00:21:54 · Rebecca Balan, Tomer Schwartz
[00:21:54] S1: Yeah. We've been hearing about this, right? And this kind of feels like the canary in the coal mine in terms of how safe the Internet can be, like what will come next? This is clearly the first of many. Is there anything that, you know, well, first, before I actually ask for like, what can any of us do with PHP in particular, is still unpatched? You know, Zach had said that smaller IT teams, solo devs, like anything that bundles PHP like routers, storage devices, firewalls, dev tools generally are still unpatched. Then there's like the legacy systems that can't be updated. So, you know, who's at risk? Who should be taking a closer look? [00:22:33] S2: Well, anyone who did not patch in the last couple of days is currently at risk. And we're monitoring this every single day either with the the Wiz customer base or with broader scans that we're doing over the Internet, and we're seeing that still a majority of of workloads are not patched. It takes a lot of time to actually fully patch a live website to to figure out that... You know, what's the right way of doing this, to understand who the owner is, to make sure that the releases are actually installed. I do worry that we're going to see this tale of unpatched systems for quite some time now.
00:22:33 · Tomer Schwartz, Rebecca Balan
[00:22:33] S2: Well, anyone who did not patch in the last couple of days is currently at risk. And we're monitoring this every single day either with the the Wiz customer base or with broader scans that we're doing over the Internet, and we're seeing that still a majority of of workloads are not patched. It takes a lot of time to actually fully patch a live website to to figure out that... You know, what's the right way of doing this, to understand who the owner is, to make sure that the releases are actually installed. I do worry that we're going to see this tale of unpatched systems for quite some time now. [00:23:11] S1: So anyone that's not patched, any website that's not patched, there's lots of small businesses that are using WordPress or Wix or GoDaddy or whatever, like hosting platforms to build their own websites. Is it only a problem if they're based on PHP? Like, can those people rely on those companies, those hosting platforms, website builders to fix it for them. You know, there's Replit that's also creating a ton of websites for people, Lovable, etc. So I'm kind of curious, like, doesn't every individual with their own little website need to be freaking out, or can they trust the the businesses that, you know, help them build their websites?
00:23:46 · Tomer Schwartz, Rebecca Balan
[00:23:46] S2: So I think those major companies are well aware of this, and they have different ways to to identify if their customers are using PHP right now. So I've seen a lot of notifications on this. I think that those centralized businesses are are taking this very very responsibly and are trying to be proactive about this. In many cases, they can patch behind the scenes. If they can't, they do notify their customers to to let them know. But I do encourage you to to think about all of those smaller businesses that maybe have set up a WordPress site sometime in the past and maybe have not used those more centralized platforms, I think these are are very likely to be vulnerable. The other thing is that if you're not sure, just ask. Uh-huh. So you can contact the the platform that you're using. You can even contact us at php two shell dot com. We're trying to to have a very clear advisory there with all of the details, all of the technical details. And if something is not covered there, there's also a way to contact us to to see if we can help. [00:24:49] S1: Okay. So since this is going to be a continuous issue, unfortunately, this kind of crisis level vulnerabilities that are going to be found, or at least that's what we think is going to happen, what's your advice for companies out there with 10 people and no security team? What do they even do this week or this quarter?
00:25:08 · Tomer Schwartz, Rebecca Balan
[00:25:08] S2: It's a good question, because we got to prepare to a time in which critical vulnerabilities are discovered all the time. So for new startup companies, for new businesses, I do encourage everyone to think about how the architecture can be as resilient as possible to changes. So if right now we're thinking about businesses that were built pre AI and maybe they have some some manual patching cycles, I think these will never scale given the the amount of vulnerabilities that is upon us. Right? So if we're seeing similar vulnerabilities disclosed on a monthly basis or even on a weekly basis, you got to really think about your patching strategy and your, honestly, your your whole IT architecture from first principles and think about if we can take down systems, if we can automatically patch, if everything is defined in code in a way that allows us to spin up the continuous deployment cycle change things behind the scenes. I think these are very good practices to think about, especially when you're still small. It's much harder to make these changes if you're a thousand people company already with a ton of legacy systems. So I think those smaller companies that are now emerging are actually in a pretty good spot. But you're going to think about this and not just hope that these things will not happen. [00:26:36] S1: Yeah. Would you say that for startups, like early stage startups, are we at the point where one of your first hires or even one of your cofounders should be a security person?
00:26:36 · Rebecca Balan, Tomer Schwartz
[00:26:36] S1: Yeah. Would you say that for startups, like early stage startups, are we at the point where one of your first hires or even one of your cofounders should be a security person? [00:26:47] S2: Well, it's hard for me to say because I am. But I think it depends on the business. Right? I think there's there's some businesses where it makes sense. If a big part of the way that you're doing business relies on trust, I think it makes more and more sense to have that expertise in house. If it's not a founder, maybe it's one of the very first hires that you're making to make sure that you're actually building this in the right way. Otherwise, this will always be something that will stop you from being able to accelerate and move faster and faster as a company. So if you're not really thinking about this from the get go and let's say that you're dealing with, you know, critical personal data and this really is the foundation of your business, you've got to think about this from the very, very early days. Otherwise, again, you'll be in a situation that you're just... Every single week is going be a fire drill and it's going to be very difficult for you to scale. [00:27:46] S1: And Tomer, you haven't only been with Wiz, right? You had your own two startups, right? Both were cybersecurity startups. It might be, you know, give us a little walkthrough of what those companies were, how they exited and what advice you might have for what I'm sure is a plethora of cybersecurity startups that are coming onto the scene today.
00:28:05 · Tomer Schwartz
[00:28:05] S2: Yeah, I've been around the block. So I was CTO and co founder of a company called Dazz, which was acquired by Wiz, and that's how I ended up here. Prior to that, I was CTO and co founder in a company called Armis that is now acquired by ServiceNow. I think the cybersecurity industry for startups is really interesting right now because the typical playbook that we used to have pre AI has completely changed. It's changed because of the same reasons that we've been talking about today. I think AI is changing everything about not only cybersecurity, but also the underlying IT infrastructure, about the way that we think about how organizations are actually doing a lot of different things. We talked about patching, for example, but also changes the way that they think about internal applications, and it changes the way that they think about how to utilize AI as a replacement to labor. There's so many different changes that are happening right now where the blueprint is not really well defined for us to build cybersecurity solutions on top of. So for me, it's really interesting times to be in the cybersecurity industry. I think that for for those startup companies that are already out there, I think if you haven't thought about how to reinvent yourself given the changes that are happening, then now is probably the best time to do this. But but the other thing is for those who are thinking about getting into the cybersecurity industry from from a start up angle, I think you gotta think about the changes that are happening in different ways to capture sort of the the broader set of the market and thinking about how technology is going to change and as a function to that, how cybersecurity products are going to change.