00:23:46 · Tomer Schwartz, Rebecca Balan
[00:23:46] S2: So I think those major companies are well aware of this, and they have different ways to to identify if their customers are using PHP right now. So I've seen a lot of notifications on this. I think that those centralized businesses are are taking this very very responsibly and are trying to be proactive about this. In many cases, they can patch behind the scenes. If they can't, they do notify their customers to to let them know. But I do encourage you to to think about all of those smaller businesses that maybe have set up a WordPress site sometime in the past and maybe have not used those more centralized platforms, I think these are are very likely to be vulnerable. The other thing is that if you're not sure, just ask. Uh-huh. So you can contact the the platform that you're using. You can even contact us at php two shell dot com. We're trying to to have a very clear advisory there with all of the details, all of the technical details. And if something is not covered there, there's also a way to contact us to to see if we can help. [00:24:49] S1: Okay. So since this is going to be a continuous issue, unfortunately, this kind of crisis level vulnerabilities that are going to be found, or at least that's what we think is going to happen, what's your advice for companies out there with 10 people and no security team? What do they even do this week or this quarter?
00:25:08 · Tomer Schwartz, Rebecca Balan
[00:25:08] S2: It's a good question, because we got to prepare to a time in which critical vulnerabilities are discovered all the time. So for new startup companies, for new businesses, I do encourage everyone to think about how the architecture can be as resilient as possible to changes. So if right now we're thinking about businesses that were built pre AI and maybe they have some some manual patching cycles, I think these will never scale given the the amount of vulnerabilities that is upon us. Right? So if we're seeing similar vulnerabilities disclosed on a monthly basis or even on a weekly basis, you got to really think about your patching strategy and your, honestly, your your whole IT architecture from first principles and think about if we can take down systems, if we can automatically patch, if everything is defined in code in a way that allows us to spin up the continuous deployment cycle change things behind the scenes. I think these are very good practices to think about, especially when you're still small. It's much harder to make these changes if you're a thousand people company already with a ton of legacy systems. So I think those smaller companies that are now emerging are actually in a pretty good spot. But you're going to think about this and not just hope that these things will not happen. [00:26:36] S1: Yeah. Would you say that for startups, like early stage startups, are we at the point where one of your first hires or even one of your cofounders should be a security person?
00:26:36 · Rebecca Balan, Tomer Schwartz
[00:26:36] S1: Yeah. Would you say that for startups, like early stage startups, are we at the point where one of your first hires or even one of your cofounders should be a security person? [00:26:47] S2: Well, it's hard for me to say because I am. But I think it depends on the business. Right? I think there's there's some businesses where it makes sense. If a big part of the way that you're doing business relies on trust, I think it makes more and more sense to have that expertise in house. If it's not a founder, maybe it's one of the very first hires that you're making to make sure that you're actually building this in the right way. Otherwise, this will always be something that will stop you from being able to accelerate and move faster and faster as a company. So if you're not really thinking about this from the get go and let's say that you're dealing with, you know, critical personal data and this really is the foundation of your business, you've got to think about this from the very, very early days. Otherwise, again, you'll be in a situation that you're just... Every single week is going be a fire drill and it's going to be very difficult for you to scale. [00:27:46] S1: And Tomer, you haven't only been with Wiz, right? You had your own two startups, right? Both were cybersecurity startups. It might be, you know, give us a little walkthrough of what those companies were, how they exited and what advice you might have for what I'm sure is a plethora of cybersecurity startups that are coming onto the scene today.
00:28:05 · Tomer Schwartz
[00:28:05] S2: Yeah, I've been around the block. So I was CTO and co founder of a company called Dazz, which was acquired by Wiz, and that's how I ended up here. Prior to that, I was CTO and co founder in a company called Armis that is now acquired by ServiceNow. I think the cybersecurity industry for startups is really interesting right now because the typical playbook that we used to have pre AI has completely changed. It's changed because of the same reasons that we've been talking about today. I think AI is changing everything about not only cybersecurity, but also the underlying IT infrastructure, about the way that we think about how organizations are actually doing a lot of different things. We talked about patching, for example, but also changes the way that they think about internal applications, and it changes the way that they think about how to utilize AI as a replacement to labor. There's so many different changes that are happening right now where the blueprint is not really well defined for us to build cybersecurity solutions on top of. So for me, it's really interesting times to be in the cybersecurity industry. I think that for for those startup companies that are already out there, I think if you haven't thought about how to reinvent yourself given the changes that are happening, then now is probably the best time to do this. But but the other thing is for those who are thinking about getting into the cybersecurity industry from from a start up angle, I think you gotta think about the changes that are happening in different ways to capture sort of the the broader set of the market and thinking about how technology is going to change and as a function to that, how cybersecurity products are going to change.
00:29:47 · Rebecca Balan, Tomer Schwartz, S0
[00:29:47] S1: Definitely. That's great advice. Well, we're just about out of time, but I wanted to... There was that website, can you say it again, that people can come to if they have questions? [00:29:56] S2: Yeah, it's phptouchel.com. Pretty straightforward. [00:30:01] S1: Okay, great. And where can our listeners connect with you online? [00:30:04] S2: Either there or on Twitter or on LinkedIn, you can find me. I'm Tomer Schwartz. Somewhat difficult to spell, but I'm sure that the name is out there in the podcast description. Yeah. [00:30:16] S1: Well, thank you again for joining us on the show. To our listeners, you can find me on Twitter and LinkedIn as well. You can find Equity on Twitter and threads at Equity Pod. Talk to you next time. [00:30:27] S0: Equity is hosted by TechCrunch senior reporters and produced by Teresa Loconzola with editing by Cal. Subscribe on YouTube or wherever you get your podcasts and find out what's [00:30:36] S1: next at techcrunch.com/events. Thanks so [00:30:38] S0: much for listening, and we'll talk to you next time.