The Future of AI Software Security | Ep. 39

SPEAKER_01

There is this saying in security circles that in order to survive a bear attack, you don't need to outrun the bear, but you need to outrun the person running next to you. That's the way that the business has been operating for a very long time. But with AI, you can think about the fact that there isn't just going to be one bear, there's going to be a thousand AI bears. That's terrible. So we're really trying to secure the whole software from AI bears, really.

SPEAKER_00

Today, I'm here with Daniele Perito, who co-founded FAIR. Before that, you were a founding team member at Cash App at Square, and you also ran data and security there. And then most recently, you've now become the founder of Depth First, which is an awesome AI security company. Really excited to be doing this podcast with you today. Thank you for having me. I want to start by learning about FAIR and what your experience was like there. But maybe if you could take us back to the founding inside or what led to the creation of the company.

SPEAKER_01

I would say that FAIR was probably a little bit of a contrarian bet. Yeah. People at the time didn't think that brick and mortar retail was this place where there was going to be a lot of growth. FAIR proved that. But at the time, Max, Marcel and I were talking about ideas on companies to start together with Jeff Golubson as well. And Max was introducing a high-end umbrella from New Zealand to the US market. That was a side gig. He was working at Square, but he had a little side gig. And he was seeing how getting sales on Amazon was extremely hard, getting into Nordstrom or Walmart was also extremely hard.

SPEAKER_01

And working with hundreds of thousands or millions of retailers was just impossible because there were many regional sales reps and things like that. So we thought that there had to be a better way. And then from Square, we knew that taking risk on behalf of your customers was always a good way to create value. Because Square is in the risk management business, in a sense, and we learned that there. So we decided to give retailers the ability to order and not have to pay for 60 days and be able to return anything that they don't like.

SPEAKER_01

So we took the discovery risk off of their balance sheet and then not even asking brands to offer that value prop, but us trying to use technology to offer that value prop. So that was a big insight. Yeah. Starting FAIR.

SPEAKER_00

Did it go the way you expected from the beginning? How linear was it from that concept to the company taking off and going the way that it ended up going?

SPEAKER_01

Yeah, I would say that pre-product market fit, there was a little bit of meandering. I think at the time we were unsure exactly what was going to give enough value to retailers to order on FAIR. We were experimenting with a lot of things. We were experimenting with something called consignment, which is a technical term in the business, but it's easy to put something on someone else's shelves without them having to actually buy the merchandise. Right. And we were experimenting with consignment that was extremely capital intensive for us and very risky. We were experimenting with points programs and we were experimenting with other things.

SPEAKER_01

And I remember one night, this was maybe July or August of 2017. Max was at a trade show in Atlanta. Every single day he was at a trade show and Marcelo and I were in the background coding changes so that he could sell them the day after. And he was just, I think we need to go with try before you buy, which is the same thing we've been experimenting around, which is net terms plus the ability to return. But I'm going to talk about it as try before you buy. And so that night I coded that behind the scenes. The day after he went in front of customers, they immediately got it. And that's when we knew we had something.

SPEAKER_00

Yeah. It's amazing how in those early days, the speed you can move, the way customers react when you do that is crazy. I remember we had some experiences like this early on at Lattice where you take some customers' bug and you fix it within the hour. And then it just completely changes the relationship. I'm sure you had a lot of that. [SPEAKER_01] Yeah, 100%.

SPEAKER_01

And I think it's really, product market fit is this thing that everybody talks about, of course. But I feel until you see it not being there and then being there. [SPEAKER_00] Yes.

SPEAKER_00

And that shift is real. Because before that actual shift, you try to convince yourself.

SPEAKER_01

I think we have product market fit.

SPEAKER_00

Yeah, because you don't want to tell yourself you're wasting all your time. Right. [SPEAKER_01] But after that, you actually say, oh yeah, I was lying to myself before.

SPEAKER_01

And this is actually what it is. [SPEAKER_00] Yeah.

SPEAKER_00

For us, we had something similar where it's a product was built and all of a sudden it went from no to yes. I think maybe there's some companies where it's more of a gradual thing that happens. Yeah. We can talk about this when we get to Depth First. But I'm curious how that experience compares to the current experience. Before we get there, I want to stick with FAIR a little bit longer. You talked about how it was an operationally intensive business that required a lot of rigor. Can you talk about what that looked like in practice? [SPEAKER_01] Look, one of our values at FAIR is seeking the truth. [SPEAKER_01] And that is necessary in operating a marketplace business.

SPEAKER_00

[SPEAKER_01] You are providing value to retailers by having more brands on the platform that can sell to them, providing value to brands insofar as there are retailers on the platform that buy from them.

SPEAKER_01

There are all sorts of balances you're trying to make sure exist between supply and demand. You want to give retailers amazing discovery. You want to manage risk so that retailers can get as much payment terms on the platform. They can order on terms as much as possible, but without risking too much on your end. And to brands, you want to onboard them as fast as possible, but also making sure that in their first week, in their first month, they get as many orders as they possibly can. So there are many factors in the marketplace business. And you're trying to make decisions within a system that is highly recursive and chaotic. Small changes can ripple out.

SPEAKER_01

And so intellectual rigor and data analysis is crucial. You want to give retailers an amazing discovery. You want to manage risk so that retailers can get as much payment terms on the platform. They can order on terms as much as possible, but without risking too much on your end. And to brands, you want to onboard them as fast as possible, but also making sure that in their first week, in their first month, they get as many orders as they possibly can. So there are many, many factors in the marketplace business.

SPEAKER_00

[SPEAKER_01] And you're trying to make decisions within a system that is highly recursive, where it's chaotic. [SPEAKER_01] Small changes can ripple out. [SPEAKER_01] And so intellectual rigor and data analysis is crucial. [SPEAKER_01] But of course, that always needs to be paired with intuition and a vision, because otherwise you can be a little bit too incremental. [SPEAKER_01] So you want to balance out these two things. But in operating a marketplace business, you really need to be rigorous.

SPEAKER_01

[SPEAKER_00] Yeah, I often think about that where a software business, another cut on this software business has these high margins. [SPEAKER_00] And that affords a lot of error underneath.

SPEAKER_00

When you're operating a business that has a different margin structure, let's say you have a 10% margin versus an 85% margin.

SPEAKER_01

[SPEAKER_00] There's just a lot less underneath there that you can operate within.

SPEAKER_00

So I imagine the daily workings of the company have to be more precise and measured. [SPEAKER_01] Yeah.

SPEAKER_01

I mean, one thing to say is marketplace businesses are not, depending on how you compute them, but usually you compute them over gross revenue. [SPEAKER_00] Yeah. So in general, they're more like 50% margin. [SPEAKER_00] Yeah, yeah, yeah. [SPEAKER_00] So I was even thinking of there's a business like Amazon or something like that.

SPEAKER_00

[SPEAKER_01] You know, it's at the extremes, how careful do you have to be day to day? [SPEAKER_01] There is a lot of rigor that you need to build in. [SPEAKER_01] You have all of these machine learning models that are making predictions at all times. [SPEAKER_01] And the business really relies on them to actually operate and flourish. [SPEAKER_01] The marketplace is really something that needs to flourish where demand must meet supply.

SPEAKER_01

[SPEAKER_00] I'd imagine that means you also need a culture of a lot of testing rather than maybe in a B2B company, you can do a lot of just here's a plan. [SPEAKER_00] And we know this is roughly going to work. [SPEAKER_00] It takes a lot of effort and you do the plan once versus I'd imagine a marketplace business. [SPEAKER_00] There's a lot more test things, see what happens in reality, and then you can grow programs over time. [SPEAKER_00] I would say that operating Fair has given me a healthy amount of epistemic modesty and humbleness because. About how much you can really know? How much you can really know.

SPEAKER_01

And I come from academia, right, where I was trained in some sense to be skeptical of my own beliefs. But there is nothing quite like trying to test your beliefs in the market to actually know the limits of your beliefs.

