9 Minutes to Erase All Code. Security in the Age of AI | with Jack Nelson, Ivanti

0:00A company using Cursor and one of the kind of smaller hyperscalers and Cursor decided to delete his entire source code plus his backup repo in, they said, nine minutes. You know what? Nine minutes to no code.

0:11Shamil Malachiyev: My guest today is the chief information security officer at a cybersecurity company, Ivanti. He spent 10 years as a commercial litigator before crossing into security. So please, welcome to the studio, Jack. And there's a whole host of issues, right? This was not just Cursor's fault. I don't think the underlying model is the issue, but it had one bad hallucination where it said, well, I couldn't get past this authentication piece, so I thought I would just delete the repo. And then it turns out that deleted across the whole stretch of code for them. That should keep CISOs up at night, but you don't have that kind of grounded human interaction to say, does this really make sense?

0:49It's like, no, no, you told me to do this, and that's what I'm going to do. There's the famous Donald Rumsfeld quote about the known unknowns and then the unknown unknowns. Right. You don't even, you miss what you don't know because you don't know to ask the question. It's a nice kind of, I think, valve or gate, if you want to use kind of coding parlance, right, that you've got to get through to help cut down some of that risk, but not put you so slow to adopt that you're going to be with the dinosaurs. Defense has to get it right all the time. The bad guys only have to get it right once. If the output's coming from you at the end of the day, if your name's going on it, you've got to be able to answer for it, whether it was a robot or you that wrote it.

1:28or it was an agent or not. Slow is smooth, smooth is fast.

1:31Shamil Malachiyev: Good morning, everyone, and welcome to this week's episode of The AI Floor. My guest today is the Chief Information Security Officer at a cybersecurity company, Ivanti. He spent 10 years as a commercial litigator before crossing into security. He calls himself a nerd translator, the person who sits between the engineers who find the vulnerabilities and the executives who have to explain them to the board. Today, we're talking about agentic AI security. attorney-client privilege in the age of AI, assistance, and why 45 % of projects fail. So please, welcome to the studio, Jack. Great to be here.

2:10I appreciate the chance to chat about it and hopefully can shed some light on things for folks who maybe don't sit in that crossover between legal and security. All right.

2:20Shamil Malachiyev: So can we start with a little bit of you telling us about your path to the role of the Chief Information Security Officer at Devante, where you started and what are you currently seeing happening in the industry? Absolutely. So I think my path to the CISO seat, I suspect, is different than most, in particular because I don't have a technical background. So I admittedly have never written a line of code in my life. I may have some HTML way back when in the MySpace days, if I'm going to date myself, but actually even before that. But my background is legal primarily. So like you said in the opener there, I spent 10 years as a commercial litigator.

2:59So fighting over all sorts of different legal cases, everything from medical malpractice defense all the way through complex contracts, disputes, kind of bet the business style. litigation. And after a little more than 10 years, I had an opportunity to come to Avanti. So a former partner of mine, now our chief legal officer here, called me. She was in need of some help, primarily in managing risk at the company. Brooke is fantastic. I couldn't sing her praises higher, but she was in a place where it was 100 hours a week for her. She needed someone to take over some of it. And ideally someone she didn't have to spend too long training.

3:39So we'd known each other for some time. She knew that I had the capability to do that. And so I initially came into Avanti to manage risk. So, and that's a company-wide, everything from cybersecurity, but also HR, contracts, kind of the whole gamut. If it looked like it might involve lawyers from another side, it typically would hit my desk. But it turns out at a cybersecurity company, like Avanti, we are a mix of kind of traditional IT software as well as security software. A lot of that risk tends to be cybersecurity risk. And for better or worse, those that have seen the headlines from, you know, two years ago, three years ago in particular, Avanti has cut its teeth a bit on cybersecurity risk.

4:26And so it was trial by fire for me for some of that, jumping into incident response, learning how to handle through vulnerabilities, particularly a vulnerability exploited in the wild. And throughout that process, you get to really learn the incident response plan, what it looks like at the company, who your subject matter experts are, and just how a company should deal with outside risk from everything from your smash and grab ransomware actors to your nation states and sophisticated kind of espionage threats. They're all things that we need to be cognizant of day in and day out. And so this past May, so coming on just about a year ago, we had a little reshuffle with the company.

5:12And it turns out the CISO seat was open and my name got floated. And luckily, I knew how good our full security team was. And so with that, I said, yeah, I'd be willing to take over that role. And it's been full cybersecurity ever since.

5:30Shamil Malachiyev: And how does it help you having had that much experience in litigation? Yeah, I think, and this may be a little counter to what folks would generally think, but litigation as a background forces you to be able to take on a lot of information very quickly. and then become kind of a mini expert in a very specific set. But to do it quickly and then, like you said, to be able to translate that into a form that your average person can understand and digest. If you think about who sits on a jury, it's pretty rare to see a software engineer, unless maybe you're seating a jury in Palo Alto or somewhere like that.

