The End of Event-Based Cybersecurity, AI Science & World Models | Lightwork

0:00Is the internet broken? Because I feel like that's what everybody's worried about.

0:04Josh Machiz: 70 % of our internet's websites were exposed. Now you have one human who has a swarm of agents that work 24-7. They don't need to sleep. They can brute force their way through everything. And that makes a really tough opponent to defend against. Imagine having to thank your model in your Nobel Prize acceptance speech. DoorDash is buying Instacart. I can see why people could start to question their reality and ask whether we're living in a simulation.

0:39Claire, have you ever been to the New York Stock Exchange?

0:42Josh Machiz: I have, actually. I came here for a night event, which was actually a really cool experience, but I've never actually been here during the day. Right. And how cool is it to see Cyber 60 companies on the floor of the exchange with their logos on the cubes? We got to see the opening bell, which was awesome. I've only seen that on TV. Well, it's on CNBC and it's here live in person. And for those who haven't heard about Cyber60, do you want to give them a little bit of just context on why we do this and how we decide? Absolutely. So the Fortune Cyber 60 is a partnership between Lightspeed, AWS, and Fortune.

1:18And essentially, our investors, Anushka, James, Guru, Justin Shen, the whole cyber team works together throughout the year to put together the top 60 companies, early, early growth and growth that we view with Fortune's help as defining companies of cyber this year. This is our fourth year doing it. This is our first year hosting a really beautiful event here at the Exchange. And it's a crazy year in cyber. Also crazy last few weeks. Crazy last few weeks. Yeah. So is the internet broken? Because I feel like that's what everybody's worried about.

1:59Josh Machiz: Yeah, I feel like I've heard a couple different ways it's been phrased. I've heard someone call it the great hackening. I think the more commonly termed right now is Black October is what everyone's calling this year. Are people calling it Black October? Yeah, yeah, it's Black October. Very Cybersecurity Awareness Month themed. I also, one of my, actually, yeah, it's like a little bit Halloween, a little bit too. But one of my favorite sub-sac writers also called it like the Internet's Wuhan moment, which is also interesting because he framed it as out of every pandemic or major, you know, series of issues like Black October, there will be new solutions that come out of it.

2:36Josh Machiz: And we can talk a little bit about that. But yeah, there's been a lot of attention on cyber. And I think it was interesting. I did a video on the recent PHP vulnerabilities and. Oh, my God, that went so viral. Yeah. But a lot of people were like, finally, people are waking up to the fact that like cyber isn't just this events based thing and one time thing you sort of have to do for compliance, but rather something that actually really matters because there's just so much infrastructure and our entire lives run on it. I mean, we've been hearing about this for a long time, right? Like ever since Mythos, we've understood that AI was about to change everything about cyber.

3:12Josh Machiz: But it was all super high level then. Like you never really thought about. It was so theoretical. It wasn't like, oh, yeah, all these things that we use and that every company uses are now vulnerable. So explain to our viewers what happened with PHP and why was so much of it so broken? I won't go too deep into the lingo because there's a lot out there. And, you know, we have a great Cyber 60 podcast if anyone wants to keep up to date with all things cyber. But the gist of it is that there was a vulnerability in a programming language called PHP. And 70 percent of our Internet's websites were exposed, specifically things that might ring a bell or things like WordPress.

3:52Josh Machiz: And what ended up happening is unlike other types of cyber attacks where you have to have a human click a link and input their passwords. This did not need any of that. It was in the code itself, which meant that anyone could send a request and, for example, switch out the checkout page or switch out the login page and collect your information that way. And it's scary because it's crazy that this language has been around for so long and that it's just been discovered now. And I believe they actually discovered it way, way back, actually. Absolutely. So developers knew about this issue and potential exploit many, many years ago, but they just assumed like, hey, this requires a lot of brute force and a whole team.

