00:13:27 · Gil Feig, Shensi Ding
[00:13:27] S0: A lot of our product and adding new connectors and really supporting what our customers need for connectivity and for security and all of that, like, that's, that's great. But a lot of times now, I think, I think we kind of had this almost move back in time with trusting cloud and trusting other services. And, and you saw it when AI first, when Gen AI started to take off, everyone was like, no, I don't want you to train on my data and I don't want this and that. All these custom clauses got inserted into every contract that was like, use of AI, no doing this. And I think there was just fear of uncertainty, of like we have on these sales calls in general with people who just don't know what they're looking for. But now I think over the past year, you've seen people use the models, trust them more, and now everyone's backing away from that language. But there's still a lot of reservations now around using anything AI in the cloud. And so still demands for, no, we want this running in our own infrastructure. We don't trust a multi tenant. But it is kind of, again, moving back towards, okay, we trust the cloud again. [00:14:21] S2: Yeah. There's also, especially with the players that we're working with, there's already preexisting partnerships or requirements where they can only use certain cloud providers. And so then we have to, like, oblige by those requirements as well, which is our pain. But, you know, it's something that's worth it.
00:14:21 · Shensi Ding, Molly O'Shea
[00:14:21] S2: Yeah. There's also, especially with the players that we're working with, there's already preexisting partnerships or requirements where they can only use certain cloud providers. And so then we have to, like, oblige by those requirements as well, which is our pain. But, you know, it's something that's worth it. [00:14:35] S1: Yeah. I'm curious. You you spoke a little bit about this in the explanation, but cybersecurity has become a hot topic and we're seeing prevalent breaches over and over and over again. And a lot of times it's through integrations and different APIs connecting things together, whether it's like someone's using I don't know, like Vercel was talking about theirs openly. Like we saw the Mercur one. We've seen so many. Okay, so what is the state of cybersecurity in this layer of AI?
00:15:04 · Gil Feig, Molly O'Shea
[00:15:04] S0: Yeah, I mean, I think one of the biggest problems, so what caused, know, Merkor and a bunch of others is the supply chain attacks where everyone's using these same open source packages, but now the number of pull requests or code change requests that are being sent to GitHub I I haven't seen the chart in a little bit, but it's, like, massively soaring to the point where it's you can tell it's all agentic. Right? Agents are pushing a ton of code. You don't have enough humans to read all that code. So things are slipping by, things are getting in. And one of them was a vulnerability that gets injected into an open source package that everybody relies on and uses. And so all of a sudden that, that little, you know, virus or that file goes into all the code bases and people are just getting really screwed over by that. So I think there is a need for seriously like slowing down, especially with these core packages being incredibly careful. Yeah, I think that's one of the big ones we're seeing. We're only going to see more of that as more AI generated code continues to get pushed out. [00:15:59] S1: So what's your solution?
00:15:59 · Molly O'Shea, Gil Feig, Shensi Ding
[00:15:59] S1: So what's your solution? [00:16:00] S0: So that one is a tougher problem. But I think the problem that we fall into and what we're doing is is really this problem around, integrations, empowering data to be sent anywhere. So if you think about the world before Gen AI writing code, before agents actually, you know, sending data to places, what you had was you had an engineer who explicitly said, pull this data, exact fields from this platform, and then take it, transform it in this way and send it to this platform exactly in this way. And then a second engineer had to go and approve that code and make sure that that looked right. Now, instead you're saying, Hey, AI agent, that is non deterministic and can do whatever you want, whenever you want. Take the data from here and send it here, and please don't send the social security across with it. And then next thing you know, that gets sent across. So that's where we are. We're blocking that type of thing from ever happening. We don't trust agents. We say, hey, we can try. We can try to set rules, but there needs to be hard guardrails and blocks for things like sensitive data being sent across. And so we've doubled down there. We continue to double down around other things like jailbreak detection and all of that as well. [00:17:05] S1: That's crazy. [00:17:06] S2: I know. It is. I know we built a lot. It's really cool. Because I think honestly, like a lot of the issues with agents is like data leaving the system. Yeah, that's what would be really helpful.
00:17:06 · Shensi Ding, Gil Feig, Molly O'Shea
[00:17:06] S2: I know. It is. I know we built a lot. It's really cool. Because I think honestly, like a lot of the issues with agents is like data leaving the system. Yeah, that's what would be really helpful. [00:17:17] S0: Yeah. And, you know, I've written about this and we'll write more about it. But you know, it's kind of like if you have this sort of evil genius who's a mass murderer, but they're locked in a jail cell, like they can't do anything. And it's the same, it actually is the same thing as an agent though, right? Like, what do you care if the agent is so smart, it could do any cyber attack and knows how to do everything, but it has no tools and you're just it's sitting there just talking to you. Like, who cares? It can't do anything. The second you connect it to tools, which is what everyone is trying to do right now. That's where everything goes wrong. [00:17:45] S1: Well, heard with Slack too, there's like major, there's like a major leak there. Just as you deploy it, you can get all this sensitive data just through onboarding onto Slack. Yeah. Company information. And I'll probably take that part out. [00:18:01] S0: But Yeah. I don't know about that one.
00:18:01 · Gil Feig, Molly O'Shea, Shensi Ding
[00:18:01] S0: But Yeah. I don't know about that one. [00:18:03] S1: I've talked to a couple people about this. One of our interviews was with Gilly Ronen from CyberSearch. And he had a crazy, like, doomer viewpoint, but he's also being realistic. He's like, look, if you are multiplying the amount of instances that you could be hacked and there are breaches, it's obviously gonna happen. Yeah. So we were, like, talking about he thinks, like, really dark days are about [00:18:26] S2: Also, getting easier to find breaches too. I think you can just tell there's a lot more like automated, like ways to try to find bugs and like security issues. [00:18:34] S0: Yeah. [00:18:35] S2: So yeah, both sides. It's to like create issues and also easier to find them. [00:18:38] S0: I'll I'll be yeah. To be honest, like, I I'm on call this week for our team. I like to go back into the on call rotations just to kinda see what's going on. And yesterday, I had to manually go in and intervene because we all of a sudden had over a thousand bot sign ups in in like an hour, and we could see them actively scanning all the endpoints across our back end. And it was called like scanner a, scanner b, scanner c. And it's so hard to block them because they're coming from IPs all around the world. Fortunately, we have some good tooling with bot detection, we were able to to block them. But those are just getting really prevalent and all it takes is one and it could we know this from some recent instances, like it could mean the end of your company. So