6:15The typical jury is more likely to have retirees and a stay-at-home parent than it is to have a software developer. And so you really need to be able to take those complex ideas and boil them down to ways and analogies that can make sense to the average person. And I think for the CISO role, especially where you are sitting, like you said, as a translator between your security, your red teamers, your engineers, your PMs and your execs who need to understand it or your financial teams who need to understand, hey, yeah, budget does need to go up. And I get it that it's not a budget that's returning dollars back to the company, but boy, it's one that might save the company from losing big.

6:59And so the ability to do that translation, I think, is something that lawyer or not would help every CISO out there.

7:07Shamil Malachiyev: And do you have to constantly battle your clients kind of going back and forth between we have to adopt AI, so let's kind of close our eyes on the risks at some point. So they're kind of closing our eyes on budget, risk, because if you don't adopt any AI, you might be at a worse position than taking the risk. and at the same time, you know, company being like, oh, AI is really vulnerable, like in terms of like vibe coding, like agency coding inside the systems. How do you see clients kind of manage that internal battle between, you know, staying on the cutting edge while at the same time trying to, you know, make sure the security is in place?

7:49Yeah, I will say, I think at Avanti, we have taken a calculated look at that exact issue. And being able to see it from the legal perspective is one that is helpful on that front. The big piece we've had is to try to do it in a thoughtful way. So you're not building a house of cards. It's the foundation of your adoption for AI, whether it be integration into your product itself or integration into your corporate operations as a general matter, finance, in engineering, in security. We wanted to make sure we adopted it in a fashion that allows us to be able to set a foundation of security. Like you said, I mean, agentic AI still does give me ulcers, you know, the gray of my hair.

8:39It definitely is not just a deposit. It is the fact of, you know, I think I just read a headline about a company using Cursor and one of the kind of smaller hyperscalers. And Cursor decided to delete his entire source code plus his backup repo in, they said, nine minutes. You went nine minutes to no code. And there's a whole host of issues, right? This was not just Cursor's fault. I don't think the underlying model is the issue. but you know it had one bad hallucination where it said how well i couldn't get past this authentication piece so i thought i would just delete the repo and then it turns out that deleted across the whole stretch of code for them that should keep sys up at night and that's why you need to have this foundation so you know we have our aigc which is the group that the company here at avanti if you want to adopt anything it allows you to go to that group and say here's the product, here's what it's going to do.

9:39Here's how I want a proof of concept to test it. And then that runs through legal privacy security. And it does, you know, raise some concerns from folks on speed sometimes, but you know, it's not hard to then turn around and say, well, if it turns out you just gave up the full source code for this product to the general internet, I suspect that's going to take longer than, you know, weak turnaround for the AIGC to take a look at it. So that AIGC, that is AI General Counsel? It is, it's our AI Governance Committee.

10:16Shamil Malachiyev: Governance Committee, okay. We, like every tech company out there, love acronyms. So if I ever skip over, if you don't know, please. I'll make sure, yeah. To dumb it down a little bit to understand for everyone. But that process, I think, has been iterative, and we've had to speed up in some spots and slow down in some spots. But it's a nice kind of, I think, valve or gate, if you want to use kind of coding parlance, that you've got to get through to help cut down some of that risk, but not put you so slow to adopt that you're going to be with the dinosaurs. Yeah. Yeah. And I've also spoken to quite a few head of procurement departments and to general counsel at companies.

11:03Shamil Malachiyev: And the thing they're saying is a lot of kind of AI initiatives always go through them, either through compliance or just making sure, you know, the cost value is there. And it kind of forced them to kind of start evaluating like they have to be the point in a company that really understands the value drivers within each AI kind of platform that is being added. to kind of understand the cost structure, the contingencies that are going to be in play there. Is this sort of like the general committee of like tops of different departments that have been put together to kind of do that evaluation together?

11:37Shamil Malachiyev: Or is everyone individually expected to kind of know how to evaluate all these new AI initiatives by themselves? Yes. Our AIGC has a representative from security, which obviously I'm big on. We have someone from legal. We also have part of our privacy team there because obviously where your data is going and who's processing it, I think is one of the biggest, like fundamental underlying questions that people don't necessarily have answers for, for a lot of these models. And then there is sales or whomever procurement is on there and then whomever is bringing the issue to the council. So whether that be sales, finance, engineering, product, any of those kind of core pillars of the company, whoever wants the issue to be there is the one that's going to have to advocate for it.

12:28Shamil Malachiyev: And how easy it is to reach a resolution in a meeting like that, especially for something that has been tried and tested in the industry like thousands of times and it's relatively new. how do you go about actually resolving and evaluating things like this yeah so we have you know there's more than one process there if it is a proof of concept so you're going to only roll it out into a small sandbox or only a couple of users and you have a good handle on how's it going to manage data or if it's going to just see data that isn't necessarily super sensitive right so it's not like you're tying it into your workday or hr systems or you know it has access to all of Salesforce or something like that.

