A security firm scanned a million AI services on the open internet this week. The headline was that most of them shipped with no authentication. It’s a clean stat. It traveled.
\nBut the headline missed the part that actually matters.
\nAuth-off-by-default is bad, but it’s not new. We saw it with MongoDB, Elasticsearch, every database tool that shipped open and got burned a few years later. The industry knows this\npattern. The fix is boring: make auth required, not optional. Run the playbook.
\nThe deeper problem is something most founders shipping AI haven’t thought through yet.
\nConnect an AI to your CRM, your email, your files, your database, and the agent inherits everything those tools can do. It calls them on your behalf. It uses your credentials.
\nThere’s no permission layer between the AI and the tool.
\nIn normal software, there are layers between a user and an action. Authentication, authorization, role-based access, input validation. We didn’t build all that for fun. Every layer\nis there because we learned the hard way that user input can’t be trusted.
\nAI agents skip most of it. The agent isn’t a user. It’s a process running with the full permissions of every tool you connected. And the input driving it is natural language, which\nis the most untrusted input we’ve ever built systems to accept.
\nSo when someone tricks the AI, through prompt injection, a poisoned document, an email it summarizes, a support ticket it reads, they’re not manipulating the AI. They’re operating\nyour tools with your credentials. The model is just the steering wheel.
\nThe blast radius is every tool the agent can call.
\nThis is what the research is really showing. Agent platforms exposing their business logic. Inference servers wrapping paid frontier models. Workflow tools with credentials in\nplaintext. None of it is a one-off mistake. It’s what happens when teams treat AI agents like a normal SaaS feature.
\nThey’re not a normal SaaS feature. They’re closer to giving a stranger root access to half your company and hoping they behave.
\nThe thing I keep saying:
\nYour model is not a security boundary.
\nThe model parses intent and calls tools. That’s the job. It’s not checking what’s safe. It’s not enforcing your business rules. It’s not validating that the person asking to “send\ninvoices to procurement” is the same person whose email it’s signed into.
\nThe boundary has to live somewhere else. In the infrastructure between the model and the tools. Permission layers. Tool allowlists that validate parameters. Sandboxed execution for\nanything touching code or files. Audit logs the agent can’t quietly rewrite.
\nMost teams have none of that. They have a model, a list of tools, and a vibe.
\nThe vibe is “we’ll add guardrails later.”
\nThis week’s research is what later looks like.
\nOne question for anyone shipping AI right now:
\nWhat can your agent actually do if someone tricks it?
\nNot what it’s supposed to do. What it can do.
\nIf you can’t answer that in thirty seconds, naming the tools, the parameters, the data sources, the side effects, you don’t have a security model. You have a hope.
\nI’d rather you have a model.
\nLast post, “AI Agents Aren’t Coming. They’re Already Taking Market Share,” was about what’s happening to the\nmarket. This one is about the gap underneath it.
\n" }, { "id": "https://dev.charles.green/issues/2026-03-29-ai-agents-competitive-weapon-not-future-tech", "url": "https://dev.charles.green/issues/2026-03-29-ai-agents-competitive-weapon-not-future-tech", "title": "AI Agents Aren't Coming. They're Already Taking Market Share", "date_published": "2026-03-29T00:00:00.000Z", "summary": "What changed in the stack, what it costs now, and what the gap looks like from the other side of it.", "content_html": "The best AI investment you'll make this year isn't a ChatGPT Pro subscription.
\nIt's the custom AI agent that qualifies your leads at 2 AM, deflects 70% of your support tickets, or automates the workflow eating 15 hours of your ops team's week. The agent that works in your stack, speaks in your voice, and ships in 4 weeks, not 6 months.
\nIf you're running a SaaS at $1M-$10M ARR, you're at an inflection point. The companies deploying AI agents in Q2 2026 will own their categories by 2027. The ones waiting for "the\ntech to mature" will be scrambling to catch up while their competitors compound advantages they can't close.
\nHere's why. And what to do about it.
\nFour things aligned in 2025-2026 that make AI agents a business necessity, not a science project:
\nAPI maturity. Every tool in your stack (HubSpot, Intercom, Zendesk, Slack) now has robust APIs. Pre-2023, integrations were brittle and expensive. Now they're commoditized.
\nLLM reliability crossed the threshold. Claude 3.5 and GPT-4 error rates dropped from 15-20% in 2023 to sub-5% in 2026 for structured tasks. That's the difference between\n"interesting experiment" and "bet the business on it."
\nEconomics flipped. LLM costs dropped 90% since 2023. A lead qualification conversation that cost $2 in 2023 now costs $0.15. That changes the unit economics completely.