SPEAKER_00

[SPEAKER_01] Yes. [SPEAKER_01] Where you will launch an A-B test and be like, I am certain that this A-B test will land. [SPEAKER_01] And then you'll discover that there is a second, third order concern that you will never have anticipated that completely undermines the hypothesis that you had. [SPEAKER_01] Yes. [SPEAKER_01] And so this idea that there are limits to human knowledge and you need to experiment your way into things is really just beating to you if you're operating a marketplace business. Yes.

SPEAKER_01

[SPEAKER_00] I mean, in general, I really appreciate when people can express the confidence interval that they have on whatever they're saying. [SPEAKER_00] Right. [SPEAKER_00] I'm really sure about this thing. [SPEAKER_00] I'm 85% sure I'm right. [SPEAKER_00] I really like that actually when people can just admit that whatever strong view that they have, unless it's a piece of arithmetic, you probably don't know for sure. Yeah.

SPEAKER_00

[SPEAKER_01] I have this little quip, which is I say that the market is an incredible truth seeking machine for the type of questions that it can investigate. [SPEAKER_01] Now, you're not going to know whether neutrinos are a certain way or another way with the market. [SPEAKER_01] But for the types of questions like does a certain type of sign up flow work best for retailers or another type of sign up flow work best? [SPEAKER_01] Yeah. [SPEAKER_01] The market is really good at getting the answer to that question.

SPEAKER_01

[SPEAKER_00] Right on the other side of product market fit when you're like, okay, this thing's, you know, we've got something people want. [SPEAKER_00] It's working. [SPEAKER_00] Did you experience ease from there? [SPEAKER_00] Like did employees and candidates, did investors, like did people see what you saw at that point? [SPEAKER_00] Or was it this is still niche, the TAM's not that big or was it easy to get people excited? I think there was probably another two or three years. I don't remember the exact dates, but another two or three years of just pushing to get people to understand. Even though you knew it was working.

SPEAKER_01

Even though we, I mean, I think we had a very good idea that it was working. We had no idea about TAM. And that's why when founders talk to me and they're like, how do you think about the TAM of this business? I think TAM is just a directional thing where for the first two or three years, we were trying to estimate the size of the fair market in a thousand different ways. There were these signals that tell us there are millions of stores across the globe, trillions of dollars of wholesale orders. And it was just hard to wrap our heads around it. It took really two or three years for us to be like, okay, this is a gigantic market and we have a place in it.

SPEAKER_01

But investors didn't quite get that or many investors did.

SPEAKER_00

[SPEAKER_01] Of course, the ones that bet on us did. [SPEAKER_01] But I was in a lot of one on one conversations with candidates where I was just like, no, this is going to be big. [SPEAKER_01] Trust me. [SPEAKER_01] But yeah, I think it took a while to really get the word out. [SPEAKER_01] And I remember maybe it was four years into starting the business where now people were starting to repeat back to me things that I was trying to tell people three years earlier. You're like, where'd I hear that before? Right. And finally, it was just like, oh, finally, we get it now.

SPEAKER_01

[SPEAKER_00] Yeah. [SPEAKER_00] When you look around the AI landscape right now and you think about comparing this moment in time, starting a company today versus when you started Fair, does it feel qualitatively different? [SPEAKER_00] And the psyche of founders or how people are thinking about these types of questions? [SPEAKER_00] Or is it similar? I feel like you could rely on an assumption of some type of steady state system underneath you nine years ago. And right now, the assumption is that everything is about to change every three months in ways that are hard to predict. [SPEAKER_00] Right.

SPEAKER_01

[SPEAKER_00] And finally, it was just like, oh, finally, we will get it now.

SPEAKER_00

Yeah.

SPEAKER_01

[SPEAKER_00] When you look around the AI landscape right now and you think about comparing this moment in time, starting a company today versus when you started FAIR, does it feel qualitatively different? And the psyche of founders or how people are thinking about these types of questions? Or is it similar? [SPEAKER_00] Very different.

SPEAKER_01

I feel like you could rely on an assumption of some type of steady state system underneath you nine years ago. And right now, the assumption is that everything is about to change every three months in ways that are hard to predict. And you have to just stay alert to all the potential changes. And everybody is trying to see where the puck is going. And it's extremely hard. So I would say the level of energy, paranoia, the level. And I think it's also because the rewards are much better than that. It's bigger than ever. [SPEAKER_00] I mean, stuff growing faster than it ever.

SPEAKER_01

Yeah, exactly. So there is just a level of the stakes are higher and everything is just so intense all the time. And this was, I mean, don't get me wrong. Things were extremely intense. [SPEAKER_00] Yeah. Fair too. But it was like we had our market where we knew that it was there and we just had to figure it out within that market. Right. But now things are just changing all the time.

SPEAKER_00

Right. Both because the market might completely change. What product you could build might completely change. Competition might completely change. Just way faster. [SPEAKER_01] Yeah. Or we might get the singularity in a month. And everything changes. That's right. Yeah. Can we talk about Cash App, your time at Square and sort of the beginnings there? So you were on the founding team at Cash App. And you talked to me about how there was a certain mindset that you went into that with where you're like, taking a bet inside a big company. Can you talk about that?

SPEAKER_00

[SPEAKER_01] Yeah. Yeah. So this is something that I like to tell people a lot. Just establishing my frame of mind at the time. I joined Square as my first corporate job. I was a researcher before, in academia. I was doing a postdoc and I joined corporate America. And at first my feelings were, oh my God, everybody's going to be on top of it. Imposter syndrome. But then I think right after that, I started having this belief. And the belief was simply like, stated in my mind as: individually in a company of a few hundred people, there has to be a way for me to X the value of this entire business. I don't know how or why I had that belief, but I did. And I think that when you have a belief like that, it has a way of being self-fulfilling. Why? Because I think another way of saying it: if you knew the success was guaranteed, what would you do to achieve that success? If you knew there was a way, then your brain is just going to try to find a way through solution space to find the set of actions you can actually take. So the way that manifested itself for me was Cash App was a Hack Week project. It was spearheaded by Jack. At the time we were using a trick, which was sending an email, cc@cache.square.com. And as you know, emails can be spoofed and things like that. So everybody was a little bit worried at Square that things were going to get weird with security. I was working in security at the time at Square. And I was just like, hey, put me in coach. I want to work on this problem. And I was like, I want to make sure individually that this is implemented correctly. Now, a few months later, we moved away from the email trick and luckily because we built an app and it was much better. But the other thing that then happened is that our risk losses, our fraud losses from stolen credit cards and things like that were a little too high. And I remember going to my boss at the time and being like, I want to work on this problem. I think I can make a big dent. And it was still through this mindset that I had at the time, which was like, what is the biggest thing where I can have an impact? I think my brain is very anxious, paranoid. And I tried to always find ways in which things can go wrong. But that was very well suited to the problem of fraud and combating fraud. So I came up with a whole system. I implemented all these rules and machinery models where I had like one or two people helping me at the time. And so we implemented the system and we reduced the risk losses by 80%. We brought them into a range that was actually healthy. And then, in some sense, that allowed Cash App to thrive and survive and go on to become the massive business that it is. I think, according to public data and earnings calls, it's a $10 plus billion revenue business. It's amazing. So in some sense that did end up happening. That belief ended up materializing. Of course, it was a large team. Many people had.

SPEAKER_00

Yeah, but it's a good mindset. Because I also think when you feel like I could work really hard and nothing's going to come of it, that's super demotivating. Or if you're like, I can work really hard, but the best I can accomplish just doesn't matter that much. It's hard to care when you think those things.

SPEAKER_01

Yeah, and I think it's actually a mindset that is related to security in a sense, right? Because what do hackers do? Hackers find a way in where nobody else sees a way in. This suspension of disbelief is similar. For the hacker. Similar to how a hacker will think. It's like, there has to be a way to create value. There has to be a path for me, a set of actions, a few words to whisper to the right people at the right time, a piece of code that I can write, an idea that I can have, a partnership that I can form, a customer, whatever that may be. Yeah. It's also a win. Because what do hackers do? Hackers find a way in where nobody else sees a way in.