13:06It's a smaller subset or it's a subset of, you know, maybe anonymized data that they want to be able to do analytics on with AI, but it's not data that, you know, if it leaked to the world, we wouldn't be, you know, no one's paying a ransom over that.

13:21Shamil Malachiyev: From the legal perspective, we're talking about. If that's the case, then you have a faster track. So that's relatively quick. If it is, you know, Say you wanted to roll out cloud code to the whole company so they all had access. That's a much bigger issue, right? You need IT in there so they can talk about how it's going to work. Just logistically, you need to do some real budget looking at, right? Like how many tokens is every person going to get? And is this wonder of the robots taking over human jobs? It turns out they're more expensive than the people you'd have anyway. That's always a concern too.

13:57And so it really does, it scales up and down depending on the scale of the implementation.

14:03Shamil Malachiyev: And where are you seeing the adoption? And the reason I'm asking is, you know, usually the final hurdle before getting like companies to adopt any kind of piece of AI software or anything agentic are usually the security considerations. So it's either compliance, security or cost, like in my head. So whatever gets past you, you know that that's something that's already proved its place in the industry and is probably going to work. Like whatever didn't is probably just testing the waters. So what are you seeing in terms of general adoption of various tools out there? We've talked about like work days for like HR systems, for example.

14:43Shamil Malachiyev: Which particular verticals are you seeing being the most ripe ones for like good adoption? Yeah, I think this comes, we actually just had a conversation. I was filming part of our kind of AI training for the company earlier this week, but having a conversation with actually, so Brooke, our chief chief legal officer, and then Sterling Parker, who's our SVP over support. support. And one of the things we talked about is you're not going to find success in adoption unless you have a good view and good clean data into what the actual tasks are you're looking at. And I think most folks that use agents to do things or have been kind of early adopters, I suspect either have run into this and it turns out their adoption doesn't work well, or they understood it fundamentally from the outset that garbage in, garbage out has been a problem with software from day one.

15:38And I think AI, and this is probably for almost all of the implementation of LLMs, agentic work, any of it, is that garbage in, garbage out idea is now at machine speed, if you want to use the marketing speak, right? But what it does is it turns the volume to 11, right? You're on spinal tap mode for any sort of problem like that with AI, because there's not, there's strong reasoning there, right? But you don't have that kind of grounded human interaction to say, does this really make sense? It's like, no, no, you told me to do this and that's what I'm going to do. And then, oh yeah, I'm sorry.

16:16I was looking at five-year-old data because you didn't fill in the right thing. And so that's been one of the big pieces we've tried to look at is to make sure we really understand the tasks. Where we've seen solid adoption, and I don't think this has come as a surprise, right? Like products like CloudCode or similar coding agents, there are repetitive actions there that really are easy to push to automation. We're a company that's been using machine learning for a long time, 20 plus years with our patch products, right? So we're pretty familiar and comfortable with that. I think that the recent developments in models, and this is mythos and all the rest of that aside, but the current frontier models even have become much better, for instance, on the security side of the house.

16:57So our, and this is not in the context of trying to replace a red teamer or, you know, go to an AI SOC, but in the hands of, I mean, we have a fantastic red team here. I'll happily stand them up against anyone out there. But when you give that team also having access to cloud code, their ability scales so well that, and the company's made a distinct push to not have AI be an eliminator of roles. But I do think you'll see less hiring. I mean, I think that's just the nature of the beast. We're not eliminating people, but the people we have, when they can leverage tools like that, what they can do, it grows exponentially.

17:40Unfortunately, for the security side of the house, it has to, to keep up because the inbounds are going to grow as exponentially. But that's been one place where I think we've seen some really solid adoption. I don't think it comes as a surprise that the creative side of the house has also been one where they can leverage ai tools and it just speeds up the process I don't think you can lose that human in the middle yet but the ability to leverage it really is a big thing the analogy I use I because I'm a lawyer by it's still at heart all the time but and it may be because I also have a seven year old daughter that I've been reading Harry Potter to right but you could go to the wand shop and buy the best wand in there but if you don't know the spells you're not going to get any magic out of it.

18:23So you can hand someone without a coding background like me, Claude Code, and maybe I can vibe my way into something that looks cool, but it's really not going to be that great. But you take a seasoned red teamer and say, oh, here's this product that can then fill in the gaps where maybe you don't know Rust that well or Bash isn't something that you use all the time. But you've got an LLM that you can go get trained up quick to learn about a niche area, right? You have one chunk of bash, for instance, and you want to know how that's going to work. You can learn about it, and then you can switch over to a coding agent and say, this is what I think.

