00:18:01 · Gil Feig, Molly O'Shea, Shensi Ding
[00:18:01] S0: But Yeah. I don't know about that one. [00:18:03] S1: I've talked to a couple people about this. One of our interviews was with Gilly Ronen from CyberSearch. And he had a crazy, like, doomer viewpoint, but he's also being realistic. He's like, look, if you are multiplying the amount of instances that you could be hacked and there are breaches, it's obviously gonna happen. Yeah. So we were, like, talking about he thinks, like, really dark days are about [00:18:26] S2: Also, getting easier to find breaches too. I think you can just tell there's a lot more like automated, like ways to try to find bugs and like security issues. [00:18:34] S0: Yeah. [00:18:35] S2: So yeah, both sides. It's to like create issues and also easier to find them. [00:18:38] S0: I'll I'll be yeah. To be honest, like, I I'm on call this week for our team. I like to go back into the on call rotations just to kinda see what's going on. And yesterday, I had to manually go in and intervene because we all of a sudden had over a thousand bot sign ups in in like an hour, and we could see them actively scanning all the endpoints across our back end. And it was called like scanner a, scanner b, scanner c. And it's so hard to block them because they're coming from IPs all around the world. Fortunately, we have some good tooling with bot detection, we were able to to block them. But those are just getting really prevalent and all it takes is one and it could we know this from some recent instances, like it could mean the end of your company. So
00:18:38 · Gil Feig, Molly O'Shea, Shensi Ding
[00:18:38] S0: I'll I'll be yeah. To be honest, like, I I'm on call this week for our team. I like to go back into the on call rotations just to kinda see what's going on. And yesterday, I had to manually go in and intervene because we all of a sudden had over a thousand bot sign ups in in like an hour, and we could see them actively scanning all the endpoints across our back end. And it was called like scanner a, scanner b, scanner c. And it's so hard to block them because they're coming from IPs all around the world. Fortunately, we have some good tooling with bot detection, we were able to to block them. But those are just getting really prevalent and all it takes is one and it could we know this from some recent instances, like it could mean the end of your company. So [00:19:16] S1: Yeah. What else are you saying? I mean, you probably read [00:19:18] S2: and read Oh, He's so good [00:19:19] S1: at them. And research everything. [00:19:20] S2: He does the security reviews too for like different vendors that we end up onboarding on too. Wow.
00:19:20 · Shensi Ding, Gil Feig, Molly O'Shea
[00:19:20] S2: He does the security reviews too for like different vendors that we end up onboarding on too. Wow. [00:19:24] S0: Yeah. Yeah. I mean, I see a lot, like we've just been seeing just repeated attacks. We've been seeing people just, you know, like, I'm sure you saw the GitHub one recently. I think that was like, not that long ago, where basically Wiz found that they were able to do a single git push of a file and gain access to every single repository hosted on the platform. Unfortunately, they responsibly disclosed it, but I'm sure Wiz did not find that manually. They're using AI. They're finding these things. Everyone's hearing about Mythos, who knows how true the whole secrecy and whatever story is. But the point is, like, models are going to be really good at finding these things. So we need to get out of that. [00:19:58] S1: So what is your view on Mythos? [00:20:01] S0: I mean, my, I guess, I guess my take is like, it's- [00:20:05] S1: Hypothetically or, you know, realistically, I don't know which one
00:20:05 · Molly O'Shea, Gil Feig
[00:20:05] S1: Hypothetically or, you know, realistically, I don't know which one [00:20:08] S0: it is. I mean, I think it's realistic that if we have an incredibly smart model, it's going to be able to find a lot of things that have existed in these packages that we've been using for twenty, thirty years. I think it's also good that we're letting it loose, you know, for for kind of like security and researchers up front to find those things and patch them because we saw how bad the Axios attack was, where they just I'm sure they use an agent to find, you know, a a sort of like some problems and find patterns of how they could easily inject, something into the package without getting caught. But it worked. So I think it's also the other problem here is, you know, a lot of these attacks don't come from Americans or from people who who live a really great quality of life and are not, you know, not like looking for ways to make a quick buck. It's it's people who who necessarily need to do other things to find to find money in the world. They now speak English perfectly. They now write code perfectly, and they now have unlimited manpower all driven by AI. And so I think we're just gonna see more and more of it.
00:21:04 · Molly O'Shea
[00:21:04] S1: Sorcery is brought to you by Brex, the financial stack trusted by more than 30,000 companies, including one in three venture backed startups in The US. Nearly 40% of startups fail because they run out of cash. REX is literally built to help founders avoid that. Unlike traditional banks that let your money sit idle, chipping away at it with fees, REX is designed to help you spend smarter and move faster. Their all in one solution combines checking, treasury, and FDIC protection into one powerful account. You can send and receive money globally at lightning speeds, get 20 times the standard FDIC coverage through their partner banks, and even high yield from day one. With same day and even same hour liquidity, access your funds anytime. Companies like Scale AI, DoorDash, Service Titan, HIMSS, Anthropic, Flexport, Robinhood and Plaid trust and use Brex. Start today at brex.com/sorcery. That's brex.com/sorcery. Turing is training the next generation of AI with tasks that require real expertise and real world judgment. That's why companies like NVIDIA, Anthropic, Salesforce, and Gemini partner with Turing. Turing builds realistic reinforcement learning environments and data systems based on real operational traces, the kind of infrastructure Frontier Labs need to train superintelligence. Visit turing.com/sourcery. So as CTO, what are the precautions that you take? You have a bot detector, all these other things internally. Like, what are the how do you go about it?
00:22:41 · Gil Feig, Molly O'Shea, Shensi Ding
[00:22:41] S0: Yeah. So bot detection is one of them. You also you know, I think in insecurity in general, I think this is not commonly known, but your biggest threat is always internal. Right? So we're we're less afraid of someone scanning our ports and finding issues as we are someone compromising someone internally and phishing an account and then using that their account to do things or, you know, hiring the wrong person, hiring someone who secretly is spy. Like, that stuff sounds far fetched, but it happens. And that's why we're crazy about background checks and doing reference calls and making sure that we really are only bringing in trustworthy people. So again, I'm actually more afraid of that, of us bringing in someone, someone, you know, bad than I am of anything else. [00:23:20] S1: Oh, that's a good point. Yeah. I'm so curious. This might be a little off topic, but when, because most of these are organizations that try to hack into companies breach and then sell the data for millions of dollars. Yeah. What do they do with that data? What happens? [00:23:36] S0: What do you what? [00:23:36] S1: When they sell it to someone, what do they do with the data? [00:23:40] S0: I think it depends on [00:23:41] S1: what the [00:23:41] S0: data is. Yeah. Mean, depends on what the data is. Right? So imagine someone steals all of, I'm not going to use, I don't want to use merge as an example. [00:23:48] S2: It's bad karma. [00:23:51] S0: Data is unstealable. Let's say like someone hacked Plaid. I'm just going to pick up. Oh my god. They're financed. [00:23:58] S2: They can't.