\nCustomer expectations shifted. B2B buyers now expect instant response. The company that replies in 5 minutes wins the deal over the one that takes 5 hours. Humans working 9-5\ncan't compete with 24/7 availability.
\nThe infrastructure, economics, and market conditions aligned. This is the window.
\nHere's what's playing out right now across the mid-market SaaS landscape:
\nPath A: Early Movers (2026-2027)
\nDeploy AI agents for lead qualification, support deflection, and ops automation. Achieve 2-3x improvement in response time and 40-60% cost reduction in operations. Use the savings\nto hire 1-2 more product engineers or sales reps. Compound the advantage: better product, faster sales cycle.
\nPath B: Late Adopters (2028+)
\nWatch competitors respond to leads instantly while you take 4-6 hours. Lose 20-30% of inbound deals to faster competitors. Watch support costs stay flat while theirs get cut in\nhalf. Hire more ops people to keep up, widening the efficiency gap.
\nThe moat is time. You get a 12-18 month window to build advantages that compound into better unit economics, faster growth, and market share gains before everyone else catches up.
\nLet's cut through the hype and look at actual ROI from deploying custom agents.
\nA typical custom build runs $10K-$20K depending on complexity and delivers 1-3 agents in a few weeks. Here's what that looks like for a $3M ARR SaaS:
\nLead qualification agent.
\nYou're getting 100 inbound leads per month. Right now you convert 10% to meetings (4-6 hour response time, manual qualification). That's 10 meetings, 2.5 closed deals at $3K ACV = $7,500 MRR.
\nDeploy an agent that responds in 90 seconds and pre-qualifies based on your ICP. Conversion jumps to 16%. That's 16 meetings, 4 closed deals = $12,000 MRR.
\nThe delta: 2.4 extra deals per month × $3K × 12 months = $86,400 incremental ARR in year one.
\nCustomer support agent.
\nYou're handling 200 support tickets per week. That's 10,400 tickets per year at 20 minutes each. You need 2.6 full-time support reps at $50K each = $130K/year.
\nDeploy an agent trained on your docs and past tickets. It handles 70% of Tier 1 tickets automatically. Your team handles the remaining 3,120 tickets = 0.78 FTEs.
\nThe delta: $130K - $39K (one FTE) = $91K saved in year one.
\nMore importantly, as you scale from $5M to $10M ARR, support costs don't double. Without the agent, you'd need 5+ FTEs ($250K/year). With it, you need 2 FTEs ($100K/year). That's a 3% margin improvement on your entire ARR.
\nOperations automation agent.
\nYour ops team spends 15 hours per week on manual workflows: customer onboarding sequences, data entry, internal requests. That's 780 hours per year at $35/hour = $27,300 in direct cost.
\nDeploy an agent that automates 85% of these workflows. Your team gets 15 hours per week back to focus on strategic work: customer success outreach, upsell conversations, product feedback collection.
\nThe delta: $27,300 direct savings + conservative estimate of 10 upsells at $500 ARR = $32,300 total value created.
\nThe combined picture.
\nA single build that addresses your two highest-impact bottlenecks creates $150K+ in year one value. Factor in $12K/year for ongoing optimization, and you're looking at:
\nYear one: $150K value on $27K investment = 5.5x ROI.\nYear two: $200K value (as agents scale with the business) on $12K investment = 16x ROI.
\nThat's $350K created on a $39K investment over two years. 9x ROI.
\nIf you're VC-funded, you throw 3 more SDRs at the lead problem ($240K/year). You absorb 6-month payback periods because you're optimizing for growth velocity at all costs.
\nIf you're bootstrap, you deploy for $15K and reinvest the savings into product. You need sub-6-month payback periods because you're optimizing for capital efficiency and margins.
\nAI agents are a 10-20x force multiplier for bootstrap companies in a way they're not for VC-funded competitors. You get the same operational leverage without the dilution, the board approvals, or the 6-month vendor evaluation cycles. You decide in one meeting and ship in 4 weeks.
\nEvery dollar you save on ops headcount is a dollar you keep as equity. Every margin point you gain compounds into more runway, more reinvestment, or more founder salary.
\nAnd when you exit, buyers pay more for businesses with AI-automated operations and low marginal costs. That's the difference between a 5x ARR multiple and a 6.5x multiple. On a $5M\nARR business, that's $7.5M in additional exit value.
\nThe companies that move now will have compounded their advantages by the time their competitors wake up. The ones that wait will spend 2028 playing catch-up against competitors with superior unit economics, faster growth rates, and battle-tested AI systems they can't replicate.