4:35Josh Machiz: It is very, very unlikely we will ever see any sort of exploit here. But lo and behold. AI changed everything. Yeah, exactly. And so now, you know, you had Calif and Wiz, I believe these two groups that leveraged a bunch of frontier models to essentially identify this issue. And most of it's been patched. But I think for a lot of folks seeing the headline of like 70 % of our websites are exposed, you know, we got to make sure that you have two factor authentication on. I think it's just brought up a lot of really good discussion about the fact that cyber is so critical. I mean, I went down this whole rabbit hole about how many things that I have accounts around that are probably very not secure and I don't have like authentication apps set up.

5:19Josh Machiz: The other side of it was I think a lot of people sort of spiraled around a lot of these conspiracy theories around. I think simultaneously a lot of governments were like you need to have enough water and stock up on pantry items. This is foundations of the internet being exposed. So it's kind of like what's next. Yes. I think the more sci-fi dystopian version of this is, you know, you could lay out a world where with these agent swarms, you have it attacking our grid or our sewage systems or our water systems or even everything. And so we kind of forget that we sort of take a lot of the Internet and the safety of our cybersecurity for granted.

6:00We definitely do. And particularly with these agent swarms, it's like these could take down pretty much any part of the Internet without very much work, especially since like the reward systems are so built around achieving the objective that they're set out to achieve. Yeah. It almost feels like we're not prepared and which is why there are so many great opportunities in cybersecurity today and why we're seeing so many incredible emerging companies.

6:26Josh Machiz: Yeah. And I definitely want to get into where you think sort of like second order effects are around this and what this means for a broader industry. But one of the big questions I've gotten is just why now? You know, like we've had swarms, they've been merging. I think in particular to make it very clear for folks is that one, we now have a certain capability threshold reached for AI. So there's that. But it's not even that. It's the fact that we now have swarms. So before you had humans versus humans. Now you have one human who has a swarm of agents that work 24-7. They don't need to sleep. They can brute force their way through everything.

7:00Josh Machiz: And that makes a really tough opponent to defend against compared to before you sort of had a group of human hackers and then you had humans who would patch things. At the defensive side, there's just a lot more work. I think what's clear here is just you sort of have this dynamic where you have like AI swarms vs humans on attack versus defense. And it's very clear that what we're moving towards is we're going to have our own swarms of agents to defend against other agents. Yeah. And it feels like we're going there very quickly. Yeah. I think my big takeaway, even from this day on Cyber 60, is that the idea of cybersecurity being this one thing, it's like one vulnerability or one incident.

7:40Josh Machiz: And then we got to patch things and yay, it's done. Like this event-based paradigm of the way that cybersecurity works, I think that's like pre a couple weeks ago. That will be the end of that era. We are now entering a time when cyber is just something that's like constantly attack swarm, defense swarm, constant inference running. So I think there's a lot of excitement around what that looks like, a lot of fears around what that looks like. But I think it really changes how we think about defense and cybersecurity in the first place when it isn't like an events based thing and it's a constant swarm.

8:17Yeah, it does change kind of everything in cybersecurity. And we even saw it from the CISO survey, right? Like we are finding that large companies are already comfortable running agents in their environments. I think the scary thing is a lot of them know that there are agents that are running in their systems that they're not quite aware of what they are and what they could be doing.

8:40Josh Machiz: Yeah. So I think there's a lot on the enterprise side that clearly needs to be resolved. We've got a long way to go. But I think for starters, for any just regular folks like you and me who are listening to this, probably turn on two-factor authentication and don't log into any sketchy websites. And think twice before you vibe code your website. Oh, that is true. That's a good point. I was thinking a lot about how this is actually tough for. Right, because everybody's vibe coding today. And now it's like, you're not thinking about cybersecurity when you're vibe coding something. No, and if you're vibe coding, you also have to be thinking about.

9:13Josh Machiz: Like, it's not just, ha ha, let me put a bunch of code out there. It is, you're also thinking about security. And what you may have exposed on the internet. Exactly. And I actually, I know this because I've played around with a lot of these vibe coded tools. I wonder if there's going to be pushback. Well, one, I wonder if there's going to be pushback around using Vibe-coded tools. But two, if actually there will be a whole suite of tooling and startups built around serving cybersecurity for these like sort of smaller scale Vibe-coded enterprise projects. And so such that it's not just this like, you know, clear discrepancy between like enterprise that have full cybersecurity teams or nothing.

