No Priors: Artificial Intelligence | Technology | Startups
00:05:17 · Sarah Guo
[00:05:17] S1: So can you describe a little bit just because it's, I think, both close to impossible and then very useful in this period of AI to think about what is deployment right now and then, you know, what's changing about capability? What's the one liner on what the Onyxx product does today? And then, like, how you think about long term vision?
00:05:36 · Maxim Bar Kogan
[00:05:36] S0: Today, like, Onyxx is really does two things. Number one is we train models and build agents that can oversee other agents. And the goal of that is to say, okay, we need someone to be able to tell that all of these actions that are now happening by these AIs that we're adopting are legitimate because the number of these actions is growing exponentially. And so, things that we thought might be useful in the past, like a human in the loop, now that you're going to have 100x, 1000x, a million x of these actions, that's not going to work. And then we take that capability and we basically productize it in a product that we call the AI control plane or the secure AI control plane, where we come to Enterprise and say, hey, let's find all of your AIs and autonomous agents and hook them up to Onyx to this system where we can oversee what your AIs are doing, so that you don't run into the risk of, as you're exponentially doing more things with AIs, you're going to start having really bad actions happen. And we've seen some of that happen lately with downtimes that were caused by agents doing their own thing, agents accidentally publishing code and tokens that they weren't supposed to, and so on. So, definitely, enterprises are starting to realize that that risk has grown exponentially and that they don't have any way to stop the adoption. So, they just now have to do something to reduce the chance of these agent actions being illegitimate or incorrect.
00:07:11 · Sarah Guo, Maxim Bar Kogan
[00:07:11] S1: Yeah. I think one of the core reasons, obviously, the foundation model labs are going after code is because it is very powerful in general and can do, you know, in theory, all things software can over time. The flip side of that is it can do all things software can. Right? And so I joyously am already in the camp of a, having been over permissive with my agents such that it deleted data permanently and caused rework. So I'm like, [00:07:41] S0: oh, okay. [00:07:42] S1: I think I need some guardian spirits around it. Given your deployments today and talking to large enterprises, what is the state of deployment? Right? Like, much do you see that's within these more scoped, like, studio like platforms versus, you know, free riding coding agents? How much are you actually seeing in large enterprises and in different sectors?
00:08:09 · Maxim Bar Kogan
[00:08:09] S0: Yeah. So, I think right now, in our typical enterprise, we break it down to three categories. So, we break it down to various SaaS platforms that are typically more low code, where people build agents in this drag and drop way, and they're not really autonomous agents. I would think of them more as the automations. Then there are first party agents. People are building in their cloud, potentially because it's an application they want inside the company, or even a product they're planning to release to the customers that is agentic. And then the third category is very autonomous coding agents and assistants. Of these categories, I would say roughly at this point, over 50% is the autonomous coding agents and assistants in the average enterprise. Then probably 45% is those low code automations, and the last 2% are really the first party ones that they're building themselves, because obviously it's much harder to build effective agents, and it's much easier to adopt agents off the shelf or build them with low code. And that's what we're seeing. We do think that the automations are also the fastest growing category. So, it used to be that only developers would see cloud code growing like fire in our customer base, and now we're seeing a cloud co worker growing even faster. We're starting to see, to our own surprise actually, people adopting OpenCloud as a legitimate sanction tool in the company because the CEO is very driven to adopt AI. So, I think that today, autonomous Azure is by far the fastest growing category, today typically comes without any controls.
00:09:58 · Sarah Guo
[00:09:58] S1: So enterprises already buy, let's say, 100,000,000,000 of security today. They have lots of different protections at the endpoint and network and cloud and identity domains. What's relevant here for securing agents, or is none of it? Like, how do you think about the existing protection set?
00:10:24 · Maxim Bar Kogan
[00:10:24] S0: Security is always a space where you have some overlap between different tooling. In this case, and you have the concept of defensive debt as well. So, you want to have defenses at different levels of your technology stack to solve the problem. And that said, I think in this space, a lot of enterprises are kind of helpless because I'll take an example, the identity approach. Traditionally, if we have a software system that's running in our company, our first and most important control will be to limit what permission it has. And then no matter what, even if it goes wrong, even if it's compromised, it can't typically do stuff that it was originally allowed to do. But with these autonomous AIs, with these assistants, with these coding agents, we kind of want them to have our permissions because we want to tell Cloud Code to do something or Cloud Code work to do something, and we want to then go have lunch, we want to come back and see that it's done. And we want to give it so many diverse tasks as well that we kind of can't find the right set of permissions to do. So, suddenly our identity security software is not very useful. Then if you think about endpoint security or API security, if we tell our Cloud Code that we want to recreate a database and it should delete it and recreate it, that's great. That's gonna save our DevOps team and our platform teams a lot of time. It's a great benefit of Cloud Code. But if Cloud Code is working on an unrelated task and suddenly thinks that maybe the right thing to do is to delete our database and recreate it. Maybe we don't want that to happen. And unfortunately, our endpoint providers or API security tools, they don't know what cloud was thinking, why is it doing what it's doing, right? So, a lot of these existing tools, they don't have the context to understand what these very flexible, unpredictable systems are doing. If you're not building some kind of controls that are built for these systems, then you're either going to end up limiting them a lot, making them almost much less useful to the enterprise, or you're going to miss a lot of pretty dangerous things that they might be doing.