\n" }, { "id": "https://dev.charles.green/issues/2025-08-04-four-months-5-interviews-why-i-became-a-saas-founder", "url": "https://dev.charles.green/issues/2025-08-04-four-months-5-interviews-why-i-became-a-saas-founder", "title": "Four Months Building: Why a Serial Entrepreneur Is Betting on Profitable SaaS", "date_published": "2025-08-04T00:00:00.000Z", "summary": "The search that did not land, and the arithmetic that made building the better option.", "content_html": "It's been four months since my last post. That wasn't planned.
\nWhen I announced Brevleads in April, I thought I'd keep writing about the journey. Document the ups and downs. Share the lessons. But something unexpected happened: I got completely absorbed in building the right thing.
\nBetween April and today, I've been methodically validating and building.
\nI've conducted 5 deep customer interviews so far - each one a 60-90 minute deep dive into the LinkedIn-to-CRM problem I'm solving. And I'm actively using the newsletter and community to conduct more research and gather feedback as I build.
\nEach conversation has taught me something crucial about what sales teams actually need, not what I think they need. And each one has reinforced why I'm pivoting my entrepreneurial focus specifically to profitable SaaS after 11 companies of experience.
\nEven with just 5 interviews, clear patterns are emerging that I can't ignore.
\nThe problem is bigger than I thought. What started as "I need Hublead.io for Brevo" became something much more significant. Sales teams are drowning in manual processes. They're copying and pasting between systems. Losing leads in spreadsheets. Spending hours on administrative work instead of selling.
\nThe solution is more nuanced than I expected. It's not just about syncing data. It's about workflow automation, lead scoring, and sales intelligence. It's about giving sales teams their time back so they can focus on what they do best: building relationships and closing deals.
\nThe market is ready. Even from these early conversations, I'm hearing genuine interest and willingness to pay. People are asking "when can I get this?" rather than just being polite about the concept.
\nAfter founding 11 companies across the US, Thailand, and Japan over the past 25 years, I've learned what works and what doesn't:
\nEach company taught me something crucial. Early ventures taught me to move fast. Security work taught me to think in systems. Recent failures taught me to validate before building. Growth engineering taught me to think in experiments.
\nNow I'm applying all those lessons to profitable SaaS—the model I should have focused on years ago.
\nI stopped writing because I was learning so fast that documenting it felt premature. Each customer interview shifted my understanding. Every conversation added nuance to the problem.
\nI didn't want to share half-formed thoughts or pivot publicly every few weeks. I wanted to get it right first.
\nBut I've realized that was the wrong approach. The uncertainty is part of the story. The evolution is part of the value. Building in public isn't about having all the answers—it's about sharing the journey of finding them.
\nCustomer interviews are everything. After multiple company failures, I know the cost of building on assumptions. These 5 deep conversations have already taught me more than months of my own opinions. My goal is to reach 25-50 interviews—a discipline I wish I'd had in my earlier ventures.
\nValidate before you build, but build to validate. My previous companies often failed because I either over-engineered before validation or under-built after it. I'm building lean prototypes alongside customer research—each iteration guided by real user feedback, not founder fantasies.
\nSaaS changes everything about technical debt. In my consulting businesses, technical shortcuts were manageable. In my previous product attempts, they killed momentum. With SaaS, every shortcut compounds exponentially. After 11 companies, I know the difference between smart constraints and destructive corners.
\nProfitability over scale. My anti-VC philosophy comes from watching founders lose control of their companies. I've seen what happens when growth becomes more important than sustainability. With Brevleads, I'm building for profit first, knowing that sustainable growth follows profitable unit economics.
\nWe're launching the Brevleads beta in 1-2 weeks.
\nIt's not the product I originally envisioned. It's already more focused and valuable thanks to early customer feedback. As I continue gathering insights through the newsletter and community, the product will keep evolving based on real user needs.
\nThe beta will be small—maybe 20-30 power users who've been involved in the development process. We'll iterate quickly, fix issues fast, and build features based on real usage patterns, not assumptions.
\nI'm committing to sharing more, not less.
\nThe next few months will be a masterclass in applying 25 years of entrepreneurial lessons to profitable SaaS. Deepening customer research through the newsletter community. Validating product-market fit with real users. Building from beta to launch with the discipline that comes from multiple failures and the wisdom that comes from hard experience.
\nI'll document it all. The wins, the mistakes, the pivots, and the breakthroughs.
\nThis is just the beginning.
\nIf you're building in B2B SaaS or interested in the LinkedIn outbound space, I'd love to connect. Drop me a message or comment below. And if you're using Brevo for your CRM and LinkedIn for outbound sales, join the Brevleads waitlist to get early access to the beta.