9:51Josh Machiz: It's sort of like this middle ground. So we'll see. Yeah, I don't know if I would trust something that I knew was vibe coded anymore after this. And like, for sure. Now, as you think about we've been talking about all these personal agents, everybody's putting their email, all these different data sources into agents. And we're just walking towards a future that I don't think we know what's coming. Yeah. And I think for what it's worth, I think it means that cybersecurity becomes a line item that you just like have to spend on. I mean, it's been a line item. It's always been the biggest line item.

10:21But it feels like it's only getting bigger. And I think we even heard it on some of the panels today at the New York Stock Exchange. Like, it seems like organizations know that they have to move fast to keep up with this speed. And the crazy thing about CISO is that I don't think a lot of people know is it's kind of a short-lived job. I didn't know that. Yeah, it's one of those businesses where if you don't earn your paycheck and keep your company secure, you're kind of out. Yeah. And so it is the one job in the C-suite where you actually have to adopt the latest technology as quickly as you can, not just for your company, but to keep your job.

11:03Yeah. I feel like it's now weekly. Yeah. And I'm like, I'm starting to be like, what is this thing that everybody thought was true that is probably not true, but will yet to be confirmed or whatever it is? And it's like, how do we start to think about these problems that it's solving so quickly? Like, how do we keep up with the pace of this? And maybe what are these new ones that we had this week?

11:30Josh Machiz: I feel like I'm definitely feeling a lot of that sentiment where I'm like sort of getting inundated with the AI model solves, you know, previously humanity unsolvable problem. I mean, this is math, computer science and physics this week. Yeah. In one paper. Yeah. Yeah. And I think a couple of weeks ago, which did get a bunch of mathematicians angry, which was, I believe it was 400 math results. That was a whole situation as well. But we are just seeing the volume and the results of this idea that AI is going to help humanity discover things. It's not just a regurgitation machine, but rather something that can aid us in the earliest parts of innovation and discovery as well.

12:12Josh Machiz: But to make sense of it all, there's a couple of things happening here. Yeah. What were the big ones? And what are the ones that are maybe a little mind-blowing to people? Yes. So for starters, there were three major results as of recently where they made a discovery in math and computer science and physics. I won't go too deeply into all of these, but one was really around waves. And actually, a mathematician had won a Fields Medal for solving this problem in 3D. However, what OpenAI says it's done is solving the same problem in every dimension. So you can just sort of like, that's almost like an interesting, you know, those races where it's like human versus, you know, regular person versus Olympic athlete.

12:55Josh Machiz: That's like a good comp of like a field medalist, you know, the best, the best award you can possibly get in math versus AI model, every dimension. And then in physics, you have something around the universe's rule book for tiny particles that predict experiments almost perfectly. For that one, about for 50 years, nobody could prove the math that held it together. But now OpenAI says that math holds. And so it's really cool. I think if you are geeking out in the ways that I often can in the physics and the science of it all, it's really cool to see all these problems like Navier-Stokes, to see proofs and solutions around those longstanding problems.

13:34Josh Machiz: But I think what the industry is starting to feel, and especially with a couple of weeks ago when OpenAI released about 400 math results across more than 700 papers at once. At first, obviously, people were like, huge, another big, big advancement. But I think what people are starting to feel is that, yes, it's very impressive, but it isn't actually that productive for the field. Right. I mean, what happens next? does a human then have to go and verify these results? And how long does that take? It almost feels like in some ways for some of these, it takes a little bit of the oxygen out of solving it.

14:12But I understand this is the power of these models. And like, this is the tip of the iceberg of scientific discoveries that are going to be solved by these frontier level models.

