The Information's TITV
01:06:42 · Stephanie Palazzolo, Brittany Greenfield
[01:06:42] S0: And where do you think is kind of the best place to insert yourself in the kind of software development cycle? Is it while they're writing the code? Is it after they've written it? During the checking process? [01:06:51] S4: It's got to be... Software development is represented by an infinity loop for a reason. And that's why you have to have security as part of the SDLC throughout it, including the dynamic management component of it. So this starts with sharing with your developers what those policies are. In the age of AI, as we're asking them to not just write code, but really delegate tasks and in some sense almost be closer to PMs, that policy sharing at the beginning, before they even write code or ask an agent to do it, is critical. What is the policy, and what are my security standards here? You then have to move into the finding and risk prioritization. Standards are great, but risk appetite is different for every organization, for every application even. And then you have to get into monitoring and saying, were these things fixed in the SLA that they need to be fixed in? You can't fix everything. And then, of course, there's the dynamic nature. We saw this last week with the PHP. A day before, we didn't know that there was a new vulnerability, and in a world where vulnerabilities are now the number one breach point, being able to respond in a timely manner and have that communication between security and development is critical.
01:08:08 · Stephanie Palazzolo, Brittany Greenfield
[01:08:08] S0: And I think more than just the fact that whether or not the code that's written is safe or not, it does feel like the AI coding tools themselves are perhaps giving hackers new ways to break into companies and thinking about the open code breach. I mean, if you were you know, if you were running cybersecurity for like a Fortune 500 company today, are there any kind of AI coding tools or capabilities that you would be telling them not to use or certain types of roles that shouldn't be using AI coding tools? [01:08:36] S4: Right. I don't think it's that. I think that you have to start with policies, the rules, the workflows. Let me sort of take a step back. Think about those of us that spend a lot of time writing prompts or building agents. We give it a role and an instruction, and we're very prescriptive. And right now, people are just... You know, I think it's 96% or so of developers are using AI coding tools, and they're doing it blindly. And so, this is like unleashing a thousand junior interns on your software development stack without giving them any insights or rules. So I think the bigger thing is developing those skills and making sure people understand the standards by which software and AI work together. [01:09:21] S0: So you're saying it's less about maybe limitingnot using certain tools or limiting to only certain employees can use them, and it's more about inserting more policies and guidelines upfront?: Correct.
01:09:21 · Stephanie Palazzolo, Brittany Greenfield, Lori Goler
[01:09:21] S0: So you're saying it's less about maybe limitingnot using certain tools or limiting to only certain employees can use them, and it's more about inserting more policies and guidelines upfront?: Correct. [01:09:33] S4: Right. So I think you have to look at it in three ways. One, we already talked about the volume. Right? Volume's increasing exponentially. Hey. Vulnerabilities are becoming the number one, attack point for breaches. And so you have to find a way to make sure that your security practices can scale. The second is surface area. Right? That goes naturally with just... With the volume, but what we're also not thinking about is the agents are now attack points. [01:09:58] S6: Mhmm. [01:09:58] S4: Right? So you have to have clarity on what you're using. You cannot allow your team to go off and start using their own agents. I had this conversation last night. People go home and suddenly put code in because they think that they're doing something right, and you have immense security problems with that, let alone also quality and consistency problems. I think the third is opacity. We have the opacity issue from the AI itself. We saw this with Astra, but also the opacity in what the process is. I'm a big believer that there are no new problems, just new applications of old problems. And here we have the people, the process, and then the tool. And the problem has been that we're running at the tool, and we have forgotten to put the process in and train the people.
01:09:58 · Brittany Greenfield, Stephanie Palazzolo
[01:09:58] S4: Right? So you have to have clarity on what you're using. You cannot allow your team to go off and start using their own agents. I had this conversation last night. People go home and suddenly put code in because they think that they're doing something right, and you have immense security problems with that, let alone also quality and consistency problems. I think the third is opacity. We have the opacity issue from the AI itself. We saw this with Astra, but also the opacity in what the process is. I'm a big believer that there are no new problems, just new applications of old problems. And here we have the people, the process, and then the tool. And the problem has been that we're running at the tool, and we have forgotten to put the process in and train the people. [01:10:43] S0: I mean, think one thing that we hear a lot from CIOs, CSOs is they're just overwhelmed by all of the tools out there, especially in a, you know, field like cybersecurity, I mean, you were giving advice to them other than, you know, buying Wabbi's products, how should they be thinking about what tools they should be buying, who they should be buying it from? Is it better to get something that feels more fulsome, something that goes after certain parts of... You know, how should [01:11:09] S4: I think? I would say don't let yourself be driven by fear. This is a hygiene [01:11:14] S0: That's a very tough thing
01:11:14 · Stephanie Palazzolo, Brittany Greenfield
[01:11:14] S0: That's a very tough thing [01:11:14] S4: right now. It's a tough thing. I think cybersecurity, CSOs have felt this, right? The beauty of cybersecurity, why I'm passionately in love with the industry, why I got into it from the broader enterprise software industry, was because you always have to be one step ahead. And so, I think CISOs have felt this pain because you often see, hey, we go buy 13 tools to try to tackle this one problem, and then they realize that those tools either aren't delivering value or they're too tough to manage. So, I would ask CISOs and CIOs to say, learn from your past lessons. This is nothing new for you. Take some time to evaluate the tools, but again, focus on that process because if you look at the process first, then the tools will naturally fall into place to be able to support it. [01:12:05] S0: And I think taking a step back, I think you're getting at this question a little bit in your answers, but it does feel like every day people are wavering back and forth between, you know, it's everything is so over. AI is this completely new technology that is, you know, creating these holes in our software that we've never seen before versus kind of like maybe what you're saying, which is like, we've seen this stuff before. Maybe this is a new technology, but we're... It's similar problems that we fix. Like how much of what is going on and what we're hearing from the model companies is hype and, and fear, you know, fear mongering versus something that we should really be concerned about. So this is where I love the word and,
01:12:44 · Brittany Greenfield, Lori Goler, Stephanie Palazzolo
[01:12:44] S4: and it's why the word and exists. Yes and no. Like, hey, is it hype? No, it isn't. Very real. We saw in Anthropic S1, right? AI is going to be one of the biggest global security risks ever. There's no doubt about that. But, that's a fixed problem, not a fine problem. We are heading that way. This just happened faster and sooner than I think anybody was was expecting it. The reason I say no is is we are pulling back. The numbers show it. And quite frankly, I actually like looking at the adoption of enterprise AI versus consumer AI. Yes, all consumers are using it, but it tends to be, you know, what's your color board? Right? Or help me come up with a recipe for dinner. You see enterprises using it at a third of the rate of consumers. So I do think we are in an optimistic moment where people are slowing down. Flip side is the adversaries are a real thing. Right? We saw, a couple weeks ago the Korean bank attacks. Right? They have always been working faster to go find and take advantage of those vulnerabilities. So I go back to the keep calm, implement a good process, and carry on, and do not get distracted by the hype piece of it. [01:13:59] S6: Mhmm. [01:13:59] S4: But it is real. [01:14:00] S0: Definitely. Well, I feel like that's the kind of calm and mentality that we need to be hearing more of.