18:59Hammer away on it. See if you can find an answer. And all of a sudden, that one red teamer has now taken the place of not just his job, but he saved time for your engineering team because he doesn't have to go back and ask. And he saved time for what would have probably been a junior role to try to develop POC or even a fix. So that's where the leverage really comes in.

19:20Shamil Malachiyev: And maybe like as an additional kind of service direction for security companies, I was listening to Andrew Karpathy's presentation at AI Ascent. And he was talking about how our hiring process needs to change for the developers, for engineers. And he says something about the rise of actual agentic engineers, agentic engineering. And instead, the future of hiring will be like, you come in and we give you, okay, give me a copy of X or Twitter for agents. And actually have agents write dummy data, talk between each other on the platform. And what I'll do, I'll spin up 10 codexes from Chargift and I'll try to pen test it and break it down.

20:08Shamil Malachiyev: And I'll see how well it works in that kind of perspective to kind of identify all of those things. And I can imagine for any Red Hat member, it's just sitting there, you know, with all of the potential agents to kind of go and test the crap out of the system. And just maybe like even potentially like do a small DDoS with, you know, having so many agents at their thing. Is this something that Ivanti is kind of getting prepared for? because mythos is coming and people say like, ooh, mythos might be used by the bad actors just as well as by the white hats ones. Yeah, I mean, I think at some point, it's probably 24 months, maybe a little longer.

20:53That kind of work I think is going to be table stakes, right? Like the reason why people are going to buy enterprise software, it's going to be security, support, those things that you can look to someone else to have done it, because I think the front end piece of it is going to become less and less valuable, right? And to the extent your agents can get in and see the data, they can likely come up with the dashboards you need to be able to see it, right? Like if you're just making the dashboard, it might be time to pivot. But the, if you're the one that holds the data that the agents need to see, you know, I think that product's still going to be valuable, especially if it keeps it in a language, you know, with a context layer that AI can see MCPs are coming around all over the place.

21:37And so maybe even that, you know, if you want to call that a moat, it might be drying up a little bit too. But I think that you're going to have to in the next two to three years, if the front end of your product isn't being banged on by 10 agents at once, like it's, you're going to be out of here, you're going to have to do it. And I think in the interim, you know, I'm not here to give a sales pitch for any of our product. You know, one thing our CEO recently said, like you see these, all these kind of clickbaity articles about the SaaSpocalypse is coming. But I think that you do for this, this interim period where people are adopting the models and they're getting better, it's going to be what he called a patch apocalypse.

22:18And I think that's true. Like, I think the speed at which fixes are going to come out, especially for legacy on-prem software, it's going to have to ramp up. Right. And there are still, we are a company with legacy products. We make on-prem products still. And it's because there are customers that need it, right? And they tend to be the customers that are very sensitive, right? That just cannot have their data in a cloud setting. Yeah. Turns out who are also the targets of your nation states of the world, right? Those are the places that they want to look and see. And so having the ability to automate patching and things like that over this transition period, over this patch apocalypse, which it turns out Avanti sells.

22:55You know, if you need to get into automated patching, we can help you there. Autonomous endpoint management is kind of our big push. It's where we're looking because I think organizations are going to need it. You're going to need to be able to automate the fixes and push them out faster. Just doing Patch Tuesday is not going to cut it anymore. I think you're going to need to be able to do it faster. You're going to need to be able to automate it because otherwise things are going to get missed. You get 92 % coverage. That used to seem great. But now if there's robots out there that can scan your whole network, that 8 % is still a pretty big hole.

23:29You know, the ability to understand what's on your network, be able to get to it and be able to be tied into those patches as they come out and push them when they come out is just going to become more and more important until all of that software on the front end is seeing that rigorous kind of testing. I don't think that any of the LLM work, it's not as if people couldn't have done it. They're not finding new classes of vulnerabilities, but boy, are they good at finding the classes of vulnerabilities that we already know. Right. And so I think you're going to have to see people eliminating full classes of vulnerabilities.

24:03This is stuff that you've heard from the likes of like Jack Cable, for instance, formerly at CISA. He spends a lot of time talking about eliminating classes of vulnerabilities and something his company has been really pushing, I think, as part of the use of artificial intelligence to do that. He's a very smart guy, I should say. Nice guy. But that idea resonates with me in the sense that that's where that agentic work can be really strong. Because that's what it's trained on. It's trained on all the history we have of finding, whether it's cross-site scripting or you name it, of kind of our standard classes of vulnerabilities.

24:43I think you'll find that the newest models, every time they get better, are going to be better and better at finding those.

24:48Shamil Malachiyev: and how do you see like with companies that are opting in for the highest level of security and let's say they all want on-prem how are they getting the access to the latest models out there while using on-prem to make sure that internally i think you're going to have to have systems that are going to do that um and that's where like i said you don't want to set up a system that's on a foundation of sand you need to set up a solid foundation and i think that's something we're trying to do. So you're going to adopt, we've adopted multiple models in that security process so that it's not just one view.