SPEAKER_00

[SPEAKER_01] This suspension of disbelief is similar. [SPEAKER_01] For the hacker. [SPEAKER_01] Similar to how a hacker will think. [SPEAKER_01] There has to be a way to create value. [SPEAKER_01] There has to be a path for me, a set of actions, a few words to whisper to the right people at the right time, a piece of code that I can write, an idea that I can have, a partnership that I can form, a customer, whatever that may be.

SPEAKER_01

Yeah. It's also a win. It's a win. It's a win. It's a win. It's a win. It's a win. It's a win. It's a win. It's a win. It's a win. It's a win.

SPEAKER_01

degree that our software is not secure, which it isn't, and we need to make it a lot more secure, then what are we even talking about? And so I was like, okay, if I can create a business that is both commercially successful, but it's aligned with the mission of making the whole software more secure, then maybe I can create a flywheel there. And the flywheel is helping secure open source software, building better AI to find vulnerabilities and fixing them in the software that runs the world, creating infrastructure, open source, anything, creating goodwill with that. And on the other hand, using the same technology that we build to create a product that customers want. And here we're talking about corporations like Square, Fair, Lattice, companies that are trying to secure their perimeter, making sure that their customers later secure. And I really thought that there was a way to create a massive business with a tremendous amount of positive impact by creating this flywheel.

SPEAKER_01

I would say that I think we're starting to get a good way there. The pieces are really falling in place. And I'm really excited about the mission. I could not be more excited. Broadly speaking, before we get into the specifics, what is the landscape for security with AI? If you had to try to describe the most important parts of the new territory now that there's AI, AI generated code, the ability to do reasoning to look at, if you're an attacker, what does this all mean for security? There are multiple lenses through which we can answer that question. But at the macro level, at the mission level, I'll start at the mission level and then the commercial side.

SPEAKER_01

[SPEAKER_00] At the mission level, software runs the world. There are billions and billions and trillions of lines of code and systems and configurations that make the lights turn on and operate the banks and all the things. Every serious security professional will tell you that there is always a way in. I think AI is fundamentally changing the equation that we can maybe get into that a little bit later, if you like. On the commercial side, I think people are figuring it out. Our take at first is that two years from now, a company like FAIR will operate pretty differently than the way that it operates today. Today, a company like SWAT or FAIR will buy a certain number of SaaS security products.

SPEAKER_01

They scan certain subsets of their code or their infrastructure. They do so largely using old school techniques like heuristics and rule-based systems. Those techniques necessarily have higher false positives, lower detection rates, and can only discover shallower problems. With reasoning and AI, what we really see happening is a convergence of all of these subcategories in security. And essentially what we're building is an AI security engineer. Think about a swarm of independent agents that are going through your organization, going through the lattice infrastructure, and they're saying, hey, there is a code bug here that allows someone to log in as someone else. And nothing before could detect that. It was not possible. It needed the intuition and judgment of a human. But today we're starting to approach the point where we can do that. Or there is a misconfiguration in your cloud that will allow someone to get in this way. The pieces were there. The detection rates were lower. The false positives were higher. The technology before only allowed to solve a little sliver of the problem. But with AI, we really think we can put it all together and make it feel like you have an AI security engineer all the time.

SPEAKER_01

Should it end like self-driving, to a degree where it's like you don't need to name, okay, here's it for permissions and here's what we care about for logins and here's what we care about for API keys and whatever else. And you're able to just say, I want this thing to just very intelligently say what are all the possible vulnerabilities and just swarm and look at it all?

SPEAKER_01

I think a lot of that is true. I think there is probably the human element that's still going to be something different. Someone calls, oh, I dropped my password. Can you give me your login? Yes, I think the human element is still there. I think there are always companies that need to understand how to interact with the human side and make sure that they authenticate properly and they don't do something. But on the software side, do you think that's basically where this is getting?

SPEAKER_01

I think there is going to be a great unification because the technology, to me, it's just a mechanistic claim. Before, technology called out small slivers of problems. And now the technology is actually able to generalize a lot better.

SPEAKER_01

Do you think in theory at the end state, let's go ahead four or five years and just assume things kind of stay what we expect, do attackers or defenders have the edge over time? I think it's a dynamic system. I'll use an analogy. Perfect security is not achievable. And I think this might seem like a scary claim if you're not into security, but everybody understands this intuitively. Everyone knows that there is no such thing as a perfect bank vault. A bank vault is only as secure as two things. Number one is how difficult we can make it to attack it, to get in. And that's a matter of cost, equipment, expertise to actually drill into it or lock or things like that. And then the second aspect is how likely it is that you're going to get caught. What are the sort of disincentives there? So you do the equation and then thieves and attackers do pretty rational math there where they say it's not worth it or it is worth it. In software, it's similar. There is no perfect vault. That's just impossible from a purely theoretical perspective. And attackers are making the same judgment call. And it has to do with how hard is it to get in. And it has to do with how good

SPEAKER_01

to actually drill into it or lock or things like that. And then the second aspect is how likely it is that you're going to get caught. And what are the disincentives there? So you do the equation and then thieves and attackers do pretty rational math there where they say it's not worth it or it is worth it. In software, it's similar. There is no perfect vault. That's just impossible from a purely theoretical perspective. And attackers are making the same judgment call. And it has to do with how hard is it to get in. And it has to do with how good your protections are and then how good enforcement is. But the reality is that online enforcement is last. It's much more difficult. It's much more anonymous. You're not going to leave fingerprints and you might be in a state where there is no bilateral treaties for things like that. So the equation has the same factors. Enforcement is a lot smaller now. So therefore it's really about cost. How much does it cost to get in? With abundant intelligence, that cost is bound to go down. And I think what's going to happen because of that is that we're going to see a lot more frequent attacks for organizations. And on the other side of that, I think we need to get far ahead of the attackers. So I'll get to the actual question, which is, I think a company at first is going to have to get in front of the problem, help organizations secure themselves for this coming wave. And I think we're doing that. On the other hand, though, I think that the balance of attackers and defenders is not going to change drastically because defenders still have a certain advantage, which is they have full context. At first, we spend hours and hours of compute on one of our customers' code bases to fully understand how it works. The AI spends hours and hours understanding, those are the ingress points. Those are egress points. This is the inputs and the outputs. This is how everything works together. And using that knowledge, the AI helps secure the business. Attackers need to fly blind. There is another advantage that the attackers have, which is defenders need to find every attack. Attackers need to find one. But I do think that with the technology that we're building at first, we can tilt the scales in favor of defenders.

SPEAKER_01

[SPEAKER_00] You also have some advantage as a defender because you can know everything about your own systems versus an attacker. You can't know everything about the system. Exactly. This is the context point that I was making. Our AI spends hours and hours mapping out everything. I guess every time you push new code, though, it exposes a potential for new vulnerabilities too.

SPEAKER_01

[SPEAKER_00] Yes, exactly. And that's why one of our products is one that scans all of your pull requests as they're being written. And I think one thing that I've noticed at both Square and first is that there's always been a little bit of difficulty between prioritizing security versus productivity. And I really think that this is a false dichotomy at this point. I think another big thing that AI will enable is a great reunification piece between the InfoSec teams and the security teams, and they'll be able to achieve that security that they want without impacting productivity. It's like a drag.

SPEAKER_01

Security engineers had to sometimes say, hey, folks, we need to look at this. Give us a day or two and we need to. And that was totally rational. It was the way to do it. But if you move at the speed of AI, you can do those reviews much faster. And so I think we're also going to see a little bit of reunification. I think we will be able to achieve security with productivity as well.

