No Priors: Artificial Intelligence | Technology | Startups
00:23:49 · Maxim Bar Kogan, Sarah Guo
[00:23:49] S0: Right. I think it's one of those things that should not be possible. So, in theory, there's no reason why a Fortune 10 or 20 company would work with us because who are we? We're a two year old company. We're like a few people you know, who've done math and cyber. But I think it's an opening that only happens when their pain is very strong. So, their pain is so strong that they're gonna say, oh my god, I just saw this company come out of stealth, but it's a problem that I have daily. So, I'll give them a call. And suddenly, get inbound from these large customers, which is of course the best thing you could hope for as an entrepreneur. And I think it reflects, in my opinion, their understanding that a lot of the startups in this space are still small and new, but there's gonna be a huge company here, and we wanna find the right horse to bet on. So, we're gonna take a look at these companies. And number two, that if we don't do anything, then in a very short time, this will disable our business. At the end of day, security people are in the business of revenue preservation. They understand that this is between the two risks. They want to partner with someone that's promising and early rather than not do anything. [00:25:10] S1: The other thing besides agent actions across their surface area that every CSO I know is freaking out about and every engineering leader is freaking out about is the I would just describe it as the plummeting cost of vulnerability finding with these coding tools. [00:25:30] S0: Yes. Mythos.
00:25:30 · Maxim Bar Kogan, Sarah Guo
[00:25:30] S0: Yes. Mythos. [00:25:31] S1: And that has caused a number of issues for vendors that are being compromised. How do you think people should react to this other issue?
00:25:45 · Maxim Bar Kogan
[00:25:45] S0: I think mythos is really like, if you took me ten years ago, automated vulnerability research looked like a dream that would take twenty, fifty years to happen. Maybe it's because we were doing a lot of that in the Israeli intelligence, and we like to pat ourselves on the shoulder of how difficult the job is that we're doing. But it did look really far, and suddenly it's coming all at once. And so, I think that, first of all, the market is not overreacting. I think this is a huge change in what this means for security teams. If you're a pragmatic security person today, you understand that you need to move very quickly. Your strategy might look something like, I need to do the fastest quick fixes I can to mitigate the immediate risk. So, maybe I'll invest in whatever the vulnerabilities that have been found, let's try to mitigate for them, whether it is through patching or through mitigating controls. But then the real solution, and every security leader at large enterprise knows it, is that we need to have the foundational pieces in place to avoid those risks. And the foundational pieces are we need to have identity locked down. We need to have a firewall. We need to have endpoint detection. And for different asset classes in your enterprise, for different parts of your stack, there's a different foundational security mechanism that you need in place. For the AI attack surface that you now have, or for the AIs in your company, you also need a foundational security solution. That's kind of the role we play in that space. So, as part of your preparation for Mythos level models and beyond, you're going to need a lot of foundational security tools to fortify your different parts of the enterprise, and we're playing that part in the AI space.
00:27:45 · Sarah Guo, Maxim Bar Kogan
[00:27:45] S1: Do you have a point of view on the phased rollout or controlled rollout with Glasswing and Daybreak from Ant and OpenAI in this area? [00:27:55] S0: I don't have a strong opinion, but I think it's on the one hand, if we knew that there's not going be anyone who's going to release a Matas level model soon, I think that would be great because it gives enough time for me to prepare, to build the know how, to build the playbooks, to share that around in the community, and to make sure that we're not starting to see airlines go down and power plants go down and really disastrous effects that could happen. The problem is that if anyone gets to a mythos level model earlier, then in retrospect, it would look like a huge mistake because we could have at least given companies the choice to start moving very quickly and give more companies access to Mythos, now they're all vulnerable because there's a Chinese model that's Mythos level, and there's nothing they can do about it. So, I think hopefully we manage to do the gradual rollout correctly. I would really encourage that we expand the amount of companies that get access to this and make it much easier for people to get. I would advise everyone to assume that these models are coming anyway. The only thing you can do right now is to invest in these foundational controls that will stop the downstream effects of these vulnerabilities that are going to be found in their systems.
00:29:11 · Sarah Guo, Maxim Bar Kogan
[00:29:11] S1: Do you see in large enterprises any holdouts? Right? And I would say I actually haven't spent a bunch of time talking to people about this recently. But I remember a year and a half, two years ago, there were large companies that just said like, we're going to ban all of this stuff until it's safe. [00:29:34] S0: Yeah, I hardly see that anymore. I think in the financial sector, there's some companies that are more opinionated on what they allow. They still allow agents, but there may be like more granular as to like, maybe we're only gonna allow these two tools. I personally think that the companies that are gonna do well are the companies that are gonna allow a lot of different tools because the landscape is changing so quickly. If you bet on OpenAI a year ago, that would have been the safest bet in the world, but suddenly Anthropic has much better models and better tools, and potentially a year from now, there's someone else with much better tools. So, I think there is a price to pay, but I think if you're a large company, your risk profile is and should be different. When you're a startup, you want to have your agents do everything for you because you have everything to gain and you have nothing to lose. When you're a large, we're in JPMorgan. You have so much to lose, and you can maybe take a bit more time to gain what you can gain from AI. And by the way, JPMorgan is the adopt a guy very quickly. I think it is okay for companies to have a nuanced view the bigger they are on how they're adopting AI.
00:29:34 · Maxim Bar Kogan, Sarah Guo
[00:29:34] S0: Yeah, I hardly see that anymore. I think in the financial sector, there's some companies that are more opinionated on what they allow. They still allow agents, but there may be like more granular as to like, maybe we're only gonna allow these two tools. I personally think that the companies that are gonna do well are the companies that are gonna allow a lot of different tools because the landscape is changing so quickly. If you bet on OpenAI a year ago, that would have been the safest bet in the world, but suddenly Anthropic has much better models and better tools, and potentially a year from now, there's someone else with much better tools. So, I think there is a price to pay, but I think if you're a large company, your risk profile is and should be different. When you're a startup, you want to have your agents do everything for you because you have everything to gain and you have nothing to lose. When you're a large, we're in JPMorgan. You have so much to lose, and you can maybe take a bit more time to gain what you can gain from AI. And by the way, JPMorgan is the adopt a guy very quickly. I think it is okay for companies to have a nuanced view the bigger they are on how they're adopting AI. [00:30:46] S1: How do you think about that question for yourself? Risk profile, pace, the environment's changing very quickly, and then, you know, you see a lot of problems growing the scope of the product, and the research thesis here is already quite large.