Giacomo Balli profile picture
Giacomo Balli
Your Consigliere

For owners and founders facing decisions that are expensive to get wrong.
Independent counsel from someone paid only by you.

What’s on Your Mind? LinkedIn

Blog

Writing on technology decisions, AI and buying software: 634 posts since 2012.

26 posts in Security

2026

267 posts
  1. Who is liable when a business's AI agent causes harm?When your AI agent causes harm, your business is usually the one exposed. What the OpenAI and Hugging Face breach shows, what vendor terms say, and five controls to set first.

    7 min readBuying Software

  2. AI-built product security worries usually land on the wrong layerWhen an owner worries about the security of an AI-built product, the worry usually lands on the wrong layer.

    1 min readAI

  3. You cannot model a software build on the vendor's estimateA fractional CFO asked me how to model a software build in the plan when the only number available is the vendor's estimate.

    1 min readBuying Software

  4. Technology due diligence should not happen after you have decided what you wantTechnology due diligence should not happen after you have decided what you want to do. By then it is not diligence.

    2 min readProduct

  5. If a CEO sent me a $500k software proposal tomorrow, this is what I would reviewIf a CEO sent me a $500k software proposal tomorrow, this is what I would review, in order. The problem statement, before the solution.

    2 min readBuying Software

  6. What to know before signing a three-year SaaS contractA three-year SaaS contract is on the desk with a discount for committing. Before signing, this is what I would want to know.

    2 min readBuying Software

  7. Every CEO eventually sits in the sunk-cost meetingEvery CEO eventually sits in the sunk-cost meeting. It opens with a sentence that sounds like an argument and is not one: "We've already spent $300k." That...

    2 min readSecurity

  8. Three proposals for the same project: $80k, $240k and $600kThree proposals for the same project: $80k, $240k and $600k. They are for the same project the way three quotes to "fix the roof" are for the same roof.

    2 min readBuying Software

  9. The expertise that built an institution can quietly become the reason it stopsThe expertise that built an institution can quietly become the reason it stops learning. Past success gives leaders judgment and pattern recognition, but it...

    1 min readAI

  10. A custom domain can hide the builder from your customersA custom domain can hide the builder from your customers.It cannot hide it from the internet.

    1 min readEngineering

  11. Nobody hacked Hugging FaceNobody hacked Hugging Face. At Black Hat this month, OpenAI presented what happened when they turned unconstrained agents loose on a cybersecurity evaluation.

    1 min readAI

  12. Rules are often an admission that incentives were never designedRules are often an admission that incentives were never designed. A team makes documentation mandatory. Compliance goes up for a month.

    1 min readProduct

  13. When intelligence becomes abundant, customers pay for outcomesIf, as predicted, intelligence becomes abundant, customers stop paying for:reportsdashboardsqueriesworkflow clicks ...they will start paying for:guaranteed...

    1 min readEngineering

  14. AI is unbundling professional services by deleting the middle of the workAI is unbundling professional services by deleting the middle of the work. The “judgment sandwich” is becoming obvious.

    1 min readAI

  15. “10x engineering” is a comforting story because it gives you a single lever“10x engineering” is a comforting story because it gives you a single lever: ship more code.

    2 min readAI

  16. The most effective way to disrupt an incumbent is to remove the problemThe most effective way to disrupt an incumbent is to remove the problem it was created to solve. OpenAI Sites feels like another step in that direction.

    1 min readAI

  17. Domain expertise has always been the real moat because it is the only advantageDomain expertise has always been the real moat because it is the only advantage you cannot buy on a roadmap.

    1 min readAI

  18. I’ll be honest: it makes me sadI’ll be honest: it makes me sad.Ferrari just unveiled its first-ever electric car: the Luce.

    1 min readProduct

  19. Freezing junior engineering hiring is not a cost moveFreezing junior engineering hiring is not a cost move, it is an organizational risk decision disguised as efficiency.

    1 min readAI

  20. One careless download can cascade across companiesOne careless download can cascade across companies. In February 2026, an employee at Context.ai installed a Roblox cheat.Hidden inside: Lumma Stealer malware.

    1 min readAI

  21. Speed is no longer a differentiator once the customer has to finish the jobSpeed is no longer a differentiator once the customer has to finish the job. What I see inside companies is a familiar sequencing mistake: teams treat an...

    1 min readProduct

  22. The BNP Paribas Indian Wells tennis tournament is my favorite and I attendThe BNP Paribas Indian Wells tennis tournament is my favorite and I attend every year. High-percentage tennis is what coaches teach when they want you to...

    2 min readProduct

  23. Apple will finally have their own niche hyper-performant secure modelsMost companies think the AI race is about building the biggest model. In practice it is about who controls the smallest ones.

    1 min readAI

  24. Apple’s “Apple Business” launch is not a productivity-suite storyApple’s “Apple Business” launch is not a productivity-suite story. It’s a control-plane story.

    1 min readMobile

  25. Most AI risk conversations are framed like this:Most AI risk conversations are framed like this: “There is the value, and then there are the harms.” That framing is comforting.

    2 min readAI

  26. Racing used to punish mediocrityRacing used to punish mediocrity. With a combustion engine, the car was a system you had to actively manage:gear selection, power band, traction, cooling...

    2 min readAI