a case where the agent flagged a dependency in a customer pull request that had been published to npm five minutes before the commit—something a conventional scanner would have passed because no advisory existed yet.
The stated design: the agent triggers when a pull request touches a dependency manifest, lockfile, Dockerfile, or Actions workflow; reads source code and transitive dependencies; checks for typo-squatting, malware, and suspicious lifecycle scripts; and gives packages published in the last 72 hours extra scrutiny as the active attack window.
It also opens upgrade pull requests that read the changelog and adapt code, leaving anything unverifiable marked for a human.
For brands planning a campaign
Technical audiences evaluating credibility will ask these questions. Surface this piece in developer-facing content or events where specifics matter more than positioning.
This shows how this person thinks about product direction when customer requests conflict with usable engineering.
Read more
It is the only item in the set about judgment rather than tooling, useful for anyone assessing how a founding engineer would handle competing demands.
A product-judgment argument rather than a product update.
Large enterprise prospects hand over long requirement checklists and promise multi-year contracts if every box is ticked; teams spend months building role-based access controls and custom networking, yet the deal still does not close as the product becomes harder for engineers to use.
Sam Alba's alternative is to follow where users expend their own effort: "Pay attention to the workarounds, because the workaround is the roadmap."
For brands planning a campaign
For hiring or advisory briefs, probe this position in conversation: it prioritises observed behaviour over stated requirements. Ask for real examples.
Customer incidents and quantified outcomes as proof3
CI as the enforcement point for supply-chain security2
Dependency updates as untrusted code contributions2
Autonomous agents for platform engineering and CI operations1
Startup product strategy: workarounds over procurement checklists1
Building and launching Mendral in public1
Autonomous agents for platform engineering and CI operations
Sam Alba describes Mendral as an AI-native DevOps platform where autonomous agents handle platform-engineering work.
Read more
One post describes connecting an agent to ClickHouse for SQL access across terabytes of logs, ingesting over a billion log lines a week, and using a tiered model strategy to handle 16,000 autonomous CI investigations a month. Other work includes Slack and Linear integrations and custom automations that let Mendral configure itself.
Keeps the agent harness outside the sandbox to reduce token bleed and uses a tiered model strategy for CI investigations.
For brands planning a campaign
For a DevSecOps platform hiring a founding engineer, this is concrete evidence to probe Sam Alba’s hands-on role in agent architecture, model routing, integration design, and operating autonomous CI work at scale.
CI as the enforcement point for supply-chain security
Sam Alba argues that supply-chain security must live in CI, between a developer opening a pull request and production shipping, because every dependency change passes through CI.
Read more
The described agent runs on pull requests that touch dependency manifests, lockfiles, Dockerfiles, or Actions workflows.
It reads source code and transitive dependencies, flags typo-squatting, malware, and suspicious lifecycle scripts, and scrutinizes packages published in the last 72 hours.
A separate post describes the Trivy-action supply-chain attack, in which an attacker force-pushed malicious commits to 75 of 76 version tags, and a customer running a safe version after a proactive Mendral upgrade.
Runs the review before merge and treats the 72-hour post-publication window as the active attack period.
For brands planning a campaign
Assessing hands-on supply-chain security work calls for interview questions about where Sam Alba enforces controls, how they handle pre-advisory risk, and how they would reduce false positives without blocking delivery.
Dependency updates as untrusted code contributions
Sam Alba argues that blindly auto-merging Dependabot pull requests is a leading vector for supply-chain compromises.
Read more
The post cites Shai Hulud, Nx, chalk/debug/qix, and tj-actions/changed-files, and says dependency updates should be reviewed like pull requests from a stranger.
The described approach reviews every dependency pull request inside CI, runs the package in a sandbox, checks for post-install scripts, new transitive dependencies, and behavioral drift, then approves, requests changes, or blocks.
Another post says the same agent opens upgrade pull requests, reads changelogs, examines how a package is used in the codebase, and makes required code changes, with CI validating the result.
Treats dependency updates as untrusted contributions and uses sandbox execution plus compromise markers instead of auto-merging.
For brands planning a campaign
Relevant to evaluating dependency security expertise and Sam Alba’s position on replacing automated update tools. Ask how they would design review gates for a new platform and where automation should stop and human review begin.
Startup product strategy: workarounds over procurement checklists
In an early-startup post, Sam Alba warns that large enterprise prospects can hand over massive checklists and promise multi-year contracts if every box is checked.
Read more
Teams can spend months building role-based access controls and custom corporate networking for purchasing managers who will never use the software, then still lose the deal while making the product too complicated for engineering teams. They argue that product direction should come from watching where users expend their own energy: the workaround is the roadmap.
This is a general startup argument, not a description of a specific Mendral product capability.