14:23Josh Machiz: Yeah. And so a lot of these solutions are sort of like the fields metal worthy solutions. And if it had been done by a human team, it would have been extremely impressive. They would have won awards for it. But then in this case, it's like OpenAI just slams 400 of them at you. And I think the issue of all this is like, one, to your point, nobody can verify this and check it all. So about 42 % of papers came with computer check proofs. And the rest of them have to be checked by hand, which actually takes an enormous amount of time. And a lot of these papers are apparently hard to follow. I'm not personally analyzing a lot of mathematical papers.

15:00Josh Machiz: but you're seeing some of them being called out for also missing proper credit for earlier work and apparently three of them so far have been pulled for errors and then generally there's not a lot of transparency so i actually i don't know if this is the right way to phrase it but like in many ways it feels like solution slop like you're just like it is a little solution slop yeah and imagine having to thank your model in your nobel prize acceptance speech yeah yeah Yeah. And it's just like, yes, we know it can do it and it can like brute force its way to answers. But does it actually mean anything for the advancement of society and innovation and science and sort of these like downstream innovations that come out of understanding this mathematical or scientific breakthrough?

15:43Josh Machiz: We don't know that. It just feels like we have a lot of answers, but then they're like half baked in humanity's understanding of it all. Yeah. It's a little inelegant. I'm looking forward to someone finding a way to make this where they can actually explain these in a very relatable way to humans versus these papers that for some reason are just really hard to get through. I think a lot of mathematicians were quite dejected by the situation because, you know, one of the big things was just like the broader mood around being shocked and sort of dread that like having this existential dread over what is the purpose of my work.

16:19Josh Machiz: I've dedicated 50 years of my life to a problem. And now it's like overnight, boom, the answer is there. And so I think that's an issue. I think a lot of people are frustrated. You know, they mentioned how like PhD students and early career researchers are hit most because now there's like a lack of open problems that they can build their careers on in dissertations. At the same time, though, I don't think mathematicians are necessarily against AI or scientists for that matter. Like, I think a lot of people are excited about this technology. It's more a matter of sharing these results and moving towards them and advancing what these results unlock in the right way.

16:57Josh Machiz: And I think with this time with the three results in math, computer science and physics, they actually released it to scientists and were sort of like co-collaborating with them in that verification process. It seems where it needs to move. Yeah. As opposed to just being like, here's a bunch of answers. Here's a bunch of answers. Yeah. And that's not honestly, as we know, it's like it's the same as us, you know, or students cheating on Chatapati. Like, yes, everybody can get answers, but it's very different actually internalizing and understanding it all. No, it's about knowing how to solve the problem that teaches you the answer.

17:30Josh Machiz: And I think humanity is just at this point right now. But that's like the society level problem we have is like we haven't we have all these answers on paper, but internally we actually don't understand them. And we'll see. Hopefully that means actually exciting things. Yeah. Maybe it gives humanity a job. Claire, it's rumored that DoorDash is buying Instacart for everybody. Instacart was the pandemic darling. It's how we got our groceries in that moment. And it's honestly, it's how busy parents run their lives. And I thought that it had such potential. Why is it considering this acquisition from DoorDash?

18:07Josh Machiz: Yeah, it's all alleged right now. So we can only speculate on why DoorDash would be interested. But for a couple of reasons, I think I would love for you to speak on a little bit of how the company has performed in the stock market, because that's probably one of the big issues. But I think from a business model standpoint, what you're seeing is it's really being squeezed from two different sides. On the delivery app side, you have DoorDash and Uber Eats all moving into grocery. You know, you see this with the ways that Uber Eats now pushes groceries as like, you know, they put groceries as much as restaurants.

18:44Josh Machiz: And so that's really becoming part of their strategy. At the same time, you also have big retailers moving further and further. and Walmart, Amazon becoming these massive grocery giants. So I feel like Instacart is a little bit in the middle of all this and figuring out where, you know, how it exists between all these players encroaching in its space. I mean, it's had a rough go. I think that, like, to your point, like, it's certainly competition's been a big factor. But also I think perhaps a lack of innovation on the Instacart side of the house. Like, especially as you see that much like we talked about Amazon with Muse and some of this, like these competitive forces that agents could actually disrupt their entire advertising business.

