Home / Insights
InsightsNotes for a team deciding what to buy.
Three notes from public counts and from a CISO survey published the day before. Each one ends on a purchase: a patch on a host you run, a booked test of that host, or a booked test of an agent you operate.
- What should you do when CVE volume jumps? The CVE Program had published 72,812 records in 2026 through Q3, more than all of 2025. How to turn that into a patch list, and when a one-host test is the buy.
- Should you buy an AI pentest or book another test? In a16z’s survey, 42% of CISOs plan to buy offensive security, and production use is still the minority. Which shape fits which team.
- How do you test an internal AI agent before you widen its access? Internal AI agent security is three purchases. An authorized test covers one of them: the agent your company operates.
Who is writing
Keith Vaughan is the founder of Cipher Projects, the company behind Observ. He is a cloud engineer and AI security consultant with 18 years in IT. Observ sells two authorized tests: one host for $3,995, and one AI agent for $5,995. A person reviews every finding. Each fee includes a report, an attestation letter, a debrief, and one retest inside 90 days.