SPEAKER_01

It's funny also because outside of engineering, I think people understand security as password protection and random stuff, you know, if somebody sends you a phishing email, be careful. But that is part of it. And there's probably a whole separate approach needed there. But for the software piece, it does seem like everything's about to probably look very different. That's why I'm here too, because I want to tell people how cool security is. I got into security originally in grad school because of how fantastical it is. You know, there's attackers and defenders and firewalls and bastions. It's really just a fantasy world. It's really funny because the excitingness of it ranges from password manager and somebody at your company telling you to follow these protocols, that's one side. And then the other side is Ocean's Eleven. Exactly. So people, I think the first thing, if I ever tell someone that I'm working on security, I think the first thing that they think about is, oh, should the other day I had to reset my password? That was painful. I think that's the first thing they think about. But the reality is that what they should really be thinking about is those crazy hackers that are doing daring things to get into systems, high level government agencies. That actually is what security is at the limit. And it's incredibly intellectually stimulating. It's at the edge of technology. It's also possible that by the end of the cloud software generation, it was getting a little bit boring. And now with AI, it's back to this very fresh thing. Right. Because I think it goes back to that point I was making, which is security is relative to the level of attacks. Right. So we had reached a steady state where a company could operate with a team of ex-security engineers and business would go on and the likelihood of attacks was relatively low. So you could put security a little bit on the back burner. There is this saying in security circles that in order to survive a bear attack, you don't need to outrun the bear, but you need to outrun the person running next to you. I think that's the way the business has been operating for a very long time. But with AI, you can think about the fact that there isn't just going to be one bear. There's going to be a thousand AI bears. That's terrible. So we're really trying to secure the world's software from AI bears.

SPEAKER_01

Why does it seem like security is its own ecosystem echo chamber world? To me, I'm not lucky to invest in you, but in general, I don't do security companies. And what I found is it seems its own world. Why is that? Why is it not similar to other software categories? For context, I was in charge of security affairs during my tenure there and had a team of folks that was super talented. And as well as Cash App, that was within Square. to be one bear. There's going to be a thousand AI bears. That's terrible. So we're really trying to secure the world's software from AI bears, really.

SPEAKER_01

Why does it seem like security is its own ecosystem echo chamber world? To me, I'm not lucky to invest in you, but in general, I don't do security companies. And what I found is it seems like its own world. Why is that? Why is it not similar to just like other software categories? For context, I was in charge of security affair during my tenure there and had a team of folks that was super talented, and as well as Cash App that was within the Square ecosystem. I would say that security is such a different market just because of how hard it is for both buyers and sellers to know what they're buying, what they're selling. When you're selling observability software or databases, someone can try your database. You make a claim. I test it. I see it and it's done. If I run a company like FAIR, I don't necessarily know everything that is wrong or Lattice or anything or any other business really. And a vendor, a security vendor comes in saying, I think these things are wrong. And I was thinking, are they really wrong? First, you don't know because the claim may be partially incorrect because many security issues may be false positives because it's almost true that someone could take advantage of it. But there's this one little detail that makes it not true. So first you need to investigate every single claim. So that's the first part. Both the buyer and the seller might have different opinions on what's really a false positive, what's really a true positive. And then another more pernicious part is neither the buyer or the seller know what the true positives are. So let's say that I go into your organization and I don't find anything. Did I not find anything because I'm not good? Or did I not find anything because you don't have anything to find? Neither of us knows. So the information of the ecosystem is weird. Very hard to get. It's a worse than a market for lemons in some sense. Neither the buyer nor the seller really know what's going on. And I think with AI, actually, we can overcome that because I think the reasoning abilities of these models can actually do that. You can trust that the AI will find the bug if there's a bug. And also you can make sure you can trust that it will find a higher percentage of those bugs eventually. And then I think this is why we're investing in technology. And I can tell you about our investments there. The percentage of bugs that you can actually find is increasing pretty rapidly. So that part of the equation is changing. And then the second part is that the AI can actually operate almost like a human in the sense that they can verify their work. And they can be like, oh, those were my assumptions. I thought that there was a real security problem because X and Y and Z. And actually, one of the things our customers love about our product is that we tell them, we list out all the assumptions that we made to conclude that something was a real security issue. And we showed the work that the model has done to actually verify each assumption. Security is a different market because of those reasons. But I do think that AI hopefully will change the equation a little bit where it's going to be much more easier for buyers and sellers to be on the same page exactly on the value that is being exchanged. Getting into the tactics of depth first, what are the important pieces of technology for you all to build to be able to accomplish this?

SPEAKER_01

[SPEAKER_00] Yeah. So maybe let's digress a little bit. So I'm one of the founders and the executive chairman. Kasim is the CEO. He comes from Databricks. He was a director of infrastructure there, also in charge of security. And then Andrea is the CTO. He comes from DeepMind. And he was one of the authors of Alpha Dev, which is the reinforcement learning algorithm that found a better way to sort and hash on Google. And I think this is almost like the perfect team to go after this problem. Because AI, so to answer your question, AI has a big infrastructure component, especially when you're doing AI for security. We're doing these technical things. I don't want to go into too much technical detail, but we're spinning up Docker containers to run code inside so that the LLM can test whether certain hypotheses are true or not. And having hired a bunch of folks from Databricks has helped us a ton in setting up that infrastructure. People have been calling it the scaffold, the harness, but it's our intelligence layer that allows us to really repurpose the technology that we built on each new problem. So vulnerability discovery is one thing we've applied it to, but we also applied it to other things. And each thing that we apply it to becomes easier and easier because we built a really solid AI infrastructure there. The second piece is more like the deep research side, which Andrea has done before at DeepMind. Fundamentally, I believe that reinforcement learning plus large language models will allow us to create a superhuman hacker for defensive purposes. We were talking about the fact that systems, we were only able to find a certain low fraction of the real problems that existed. And that was because the other problems were deeper and deeper and more and more complex. And I think with reinforcement learning, we can teach these LLMs to go deeper, to find those clever ideas that will allow them to put two small vulnerabilities together and combine them into something that is actually real. We have some security researchers on the team coming from Apple and security service like IDF. And the way that they work is phenomenal. Their brain worked differently. When Mabo and the team tells us that he's discovered Amalabini with our LLM and how he verified it and how he actually sometimes pieces it together, it's wonderful to see.

SPEAKER_01

Is that way of thinking learned or is that a certain brain type that exists from the beginning? Is it something that comes out of experience or is it something that's by nature?

SPEAKER_01

[SPEAKER_00] I feel like just almost like everything is probably a combination of nature and nurture. Personally, I feel like my inclination of being a little bit of anxious, paranoid person that is always trying to see how things could go wrong helps. It's definitely the background thread in my brain that is constantly seeing how things can go wrong is definitely helping in that pursuit. And there are definitely people that are more apt at stepping out of the box and seeing things from a different angle, which you clearly need. But I will say that it's probably just almost like every other thing. It starts with probably a small talent, which then tells you, oh, I'm good at this. And then you invest more in that. And then you get better at it. But if I had to guess, the seed was actually quite small and then it blossomed because you invested all the time because you were good at it.

SPEAKER_01

[SPEAKER_00] my brain that is constantly catastrophizing and seeing how things can go wrong is definitely helping in that pursuit. And there are definitely people that are more apt at stepping out of the box and seeing things from a different angle, which is what you clearly need. But I will say that it's probably just almost like every other thing. It starts with probably a small talent, which then tells you, oh, I'm good at this. And then you invest more in that. And then you get better at it. But if I had to guess, the seed was actually quite small and then it blossomed because you invested all the time because you were good at it.

SPEAKER_01

So this is the technology underlying the product. And then I guess is the idea with the product itself, should it get to a place where a customer can just install Depth First and they just know that you're constantly exposing vulnerabilities at a way higher rate than people and you're doing it more thoroughly, faster, cheaper. Is that basically it?