25:22The other piece is having that system set up to integrate the models so that when the new frontier model comes out, it slots right in and you're ready to use it. And I think that's pretty consistent with what Anthropic said in their kind of mythos preview, right? Was even if you're not part of our super special group that managed to get in here early, a masterclass in communications and marketing being strung along as a warning. But the ability to slot in those new models as soon as they do become more widely available, right? That's that foundational system. You need to set up systems that allow you to adopt like that.

25:57Shamil Malachiyev: You know, with our announcement of Mythos and just cloud security, there is a lot of kind of uncertainty out there. Like how much of it is hype? You can see security companies being worried about how people are going to be able to secure their own software by themselves now. But obviously, we have to also look at the fact that Anthropics is likely going to IPO this year. So they're trying to bump up the hype, the prices, the valuations to the max as well. How much do you think the overall role of security is likely to adjust to something like cloud security, for example, if it is as powerful as they claim it to be?

26:36Yeah, I mean, clearly I'm not disinterested given my role. I think that, you know, some of the guidance we've seen across the industry and this is coming from, you know, even you're seeing PE white papers, you know, and these are folks that are very focused on the bottom line, talking about how, you know, that 10 % bump in your security budget is not enough, especially for folks who have not already established those patching processes. if you don't have autonomous patching, and you should probably look at more like doubling that budget because the ability to keep your network and all of the devices on it up-to-date and secure is going to be, like I said, it's going to be table sticks.

27:16You're going to have to do it. And so you've been putting it off because, oh, well, we can manage through it. I think the volume, and the issue here is not necessarily that it is novelty, that it's something new you need to be able to take care of. it is that the volume and speed at which is going to happen is going to break those processes if they're not already well established. And so that always is, it's interesting to me because when you see private equity talking about the need to invest in something that is not sales driven, not revenue driven, I think it shows that, well, I'll be the first to say, I think, like I said, the Anthropic Mythos preview release was a masterclass in communications going from, you know, being labeled as a supply chain risk to then having more people knocking at your door to spend money with you was, you know, my, my background actually before law school was in marketing, but the, uh, I appreciate how well they did that.

28:10But I think, you know, when you see the folks with a profit motive saying, we need to spend money, there's some there, there, right. I don't think it's quite the scare tactic necessarily that some folks are using it for. It's makes lovely clickbait to click on, on LinkedIn or wherever else you want to read, but there's enough meat in that mythos preview that it's good, right? Like it, especially when it's leveraged by someone, like I said, you know, a true spell master that knows how to use that wand. It's a, it's a good one. Yeah.

28:41Shamil Malachiyev: Because I also believe like having companies like a one is going to be important because on the other side, you don't have malicious actors who are noobs and newbies, you know, using these tools because those can be like highly professional people who've been doing that for their lifetime. likely yeah i mean the skill sets from nation states are they were already good right and i think it's that exact same thing like i talked about where we're not necessarily eliminating people but we're letting them leverage their skills further that's not just the good guys right and as a defender you've got to get it right all the time right and this is something you hear right defense has to get it right all the time the bad guys only have to get it right once It's true, though, right?

29:22One hole is enough if someone can get in. I think defense in depth is going to become even more important so that you're at least pushing the context limits of these models when they're trying to punch holes and things. And again, getting back to systems at the root cause of it, it's still good hygiene is going to be the most important thing. And it's going to become more and more important to stress that across an organization because you might have been able to get away with having folks who, you know, didn't have MFA turned on on their device. You know, I hate to say that C-suites tend to be the most guilty of that.

29:58That's just not going to fly anymore. You can't do that. So if you have a good, robust kind of foundational level security controls, you know, good data segmentation, good identity, and teams that understand how it works so that they can see anomalies in the process, the speed at which this is coming is going to test that, right? It's going to push the boundaries of those systems. But if they're strong, they should still hold. Defense in depth still matters. I still think even with Cloud Code and the rest, it's going to democratize the ability to use complex exploits. Phishing the CEO's executive assistant is still probably an easier route into a system.

30:35Shamil Malachiyev: Do you still think social engineering is the easiest kind of point of entry? Well, I do. I still think people are going to be the weak links without a doubt. I think that's getting harder. I also think, you know, I read an article the other day that was talking about a little bit of the, you can look at prompt engineering or prompt injection a bit like social engineering and agent, right? It's not, it's not way different, right? You're asking a little bit different question. You know, the classic examples you see are like, I'm writing an article about, you know, how do I explain? 75 kilogram chicken.