19:31Right. A big part of when you go to Instacart to order things, the ads business.

19:37Josh Machiz: Isn't that that I like have never used Instacart? Well, I think maybe also generationally. Maybe I'm the one contributing to the death of Instacart. I think your generation might be contributing to the death of Instacart, right? Like there is something. And I think the hard thing for them to grapple with is like times have changed and it's not like the go to app for Gen Z. It maybe was for like the millennials who are forced into COVID that they just became habit with this app. And I feel like with those cohorts, they're probably still doing well. and with this new world, we've got DoorDash talking about they have their own agent where you can go and do agentic ordering.

20:19They have drones. They have drone delivery, right?

20:21Josh Machiz: And they've got massive surface area. Yeah. And if you look at Uber Eats and you look at DoorDash, their ability to touch so many more customers and to offer more suites of things, they're not as dependent on this ads business that you can see as soon as, you know, you are asking Instinct to place your Instacart order, you're totally avoiding all of Instacart's ad business. It didn't happen all at once for them. Yeah. So why do you think DoorDash wants to buy them if it's not that attractive? Well, one, they still have a lot of scale and they have a lot of trusted partnerships, right? Like I think anytime you see an acquisition from either Breeds or DoorDash, a lot of it is they're buying the customers and they're buying the partners.

21:09Right. And they do have a lot there. Yes.

21:12Josh Machiz: And I think that's actually where DoorDash has failed to crack is. For sure. There's still a lot of grocery stores that are probably not on DoorDash that are still Instacart loyalists. loyalists. And as soon as it's Instacart by DoorDash, if this all goes through, that opens up a lot to not only those grocery stores who are going to get all of these extra customers that just quite frankly weren't on Instacart, but it opens up like a whole new business for Instacart. So it does feel like there's natural synergies here. But I actually think that might also be the biggest risk, though. The grocery stores like Instacart today because they are a white label on top of their storefronts and they never go into their business.

21:59Josh Machiz: They're sort of like this aggregator and a dollar to Instacart flows down to these grocery stores. But I think with DoorDash, there might be a risk that because DoorDash has Dash Mart, I believe, they are in the grocery store business. And so I think there's open questions around if I am a Kroger, if I am a major supermarket, do I now see DoorDash? Instacart was like a friendly person. Yeah, I don't think that they trust DoorDash the way they trusted Instacart. I do think it was a much more, and you even saw it in their IPO, it was like all about their collaboration with these grocery stores, which is how they got so many on board.

22:37And it'll be interesting to see if this goes through, do the customers stay?

22:42Josh Machiz: Yeah. And for what it's worth, I do think the AI agent threat is one for both Instacart and DoorDash. Absolutely. There is no doubt it is an existential threat to kind of every player in commerce. But I think groceries are more of an agent use case because it's... Lots of reorders. Yeah, it's repeatable stuff and pretty low stakes. If I get the toilet paper wrong, it doesn't really matter. versus if you're buying me a$2 ,000 flight, then I don't want to get that wrong. I don't want to buy something that's non-refundable. But groceries feels like it's, you can build repeatable behavior. You can pull a lot of context.

23:20Josh Machiz: And I actually think, again, I feel like there's no black and white answer of a lot of this stuff. And we're both speculating here. But at the same time, maybe the opportunity and what they see here is like in the age of AI, as much as Instacart's surface area gets disrupted and their ads business gets disrupted, What is actually an opportunity is the fact that they have all this data and network with grocery stores that I think if I go to DoorDash or if I go to whatever this entity looks like and I ask for toilet paper, it has much more data on the types of things that people like to buy and which ones are most popular from what stores.

23:58Understands consumer behavior. Exactly. Isn't going to send you the wrong thing.

24:01Josh Machiz: We specifically have a really great data set and a bunch of agent traces around how people purchase specifically groceries, which we know that DoorDash is only starting to break into this. So we have another Genie drop. Yeah. Google released Genie 4, which is another world model. We've talked about world models on this show before. But maybe for the new viewers or listeners, explain a world model. why do we need this versus everything else that we've got? I always give this example, but people are like, why do I need a world model? Isn't this just the same thing as the video models and C-Dance and all these AI models that are generating what is now overtaking my short form mini drama feed?