SPEAKER_01

[SPEAKER_00] Yeah, that's the goal. And I think by training our own post training, our own LLM, which we're experimenting with right now, what we hope is that we will have a technological edge and we can tell customers. I think it's two things. One is the technological edge of our AI stack. And then two is really thinking about the problems the right way. So for example, we started with code, but we are now telling customers, Hey, if you link your staging environment, we can test the findings against your staging environment to tell you whether something is real or not. So I think expanding into other areas that our customers care about is going to be crucial and really giving them an interface, whatever that means. You know, right now we have a web app, but I'm also thinking that at some point you need to be able to talk with this thing as if you were talking with a security engineer, being like, Hey, can you double check this thing please for me? And then giving the AI access to the components, giving them the context. I think the context is super important. Another thing about security is that it's really context specific. If you're operating a social network, the fact that people can see a customer's profile is the way that it works. But if you're creating a corporate Slack platform, a messaging platform for corporate, you probably don't want the profiles to be public. So that's context specific. So our systems, as I said earlier, spends hours in a code base, sometimes going into the old commits. Because if you think about it, whether something was done differently earlier than it is done today may tell you, Hey, we actually had an assumption a year ago about how this thing was supposed to work, but now it's not like that anymore. Why? And so it's really about building a centralized repository of context about the security posture and organization. And that's what we're building. Then adding agents that can go in and say, let me look at your code. Let me look at your infrastructure. Let me look at your configurations. Let me look at this. Let me look at that.

SPEAKER_01

[SPEAKER_00] Will your system learn as a result of knowing, you know, the more customers you have, the more you will learn to be safer for the next one? Or is each one its own new instance? [SPEAKER_00] So as an enterprise company, you know, one thing. [SPEAKER_00] Yeah, of course data can't be shared. Data cannot be shared. The customer data is never made into the weights. Yes. Never. We just don't do that. We cannot and we will not. But what I will say is that there is an outer loop, as the folks in AI like to say, there's an outer loop, which is we learn from the types of issues that we are not. You, the people at Depth First.

SPEAKER_01

Yes. The people at Depth First learn. So what do we do when we see that we're not quite doing as well in that type of issue. We will take some open source software, find the issues that are similar and then train on that. So that's the way in which we're participating in an ecosystem.

SPEAKER_00

[SPEAKER_01] Yeah. [SPEAKER_01] That's not that different from how any other product becomes better because more people use it. Because as you join a platform or a SaaS offering, you're probably benefiting from the fact that other people have discovered ways to use it that have been built into the product. [SPEAKER_01] Yeah. [SPEAKER_01] So in that sense, there is some. [SPEAKER_01] Do you think of Depth First, when it's a security engineer operating on the team? Is its role to help manage the human security engineers or are the human security engineers managing the AI?

SPEAKER_01

I think it's going to be a collaborator. I think it's going to be like the humans will probably have the ultimate amount of final say in context. I think you still need that. For now. Probably one day you don't. [SPEAKER_00] At that point, it's not this company that changes. I think the whole society changes. And I don't know what happens. [SPEAKER_00] By the time that's happening, it's like all these rules don't apply anyway.

SPEAKER_01

[SPEAKER_00] Yeah. And then I think we need to figure, we need to have an entire different conversation as a society about what's going on. But before that, I think the security engineers would be the ultimate judges of what's going on and making sure that everything works.

SPEAKER_01

[SPEAKER_00] Okay. I want to switch back to generalities around building this company versus building Fair. And we talked a little bit about the mindset of the grounds are shifting faster, the rewards are bigger than ever. So that changes things. I also imagine that in some ways, the types of culture inputs that you want are a little different, maybe the types of people are a little bit different. What have you found when you take that difference in the environment, how does that apply to building a company now in this era? Whether it comes to recruiting, the way you manage the team or anything else like that?

SPEAKER_01

So there's this book called The Platform Revolution, and they talk about two types of businesses, platform businesses and pipeline businesses. Platform businesses are dual sided marketplaces, social networks and things like that. Fair. Exactly. Pipeline businesses are businesses that produce a service or good and sell it to their customers. And there isn't much interactions between the customers or there isn't a lot of interactions on the other end. I would say that in a company, in a platform business, a marketplace like Fair, I think you need to keep a tighter grip on the business just because everything is so interconnected that it's hard to just let people completely run things because there is always going to be second and third order things that might happen. In a pipeline business, I'm noticing with Depth First, I think there is a little bit more of letting a thousand flowers bloom and seeing what works. But so that's one potential.

SPEAKER_01

businesses that produce a service or good and sell it to their customers. And there isn't much interaction between the customers or there isn't a lot of interactions on the other end. I would say that in a company, in a platform business, a marketplace like FAIR, I think you need to keep a tighter grip on the business just because everything is so interconnected that it's hard to just let people completely run the things because there is always going to be second and third order things that might happen. In a pipeline business, I'm noticing with that first, I think there is a little bit more of letting a thousand flowers bloom and seeing what works. But so that's one potential, but it's a small difference. I'm not saying that it's huge.

SPEAKER_01

No, it makes sense. So it's almost like you just need greater coordination of efforts in a marketplace business versus a pipeline business. You need systems that let the flowers bloom. I think so. I think that's a fair characterization. So that's one thing. A lot of things are the same. For example, one of the things that I tell folks that I work with is don't shy away from putting 30 data points on a spreadsheet and look at them and see what's going on. And data points here is a generic term. It may be 30 customers. It may be 30 issues of chargebacks on your platform. It may be whatever it is. 30 is approachable. I'm, I could do that in two days for most things.

SPEAKER_01

Yeah. It could be two days. It could be two hours. Just spend some solid time. You're going to have a few things happen. One, you're going to build so much intuition about whatever that is. You're going to be, oh, actually that is how that works. And that was already incredibly valuable. But then I think it forces you to overcome this anti-pattern that we have as tech people, which is we want big data because that's the only way to know. A lot of data is the only way to know. But the reality is that with 30 data points, you're going to know whether something is 60% plus or minus 10% or it's 10% plus or minus 10%. And you can know a lot from that fact alone. You know, is your conversion rate, is your chargeback rate, whatever that may be. It's roughly good or it's roughly bad, and make a decision. Yeah. And then take the top three things you've learned and try to address them. So even with everything, when it came to FAIR, get an actual bunch of search results and look at them one by one and form an opinion about when is it that you don't think they're good enough and why? And is it because they're completely irrelevant or is it because they're just, yeah. Even though it's theoretically a little bit less accurate, I also think when you spend time in 30 anecdotes versus 3000 unemotional pieces of data, it's just very different.

Yeah. And you learn more when you look at an anecdote. Absolutely. And this is, I feel like I want people to form a deep intuition about the data, the customers, talking to good customers and things like that. And this is one way in which it happens. Yeah. And it's a little bit of a blind spot. And by the way, I try to do this myself. I seek out times where I can just put on my AirPods and put on some music and then churn through a bunch of data in a spreadsheet because I find that to be an important avenue in which I can actually get through context about what's going on. Yeah. What else would you think about, because I obviously like decision making is such a central part of what you're trying to create and what you're trying to do yourself. What else do you think about at this stage for decision making?

So another thing with that first is that I'm trying to help with all of the context that I have accumulated at FAIR, but trying to only take with me the good lessons. I feel like I could potentially overshoot my role by trying to apply the same exact learnings, the same exact patterns. It is an enterprise security SaaS company and using AI and it's just a very different type of business. And so now being a pipeline business, I think we can make sure that people can experiment. And so this is giving me the freedom to step back a little bit. But I think there's also an element of trying to take the learnings that I have, but allowing experimentation.

SPEAKER_01

Yeah. And I guess probably also with that, you're like, as long as the guardrails are safe, because obviously you need that as a security company, you probably want people to try things quickly in general. For sure. And I think we have a lot of security expertise inside, so we really make sure to build things properly from the beginning in a secure way. But when I talk about experimentation, I also talk about things that, let's see if the AI is able to solve this problem. Yeah. You know, you can do that. You're going to have someone spend two or three weeks on that. I always thought, as long as it's a two-way door decision, the faster we can try stuff, the better. Absolutely. Yeah. I'm always about making three 90% confidence decisions every week rather than one 99% confidence decision every quarter. Yeah. Well, Daniel, this was really fun. Thanks for making the time for this and super excited what you're doing at first. Thank you so much.