For brands planning a campaign
A founding engineer brief can test whether Sam Alba can distinguish must-have platform capabilities from procurement-driven feature sprawl and keep the product usable for engineers.
Sam Alba gives a self-reported timeline: leaving Dagger with Andrea in September 2025 to start from a blank slate; a functioning MVP in December; starting Y Combinator’s W26 batch in January 2026 and launching Mendral as an AI-native DevOps platform; connecting the agent to ClickHouse in February; completing YC Demo Day in March; adding Olivier, publishing a framework post on keeping the agent harness outside the sandbox, and shipping Slack integration in April; shipping a supply-chain security agent, two-way Linear integration, and custom automations in May; and publishing production case studies in June.
Read more
The post ends with a teaser about a bigger announcement.
Ask for references to corroborate the self-reported timeline.
For brands planning a campaign
This gives a hiring manager a timeline to discuss execution pace, technical milestones, and how Sam Alba prioritizes platform work during rapid startup scaling.
Customer incidents and quantified outcomes as proof
The posts use customer stories and engineering counts to support claims about autonomous delivery.
Read more
One describes Anyshift.io and its CTO Stephane Jourdan discovering that a proactive Mendral upgrade from Trivy v0.30.0 to v0.35.0 put them on the only safe version during the Trivy-action compromise.
Another cites PostHog’s engineering team merging 104 autonomous fix pull requests in a single month.
A separate post describes an agent flagging a dependency published to npm five minutes before a pull request commit.
Uses named customer incidents and quantified engineering outcomes as proof points for autonomous delivery and supply-chain security.
For brands planning a campaign
Assess whether Sam Alba uses customer information rigorously or overfits to a single dramatic incident. Ask how they validate autonomous fixes before claiming customer impact.
Sam Alba’s documented brand relationships are through Mendral, the AI-native DevOps company they say they co-founded after leaving Dagger, and Y Combinator’s W26 batch.
Read more
Their posts name Mendral customers Anyshift.io and PostHog as working examples and cite Aqua Security’s Trivy GitHub Action compromise as context for Mendral’s supply-chain agent. Ask Sam to confirm any sponsorship, affiliate, or investment relationships before a campaign.
Mendral
Owned business
Sam Alba says they and Andrea left Dagger in September 2025 to build Mendral from a blank slate.
Read more
The company’s AI-native DevOps platform includes an autonomous agent for CI investigations and maintenance, a supply-chain security agent that reviews dependency changes in pull requests, and Slack, Linear, and custom-automation features. Mendral launched in Y Combinator’s W26 batch.
Mendral customer Anyshift runs Trivy across its delivery pipelines.
Read more
Sam Alba recounts that Anyshift CTO Stephane Jourdan found the team running v0.35.0, the only safe version, after Mendral upgraded Anyshift 11 days before the Aqua Security trivy-action compromise was disclosed.
In Mendral’s June 2026 production case studies, the PostHog engineering team is reported to have merged 104 autonomous fix pull requests in a single month.
Sam Alba cites Aqua Security as the vendor whose trivy-action GitHub Action was compromised, with 75 of 76 version tags force-pushed to malicious commits.
Read more
They use the incident to illustrate the supply-chain problem Mendral’s agent addresses.
Sam Alba's posts document one company being built in public, so read them as a sequence.
Read more
Start with the month-by-month update, which follows the journey from leaving a previous startup through launch, integrations, and early customer results.
Then read the two supply-chain posts together: one explains where dependency risk gets caught; the other walks through the Trivy tag compromise and why a proactive upgrade mattered.
The post on reviewing dependency updates as untrusted code is the clearest statement of the technical position.
For a different register, the early post on enterprise requirement checklists offers product advice.
Erünkut's post walks through the Trivy compromise that Alba also describes, including force-pushed version tags and credential theft inside CI. A second post sets out what long-running agents need to work in production.
Erünkut writes analysis and architecture arguments for founders and technical leaders; Alba shares updates from building the tooling. Erünkut's agent post identifies identity, context, and durability as blockers, while Alba focuses on adding a review step to pull requests before merge.
Jurga also treats the build pipeline as the front line of a supply chain problem, pointing to a mass package compromise and arguing that pipeline tooling and third-party dependencies are part of an organization's own attack surface.
Read more
Jurga writes for boards and executives, framing the issue through blast radius, regulatory exposure, business continuity, and backup recovery. Alba focuses on engineering: catching a poisoned package before merge and automating the maintenance that keeps pipelines trustworthy.
Van de Grift shares Alba's premise that the software supply chain is a leadership-level risk, not a technical hygiene issue.
Read more
Named incidents, including one in the automotive sector, show how one weak link can spread through a supplier network.
