00:57:47 · Varun Badhwar
[00:57:47] S0: It's been different. And I say that because when when you are creating a category, there's no incumbency. So whatever you define either solves the problem or doesn't. When you're disrupting an existing category that's been around for 20 years, you need to build the differentiation, but you've got to build the long tail of every other feature function that existing products have and support and integrations, because that's what a customer has been using for many years. So they need all of that that they use, and they need a significant order of magnitude differentiation to go through the work and pain of removing an incumbent tool and swapping it out. The thing that then shifted and put this into hyperdrive for Endor was when AI coding came along. Because until AI coding came along, it was like, look, you've had this problem, you've tolerated it, now you need to change your way so you can get a better experience. The AI coding agent disrupted entirely what a workflow looks like, what an agentic STLC, how you create software. It completely disrupted this whole idea of, you know, today we're identifying 16 times more vulnerabilities than we can fix. That gap has widened more in the last year than it has in the last 10 years. That pain didn't exist for the last 10 years. So I would say the hyperdrive is coming from AI coding agents are now saying, well, not only is this a disruption of an existing category, but it's an entire rewrite of the entire workflow of how you do the moving forward.
00:59:26 · Siddhartha Ahluwalia, Varun Badhwar
[00:59:26] S1: So hypothetically, if you imagine at a company, a tech forward company, if 100x more code is getting written, are the vulnerabilities also increasing by 100x? [00:59:39] S0: Easily, yes. Because I think the linear formula would say that. It's not just you're creating more software, you're also creating them at a more faster pace. The other challenge, I was with a CIO of a very large entertainment company. And he said, Varun, look, my problem is not just I have citizen developers. My finance team is building a forecasting app. And we happened to go analyze that code, we found a security bug. We emailed the individual who is writing that code, and we said, Here, could you please fix this vulnerability? Do you want to guess what the response of that individual was to the security team? [01:00:25] S1: I didn't create it. The agent created it. So please ask me.
01:00:28 · Varun Badhwar
[01:00:28] S0: Actually, even more fundamental, which is what's a vulnerability? Like now you're talking about securing an ecosystem of code that is being generated 10 times faster with more security problems, but also the dynamics of the individuals you're working with, is you're going back to their baseline. So at that point, to your, I basically where you're going with your idea is security just needs to be autonomous. Security just needs to be handled for the user, not being something that a user needs to think about and be trained about. And I think that opportunity exists. Think about this. For the last 20 years, for people who are on this podcast that are listening, that are software engineers. Every year in your company you go through an annual security training. They teach you how to write code. But then there are 20,000 of you in the company. Do we realistically believe that 20,000 people will remember and follow all the instructions on how to do things manually? Unlikely. But with agents, you can actually give agents consistent instructions to follow the same parameters if you can infuse that intelligence to them. So like at Endor, our product infuses that intelligence into cloud code, into cursor, into codecs. And just make sure when they are creating these loops of code, the security intelligence is fused in and they're instructed to fix the problems they're introducing right at the source. And I think agents are far more capable to do that consistently than humans can. I think that's the we've been talking a lot about like the risks of AI. But that's the boon of AI. We can now solve these problems that have been unsolved for 20 years, despite more volume, despite reduction in time we have to fix these differently. And that's what I'm most excited about.
01:02:13 · Siddhartha Ahluwalia, Varun Badhwar
[01:02:13] S1: So uh at Endor, when the code is getting reviewed as it's getting written, is it completely autonomous? [01:02:24] S0: It can be. Some of our customers are in the everything is fairly autonomous unless it's a known large disruptive change, you gotta bring a human in the loop. There are others that are still using our context to create gear tickets and not be in the developer workflow. This goes back to my uh example of meet customers where they are and then take them to your promised land and dreamline. If we had designed the product to just be autonomous, what would we do with all the customers that are not ready? And so I think it becomes really important to think about designing your product for the masses. And that's kind of where one of the common fallacies a lot of startups in Silicon Valley have is they'll talk to their friends in Silicon Valley, understand the problem, build a product, and be like, oh, well, nobody else is really thinking of it this way. And so I always tell people when they're ideating, don't be in the bubble. Get out of the bubble and go talk to you know the company that has a 40-year-old code base or has 100,000 employees worldwide that is regulated entirely differently than how Silicon Valley operates. [01:03:52] S1: But but your agents are always watching the AI coding agents, whatever they be. Yes.
01:03:52 · Siddhartha Ahluwalia, Varun Badhwar
[01:03:52] S1: But but your agents are always watching the AI coding agents, whatever they be. Yes. [01:03:59] S0: So our security agents essentially get integrated into the um your favorite IDE, and they are established through workflow and requirements to be a step in the coding process. So when Claude is iterating on your spec and writing the code, Claude's job is not done till it has gone through Endor feedback on that code, seen what problems it introduced, fixed them, re-verified them, and when Endor says good, that's when the plan is complete. [01:04:36] S1: So whose responsibility is that uh the Endor's plan is executed? Is it Claude's responsibility? Is it Endor's responsibility? [01:04:46] S0: Uh it's a it's a shared responsibility. It's the way you um insert the product into the workflow. So with Claude, with Cursor, they're now giving you more and more tools to enforce certain tools to be run or certain actions to be taken. And so using those things, specifically, uh Claude has something called Claude Hooks. You can actually mandate deterministically that Claude has to abide by the instructions of Endor. So that's how it works. We use their configurations to put ourselves in the workflow. [01:05:22] S1: So does Endor today become like a firewall, like omnipresent and um there are components of it that does.
01:05:22 · Siddhartha Ahluwalia, Varun Badhwar
[01:05:22] S1: So does Endor today become like a firewall, like omnipresent and um there are components of it that does. [01:05:32] S0: Actually, it's interesting you bring up the word firewall. With malicious open source, right? I told you this is free for all. You pull this, by the way, it'll surprise you to hear that the agents, a third of the time when they're recommending open source libraries and dependencies, they're making it up. They are not real names, they're not real versions, or they're pulling really outdated stuff. So if you think about the Firewall concept. What Endor will do is any developer or any agent that is pulling an open source package or an open source model or a skill that is malicious, that has malicious instant intent because we're evaluating them, we can block them. We actually call it a package firewall. So in some use cases, yes. But I think firewall also annotates a slightly different meaning to me, which in package firewall case is like a yes-no. It's a guard at the gate. We're not just a guard at the gate that is one use case. It's also we're the fitness trainer, we're teaching that agents how to write more secure code for you. We are your house manager, right? When all of this pile of more new vulnerabilities comes in, we're figuring out what you need to fix, how to fix it, getting that job done for you. So I think it's all of the above, right? We we want to run your house as effectively as you can. So we're a house manager, we're a cleaner, we're a security guard, all of that.