The Information's TITV
01:05:08 · Brittany Greenfield, Stephanie Palazzolo
[01:05:08] S4: Thanks so much for having me, Stephanie. [01:05:09] S0: Of course. For those who might not have heard about Wabbi before, tell me a bit about your company and how its approach differs from what people might think when they think AI cybersecurity startup. Yeah. [01:05:21] S4: I'm going to give you a boring answer. We're a DevSecOps orchestration platform that's always helped companies develop and deploy software at the speed that enterprises need. So, some sense, we're not doing anything new in the age of AI. The volume is just faster, louder. [01:05:39] S0: And, you know, as you mentioned, it does feel like in the past year or so, the big difference has just been the scale and the amount of code that is getting pushed all the time. [01:05:47] S4: Correct. Right. Wherever you're looking at the metrics, whether it's, you know, pull requests tripling or quadrupling, actual lines of code increasing by 30%, there is no doubt that the biggest impact we are having in AI is in software development today. [01:06:03] S0: And so, the kind of amount of code that's being written has increased. But in terms of the quality of that code itself, is it more or less secure compared to human written No. Code in the
01:06:03 · Stephanie Palazzolo, Brittany Greenfield
[01:06:03] S0: And so, the kind of amount of code that's being written has increased. But in terms of the quality of that code itself, is it more or less secure compared to human written No. Code in the [01:06:14] S4: This is the problem that the software development industry is having today. While the amount of code is going up exponentially, the flaw rate is exactly the same. And so now, we are shifting from not just a finding problem to really being a fixing problem, which is why I say Wabbi's almost boring in this space in the best possible way. The fix has always been the issue for organizations, and now it's come front and center for every software development organization. [01:06:42] S0: And where do you think is kind of the best place to insert yourself in the kind of software development cycle? Is it while they're writing the code? Is it after they've written it? During the checking process?
01:06:42 · Stephanie Palazzolo, Brittany Greenfield
[01:06:42] S0: And where do you think is kind of the best place to insert yourself in the kind of software development cycle? Is it while they're writing the code? Is it after they've written it? During the checking process? [01:06:51] S4: It's got to be... Software development is represented by an infinity loop for a reason. And that's why you have to have security as part of the SDLC throughout it, including the dynamic management component of it. So this starts with sharing with your developers what those policies are. In the age of AI, as we're asking them to not just write code, but really delegate tasks and in some sense almost be closer to PMs, that policy sharing at the beginning, before they even write code or ask an agent to do it, is critical. What is the policy, and what are my security standards here? You then have to move into the finding and risk prioritization. Standards are great, but risk appetite is different for every organization, for every application even. And then you have to get into monitoring and saying, were these things fixed in the SLA that they need to be fixed in? You can't fix everything. And then, of course, there's the dynamic nature. We saw this last week with the PHP. A day before, we didn't know that there was a new vulnerability, and in a world where vulnerabilities are now the number one breach point, being able to respond in a timely manner and have that communication between security and development is critical.
01:08:08 · Stephanie Palazzolo, Brittany Greenfield
[01:08:08] S0: And I think more than just the fact that whether or not the code that's written is safe or not, it does feel like the AI coding tools themselves are perhaps giving hackers new ways to break into companies and thinking about the open code breach. I mean, if you were you know, if you were running cybersecurity for like a Fortune 500 company today, are there any kind of AI coding tools or capabilities that you would be telling them not to use or certain types of roles that shouldn't be using AI coding tools? [01:08:36] S4: Right. I don't think it's that. I think that you have to start with policies, the rules, the workflows. Let me sort of take a step back. Think about those of us that spend a lot of time writing prompts or building agents. We give it a role and an instruction, and we're very prescriptive. And right now, people are just... You know, I think it's 96% or so of developers are using AI coding tools, and they're doing it blindly. And so, this is like unleashing a thousand junior interns on your software development stack without giving them any insights or rules. So I think the bigger thing is developing those skills and making sure people understand the standards by which software and AI work together. [01:09:21] S0: So you're saying it's less about maybe limitingnot using certain tools or limiting to only certain employees can use them, and it's more about inserting more policies and guidelines upfront?: Correct.
01:09:21 · Stephanie Palazzolo, Brittany Greenfield, Lori Goler
[01:09:21] S0: So you're saying it's less about maybe limitingnot using certain tools or limiting to only certain employees can use them, and it's more about inserting more policies and guidelines upfront?: Correct. [01:09:33] S4: Right. So I think you have to look at it in three ways. One, we already talked about the volume. Right? Volume's increasing exponentially. Hey. Vulnerabilities are becoming the number one, attack point for breaches. And so you have to find a way to make sure that your security practices can scale. The second is surface area. Right? That goes naturally with just... With the volume, but what we're also not thinking about is the agents are now attack points. [01:09:58] S6: Mhmm. [01:09:58] S4: Right? So you have to have clarity on what you're using. You cannot allow your team to go off and start using their own agents. I had this conversation last night. People go home and suddenly put code in because they think that they're doing something right, and you have immense security problems with that, let alone also quality and consistency problems. I think the third is opacity. We have the opacity issue from the AI itself. We saw this with Astra, but also the opacity in what the process is. I'm a big believer that there are no new problems, just new applications of old problems. And here we have the people, the process, and then the tool. And the problem has been that we're running at the tool, and we have forgotten to put the process in and train the people.
01:09:58 · Brittany Greenfield, Stephanie Palazzolo
[01:09:58] S4: Right? So you have to have clarity on what you're using. You cannot allow your team to go off and start using their own agents. I had this conversation last night. People go home and suddenly put code in because they think that they're doing something right, and you have immense security problems with that, let alone also quality and consistency problems. I think the third is opacity. We have the opacity issue from the AI itself. We saw this with Astra, but also the opacity in what the process is. I'm a big believer that there are no new problems, just new applications of old problems. And here we have the people, the process, and then the tool. And the problem has been that we're running at the tool, and we have forgotten to put the process in and train the people. [01:10:43] S0: I mean, think one thing that we hear a lot from CIOs, CSOs is they're just overwhelmed by all of the tools out there, especially in a, you know, field like cybersecurity, I mean, you were giving advice to them other than, you know, buying Wabbi's products, how should they be thinking about what tools they should be buying, who they should be buying it from? Is it better to get something that feels more fulsome, something that goes after certain parts of... You know, how should [01:11:09] S4: I think? I would say don't let yourself be driven by fear. This is a hygiene [01:11:14] S0: That's a very tough thing