Inspired with Alexa von Tobel
00:28:28 · Alexa von Tobel, Dan Lorenc
[00:28:28] S1: Let's shift a little bit to security because there is actually I sit here as someone running a venture fund, and just every day worrying about the exponential number of ways that security is getting worse. And actually, so that was one of the questions I wanted to ask you, which is, what do most companies fundamentally misunderstand about software security today? So if you were talking to all your customers today, and we've had many CSOs say to us, this agentic software is happening, and it's happening in our in our orbit right now, and we actually don't have our arms around it. Just give a sense of, like, what what worries you that you would wanna say to everybody. [00:29:13] S0: Yeah. There's probably a couple different angles to take this one from, but I think you you touched on it right there at the end. This is the first, you know, massive technical change movement like this where security teams are not allowed to say no. Everyone understands how important this is, and they need to find a path to yes. And if they're too slow, it's happening anyway, without them being in the loop. They're not allowed to say no to this, even if it is dramatically adding risk, dramatically, you know, putting a company at risk of violating trusts, getting hacked, all of these things. And they have to figure it out quickly. And on this exponential slope that we're on, if a security team is, say, three months behind what engineering is doing, that three months is getting, you know, much, much, much bigger every month that passes. [00:29:57] S1: It's, like, three years.
00:29:57 · Alexa von Tobel, Dan Lorenc
[00:29:57] S1: It's, like, three years. [00:29:58] S0: Yeah. Three months today is, like, three, yeah, three years a year from now. And it's it's it's a very scary challenge for them. The attack surface is increasing. The more code gets written. People that don't know how to write code are writing code inside of companies. And they have to figure this out quickly. Otherwise, bad things are gonna happen. But what I think here is, like, I don't actually worry about it inside of software as much. A lot of people are very concerned about, you know, vibe coding and things like this inside of inside of software teams. The software industry is already pretty good at all of this. Right? You can take an intern off the street at most companies and have them shipping production code. The models are already better than interns. Right? If if we have guardrails, we have code review, we have tests, we have all this kind of process in place. The part where I think we're always want other parts to start writing their own... To do their own things, and they don't have all of that culture and all of that process baked in. If you have a finance team that builds some new app to, you know, do payroll next week, you don't have unit tests or code review for payroll, and that's the area where I think there's a lot of risk in the organizations aren't really well equipped to deal with it today.
00:31:02 · Alexa von Tobel, Dan Lorenc
[00:31:02] S1: Dan, important... What you basically just said is CSOs can't afford to say no, because each month is actually, you know, ex... It's three months. It's A year is three years of their organization being behind on what's possible. So it's basically a race for relevance inside these companies. Obviously, there's different types of companies, right? And I sold LearnVest to Northwestern Mutual, a big regulated company. So in health care, in financial services, places where they're regulated businesses for a reason because the gaps of what could go wrong actually are severe and have real consequences. Do you feel like there... If if you're, like, a big financial service firm, is the safer thing to wait and see and actually just... Because breaches can be so dangerous. How do you think a little bit about the moral hazard decision of CSOs right now in different types of companies? [00:32:07] S0: Yeah. I... I'm a little surprised that you don't see that a real change there in adoption between, you know, the most heavily regulated companies out there and startups. [00:32:17] S1: Wow. [00:32:18] S0: Yeah. It's... They all get it. You know, the CIOs of the biggest banks there are, you know, telling their teams to get on board here, because they know if they're not one of their competitors will. You know, there's a... One of the largest, oldest banks in The US has agents inside of their org chart as employees. [00:32:35] S1: Yeah.
00:32:35 · Alexa von Tobel, Dan Lorenc
[00:32:35] S1: Yeah. [00:32:35] S0: They're they're really leaning in here. Most shifts, yeah, you see the laggards, you know, the basic kind of crossing the chasm curve. That's all compressed. Even the the people that are going slower, like, two months behind, not six years behind like they would normally be with a technology rollout. And, you know, they're depending on everyone else to figure out to do it safely, but they have to be able to ingest that very quickly to that knowledge and those practices. You know, we had a customer conference a month or so ago, you know, I asked everyone, like, raise your hand if you're using AI. Everyone in the room, their hand goes up. Raise your hand if your security team is happy about it. You know? About a quarter of the hands stayed up. Raise your hand if your security teams are using AI. Even fewer hands went up. Like, that's the scary part of all of this. If the security teams can't get on board as quickly, that gap, those that one month turns into ten years.
00:33:21 · Alexa von Tobel
[00:33:21] S1: Yeah. That's that's really well said, Dan. That that... I I I see that perfectly. If you think about the hardest trade offs that you've had to meet at Chainguard... And, ultimately, let's just state it. Chainguard is the solution to a lot of these problems, which is that you give people a chance to scale as a muscle because you're doing a lot of the security work for people. Talk a little bit about the biggest trade offs you've had to make. You've gone, again, in under five years to a 3,500,000,000 plus in growing company, securing hundreds, now 600 plus companies. What has been your biggest trade off?
00:33:58 · Dan Lorenc, Alexa von Tobel
[00:33:58] S0: It's always about focus and making sure that we're not spreading ourselves making sure that we're doing enough as as we grow and we don't miss some of these opportunities at the same time. And, you know, as we get bigger, these things take a lot longer to do. Right? It's not just shipping stuff. It's, aligning marketing and sales teams and the entire go to market around everything that we're doing. And that takes a while. And so you can't just keep pivoting every single day, you know, at this scale like you could, when you're 10 people. And so it's... You you really have to figure out where we think the world gonna be a year or eighteen months from now and make sure we're building toward that. But then, you know, constantly be adjusting that and constantly, making these changes. Because you don't feel the mistakes today anymore. You feel them two years from now. All of the stuff that, you know, going is wrong inside of the company today, we can look back and it's, yeah, we didn't do the right thing to fix that a year ago. And now to fix it, we have to wait another year to really fix things. [00:34:54] S1: If you're an individual right now, should we be thinking about our security differently? [00:34:59] S0: As an individual? [00:35:00] S1: Yeah. As an individual. Meaning, there's just more risk. Right? Like... And what you basically just said, to simplify it, is that competition wins. [00:35:10] S0: Mhmm. [00:35:10] S1: It always wins. [00:35:12] S0: Mhmm.