\nThe best products are built in conversation with users, not in isolation. Let's build something great together.
\n" }, { "id": "https://dev.charles.green/issues/2025-04-12-from-security-to-growth-engineer", "url": "https://dev.charles.green/issues/2025-04-12-from-security-to-growth-engineer", "title": "From Security to Growth Engineering", "date_published": "2025-04-12T00:00:00.000Z", "content_html": "After 10+ years building secure, scalable systems for fintech and SaaS companies, I realized something: the most valuable work isn’t just keeping systems running. It's accelerating how quickly you learn what works and what doesn’t. That realization is what drew me to Growth Engineering.
\nIt’s the intersection of product, data, automation, and creativity. Small experiments can unlock outsized results.
\n✅ Building landing pages and onboarding flows with HubSpot, Framer, and Lovable\n✅ Prototyping and testing ideas in Figma\n✅ Tracking funnel friction and user behavior with PostHog and Firebase A/B Testing\n✅ Running lifecycle email experiments in HubSpot (also familiar with Brevo, ActiveCampaign, and Mailchimp)\n✅ Exploring SEO and demand capture using Ahrefs and Google Keyword Planner\n✅ Studying PLG strategies via ProductLed (PLG Fundamentals completed, PLG Certified in progress)
\nThis is part of my ongoing shift from security and infrastructure to growth and experimentation.
\nI’m sharing this publicly to stay accountable, iterate in the open, and connect with others on a similar path.
\nIf you’re working in Growth, Product, or PLG, let’s swap notes.\nDrop me a message, comment, or link to your own journey.
\n" }, { "id": "https://dev.charles.green/issues/2025-03-17-building-lean-security-in-public", "url": "https://dev.charles.green/issues/2025-03-17-building-lean-security-in-public", "title": "Building Lean Security in Public", "date_published": "2025-03-17T00:00:00.000Z", "summary": "A Behind-the-Scenes Look at Growing a Modern Consultancy", "content_html": "In my last newsletter, I shared that SimplyCubed has been rebranded as Lean Security. While our core work remains the same, it is now structured and delivered in a way that provides more value to clients.
\nCompared to SimplyCubed, Lean Security is highly differentiated, with a clear intellectual property (IP) framework and a growing ecosystem of products that support clients at various stages of their security journey.
\nFor security teams and leaders who are problem-aware (i.e., they recognize that traditional security is bloated, expensive, and slow) but are still searching for a solution, we offer the Lean Security book, videos, and guides.
\nThese resources explain why traditional security approaches are outdated and how Lean Security provides a more effective, modern alternative.
\nAs clients engage with our content and see the value in Lean Security, they can take the next step with the Lean Security Accelerator. The Accelerator offers hands-on guidance through daily and weekly calls, helping clients implement best practices, automate processes, and eliminate guesswork with proven standard operating procedures (SOPs).
\nFor organizations needing dedicated, hands-on support, we offer Lean Security Implementers. These are Lean Security specialists who work directly with clients to accelerate implementation, further reducing the time and effort required for transformation.
\nLean Security isn’t just a service, it’s a movement. By sharing our process, insights, and lessons learned, we’re not only helping businesses adopt a leaner approach to security but also refining our own methodologies through real-world feedback.
\nThis open approach aligns with our core values: transparency, efficiency, and sustainability. As we continue to build, we’ll be sharing more about what works, what doesn’t, and how businesses can take control of their security without unnecessary complexity.
\nFor more specifics on Lean Security, check out our LinkedIn Newsletter.
\nI’d love to hear your thoughts. What security challenges are you facing in your organization? Let’s start the conversation.
\n" }, { "id": "https://dev.charles.green/issues/2025-03-03-lean-security", "url": "https://dev.charles.green/issues/2025-03-03-lean-security", "title": "Lean Security", "date_published": "2025-03-03T00:00:00.000Z", "summary": "A New Chapter & a Free Sneak Peek", "content_html": "Hey there, it’s been a while!
\nI’ve been heads down rethinking how security should be done. The short version? I’m transitioning SimplyCubed from general security consulting to Lean Security—helping businesses apply lean principles to cybersecurity so they can cut waste, reduce complexity, and actually get stuff done.
\nSecurity shouldn’t slow you down. Lean Security is about smart, efficient, no-BS security that actually works—without the fluff, wasted effort, or overcomplicated processes. Less friction. More protection.
\nI’m putting everything I’ve learned into a book called Lean Security—and the first chapter is almost ready. If you want a sneak peek, let me know. I’d love to get your thoughts before I finalize it.
\nDrop a comment, reply, or just hit me up. Excited to get this rolling! 🚀
\n" } ] }