Van de Grift's posts center on supplier and third-party risk management, procurement pressure, and regulatory regimes such as NIS2, DORA, and GDPR, with formats like software bills of materials serving as proof demanded of partners. Alba focuses on where the check happens inside a delivery pipeline and what the agent does there.
Sam Alba's LinkedIn profile lists one measured audience figure: 7,025 followers as of October 23, 2026.
Read more
For a DevSecOps platform hiring a founding engineer, that points to a small, founder-led, practitioner-facing audience focused on CI automation, dependency and supply-chain security, and agent-run delivery infrastructure.
It is a workable base for a technical launch or hiring announcement aimed at platform and security engineers, but it does not establish a large or segmented audience.
No impressions, engagement counts, or follower breakdowns are published for any of the five posts.
Treat 7,025 as a figure to test, not a number to budget against.
Before committing to paid distribution, ask for a recent follower breakdown by geography and seniority, or a documented audience survey of Mendral's readers and customers, along with engagement results for the supply-chain and CI posts—the Trivy action compromise post, the Dependabot review post, and the PR supply-chain agent post—as a same-topic comparison rather than a whole-profile average.
Sam Alba’s posts promote Mendral, the AI-native DevOps platform they co-founded, or discuss engineering strategy; they don’t describe sponsored content, brand collaborations, affiliate arrangements, or creator packages.
Read more
Two posts invite interested readers to get in touch: one asks readers curious about how Mendral works to “ping me,” and another offers access to limited accounts to try the product.
Both invitations concern trying or learning about Mendral, not working with Sam as a creator.
The posts publish no partnership format, deliverable, fee, sponsorship policy, or official inquiry route.
Ask Sam for current sponsorship terms and a partnership contact; the posts don’t say whether they accept sponsorships.
Strong fit for a DevSecOps platform hiring a founding engineer with supply-chain security and CI automation depth.
Read more
The posts show hands-on architectural work rather than positioning: keeping the agent harness outside the sandbox to cut token bleed, a tiered model strategy handling 16,000 autonomous CI investigations a month, a ClickHouse-backed SQL interface over a billion log lines a week, and Slack, Linear, and self-configuring automations shipped on a dated timeline from an empty repository in September 2025 to production case studies in June 2026.
On supply-chain security and CI automation, the detail is specific enough to interview against: the supply-chain agent triggers when a pull request touches a dependency manifest, lockfile, Dockerfile, or Actions workflow; it reads source and transitive dependencies, flags typo-squatting, malware, and suspicious lifecycle scripts, and weights anything published in the last 72 hours as the active attack window.
Alba also describes flagged packages published to npm five minutes before a pull request commit, an agent that opens upgrade pull requests by reading changelogs and adapting call sites, and a customer that avoided credential rotation in the Trivy-action compromise because an earlier proactive upgrade left them on v0.35.0 while 75 of 76 tags were poisoned.
The product-judgment post — take direction from where users spend effort, not procurement checklists — gives a concrete view of how they prioritise platform work.
Ask for repositories or documentation to verify the technical claims; none are linked in the posts, and no third-party coverage appears.
Follower count is irrelevant to this hiring need.
When to choose a specialist
Poor fit for a cybersecurity vendor buying a paid sponsored-content package with a fixed rate card, a deliverable list, and reach guarantees against a segmented enterprise security audience.
Read more
No sponsorship, brand-collaboration, or creator-package format appears in the posts.
The only two invitations to get in touch both point at Mendral itself — one asks readers curious about the product to ping, the other offers limited accounts to try it — not at terms for working with Alba as a creator.
A buyer also has nothing to plan reach against: the single measured audience figure is 7,025 LinkedIn followers, with no breakdown by geography, seniority, employer, or occupation, and no impressions or engagement counts for any of the five posts.
The same weakness applies to any campaign needing broad non-technical reach or a consumer audience, since the posts are written for platform and security engineers.
Ask directly about current partnership terms and defined deliverables before budgeting.
A worked campaign example
Worked angle for the hiring brief: an employer-brand campaign built on the incident story rather than a generic "join our team" pitch.
Hook: the Trivy-action compromise — an attacker force-pushed malicious commits to 75 of 76 version tags, and one customer stayed safe only because a proactive upgrade eleven days earlier moved them from v0.30.0 to v0.35.0, the one clean version.
The angle is that maintenance work nobody notices is the thing that prevents credential rotation, which is the kind of problem a founding engineer would own.
Asset one: a 30-minute recorded technical session where Sam Alba walks through the agent's decision path on a dependency pull request — trigger conditions, sandbox execution, post-install and behavioural-drift checks, and why the 72-hour publication window gets extra weight.
Asset two: a written engineering post pairing that session with the npm package published five minutes before a commit, showing where a conventional scanner would have passed it.
Asset three: a short interview clip on the product-judgment position that the workaround is the roadmap, used to signal how the team decides what to build.
