Every serious frontier tech company - big or small - should assume it has insider threats. And they don’t need to be that sophisticated. I saw it in government. I saw it with crypto. OpenAI is the latest. Founders tend to assume good intentions while speaking about some of their most sensitive information out loud: capabilities, unreleased products, strategic plans, government relationships. Employees are the most obvious vector. The more sophisticated operations target founders, execs, and vendors through romantic, family, and social relationships. And on small teams, one compromised person can do a lot of damage. With former federal prosecutors and ex-FBI agents as part of our team, we spend a lot of time on these issues. Here’s some of what we’re telling our founders: 1. Expect to see more private-sector versions of SCIFs and clearances, where the most sensitive conversations and work are physically isolated and under stricter access controls. 2. Agencies may know about a specific insider threat at a company but can't share that info unless someone at the company holds a clearance like TS/SCI. Lead times to get a clearance are long. Plan now. 3. Restrict access to sensitive meeting schedules, disable unused ports on conference-room equipment, and regularly sweep rooms used for confidential discussions for surveillance devices. You don't need OpenAI's budget to be ready. But you do need to start.