00:18:46 · Varun Badhwar, Siddhartha Ahluwalia
And our mission at Endor that I took on is we can help you ship fast and ship securely. If you build the right architecture, the right technology, the right insertion point in the software development lifecycle, you can solve all of those problems. We started that in 2021. And I couldn't be happier because sitting here today, we've had the time to build and scale a platform, prove it out with the world's most amazing customers in technology, finance, insurance, et cetera. And now this is the number one problem that is constraining us from adopting a gentic STLC is code generation is not the problem. It's security, it's quality, it's everything to do with releasing of the software much faster, and we're primed to solve it. [00:19:33] S1: And you operate on the left side completely?
00:19:36 · Varun Badhwar
[00:19:36] S0: The way I describe to be bill where Endor fits in is um if you want to draw a box around the entirety of the agentic SDLC from cloud code cursor, pick your favorite ID, agentic ID, through your pull requests, through your um CI CD pipeline till you have an artifact that is ready to be deployed in the cloud, container or jars, whatever, that is our zip code. From the first intent of writing code to writing the code to checking it into your pull requests and GitHub to CI CD pipelines, securing all of that such that what is ready is the most secure piece of software you could possibly create without compromising on speed is the outcome that Endor uh drives for our customers. And kind of that, unfortunately, in security, that workflow continues post-deployment because now I deployed the product yesterday. Now, today, 10 new things were found in security, like vulnerability discoveries. Now you've got to figure out off that code base, off those 10 vulnerabilities, what actually affects me? And how do I quickly pinpoint what affects me? How do I fix it without breaking my application and redeploy really, really quickly? And that time window to remediate used to be six to 12 months because, yeah, sure, somebody found a vulnerability yesterday, but the the likelihood that somebody's going to build an exploit and target you and come at you was like very low, 1%, 2%. Today that's that's reality. Within 10 hours, people have found and created working exploits for new vulnerabilities. And so this loop of remediate triage and remediation of what affects my code, what do I need to fix? Could literally become a full-time job for every engineering team on the planet. But it's not sustainable. So that's what we're automating for our customers.
00:21:32 · Siddhartha Ahluwalia
[00:21:32] S1: And why is security improving much, much more slowly than the generation of code?
00:21:39 · Varun Badhwar
[00:21:39] S0: That's a great question. One of my favorite topics I spent a lot of time on. Because you know, conventional wisdom would say look, we these agents are getting so smart, models are getting so smart, we keep hearing how they can find every security bug. Well, why can't it write code security? We have to go trace back to the origins of how these models are trained. Model from every lab that is learning coding is learning coding based on open source. They go index the last 20, 30, 40 years of code that exists on the internet. Most of it is on GitHub, maybe Stack Overflow, maybe other places. That code has various forms and vectors of security, quality, reliability, et cetera. The models are learning not just the good behavior, they're learning all of the inherent security problems that these uh the training code has introduced. And it is a very hard technical problem to figure out how to piece away what the model has learned that subsequently was known to have security bugs, and how it was circumvented or fixed later. And so models are producing way more code that is insecure than humans. The other piece is at the same time, traditionally, at least we had some review processes. Human in the loop for every pull request for regulated companies that would review the code base. Today you can't do that. Like the volume of code being generated is so high, human eyes can't pay attention to catch every security bug, logic bug, architecture bug in the code base. And so, yeah, I think the combination of the models themselves generate more insecure code. You have citizen developers that don't even understand what is being built and output, and you don't have enough people to review all of this code diligently. That is causing much more of your code to be vulnerable. That's on your code. As it relates to all of the open source code you've been using and relying on, you're finding 10x more vulnerabilities there because, again, models are easily discovering more and more problems. And if you're in the open source ethos, whose responsibility is it to fix? If I was a hobbyist, I was a college graduate. Over the summer, I created a project that became popular. Now Anthropic is coming to me and saying, you got to fix these 20 vulnerabilities that we found? I'm not interested. I'm back to school, I'm busy. Right? So it's just a very strange world that we live in.
00:24:02 · Varun Badhwar, Siddhartha Ahluwalia
We rely on all of the software that isn't written by us, and more and more and more vulnerabilities that continue to be discovered. But whose problem is to kind of fix things? [00:24:13] S1: I think it requires a very different shift in mindset because earlier, when code was written, it was assumed to be secure. And now we have to just give up with that mindset that any code written cannot be secure because the writing of code has become so easy. [00:24:32] S0: Yeah, I think I think you had, I would say, three core assumptions. That's one. Second was the person writing the code was at least a trained software developer. Right now, my mom and dad can write software. Uh scary thought. The third thing was if there was generally an implicit trust in open source. If I'm grabbing it from open source, people have had eyes on it, it'll be fine. Today, nation state actors, North Korea, China, Russia, others are completely dominating the ability to kind of push malicious code through open source because we have entirely left this space open. Yeah. It's like your doors may be locked, your windows are open. Anyone can ship you any code. [00:25:16] S1: Yeah. [00:25:16] S0: And your pipelines are just pulling in automatically these updates. It's a wild thought to think about right now when you think about the fact that anybody can go take over an account without a lot of effort in open source and push malware that affects 500 million downloads a week.
00:25:16 · Varun Badhwar, Siddhartha Ahluwalia
[00:25:16] S0: And your pipelines are just pulling in automatically these updates. It's a wild thought to think about right now when you think about the fact that anybody can go take over an account without a lot of effort in open source and push malware that affects 500 million downloads a week. [00:25:37] S1: So I assume uh at Endor, raising money would have become much easier, right? Because you had already made so $250 million for your stakeholders. The first round on Endor was $25 million, I'm right. And second round was 90.