No Priors: Artificial Intelligence | Technology | Startups
00:00:00 · Dane Knecht, Sarah Guo
[00:00:00] S0: AI has become the tool that's causing this kind of security apocalypse. Is also the tool that can help us solve it faster as well. It went from how to get everyone just using AI. Now all of sudden, everyone's racing to figure out what AI security means. [00:00:11] S1: I've heard serious technical people say things like air gap, everything important, and we're, like, not gonna be able to trust the Internet for a while, and we just assume all the critical infrastructure and government services fall down at some point. Is that your expectation for what happens? Dane, I'm so excited to do this with you. [00:00:36] S0: Yeah. Thank you. Thanks for coming here too. [00:00:38] S1: I'm sure I'm not the first person to make this joke, but your last name, Connect. That's pretty good for the Cloudflare value prop. [00:00:47] S0: Yeah. Yeah. There's been some jokes about renaming the show next year. So... [00:00:51] S1: So with everything that CloudFare is doing, what are your top few priorities as CTO right now?
00:00:58 · Dane Knecht
[00:00:58] S0: Well, mean, this past year, feels like ten years compacted into one. So those priorities are constantly shifting. But, you know, it all goes back to our mission of helping build a better Internet. And that really hasn't changed over the last fifteen years where we wanna make sure that the Internet's secure, that everyone has access to be able to get their content online easily and scale it up. And just, you know, over the arc of the AI changes in the past year, you know, it went from, you know, how do get everyone just using AI? How do you make it easy for them to deploy and their agents deploy? To like most technical transitions, security is kind of an afterthought. And now all of sudden, everyone's racing to figure out what AI security means. And it means things are... Different sides view it kind of differently. One side as company is how do you keep your data safe from AI leaking the data out? But it's also how do you keep people from getting in as well too? And over the last, I would say, three to six months, just the number of vulnerabilities that are being reported in CDEs has has just gone up exponentially. You know, previously on the Internet, we would see these Log4j moments or these Shellshock type of incidents maybe once a year. And it would be all hands on deck internally at Cloudflare to make sure how we protect not just our enterprise customers, but also all of our free customers because we view it as a public code of making sure that the Internet stays safe. So these things are now happening weekly. Not all of them are publicly reported on, but there are things that are as serious as the Log4j type things, but just something at a greater frequency. I expect that through the rest of this year and in the next year, by the next eighteen months, majority of Teams' time is going to be spent on security. I think there was a stat that was put up earlier today during one of our keynotes where it was showing that I think over 50% of engineering time is going to be spent on security. I don't think that will last forever. Think that will be a short transition. At some point, the AI will have surveyed majority of the code and found most of the bugs or found most of the shortcuts.
00:03:35 · Dane Knecht, Sarah Guo
There's one that's kind of coming out today and has been started to be blogged about and tweeted about where one of the keys on the Internet that protects all TLS and WebPKI, which just secures all your connections, was secured by the number four. Literally, they basically used... If know about cryptography, it's all about randomness, right? That's why software has our lava lamps is so that you can get good randomness. And when a key out there is they use the seed, they use the initial thing to kind of create it with a single number four is going to be reverse engineered. AI can just do all these things that doesn't sleep. It's not like the one engineer you had that was red teaming things. Last week, think OpenAI found the seeds for the NIST curves were back in 2000 that were released. These things are just moving so fast and the bar is going up and the models are just getting so good at cybersecurity. Midtest was just kind of the tip of the iceberg there where... Since then, it's not just been the models getting better, it's the harnesses. It's how people know how to... How humans know how to use them and use those frontier models in order to find those exploits. [00:04:59] S1: Given your, you know, visibility, what do you know about the humans behind, you know, these attacks and harnessing these models taking the volume of vulnerability discovery up so quickly? Like, are they, you know, nation state actors? Are they script kitties? Like, what what can you say about how the the attacker landscape has changed?
00:04:59 · Sarah Guo, Dane Knecht
[00:04:59] S1: Given your, you know, visibility, what do you know about the humans behind, you know, these attacks and harnessing these models taking the volume of vulnerability discovery up so quickly? Like, are they, you know, nation state actors? Are they script kitties? Like, what what can you say about how the the attacker landscape has changed? [00:05:25] S0: Well, I actually think for some of these some of these larger vulnerabilities that have come out more recently actually haven't been nation states. They've they've been, you know, high school kids even that are [00:05:38] S1: We're gonna call them agent kitties now. [00:05:39] S0: Yeah. Yeah. That are that are just spending their time, you know, like they used to do, kinda capture the flag security contest. They're pointing their agents at an area and doing that. There's also... And there's financial award for them. There's bug bounties that they get paid out of sizable amounts. But it's given the tools that, honestly, the nation states have had in some forms for much longer either through agents or just through, you know, sure number of people that were working on the problems, giving it to the masses. [00:06:12] S1: This is the first time in fifteen years I've heard serious technical people say things like, well, we should just like air gap everything important. And we're like, you know, not gonna be able to trust the Internet for a while. And we just assume all the critical infrastructure and and government services fall down at some point. Is that your expectation for what happens?
00:06:12 · Sarah Guo, Dane Knecht
[00:06:12] S1: This is the first time in fifteen years I've heard serious technical people say things like, well, we should just like air gap everything important. And we're like, you know, not gonna be able to trust the Internet for a while. And we just assume all the critical infrastructure and and government services fall down at some point. Is that your expectation for what happens? [00:06:35] S0: Humans, we are pretty adaptable and we can move fast when we need to. And I've seen the industry kind of partner together. When things like this happen. People that usually think of competitors are no longer competitors. We are just literally protecting critical infrastructure, as you said. And I think when those kind of critical moments happen, people will rise to that challenge. So I'm a little less doomsday. I do think that a lot of the things that we've done over the past five to ten years, moving away from a kind of a castle moat infrastructure for security to moving to more of a zero trust does put a lot of companies in a better position where, you know, you're saying this office is completely air gapped. You're saying, you know, these devices, these these flows are secured in a different way, everything's going to be tightened.
00:06:35 · Dane Knecht, Sarah Guo
[00:06:35] S0: Humans, we are pretty adaptable and we can move fast when we need to. And I've seen the industry kind of partner together. When things like this happen. People that usually think of competitors are no longer competitors. We are just literally protecting critical infrastructure, as you said. And I think when those kind of critical moments happen, people will rise to that challenge. So I'm a little less doomsday. I do think that a lot of the things that we've done over the past five to ten years, moving away from a kind of a castle moat infrastructure for security to moving to more of a zero trust does put a lot of companies in a better position where, you know, you're saying this office is completely air gapped. You're saying, you know, these devices, these these flows are secured in a different way, everything's going to be tightened. [00:07:28] S1: What is it going to take for organizations to do what you're describing? Like, 50% of engineers do not work on security right now. I had Greg Brockman from OpenAI on No Priors podcast last week, and he said that he thought in 2027, people are going to spend as much money on tokens for security as engineering? Like you're saying, related idea. What is going to drive that shift?