FAQ
Frequently asked questions
Clear answers about wallet credit, usage, subscriptions, and how Tycoon charges for work.
Is an AI enough for security, or do I need a human CISO?
It depends on what you're defending. For most early-stage B2B SaaS under 20 people, the AI Security Engineer handles the 90% that is hygiene: secret rotation, CVE patching, code review for common vulnerabilities, vendor review, compliance paperwork. What it doesn't replace: threat modeling for novel architectures, incident response with legal and PR dimensions, and board-level security conversations for regulated industries. Most founders run the AI for daily hygiene and bring in a fractional CISO for quarterly threat reviews and any high-stakes moment.
Can it actually pass a SOC 2 audit?
It handles the evidence collection and policy maintenance that make SOC 2 tractable — vendor inventory, access reviews, change management logs, secrets rotation proof, training completion. Running through Vanta or Drata is the usual path; the AI Security Engineer lives inside that flow, keeps controls current, and prepares evidence packages. The audit itself is still run by a human auditor. What changes: instead of a 3-month panic to prepare, the evidence is continuously maintained and the audit is a low-stress formality. Most SkillBoss and Tycoon properties that pursue SOC 2 complete it in about 3 months end-to-end with the AI doing most of the work.
What about security scanning for AI-generated code?
Special care. LLM-generated code has known failure modes: hardcoded secrets left behind, overly broad IAM policies, unparameterized SQL, over-trusting user input. The AI Security Engineer runs a rule set tuned for these patterns on every PR, whether the author was human or AI. When the AI Backend Engineer or AI Frontend Engineer writes a hot path that touches auth, cryptography, or payment, the AI Security Engineer's review is required before merge. This creates a check-and-balance between agents that is often stricter than what junior humans would catch.
How does it handle incidents?
First-line triage within autonomy boundary: rotate the leaked credential, revoke the exposed session, disable the compromised integration. Simultaneously pages a human and opens an incident channel with the timeline so far. Pulls logs, correlates signals, drafts the initial customer communication for founder review. Does not make the public disclosure call or commit to remediation promises — those are human decisions. The goal is that by the time you're reading the incident, the immediate bleeding has stopped and you're making decisions about what to tell customers, not chasing the fire.
Does it handle penetration testing?
It prepares for and coordinates pen tests but does not replace one. What it does: writes the test scope based on your architecture, pre-tests with OWASP ZAP and Burp to catch low-hanging issues before the external team arrives, manages the findings and remediation timeline after the test, and feeds learnings back into the SAST rules for next time. A human pen test annually is still the right call for most B2B SaaS with significant customer data. The AI Security Engineer makes that test more productive by ensuring you don't waste the external team's time on issues you should have caught internally.