I wanted to know what we'd missed.

I know why YeshID is supposed to be secure. I helped build it.

That's also why I don't want a security review that mostly confirms what I already believe.

I could have spent a few thousand dollars on another pentest, collected the PDF, and moved on. Our previous engagement had felt too much like paying someone to run Burp Suite against us and write up the results.

I didn't want to repeat it.

Instead, I used OpenAI Daybreak Blue to audit YeshID's codebase. Billions of tokens spent looking for what we'd missed.

What worries me most about an identity product isn't necessarily an obviously broken endpoint. It's an assumption that holds in one place and quietly stops holding somewhere else.

A user is allowed to start an operation. Their permissions change before it runs. Does it still execute? With whose authority?

Two customers' data is properly separated in the obvious places. Is that still true through a background job, an integration, a different route to the same record?

You can look at the individual pieces and feel good about each of them. I want to know what happens when they connect.

That's where I wanted the effort to go. Into the code, through the less obvious paths, back to the assumptions we made while building it. And when something looked suspicious, I wanted room to keep investigating. Not a conversation about what was left in the engagement.

There are excellent pentesters. Burp is a good tool. This wasn't a decision that humans are obsolete. It was a decision that the particular exercise we'd been buying wasn't enough.

To be clear: we still run an external, third-party pentest every year. SOC 2 requires it. Some of our customers' security teams require it too, and none of that is going away. It's a real engagement, and it stays on the calendar.

But a scoped, week-long engagement and a model spending billions of tokens across the entire codebase are not answering the same question. One tells me a defined set of paths held up under a defined set of tests. The other went looking everywhere, including the paths nobody thought to scope in.

If you review vendors for a living, you know the distinction. You need their SOC 2 report, their pentest summary, their completed questionnaire. You also need a reason to believe someone has seriously challenged the product behind those documents. The external pentest gives me the first. It doesn't always give me the second.

I don't want to confuse getting through that review with doing right by the customer.

Daybreak doesn't relieve me of the work. I still have to separate real problems from false alarms, fix what needs fixing, and test the changes. I don't get to replace trusting a consultant's PDF with trusting a model's confidence.

But this is where I'd rather spend our effort.

Our customers trust YeshID with identity and access to their companies. Before asking them to trust our assumptions, I want to work hard at proving those assumptions wrong.

I don't need a security review to agree with me. I need it to find what I missed.