00:21:32 · Siddhartha Ahluwalia
[00:21:32] S1: And why is security improving much, much more slowly than the generation of code?
00:21:39 · Varun Badhwar
[00:21:39] S0: That's a great question. One of my favorite topics I spent a lot of time on. Because you know, conventional wisdom would say look, we these agents are getting so smart, models are getting so smart, we keep hearing how they can find every security bug. Well, why can't it write code security? We have to go trace back to the origins of how these models are trained. Model from every lab that is learning coding is learning coding based on open source. They go index the last 20, 30, 40 years of code that exists on the internet. Most of it is on GitHub, maybe Stack Overflow, maybe other places. That code has various forms and vectors of security, quality, reliability, et cetera. The models are learning not just the good behavior, they're learning all of the inherent security problems that these uh the training code has introduced. And it is a very hard technical problem to figure out how to piece away what the model has learned that subsequently was known to have security bugs, and how it was circumvented or fixed later. And so models are producing way more code that is insecure than humans. The other piece is at the same time, traditionally, at least we had some review processes. Human in the loop for every pull request for regulated companies that would review the code base. Today you can't do that. Like the volume of code being generated is so high, human eyes can't pay attention to catch every security bug, logic bug, architecture bug in the code base. And so, yeah, I think the combination of the models themselves generate more insecure code. You have citizen developers that don't even understand what is being built and output, and you don't have enough people to review all of this code diligently. That is causing much more of your code to be vulnerable. That's on your code. As it relates to all of the open source code you've been using and relying on, you're finding 10x more vulnerabilities there because, again, models are easily discovering more and more problems. And if you're in the open source ethos, whose responsibility is it to fix? If I was a hobbyist, I was a college graduate. Over the summer, I created a project that became popular. Now Anthropic is coming to me and saying, you got to fix these 20 vulnerabilities that we found? I'm not interested. I'm back to school, I'm busy. Right? So it's just a very strange world that we live in.
00:24:02 · Varun Badhwar, Siddhartha Ahluwalia
We rely on all of the software that isn't written by us, and more and more and more vulnerabilities that continue to be discovered. But whose problem is to kind of fix things? [00:24:13] S1: I think it requires a very different shift in mindset because earlier, when code was written, it was assumed to be secure. And now we have to just give up with that mindset that any code written cannot be secure because the writing of code has become so easy. [00:24:32] S0: Yeah, I think I think you had, I would say, three core assumptions. That's one. Second was the person writing the code was at least a trained software developer. Right now, my mom and dad can write software. Uh scary thought. The third thing was if there was generally an implicit trust in open source. If I'm grabbing it from open source, people have had eyes on it, it'll be fine. Today, nation state actors, North Korea, China, Russia, others are completely dominating the ability to kind of push malicious code through open source because we have entirely left this space open. Yeah. It's like your doors may be locked, your windows are open. Anyone can ship you any code. [00:25:16] S1: Yeah. [00:25:16] S0: And your pipelines are just pulling in automatically these updates. It's a wild thought to think about right now when you think about the fact that anybody can go take over an account without a lot of effort in open source and push malware that affects 500 million downloads a week.
00:25:16 · Varun Badhwar, Siddhartha Ahluwalia
[00:25:16] S0: And your pipelines are just pulling in automatically these updates. It's a wild thought to think about right now when you think about the fact that anybody can go take over an account without a lot of effort in open source and push malware that affects 500 million downloads a week. [00:25:37] S1: So I assume uh at Endor, raising money would have become much easier, right? Because you had already made so $250 million for your stakeholders. The first round on Endor was $25 million, I'm right. And second round was 90.
00:25:53 · Varun Badhwar
[00:25:53] S0: Yes. Yeah. Yeah, look, I I am blessed to have a good track record, and fundraising has never been the issue here. Every round has been preempted in this company. We've never really had to go out officially and run a run a fundraise process. Uh, but you know, at the same time, the expectations get higher too. I don't think anybody is expecting Varun Badhwar to go create another $250 million exit outcome, right? I think the the belief, my personal belief, my own expectation of me, let alone everybody else, is that I've did that before. I learned how to build a much bigger scale business within Palo Alto Networks. And now I want to build an IP oval business independently. So expectations get higher, pressure gets higher. Also, I think we just we haven't talked about the elephant in the room. Like building a business and navigating it through today is wild compared to 2020, you know, 2017, 2018. CI, like the speed of change of technology. I may have product market fit today, I may not have it in a quarter, even though I'm a scaled up startup. Or, you know, a company with one-tenth of the capital could potentially race to building something relatively competitive much faster. So the question always becomes like, what's the moat now, right? How much of it is, you know, people say this is a system of record mode, data mode. Sure, but I think I think those things matter. Um ultimately, I think what your customers believe about you and your ability to support and service them, because they're all going through the same shifts. Um, how we react, how we show our velocity of shipping with speed and thoughtfulness, um, how we help them navigate all these changes uh matter the most. I think having loyal customers and loyal employees that help you navigate through this change is the best thing you can have. But I call it wild because of certainly those two things I mentioned about competitive dynamics, product market fit dynamics. Um but also it's like every morning when I wake up and before I get on my phone, there's this little thing in the back of my head. I'm like, oh, like what's what's today? What's today bringing out, right? What is the what is the next big launch from a lab? What is the next big thing happening in the industry?
00:28:15 · Varun Badhwar, Siddhartha Ahluwalia
What you know, we not talked about regulation yet, but there's so much chatter right now about open weight models and is US going to regulate. Are certain things gonna get bought banned? Like this has consequences. These have lasting consequences for companies like us. And uh the good news then, I comfort myself thinking I'm not the only one. If you're Sam Altman, if you're Dario, it doesn't matter if you're running the best biggest labs in the world. That same paranoia has to be living in the back of your head every single day. [00:28:48] S1: Yeah, because uh Sam and Dario both have the fear of getting disrupted by Chinese open source, right?