31:09Yeah, exactly. but that I mean it's akin to social engineering in that sense of you're just convincing an agent and not a person to give you something they're not supposed to

31:22Shamil Malachiyev: and do you find that it's easier to train the agent than a thousand people because you kind of have to train one agent and then it kind of almost replicates across all of them oh don't buy the article case let's be more careful when you have people especially when there is the natural attrition, when people come, people leave, and you always have to keep them on board on the latest SOC 2, for example, criterias. Also, do you think SOC 2 is going to evolve to SOC AI, or is SOC 2 sufficient currently as a kind of stage of like, okay, that company is secure? It is. No, I don't think so. But I don't think it was pre-AI.

32:08either. And that's not to discredit SOC 2, right? We SOC 2 certify all of our cloud products. It's an important step, I think, as much internally as externally expressing to customers that you've done this, but it forces your internal teams to look at your GRC, right? Do you actually have oversight you need? Maybe you're operating in a way that's fundamentally secure, but if that head of engineering leaves because there's greener pasture somewhere, do you lose all of that ability? So the SOC 2 helps you kind of institutionalize some of these processes. Candidly, it can give leverage to security teams to say, hey, this part of the company needs to improve.

32:49I still want to pull my hair out sometimes in those audits. I don't like checkbox audits where you're just trying to come up with evidence, but it doesn't really result in substantive on the ground fixes. But if you take it serious as a company and actually try to institutionalize real change as part of that process, I still think there's value there. So this is me. I'm not saying crinkle up your SOC 2 and don't believe it. I think it's more like SOC 2 is going to be, again, foundational, and you're going to need more on the top. You're going to need to be able to demonstrate how it is that you're keeping your agents secure, how you're implementing it, understanding those data flows, who's touching your data, can it be trained, all of these things.

33:29Shamil Malachiyev: And what would you kind of advise for? Because if we look at there, there was something like ISO 45 ,000 or 54 ,000 coming out, like about AI kind of used within companies, but these things progress so quickly. Like the certification you had like two years ago, obviously, like it doesn't make sense anymore because right now it's every, a lot of things have changed. what is the kind of like this certification that you're pushing people to kind of look at when it comes to like working with a chance at kai yeah and i don't know that there's a great place to look at the moment in terms of that and i think and this has been a problem again with sock 2 or iso or pen tests even right they're all still going to be point in time it's not a dynamic continuing ongoing piece and i think if you're going to integrate something that is going to be core into your systems, whether it's a co-pilot across your whole org or something that's going to integrate into your financials, into your HRIS, or across even broader, right?

34:30It's going to be tied into multiple different buckets because you need that kind of cross company analysis. I think you need to do, it can't just be a TPRM third party that's saying, oh, I have these 11 boxes I need to check. I think you need to actually have someone who substantively understands your systems leaning into that vendor to say, how are you keeping X, Y, and Z safe? Like that third-party risk management piece, maybe you can offload it for a lot of stuff. But if you're going to have agents that are across company, across data locations, right into the full kimono open agents, you better do that fundamental risk analysis.

35:13Shamil Malachiyev: And that's mostly about large companies, right? They have budgets. What if we talk about just starting out companies, like very small companies? Some of them are, they sell the open club back in January. They've got their Mac minis, you know, running OpenClone, their computers to kind of manage the CRM or whatever. Like, first of all, what is your view on like OpenClone and its like place in the current kind of economy? And then how would you advise them to kind of what kind of things to look for to try and secure themselves? Yeah, I mean, I think it's back to basics again, too. But I think the big piece that anyone in that one, two, three, five person founder style company, having a strong understanding of your data fundamentally at the at the base level is going to let you architect upward in a secure fashion.

36:10So I'm not against the open claw side of the house. I think it's fascinating. And I think it's, I mean, it's, it still leaves me in awe what people can do so quickly and just how much better it gets all the time. But if you can focus and understand at the ground level and have at least or more than a rudimentary understanding of what your obligations are going to be for data, that's going to let you build in a way, again, that scales up on a strong foundation. Instead of on the back end, all of a sudden you're like, oh, no, I left all of my creds here in plain text because I didn't think to ask Claude to go and actually make this secure when I started it.

36:47I was looking at the end problem. I think having at least that front end, you know, it slow is smooth, smooth is fast if you get back to sports analogies. But it's that same idea of walk before you run, make sure your footing is stable, and then scale upwards. Is it going to break along the way? Sure. It's not going to be perfect. And you always can go back. And I think the ability to go back and fix is going to improve too. Like to iterate with agents is always going to keep getting better. But I don't think it would hurt if you are in that one, two, three, five person founder, find someone who is data security focused at the front end and get them to take a look.

37:25Even if you've got to get a consultant in there briefly and, you know, you can look and there's lots of orgs out there now that do almost kind of Fiverr-esque consultation, but with high level security folks. Like you, you can do it, find someone that does it or spend your tokens on Claude to get it so that you know what the, you know, you know what questions to ask. So while you're vibe coding, it will let you turn around and say, okay, by, by the way, while you're doing this, make sure you pay attention to data segmentation. Make sure you pay attention to how this is encrypted and, you know, both in transit and at rest.