SPEAKER_01

It's win. It win. It win. It win. It win. It win. It win. It win.

SPEAKER_01

It win. degree that our software is not secure, which it isn't, and we need to make it a lot more secure, then what are we even talking about? And so I was like, okay, if I can create a business that is both commercially successful, but it's aligned with the mission of making the whole software more secure, then maybe I can create a flywheel there. And the flywheel is like helping secure open source software, building better AI to find vulnerabilities and fixing them in, you know, the software runs the world, creating infrastructure, open source, anything, creating goodwill with that. And on the other hand, using the same technology that we build

SPEAKER_01

to create a product that customers want. And here we're talking about corporations like Square, Fair, Lattice, you know, companies that are trying to secure their perimeter, making sure that their customers later secure. And I really thought that there was a way to create a massive business with a tremendous amount of positive impact by creating this like flywheel. I would say that I think we're starting to get a good way of the way there. And like the pieces are really falling in place. And I'm really excited about the mission. I could not be more excited. What's like, broadly speaking, before we get into the specifics, what is the sort of landscape

SPEAKER_01

for security with AI? Like what's the, if you had to sort of try to like describe the most important parts of like the new territory now that like, you know, there's AI, AI generated code, you know, sort of the ability to sort of, you know, do reasoning to look at, you know, if you're an attacker, like what does this all mean for security? There are multiple lenses through which we can answer that question. But at the macro level, like at the mission level, I'll study at the mission level and then sort of the commercial side.

SPEAKER_00

At the mission level, software runs the world. There are billions and billions and trillions of lines of code and systems and configurations that make, you know, that turn the lights on and they operate the banks and all the things. Every sort of serious security professional will tell you that there is always a way in. I think AI is fundamentally changing the equation that we can go maybe into that a little bit later, if you like. On the commercial side, I think people are figuring it out. Our take at that first is that two years from now, a company like FAIR will operate pretty differently than the way that it operates today. Today,

SPEAKER_01

a company like SWAT or FAIR will buy a certain number of SaaS security products. They scan certain subsets of their code or their infrastructure. They do so largely using old school techniques like heuristics and rule-based systems. Those techniques necessarily have higher false positives, lower detection rates, and can only discover shallower problems. With reasoning and AI, what we really see happening is a convergence of all of these subcategories in security. And essentially what we're building is an AI security engineer. Think about a swarm of independent agents that are going through your organization, going through the lattice infrastructure,

SPEAKER_01

and they're saying, hey, there is a code bug here that allows someone to log in and someone else. And nothing before could detect that. That was not possible. It needed like the intuition and judgment of a human. But today we're starting to approach the point where we can do that. Or there is a misconfiguration in your cloud that will allow someone to get in into this way. The pieces were there. The detection rates were lower. The false positives were higher. The technology only before only allowed to like solve a little sliver of the problem. But with AI, we really think we can put it all together and make it feel like you have an AI security engineer all the time.

SPEAKER_01

Should it end like self-driving, you know, to a degree where it's like you don't need to like name, okay, here's it for permissions and here's what we care about for logins and here's what we care about for API keys and whatever else. And you're able to just say, I want this thing to just very intelligently say like, what are all the possible vulnerabilities and just swarm and look at it all? I think a lot of that is true. I think there is probably the human element is still going to be something different. Like call somebody like, oh, I dropped my password. Like, can you give me your

SPEAKER_01

login? Yeah, I think the human element, I think there is always companies that need to like understand how to interact with the human side and make sure that they authenticate properly and they don't do something. But on the software side, do you think that's basically where this is getting? I think there is going to be a great unification because the technology, I mean, to me, it's just a mechanistic claim. Before technology is called address small slivers of problems. And now the technology is actually able to generalize a lot better. Do you think in theory at the end state, like let's go ahead four or five years and just assume

SPEAKER_01

things kind of stay what we expect, which we expect, whatever that means, do attackers or defenders have the edge over time? So I think it's a dynamic system. I'll use an analogy, like perfect security is not achievable. And I think this might seem like a scary claim if you're not into security, but everybody understands this intuitively. Like everybody knows that there is no such a thing as a perfect bank vault, that a bank vault is only as secure as two things. Number one is how difficult we can make it to attack it, to like get in. And that's a matter of like cost, equipment, expertise

SPEAKER_01

to actually like drill into it or lock or things like that. And then the second aspect is how likely it is that you're going to get caught. And you know, what are the sort of disincentives there? So you do the equation and then, you know, sort of thieves and attackers do pretty rational math there where they say it's not worth it or it is worth it. You know, in software, it's similar. There is no perfect vault. That's just impossible from a purely theoretical perspective. And attackers are making the same judgment call. And it has to do with how hard is it to get in. And it has to do with like how good

SPEAKER_01

your protections are and then how good enforcement is. But the reality is that online enforcement is last. It's much more difficult. Like it's much more anonymous. You know, you're not going to leave like fingerprints and you might be in a state where an issue where, you know, there is no bell light or

SPEAKER_00

treaties for things like that. So the equation is has the same factors. Enforcement is a lot of a smaller thing now. So therefore it's really about cost. How much does it cost to get in? With abundant intelligence, that cost is bound to go down. And I think what's going to happen because of that is that we're going to see a lot more frequent attacks for organizations. And on the other side of that, I think we need to get far ahead of the attackers. And so, but I'll get to the actual question, which is, so I think a company like that first is going to have to get in front of the problem, help organizations

SPEAKER_01

secure themselves for this coming wave. And I think we're, we're doing that. On the other hand, though, I think that the balance of attackers and defenders is not going to change drastically because defenders still have a certain advantage, which is they have full context. At that first, we spend hours

SPEAKER_00

and hours of compute on one of our customers code bases to fully understand how it works. The AI spends hours and hours in their understanding, oh, those are the ingress point. Those are egress points. This is the inputs and the outputs. This is how everything works together. And using that knowledge, the AI helps

SPEAKER_01

secure the business. Attackers need to fly blind. Now there is another advantage that the attackers have, which is defenders need to find every attack. Attackers need to find one. But I do think that with the technology that we're building at that first, we can tilt the scales in favor of defenders.

SPEAKER_00

You also, I guess, have some advantage as a defender because you can know everything about your own

SPEAKER_01

systems versus an attacker. You can't know everything about the system. Exactly. So yeah, this is the context point that I was making. You know, our AI spends hours and hours just mapping out everything. I guess every time you push new code, though, it exposes a potential for new vulnerabilities too.

