Career update: I’ve joined @OpenAI to lead Cyber as Head of Product for Cyber, where I’ll be leading OpenAI’s efforts to bring frontier AI capabilities to cyber defenders and help make software safer and more resilient by design. I’ll be teaming up with @clintgibler, an expert engineering and security research leader, who is announcing he is joining today as well.

What is now possible with frontier AI models represents a genuine step change for defenders. I’m particularly excited about the potential to improve how we:

• Analyze code and discover vulnerabilities. Models can reason across large and unfamiliar codebases, identify subtle weaknesses, focus attention on realistic attack paths, and help teams move faster from discovery to validated remediation.

• Investigate incidents and determine root causes. Security teams spend enormous time connecting fragmented signals across code, infrastructure, identities, endpoints, and applications. AI can help bring those events together, form and test hypotheses, and surface root causes faster.

• Orchestrate security work. The opportunity is not only to generate recommendations, but to help defenders safely execute work: validating findings, testing patches, improving detections, gathering evidence, and coordinating remediation.

• Make enterprise AI agents safe and controllable. As agents take on more meaningful work inside organizations, they need secure harnesses: scoped access, isolation, monitoring, verification, auditability, and clear human control. Security must be built into how agents operate from the beginning.

Our work at OpenAI starts from a simple but ambitious premise: the next generation of cyber defense should be integrated into how software is built, not only finding and patching vulnerabilities, but making systems resilient from the start.

With current model capabilities such as GPT-5.5-Cyber, alongside Codex as an agentic harness, we can give defenders more powerful tools while pairing those capabilities with appropriate verification, safeguards, accountability, and control.

Just as importantly, we need to distribute these defensive advantages broadly. Powerful security capabilities should not be limited to the largest organizations with the biggest teams. They should help developers, security practitioners, public institutions, and businesses of every size build and operate more secure systems.

And no single company can accomplish this alone. Security has always been a community effort. I’m looking forward to working closely with leaders and innovators across the cybersecurity ecosystem: vendors, researchers, practitioners, governments, and technology partners. AI will create new security challenges, but it also gives us a remarkable opportunity to strengthen the defensive ecosystem.

I’m grateful to the OpenAI team for the opportunity and excited to get started on a mission that matters deeply to me.