37:59these are all things that if you can think about them on the front end will let you keep moving at the speed you want to and hopefully let you keep selling without having to call a lawyer like me

38:09Shamil Malachiyev: because so the important thing is like while prompting have a piece somewhere that says imagine you're jack nelson 10 years litigation experience you know in cyber security and analyze everything. Sure. I think that makes sense. That is the exact kind of idea. There's the famous Donald Rumsfeld quote about the known unknowns and then the unknown unknowns. You miss what you don't know because you don't know to ask the question. And sometimes you need that naivete because you never even start if you didn't have it. But once you start moving, start thinking about what data do you have how important is it where is it going to go and how are you going to protect it and if someone stole it what would you do and those kind of fundamental questions at the front end i think will be they'll pay long-term dividends as you scale and what do you think about like i was reading about a few days ago about sap and the way they kind of closed down access to a lot of kind of agenda capabilities to make sure that they preserve all of the data within their systems.

39:23Shamil Malachiyev: Do you think that's something that a lot of like legacy systems are going to do to make sure that people have a harder time migrating the data and everything over to like newer agenda kind of systems? I mean, I think it's short-term protectionism. I think again, in this kind of wild west that we'll probably see for the next 18, 24, 36 months, If I'm SAP, I think it can make sense if at the same time and in parallel, you are developing to be able to move to that AI frontier and you can do it fast enough that those one, two, three, five man shops that are coming up with new AI, like foundationally AI capable products don't beat you in the race.

40:05right so you've got the quote-unquote moat of the data that's sitting with you and the integrations are already there but pay is coming right on your heels right to to drain that moat so if you're not in parallel developing like that i think it's short-sighted but i you know i can understand it from a business perspective i could definitely understand it if you're answering to quarterly calls and not looking at two years three years five years down the road and do you they're also relying that the enterprise companies oftentimes are the ones that are the late last

40:38Shamil Malachiyev: ones to adopt all of the like latest cutting edge because they have so much red tape and they have to go through compliance they have to go through procurement like a lot of layers they have to get approved and i think people who like before i worked with enterprise companies i always thought that they used like the latest tech you know they have so much money you're so many people they must be at the very cutting edge when you start working with them and you get into like procurement systems that they use and stuff you're like oh wow 1995 two steps off and that's loss and what they're working on yeah exactly um and it makes me kind of think like okay if their adoption in terms of like latest tech solutions has been so slow what is their general like strategies with staying relevant in the age of ai because there obviously are a lot of companies relying on this legacy kind of software, but they kind of think they have to keep moving forward.

41:31Shamil Malachiyev: But at the same time, like the legacy is stopping them because it's a lot harder to refactor and, you know, move the data, retrain people, change management and all that. Yeah. I mean, a cruise ship doesn't turn on a dime, right? Like it's, it's a lot different than a wakeboard boat. And so if you look at, again, I'm back to analogies all the time, but that is, you're exactly right. And it was surprising to me too, to see that. I hate to say that the federal government may be a prime example of that, right? We have lots of regulations that on paper make sense that the government wants things to be really well tested.

42:02You know, they need to be vetted in sandboxes. They're not going to adopt patches fast because they want to make sure they're not breaking things. And that did make sense when software wasn't developing at the speed of AI. And now that kind of unintended consequence of having regulations or procurement processes or just an overall bureaucratic process is that you're actually going to become less safe because you can't adopt fast enough to get things clean. And hopefully, you know, I think your big enterprises are going to have to be more and more cybersecurity aware. It can't just be an afterthought.

42:39Your chief security folks, whether that be a CISO, whether it is your head of IT, because you're a smaller org, they should be talking to your executive suite if they're not already in there, right? They need to have line of sight to your CEO, to the decision makers, if they're not already a decision maker. I mean, I think that that ultimately security needs to be in the room if you hold anyone's data. If anything you do revolves around, if the value you provide revolves around holding someone's data, cybersecurity is going to be critical. There's no way you can avoid it.

43:10Shamil Malachiyev: Do you think there are bonuses to being legacy? Like for example, if you look at Workday, like my company we try to integrate with a lot of enterprise systems and when you work with large ones like workday like the api availability like the endpoints the web hooks it is like it's using like rest so which is like really old kind of style which makes it really hard to kind of combine and start pulling the data back but at the same time it does make it more secure you know from if you don't create all of those like connections right well yeah i mean a reduction in api connection I think is going to be just kind of more secure by default because there's less places to bang on.

43:50I don't think that the security through obscurity is going to continue to be as helpful as it may have been. It never was perfect, right? Like there's always the second best in the past, but now if you've got agents that they don't sleep, they work faster, obscurity, it doesn't help nearly as much when someone can leverage that machine capability. Because, you know, you write a prompt and say, hey, go hammer away on all of these endpoints overnight and come back and say, well, there's that hole I was looking for. Would have taken me two weeks to do as an individual, but, you know, you found it in 45 minutes with the help of AI.

