Introducing Dimension

There are many questions for security teams in this new dimension (sorry, I can’t help myself!) we’re entering. But first off, an introduction – hi – my name’s Josh, I’m the CTO here. We’re a company that is really proud to be challenging the art of the possible with AI, and more on that in a moment. First off though, in this post I have endeavoured to be authentically myself, and as such have fiercely resisted asking AI to review my thoughts before I posted this. We are, at our heart, a human centric organization (we’re actually British, though I feel I ought to use American English as we expand our global reach across the pond). It is, therefore, extremely important to me that we do our little bit not to add to the pile of AI slop that spreads its tentacles into every corner of the web.

I’d like to take the time to tell you more about us, but maybe that can wait for a future blog. But in short, you can read more about our company here (https://threataware.com (opens in a new tab)). We’re a highly driven and motivated team, founded out of the UK and have raised $25m to change the way teams tackle the runaway train that is security in the AI era. Dimension is the way we plan to do that, and to cut right to the chase, let’s dive right into the tangled, chaotic and almost laughably ridiculous world that is security:

To many, it might look like the sheer volume of categories, subcategories and vendors is indicative of a major market problem. And maybe it is. But also, maybe not; after all, we live in a phenomenally sophisticated digital ecosystem, and the world of security in the physical world has its fair share of complexity too… armies, navies, air forces, seal teams, border forces, private security, front doors, keys, door locks, alarms… perhaps we shouldn’t be surprised a digital world needs so much protection too.

In 2021 the release of ChatGPT felt like a watershed moment for many. But it wasn’t until 5 years of breakthrough model development later that the swarms of robots came knocking on our door. Not literally (though I’m sure they’ll come), but rather 700-math-research-papers figuratively. As OpenAI have shown us, if you believe it, you can achieve it (so long as you have $5m to burn through twenty billion tokens with a swarm of ten thousand agents). What does this mean for security teams? Well, unfortunately, it means that medium vulnerabilities aren’t really medium vulnerabilities any more. Actually, we should probably start to worry about the low ones too. If anyone (or anything, for that matter) is suitably motivated, it becomes a question of not if but when the defences are worn down. So, should we worry? Unfortunately (cough PHP CVE-2026-109618 and CVE-2026-109619 cough), yes! But fortunately, as defenders, we do have a few tricks up our sleeve.

Back to the chaotic world of security tooling. If we buy it all, we’re safe, right? Unfortunately (again), probably not – if only it were that simple. In addition to products comes three more p’s we have to get right: people, policy, process. And we’ve also swept under the rug that probably no company in the world can have it all, after all, even the world’s most profitable enterprises still have to work within a budget. But back to the p’s – hold on! Surely we can, in this era of SaaSpocalyptic AI exuberance, use products to help manage the people, policies and processes that surround our fundamental product stack?

And this is where we start to realise that we do indeed have these products at our disposal. I like to think about the security market in two different layers. The first is the critical layer, the front line, if you like. These are your EDRs, firewalls, email filters, vulnerability management platforms; explicitly, your Crowdstrikes, Palo Altos, Proofpoints and Tenables. Layered on top of that, comes a function no less important: the ‘strategic command’ – a layer characterised by API interconnectivity that drives visibility, intelligence, automation and control. What am I talking about? It’s the MDRs, agentic SOCs, exposure management and threat intelligence tools.

So what? Let’s consider our question, should we build, or buy? Armed with this layer 1/layer 2 distinction we suddenly have a little more of a framework we can use to make that decision. Should we build our own EDR? I don’t think so. Our own Firewall? Well, do you have an electronic engineering degree and a semiconductor factory to hand? Let’s leave that one. How about an email filter? Do we want to mess with DKIM, SPF and our own code in front of our company domain? Hmm, I’ll pass. Perhaps layer 1 can stay bought. Layer 2, on the other hand, is a different pasture. A vulnerability enrichment platform that takes data from my vulnerability management platform, and layers on business context from my identity provider, device management platform and enriches data using my language model of choice to drive automation and action: Now that’s what I call buildable!

And if I can build, should I? Well, if I had that unlimited budget, maybe it’d be up for debate. But then again, maybe I don’t want to adapt my process to fit some vendor’s vision of how I want to work. Maybe if we were stuck with GPT-3, all this building might be a leap of faith and a step too far. But with Opus 5.5, GPT-6 Astra, Gemini 4 Argon? Why should we pay vendors to ingest our data, build pretty interfaces and pump out automation into our own tools, all whilst charging a small fortune to boot?

So let’s rip out all our layer 2 tooling and build it! Not so fast. Let’s not discredit the years of intelligence, sophistication and evolution that is rolled up into many of these products. The breadth and depth of the capability in many products may in many cases far outstrip what we might feasibly build in our own. But do we need it? It depends. The Pareto rule can be applied to many situations in life, and this one no less. I think it would be a reasonable determination that in most products, 80% of customers use just 20% of the capability, despite paying for 100% of it. So it’s probably fair to say that it will be up to each organization and each team to determine what layer 2 tooling ought to be bought, and what ought to be built, considered on a case-by-case basis. I think it useful though to set out the 3 ways in which I imagine teams might choose to build:

1. ‘Gluing’ together disparate systems for better context, visibility and actionability across the security function
2. Replacing tooling that is only still there for the handful of capabilities we can’t live without
3. Building tooling that we want but can’t have, owing to budget and resource limitations

I think it is also useful to consider, from a broader market perspective, what of layer 2 can be built? While no doubt, when fully considered, an incredibly layered question full of nuance, I think it can be boiled down to what we might call complexity-squared. That is, that simple products can be built in complex environments, and that complex products can be built in simple environments. But complex products in complex environments – those are better bought.

With this, the concept of an ‘AI frontier’ drops out. This is the practical limit of what one might build. Two years ago, I doubt one would dare attempt build an MFA management tool for even a small startup; today, I’d be surprised if Walmart couldn’t effectively tackle the MFA problem using an application they’ve built with AI. The frontier is shifting outward, at pace.

So what is Dimension all about? Well, as far as I’m convinced, the build versus buy debate is going nowhere. And if the security team, GRC team, IT helpdesk, SOC and everyone in between go crazy in Claude Code, how do we feel about that? Probably not so great. Security should be rooted in great foundation, aligned strategy, governance and compliance. We probably shouldn’t leave the following decisions up to each builder to try to implement:

• Hosting
• Authentication
• SSO
• User Provisioning
• Roles and Permissions
• Change approvals
• Audit
• Data at scale
• Credential Encryption
• Reliable Backups
• Version Control
• Compliance adherence
• Network Isolation
• And much, much more

This is where we come in. Dimension is the enterprise-grade foundation that enables teams to build freely but securely, to make democratized security secure. We have designed it from the ground up with the rigour and reliability of our founding platform, ThreatAware, but with the freedom and flexibility to tackle a much broader set of problems we face today, and tomorrow. We’re excited to see what you build.