00:10:30 · Hanah-Marie Darley, James Wise
I mean, if you talked about cloud migrations, some people are still in the midst of a cloud migration. The technological rate of change and the competencies that you had to develop, you had so much more time as a business. And now it's measured in days, weeks. And I think it's true of the threat landscape. We often talk about vulnerabilities and exploitations and threats are now measured in hours, not weeks. Um but but the same is true for the pace of technology, and and so the two are Gemini linked, I think. [00:10:57] S1: Yeah. And when we uh sort of first looked at Geordie, and obviously we we tracked um Henry and yourself and knew Benji from Snyk as well a little bit, uh, you know, you you were talking quite in a way at the time in in early 2025, it was visionary about uh, you know, agent adoption. But when we did references, a lot of security professionals were like, well, we're not using it. [00:11:15] S0: Not there yet.
00:11:15 · Hanah-Marie Darley, James Wise
[00:11:15] S0: Not there yet. [00:11:17] S1: And then there were two different perspectives we also got from experts in the space. One was, this is just another endpoint, we'll deal with it in the way we've dealt with everything else with our traditional uh cyber security stack. And the other one was, well, it's completely different to everything else. We'll just put it in a gateway and we'll just own all the data that way, and we'll do some more observability around it, and it it will be a completely different thing. Whereas, you know, you guys from day one came at it with a more broad perspective. Could you share a little bit about the, you know, the founding product principles of Geordie?
00:11:47 · Hanah-Marie Darley
[00:11:47] S0: Yeah, I think one of the most important things is that we always treated the agent as a completely new entity, as a new focus and as a new paradigm. And so I think anything that you're trying to adapt backwards from either endpoints or even from gateways, because the majority of how we tackle user challenges is gateway oriented. We put some sort of a gate in between the thing that we don't want you to have and the thing that we do want to keep protected, and therefore that will be a central access point for data, but also a central enforcement point. But I think the real challenge with agents is that they don't operate like human users. Um it's the same challenge with AI more broadly. We don't really have a category as humans for anything that has human principles but isn't sentient or isn't human. And so we sometimes over-anthropomorphize and we kind of escalate what AI is and what it isn't. And the same is true for agents. Agents operate very, very differently to human users. They have some commonalities, but they have machine speed performance. They have the capability to operate across multiple surfaces simultaneously. They have the capability in many cases in harnesses now to have their own sandboxes and to run some micro experimentation within their own operational cycle. And that would never happen from a human user. There's just no way to kind of parallelize that. And so all of the systems that are designed around how humans behave and how humans operate and controlling essentially human traffic is never going to work for agents because their operational pattern is completely different. So those were the founding principles that we came at it with. And so when we thought about how do you provide oversight, how do you provide certainty for security teams that needed evidence to move forward and to enable the business? How do you operationalize this across the business in a way that's secure, but also in a way that provides value, provides the investment back into that business in terms of either OpEx or CapEx? And really, it was fundamentally work from the agent, work directly at the agent and now the harness layer, and essentially think about the agent's execution loop.
00:13:42 · Hanah-Marie Darley
Every time the agent is making a decision, every time the agent is interpolating what the human user wants or reflecting back to its own system prompts or calling tools for context, all of that changes not only the intent of the agent, but also the layers of intent that are involved in the full decision cycle. And so we thought about all of those things when we designed our remediation system beam. So it's it's not just on or off. It's not just binary block or allow. It's not a gateway because ultimately a lot of the challenge with agents is you're not necessarily going to have every piece of traffic to route through a gateway. Part of it is very discovery-oriented. You don't know how the business is necessarily using agents because technology is moving really quickly. But you need to be able to move from discovery into operational control and security really quickly. And so a lot of that was, again, working directly at the agent, at the decision and context layers, which was at the time, very much as you say, uh, not in vogue, not what people thought was going to work. We had a million people tell us if you don't build a gateway, this won't work, this will fail. And we also had a lot of people talk about being very restrictive to surface areas. You're silly if you go across endpoint cloud code and browser. You you just need to pick a wedge. You just got to pick a wedge. But the problem is agents don't operate in wedges. And so again, you have to design the solution for the problem, not for how we've done it before.
00:15:02 · James Wise
[00:15:02] S1: I I had this early insight into this with a company we used to work with called Convergence, which which all new was bought. And I was asking a convergence model to do a task in Gmail, and it couldn't do it directly through the browser. So then it said, well, don't worry, I'll just spin up uh a new service and I'll I'll use their API. And I found your API key. I was like, oh my God, we are in a very different paradigm of security risk here. This is like 18 months ago to anything we've ever thought through before. Because as you say, agents don't act like humans. However, you know, the the work that agents do can look like human work. So how have the risks changed? If you're a CISO uh or if you're a you know security professional today, how have the risks changed that you um have to think about when you're you know working out what the next year, God forbid, three years of your security strategy should be?
00:15:51 · Hanah-Marie Darley
[00:15:51] S0: Yeah, I I think there's kind of a tactical and then an operational and strategic. So I'll start lower level. Um data mobility has never been more fluid and flexible than it is now. Um it started with things like share drives, which now feel like operational minimums. Um but previously, having shared access to documents and especially critical data was something that was really, really not a good idea and zero trust principles, et cetera. And then we sort of migrated that into zero trust principles, but with shared data stores, we now have autonomous systems operating across shared data stores that are also accessible by human users that might not be mutually exclusive. And so the mobility of data in an organization is structurally so different than what it was a couple of years ago. Um, and so things like data shared across context from an agent across tools, both of the tools might be allowed. So it's not an allowless blockless problem. But functionally, data that shouldn't be shared is being shared. Obviously, there's still the existing cyber risks of things like data leakage and insider threats and um the possibility of malicious actors or or of malicious outcomes. Um but then there's another type of malicious outcome, which is the agent deciding to do something on its own. And that may or may not be intentionally malicious. It might be inadvertently malicious. And so the agent intended to pursue its goal, it was trying to send an email for you and it accidentally dumped a database or it accidentally did something. Um and I think some people kind of create acute technology ism around this and they say, oopsie, like the agent did it did an oopsie. But it it really is structurally, the agent is a goal-oriented entity that is designed around specific contextual framing and is also designed around specific outputs. And so the way in which you have to control for operations now has moved from just human users, which are enough to manage, uh, to also autonomous users that are working at human, like 150x human capacity. And they're also operating across tools and systems that were previously bifurcated for a lot of human users. Um and so tactical. Um, then when you get to the operational layer, there is a lot of like legacy tools and systems that agents are now being used to update.