SPEAKER_00

Yes, exactly. And that's why we have one of our products is one that scans all of your pull requests as they're being written. And, you know, I think one thing that I've noticed at both Square and there is that there's always been a little bit of a difficulty between prioritizing

SPEAKER_01

security versus productivity. And I really think that this is a false dichotomy at this point. I think another big thing that I think AI will enable is a great reunification piece between the InfoSec teams and the security teams, and they'll be able to achieve that security that they want without impacting productivity. Yeah. It's like a drag. Yeah. Security engineers had to sort of sometimes say, hey, folks, we need to look at this. Give us a day or two and we need to. And that was totally rational. Yeah. It was the way to do it. But, you know, if you move at the speed of AI, you can sort of do those reviews much faster. And so I think we're

SPEAKER_01

also going to see a little bit of reunification. I think we will be able to achieve security with productivity as well. Yes. It's funny also because like outside of engineering, I think there's like a people understand security as like password protection and random stuff, you know, like, hey, if somebody like sends you a phishing email, be careful. But like, and that is part of it. And there's probably a whole separate, you know, approach needed there. But for the software piece, it does seem like everything's about to probably look very different. That's why I'm here too,

SPEAKER_01

because I want to sort of tell how to people how cool security is. I got into security originally in grad school because of how fantastical it is. You know, there's attackers and defenders and firewalls and bastions. It's really just like a fantasy world. It's really funny because like it was security, like the the excitingness of it ranges from like password manager and, you know, just like somebody at your company telling you like, hey, you got to follow these protocols like that's one side. And then the other side is like Ocean's Eleven. Exactly. So people, I think the first thing, if I ever say, tell someone that I'm

SPEAKER_01

working on security, I think the first thing that they think about is just like, oh, should the other day I had to reset my password? Yeah, that was painful. Like, I think that's the first thing they think about. But the reality is that what they should really be thinking about is those crazy hackers that are doing like daring things to get into systems, high level government agencies, high level government agencies. That actually is what security is at the limit. And it's incredibly intellectually stimulating. It's really just at the edge of technology. It's also possible that like sort of like by the end of

SPEAKER_01

like the cloud software generation, like it was getting a little bit boring. And now with AI, it's like back to this like very fresh thing. Right. Because I think it goes back to that point I was making, which is security is relative to the level of attacks. Right. So we had reached sort of a steady state where a company like Federal Lattice could operate and having a team of ex-security engineers and business would go on and the likelihood of attacks was relatively low. So you could just do your thing. Yeah. And put security a little bit on the back burner. There is this saying in

SPEAKER_01

security circles that in order to survive a bear attack, you don't need to outrun the bear, but you need to outrun the person running next to you. I think that's the way that the business has been operating for a very long time. But with AI, you can think about the fact that there isn't just going to be one bear. There's going to be a thousand AI bears. That's terrible. So we're really trying to secure the world's software from AI bears, really. Why does it seem like security is its own sort of ecosystem echo chamber world? Like to me, I'm not like lucky to invest in you, but in general, I don't do security companies. And what I found is

SPEAKER_01

it seems like its own world. Why is that? Like, why is it not similar to just like other software categories? For context, I was in charge of security affair during my tenure there and had a team of folks that was super talented, super talented, and as well as Cash App that was within the Square ecosystem. I would say that security is such a different market just because of how hard it is for both buyers and sellers to know what they're buying, what they're selling. Like when you're selling, say, observability software or databases, you know, someone can try your database. You make

SPEAKER_01

a claim. I test it. I see it and it's done. If I run a company like FAIR, I don't necessarily know everything that is wrong or like Lattice or anything or any other business really. And a vendor, a security vendor comes in saying, I think these things are wrong. And I was like, are they really wrong? First, you don't know because the claim may be partially incorrect because many security issues may be false positives because it's almost true that someone could take advantage of it. But there's this one little detail that makes it not true. Right. So first you need to investigate every single claim.

SPEAKER_01

Right. So that's the first part. Sort of really both the buyer and the seller might have different opinions on what's really a false positive, what's really a true positive. And then another more pernicious part is like neither the buyer or the seller know what the true positives are. So let's say that I go into your organization and I don't find anything. Did I not find anything because I'm not good? Yeah. Or did I not find anything because you don't have anything to find? Neither of us knows. Right. So the information of the ecosystem is weird. Very hard to get. It's very hard to get. It's

SPEAKER_01

a it's worse than a market for lemons in some sense. You know, we're not that the buyer nor the seller really know what's going on. And I think with AI, actually, we can overcome that because I think the reasoning abilities of these models can actually do that. You can trust that the AI will find the bug if there's a bug. Well, and also you can make sure you can trust that it will find a higher percentage of those bugs eventually. And then I think this is why we're investing in technology. And I can tell you about our investments there. The percentage of bugs that you can actually find is increasing

SPEAKER_01

pretty rapidly. So that part of the equation is changing. And then the second part is that the AI can actually operate almost like a human in the sense that they can verify their work. Yeah. And they can be like, oh, those were my assumptions. I thought that there was a real security problem because X and Y and Z. And actually, one of the things our customers love about our product is that we tell them all we list out all the assumptions that we made to to conclude that

SPEAKER_00

something was a real security issue. And we we showed the work that the model has done to actually verify each assumption. Security is a different market because of those reasons. But I do think that AI hopefully will change the equation a little bit where it's going to be much more much easier for buyers and sellers to be on the same page exactly on the value that is being exchanged. Getting into sort of the tactics of depth first, what are the important pieces of technology for you all to build to be able to accomplish this? Yeah. So maybe let's digress a little bit. So I'm one of the founders and the executive chairman.

SPEAKER_00

Kasim is the CEO. He comes from Databricks. He was a director of infrastructure there,

SPEAKER_01

also in charge of security. And then Andrea is the CTO. He comes from DeepMind. And he was one of the authors of Alpha Dev, which is the reinforcement learning algorithm that found a better way to sort and hash on Google. And I think this is almost like the perfect team to go after this problem. Because AI, so to answer your question, AI has a big infrastructure component, especially when you're doing AI for security. We're doing these technical things. I don't want to go into too much technical detail, but we're spinning up Docker containers to like run code inside so that the LLM can test

SPEAKER_01

whether certain hypotheses are true or not. And having hired a bunch of folks from Databricks has helped us a ton in setting up that infrastructure. People have been calling it the scaffold, the harness, but it's our intelligence layer that allows us to really repurpose the technology that we built on on each new problem. So vulnerability discovery is one thing we've applied it to, but we also applied it to other things. And each one thing that we apply it to becomes easier and easier because we built like

SPEAKER_00

a really solid AI infrastructure there. The second piece is more like the deep research side, which

SPEAKER_01

Andrea has done before at DeepMind. Fundamentally, I believe that reinforcement learning plus large language models will allow us to sort of create a superhuman hacker who are defensive purposes. We were talking about the fact that systems, you know, we were only able to find a certain low fraction of the real problems that existed. And that was because the other problems were deeper and deeper and deeper and more and more complex. And I think with reinforcement learning, we can teach these LLMs to go deeper, to like find those clever ideas that will allow them to put two small

SPEAKER_01

vulnerabilities together and combine them into something that is actually real. We have some security researchers on the team coming from Apple and security service like IDF. And the way that they work is phenomenal. Like their brain worked differently. When Mabo and the team tells us that he's discovered Amalabini with our LLM and how is like he verified it and how he actually sometimes pieces it together. It's wonderful to see. Is that way of thinking learned or is that like a certain brain type that exists from the beginning? Is it something that comes out of experience or is it something that's by nature?

SPEAKER_00

I feel like just almost like everything is probably a combination of nature and nurture. Personally, I feel like the my inclination of being a little bit of anxious, paranoid person that it's always trying to see how things could go wrong helps. It's definitely like the background thread in my brain that is constantly seeing how catastrophizing and seeing how things can go wrong is definitely helping in that pursuit. And there are definitely people that are more apt at sort of stepping out of the box and seeing things from a different angle, which is you clearly need. But I will say that it's probably

SPEAKER_00

just almost like every other thing. It starts with probably a small talent, which then tells you, oh, I'm good at this. And then you invest more in that. And then you get better at it. But if I had to guess, the seed was actually quite small and then it blossomed because you invested all the time because

SPEAKER_01

you were good at it. So this is sort of like some of the technology underlying, you know, the product. And then I guess is the idea with the product itself, should it get to a place where, you know, a customer can basically just install depth first and they just know that you're constantly exposing vulnerabilities at a

SPEAKER_00

way higher rate than people and you're doing it more thoroughly, faster, cheaper. Is that basically it? Yeah, that's the goal. And I think by training our own post training, our own LLM, which we're experimenting with right now, what they hope is that we will have a technological edge and we can tell customers. I think it's two things. One is the technological edge of our sort of AI stack. And then two is really thinking about the problems the right way. So for example, we started with code, but we are now telling customers, Hey, if you link your staging environment, we can test the findings against your