24:46Josh Machiz: And the big difference is that a video model is really diffusion based and it's trained on a lot of videos of, for example, basketball. It can recreate a basketball being dribbled because it's seen millions of images and videos of that motion. However, it has zero understanding of actual physics, how it collides with the ground, the way it might be thrown, all of that. It's only doing based off of like pattern recognition actually doesn't have that baked into its understanding. And so the big difference with world models is that it think of it like that and our ability to create entire simulations and worlds.

25:23Josh Machiz: but with full understandings of physics and how different variables and assets within this world collide and work together. It's really cool. Obviously, very natural use cases for video games, which, as we know, when we're creating video games, it takes a lot of time to render and create outputs or world engines. And then, too, for robotics because robots need a place to learn and simulate. I mean, the launch video was incredible, right? Like it really felt like it was a full step change into world models. Like even they showed like I think it was like Starry Night or something. And then like just going into it and exploring that universe and basically having like a choose your own adventure kind of story within a world.

26:09It just seems like honestly like magic.

26:13Josh Machiz: Yeah. Yeah. Yeah. And I think the big difference with this one is, and for me, what was the wow moment was, we've been tracking world models for a while. They published Genie 3, I believe, this time last year, maybe. Genie 3 was huge because it was like, okay, this is actually a functional one, but it was only for a couple seconds. What's big about Genie 4 is now you can actually have an extended time period you can run on it. It's a lot more photoreal. So it's built on Gemini Omni versus Gemini 3 was, you know, a little bit more primitive in terms of what it could render. Gemini 4, because it's drawing on Gemini Omni and also Google's multimodal model, it means it can also generate video and images and audio.

26:59Josh Machiz: So that was actually a big thing for me was the fact that like you can, this is not only a world engine, but it is a world engine that you can create a full experience where you can interact and talk to characters. That has historically never been possible. And it was so photorealistic. I feel like this is the one where I was like, oh, I can see why people could start to question their reality and ask where they were living in a simulation because this was so close to kind of felt like you could literally direct your own movie. Yeah. Yeah. And I think what's interesting is like it's actually really difficult if you think about the technical problem of like, not just the visuals, but like, how do I create corresponding ambient sounds?

27:40Josh Machiz: Or like, if I kick something, it creates the right noise. How do you even bake that in? Like, think about all these video game scenes or movie scenes where every little part of that is another component. And this is a, and, and, you know, I don't think the vision for this is like to by any means replace movies or like really beautifully created crafted video games. Rather, what it's great at is actually creating these photorealistic and physically realistic and audio realistic environments that agents and robots can all interact in. And so I think a great example is if you're teaching, we've talked extensively about this with skilled in our portfolio.

28:22Josh Machiz: But if you want a robot to learn how to clean in a kitchen, like you can't only give it this like very cleaned up demo kitchen you have to give it dirty messy environments you have to give it a new york city one you have to give it one in a different country you have to give it one in a beautiful penthouse and how do you create all those environments kids running around you have to add all of the elements that make yes and so that's where the like physics part comes in is like i want to be able to simulate a kid running into this humanoid or this robot and you can't historically do that unless you're you know hiring a bunch of people and capturing so much data around that, now you can simulate and teach a robot in all of these different experiences.

29:06Josh Machiz: And I think what's also really cool is it has real-time control. So in real-time, you can say prompt to change the scene. So you can say add rain or add sand, which I just thought was so cool seeing that in the demo. It was amazing. Yes. For now, it's only available for early testers. Yeah, it's only available for Google Ultra. I'll report back. Hopefully next week if we have a little preview discussion on this. Yeah, please play around with it so our audience can understand, like, what's the value in this beyond just the fun of exploring another universe? But I believe it'll be available soon for ultra subscribers.

29:42Josh Machiz: Google's been killing it on all things multimodal. They certainly have.