Key takeaways from Material's panel discussion with security leaders from Fleet AI, Surge AI and Lumbra.
It’s become a cliche to say that AI has thrown the old rulebooks out the window. Security practitioners feel this to their core, which is why Material hosted a panel discussion titled “Security During Hypergrowth” that cut through the obvious and dug into the actionable.
For most of the tech industry's history, security grew roughly in proportion to the company. There was time to write playbooks, hire ahead of need, and plan a year out. None of those assumptions are true today. A company can dramatically multiply in size in months while its security headcount stays static, all while the environment around it changes faster than any roadmap.
Material's co-founder and CEO Abhishek Agrawal moderated a conversation with defenders who have lived both worlds: steady-growth companies and AI-era rockets.
- Dylan Healy runs security at Fleet AI, a company building reinforcement-learning environments for frontier labs. Before that he spent about seven years at Roblox, where he was the first dedicated security hire and helped grow the team to around 150.
- Frank Wang leads security at Surge AI, which improves AI models through human-labeled data. Frank was previously the first security hire at Headway and he writes the security blog Frankly Speaking.
- Zach Morris is the sole security practitioner at Lumbra, a fast-growing AI startup, and spent years consulting for companies on the verge of scaling.
Here's the key advice they shared about doing the job when the company is outrunning you.
1. Start with visibility, then consolidate
When you're the first security hire at a company that already has 100 people, you inherit an environment shaped by speed. The first months are about learning what already exists, which means asking agents a lot of questions about the business.
Anyone who has joined a fast-moving startup can anticipate the redundancy that will be uncovered: two Claude team accounts, three ChatGPT team accounts, and a host of other apps with so much feature overlap. The first job is consolidating everything into one place, so security gets the visibility to act and orchestrate where logs need to flow.
From there, security can close gaps that enable the business to pass SOC 2 quickly like identity and access management that wasn't fully worked out, or basic antivirus instead of a fully deployed EDR. The danger of these patchwork solutions is that they may check the box while missing what the compliance standard is actually meant to achieve, plus they don't scale.
The takeaway: your first 90 days should produce an inventory, a consolidated tool footprint, and a clear map of where your logs go. You should expect to revisit earlier decisions. Dylan noted that even at Roblox he was rewriting decisions made years before. They weren't wrong at the time, but the environment changed around them. AI agents simply weren't a security problem seven years ago.
2. Front-load the foundations and buy for the company you're about to be
One aspect of security investment was non-negotiable for the panel: if you know hypergrowth is coming, front-load everything you can. Pick best-of-breed tools up front, even if you feel like you're overpaying for capacity. Get on enterprise plans. Automate from day one.
A comprehensive EDR rollout or a large-scale email security platform may feel oversized at 100 people and cost a bit more. But if you hit the next milestone within months, you'll grow into it, and you won't be ripping out a stopgap at the worst possible time.
Strong foundations also buy you bandwidth so you can spend time on genuinely new problems. You can only move to building an observability layer for AI tools if the basics are in place and compliance requirements are met. If they aren’t, you’ll stay stressed about building the essentials.
The takeaway: in hypergrowth, the cost of buying early is small and the cost of re-platforming later is large. Treat foundational controls as the thing that frees you to handle the unknown.
3. Let agents do the work you would have hired for
At Roblox, Dylan had a team of eight people dedicated to observability and detections. He doesn't have that now, so agents fill the gap. He still relies on familiar building blocks like ClickHouse and S3, but agents handle much of the infrastructure maintenance he would once have hired people for. Logging was already in place across most of production, so he scaled it up and structured it so agents can reason over it easily.
Another example was dependency upgrades. At one company, security forwarded around a hundred Snyk alerts to an engineering team, which then spent about three weeks clicking through upgrades and documentation. Later, two security teammates spent two days a week doing upgrades themselves to spare engineering. Today that work gets handed to Codex.
The takeaway: for every recurring task that once justified a hire, ask whether an agent with the right context can do it first. Spend your human hours on judgment and context, not on burning down queues.
4. Trade the annual roadmap for decisive, reversible bets
One response to "what conventional wisdom no longer holds" was the year-long security strategy. A traditional roadmap assumes incremental change over time, but that’s not how things work today. A new model ships, it can break out of a sandbox, and suddenly your plan is out of date.
What about security leaders who want to be proactive, not wake up every Monday wondering what's on fire? The panel offered a few answers on how to reconcile that with constant change:
- Be decisive. You'll sometimes choose wrong. Own it, stay flexible, and correct course when you learn more. Abhishek compared it to a maze: pick a direction, move fast, and turn when you hit a wall. The only real failure is inaction.
- Prefer reversible decisions. The rule of thumb is to avoid choices that become deeply ingrained. That's part of why lean teams make sense: hiring is one of the hardest decisions to reverse.
- Accept some reactivity. The industry needs to get comfortable being partly reactive, while still doing proactive basics like limiting access and avoiding long-lived keys.
The takeaway: plan in shorter horizons, make choices you can undo, and keep your foundations strong enough that reacting to something new doesn't mean neglecting something old.
5. Rely on technical controls, not human vigilance
Asked which practices are headed for obsolescence, the panel pointed to phishing simulations and the click-rate metrics behind them. In their view, they haven't mattered much for a decade and matter even less now. The company’s agents read email more than employees do.
Users will be tired, distracted, or opening email right after a flight, and someone will eventually click. When a phishing email leads to a compromised identity, that's a failure of technical controls, not of the user. Plus, the target keeps shifting; malicious calendar invites, for example, are a newer phishing vector.
The panel also flagged two other habits that are fading:
- Clicking through consoles to remediate. Over the past year, manually configuring and fixing things in a GUI has largely given way to reviewing and approving what agents propose.
- Loyalty to specific tools. Tools are a means to an end. Job descriptions that list experience with specific vendors miss the point. The questions that matter now are whether a tool has a good API and whether it connects to your agents. One Material customer said onboarding was easier through an MCP server, because they didn't have to learn a UI; they just talked to their AI assistant.
The takeaway: build controls that hold up when people make mistakes, and evaluate tools on how well agents can drive them.
The bottom line
No one on the panel claimed hypergrowth security is easy, or that AI has solved it. There were honest trade-offs. Some wished for the slower pace of 2019 with the team size of today. Some described the work as managing agents rather than doing the work directly. And a show of hands confirmed that most people in the room still require human code review, whatever LinkedIn says about fully automated software factories. One attendee who is building such a factory put it simply: solve one bottleneck and the next one appears, so humans stay in the loop.
The fundamentals of security haven't changed. What's changed is that you can no longer scale them with headcount. The teams that thrive will be the ones that scale them with foundations, automation, and good judgment.
Material Security protects the email, files, and accounts in your cloud workspace with automated, scalable controls built for lean teams. If your company is growing faster than your security team, get in touch.