SPEAKER_00

staging environment to tell you whether something is real or not. So I think expanding into other areas that our customers care about is going to be crucial and really giving them an interface, whatever that means. You know, right now we have a web app, but I'm also thinking that at some point you need to be

SPEAKER_01

able to talk with this thing as if you were talking with a security engineer, being like, Hey, can you double check this thing please for me? And then giving the AI access to the components, giving them the context. I think the context is super important. Another thing about security is that it's really context specific. If you're operating a social network, the fact that people can see a customer's profile is the way that it works. But if you're creating a corporate Slack platform, a messaging platform or corporate, you probably don't want the profiles to be public. So that's context specific. So our systems, again,

SPEAKER_01

as I said earlier, spends hours in a code base, sometimes going into the old commits. Because if you think about it, whether something was done differently earlier than it is done today may tell you, Hey, we actually had an assumption a year ago about how this thing was supposed to work. But now it's not like that anymore. Why? And so it's really about building a centralized repository of context about the security posture and organization. And that's what we're building. Then adding agents that can go in and say, let me look at your code. Let me look at your infrastructure. Let me look at your

SPEAKER_01

configurations. Let me look at this. Let me look at that. Will your system learn as a result of,

SPEAKER_00

you know, like, is it the kind of thing where the more customers you have, the more you will learn to be safer for the next one? Or is it is each one its own new instance? So as an enterprise company, you know, one thing. Yeah, of course data can't be shared.

SPEAKER_01

Data cannot be shared. The customers is it never makes it into the weights. Yes. Never makes it. We just don't do that. We cannot and we will not. But what I will say is that there is an outer loop as, as the folks in AI like to say, there's an outer loop, which is like, we learn from the types of issues that are not. You, the people at depth first. Yes. The people at depth first learn. So what do we do when we see that, like, we're not quite doing as well in that type of issue. We will take some open source software, find the issues that are similar and then train on that, you know? So that's, that's the way in which we, you're sort of participating in an ecosystem.

SPEAKER_01

Yeah. That's not that different from how any other product becomes better because more people use it. Because, you know, as you join a platform or a SaaS offering, you're probably benefiting from the fact that other people have discovered ways to use it that have been built into the product. Yeah. So in that sense, there is some. Do you think of depth first, you know, when it's a security engineer operating on the team? Is it's role to like help manage the human security engineers or are the human security engineers managing the AI? I think it's going to be a collaborator. I think it's going to be like the humans will probably have

SPEAKER_01

the ultimate amount of final say in context. I think, I think you still need that. For now. Probably one day you don't.

SPEAKER_00

At that point, it's not this company that changes. I think the whole, the whole society changes. And I don't know what happens. By the time that's happening, it's like all these rules don't apply anyway. Yeah. And then I think we need to figure, we need to have an entire different conversation as a society about what's going on. But before that, I think that, no, the security engineers would be the ultimate judges of what's going on and making sure that everything works. Okay. I want to maybe kind of switch to back to sort of like generalities around building this company versus building fair. And we talked a little bit about sort of like the mindset of like

SPEAKER_01

the grounds are shifting faster, the rewards are bigger than ever. So that kind of changes in things. I also imagine just that in some ways, like the types of culture inputs that you want are a little different, maybe the types of people are a little bit different. Like what have you found when you take that difference in the sort of environment, how does that apply to like building a company now in this era? Like whether it comes to recruiting or, you know, the way you manage the team or anything else like that? So there's this book called The Platform Revolution, and they talk about two types of businesses,

SPEAKER_01

platform businesses and pipeline businesses. Platform businesses are dual sided marketplaces, social networks and things like that. Fair. Exactly. Like fair pipeline businesses are businesses that produce a service of good and sell it to their customers. And there isn't much interactions between the customers or there isn't like a lot of interactions on the other end. I would say that in a company, in a platform business, a marketplace like fair, I think you need to keep a tighter grip on the business just because everything is so interconnected that it's hard to just let people completely run the things because there is always going to be second and third order things

SPEAKER_01

that might happen. In a pipeline business, I'm noticing with that first, I think there is a little bit more of letting a thousand flowers bloom and seeing what works. But so that's one potential, but it's a small difference. I'm not saying that it's huge. I mean, you're... No, it makes sense. So it's almost like you just, you need, you need like greater coordination of efforts in a marketplace business versus a pipeline business. You need like a, you basically need systems that like let the flowers bloom. I think so. I think so. I think that's a, I think that's a fair characterization. So that's one thing. A lot of things are the same. For example,

SPEAKER_01

one of the things that I tell folks that I work with is don't shy away from putting 30 data points on a spreadsheet and look at them and see what's going on. And data points here is a generic term. It may be like 30 customers. It may be like 30 issues of chargebacks on your platform. It may be whatever it is. 30 is like approachable. I'm like, I could do that in two days for most things. Yeah. It could be two days. It could be two hours. You know, just spend some solid time. You're going to, a few things are going to happen. One, you're going to build so much intuition about whatever that is.

SPEAKER_01

You know, you're going to be like, oh, actually that is how that works. You know, and, and that was already incredibly valuable. But then I think it forces you to overcome this almost like anti-pattern that we have as tech people, which is like, we want big data because you know, that's the only way to know. Like a lot of data is the only way to know. But the reality is that with 30 data points, you're going to know whether something is 60% plus or minus 10% or it's 10% plus or minus 10%. And you can like know a lot from that fact alone. Yeah. You know, is your conversion rate, is your chargeback rate,

SPEAKER_01

whatever that may be. It's roughly good or it's roughly bad. It's roughly good or it's roughly bad and make a decision. Yeah. And then, you know, take the top three things you've learned and try to address them. So even like in everything, like when it came to FAIR, like get actual bunch of search results and look at them one by one and form an opinion about when is it that you don't think they're good enough and why? And is it because they're completely irrelevant or is it because they're just, yeah. Even though it's like theoretically a little bit less accurate, I also think when

SPEAKER_01

you spend time in 30 anecdotes versus like 3000, like sort of unemotional pieces of data, it's just very different. Yeah. And you learn more when you look at an anecdote. Absolutely. And you know, this is, I feel like I want people to form like a deep intuition about the data, the customers, talking to good customers and things like that. And this is one way in which it happens. Yeah. And it's a little bit of a blind spot. And by the way, I try to do this myself. I seek out times where I can just like put on my AirPods and put on some music and then just kind of like churn through a bunch of

SPEAKER_01

data in a spreadsheet because I find that to be an important avenue in which I can actually get through context about what's going on. Yeah. What else would you think about like, because I obviously like decision making is such a central part of like what, you know, you're trying to create and what you're trying to do yourself. What else do you think about at this stage for decision making? So another thing with that first is that I'm trying to help with all of the context that have accumulated at FAIR, but trying to only take with me the good lessons. I feel like I could potentially overshoot my role by trying to apply the same exact learnings, the same exact patterns. I

SPEAKER_01

mean, it is an enterprise security SaaS company and using AI and it's just a very different type of business. And so now being a pipeline business, I think we can make sure that people can experiment. And so this is giving me the freedom to sort of step back a little bit. But I think there's also an element of trying to take the learnings that I have, but allowing experimentation, I guess. Yeah. And I guess probably also with that, you're like, as long as the guardrails are safe, because obviously you need that as a security company, you probably want people to like try things quickly

SPEAKER_01

in general. For sure. And, you know, I think we have a lot of security expertise inside, so we really make sure to build things properly from the beginning in a secure way. But, you know, when I talk about experimentation, I also talk about things that, you know, let's see if the AI is able to solve this problem. Yeah. You know, you can do that. You're going to have someone spend two or three weeks on that. You know, I always thought like, as long as it's a two way door decision, just like the faster we can try stuff, the better. Absolutely. Yeah. I'm always about making three 90% confidence

SPEAKER_01

decisions every week. Yeah. Rather than one 99% confidence decision every quarter. Yeah. Well, Daniel, this was really fun. Thanks for making the time for this and super excited what you're doing at first. Thank you so much.