Distribution is Alba's LinkedIn audience plus the platform's own engineering channels; 7,025 followers means this travels by relevance, not volume, so budget for targeted outbound rather than expecting reach.
Success test: count qualified engineer applications that cite the session or the incident post as their reason for applying, and compare against the platform's previous three months of recruiting content.
Repair if the assets attract security researchers without delivery-engineering depth.
For the same supply-chain security campaign, choose Selim Erünkut when the buyer needs a forensic walkthrough of a real attack or an architecture-level argument, not a product build story.
Read more
The March 2026 post reconstructs the Trivy compromise step by step: a stolen personal access token three weeks before disclosure, the aqua-bot takeover, a malicious v0.69.4 tag pushed through the official release pipeline to GitHub Releases, Docker Hub, GHCR and Amazon ECR, 75 of 76 version tags force-pushed in trivy-action, malware reading runner memory from /proc and harvesting SSH keys, cloud credentials and Kubernetes tokens to a typosquatted domain, a persistent systemd backdoor polling a blockchain canister, and then CanisterWorm hitting 47-plus npm packages with 28 hijacked in under 60 seconds.
It closes with defences a security audience can act on: pin commits, verify signatures, monitor CI runners as production workloads, and rehearse full credential invalidation because partial cleanup creates the next incident.
The May 2026 post argues that agent failures are identity, context and governance problems rather than model quality problems, and lays out four architectural bets around first-class agent identities, platform-level integration, durability beyond a session, and buying platforms instead of rebuilding plumbing.
Briefs needing incident analysis or a platform-architecture perspective fit this voice more directly than Sam Alba's first-person build updates.
The tradeoff is distance from first-party experience.
Selim Erünkut's posts reconstruct public incidents and architecture arguments; they do not report numbers from systems they run.
A buyer who wants demonstrable hands-on delivery evidence is trading Sam Alba's concrete operating detail — 16,000 autonomous CI investigations a month, a billion log lines a week, a customer that stayed on the one safe Trivy tag — for a wider view of the attack landscape.
The format is denser and more list-driven, with heavy hashtag stacks and a closing audience question, so a brand wanting a single tight claim gets more words per idea than in Sam Alba's incident stories.
For the same supply-chain security campaign, choose Bartosz Jurga when the audience is the board and the message is risk, resilience and regulatory exposure rather than implementation.
Read more
The September 2026 post frames the keyv compromise and the ChainDrop campaign in executive terms — blast radius across CI/CD runners that hold deployment secrets and production access, compliance exposure under NIS2 and ISO 27001, and business continuity — and links to an executive brief.
The August 2026 post takes the ransom-payment decision to leadership: low restoration rates when victims pay, repeat attacks against organisations that pay, legal and regulatory sanctions, and the argument that immutable, air-gapped and tested backups make ransom demands obsolete, plus the shared-responsibility gap where cloud providers guarantee platform uptime but not the buyer's own data recovery.
For a CISO- or board-facing resilience programme, this framing does work Sam Alba's engineering posts do not attempt.
The tradeoff is hands-on specificity and vendor framing.
These posts carry the #GitProtectExpert tag and point readers to gated executive briefs, so they read as vendor content and route the audience to a download rather than showing technical mechanics.
They offer no equivalent of Sam Alba's pull-request trigger conditions, 72-hour publication window, or sandbox execution detail.
A buyer who needs the argument to withstand a security engineer's scrutiny, or wants practitioners rather than executives to trust it, is trading technical credibility for board-level language.
For the same supply-chain security campaign, choose Toby Van de Grift when the campaign is about third-party and supplier risk governance — the accountability question rather than the tooling question.
Read more
The October 2025 posts use JLR, M&S and the Co-op to argue that supplier breaches are a resilience problem, not a procurement checklist: GDPR keeps the controller responsible even when a breach starts at a processor, NIS2 requires third-party assurance to be demonstrable and continuous, and DORA requires ICT third-party risk to be monitored, tested and reported.
One post asks boards whether supply chain risk still sits in procurement or has become a resilience function; the other insists partners prove their security through SAFE reports, SBOMs and CBOMs on the principle that you inherit every weakness a supplier fails to mitigate.
The hashtag set (#TPRM, #GRC, #NIS2, #DORA) and the ReversingLabs mention place this squarely in the governance and third-party-risk conversation, where many enterprise buying decisions actually get made.
The tradeoff is a further step away from the build.
These are governance and regulatory arguments aimed at boards; they do not show how a pipeline, agent or dependency workflow operates.
A campaign that needs to demonstrate technical depth or product credibility would pair an executive-audience message with content focused mostly on regulatory framing.
Two posts from October 2025 offer a thin published record for judging a whole body of work.
Ask for terms before working with any of the three alternatives.