44:28And I also think some of this stuff where it's like no one was punching holes in it because it was 20-year-old code and no one was really using it. Now between scanners and AI tools, all of a sudden those those holes look a little more appealing to be able to hammer away on so i don't think it helps as much as one might think um but we'll see it's it's the wild west and i'm also feeling like a lot of companies are becoming over dependent well me myself too like if you start using for example

45:01Shamil Malachiyev: cloud co-work and then use cloud code and then cloud design comes along and you're like oh i can design everything and I can code at the same time. You're like, okay, what's next? Cloud sales, cloud marketing, cloud procurement, cloud legal, and then... That's coming. And the other thing, you see the other articles floating around there where AI is making people dumber because they're not actually trying to think about things. I think it would probably be wise, especially at an enterprise level, or if you have the unique intricacies of your business, I keep getting back to the Harry Potter analogies, but you need a Hogwarts for those folks.

45:37You need a chance to train them. I don't think you need a four-year engineering degree, but I think the ability to understand the fundamentals is what's going to give you the ability to write the prompts that make sense. It's going to reduce that bucket of unknown unknowns for you. So I think it would be wise for folks to do that kind of front-end training for their new folks that are coming in. I mean, like we're starting to work on a, like an AI internship program. So it will bring in younger developers, folks that are still in school and work with them directly on both using AI, but also how are they understanding?

46:15How are, you know, what prompts are you using? How are you integrating it? And so I don't want to steer people away from education, but I also think that having the fundamentals there will give you the ability to leverage those tools much better. Like I wouldn't want to be a brand new lawyer and have to come in and I'm trying to write a brief with AI writing it for me, it'll spit something out that looks compelling. But if you don't have those fundamentals and you go in and read it, you're going to say, this is great. And then you're going to file it with a judge and they're going to be like, did you actually do the place you cited here?

46:45They don't like one, maybe it's a hallucination to maybe it just doesn't stand for what you're talking about. And if you don't know why it's there, good luck arguing your way out of it. And I, you know, speaking from experience for better or worse you know being on the losing end of an argument with the judge is not fun and that's when i knew what i was talking about i can't imagine getting my tail handed to me for a hallucinated sight in front of a judge that's a bad sorry sorry but

47:11Shamil Malachiyev: but claude said you know that it works i'm protected if the outputs come in from you at the end of the day if your name's going on it you got to be able to answer for it whether it was a robot or you that wrote it or it was an agent or not right like responsibility stays with a person exactly we i mean when we met a little bit before this right we talked a little bit about the idea of an agentic ceo and i think it's one of those things where i can understand why you might think it seems like a good idea from a board perspective you're like i've got someone who's got no emotional ties to anybody they can make a clear business decision but boy if you're the board and you're doing that and that agent you know goes wild like the cursor agent we talked about at the front end that deleted all the source code like you better you better be comfortable being named in that same complaint that sues the company uh because you're exactly right the buck has to stop at the feet of a person at some point and do you think that's the reason why we'll for the foreseeable future we'll have humans in a loop in the systems and not the fully automated departments and processes I think so.

48:17Shamil Malachiyev: I mean, I think again, until those foundational levels are strong enough that you can, you can rely on the output because people hallucinate too. I've seen terrible. We are not immune from the same problems, but our problems don't tend to scale the same way it does when you have a thousand agents that are running on the same model. And so until you can have that faith in it, I think you'll at least see people in the loop where there is true consequence for the decision making. I hope so. I don't know if the world gets real weird. We don't, you know, this, you start. Thinking about this, you can either look at a utopian or apocalyptic, right?

48:51You can take the Elon Musk universal high-income idea. I don't have enough faith in humanity to buy into that one yet, I think. Unfortunately. I don't know. T2000 was pretty cool, though. We'll see if that all can actually happen.

49:05Shamil Malachiyev: Yeah, I guess if you look at what's driving the technology, a big part of it is warfare, and that's where a lot of the budgets go. I think within the U.S. there is a huge part of the national GDP that's going towards the militaristic sector. And I guess they have the money and the technology and the people to kind of use the models to create terminators. I don't think it would be hard for – I think we have – when you see those robots that are kind of going inside the house, giving you the cup and everything and be like, hello. We can kind of see where it's going. I mean, again, it's clickbaity, but like the half marathon, the Chinese half marathon the other day where there was a fully agentic robot that beat the world record time.

49:45You know, I mean, I'm sure a self-driving car probably would have beat it too, but it's a good indicator that robotics are also moving quick. This is a cynical view of it, but right, it's warfare and pornography tend to drive technology changes across the globe for better or worse. I don't know what that says about us as humans. Maybe we should take more robot into us, but that's where advances come from.

50:08Shamil Malachiyev: Yeah, that's true. I think I was reading, I was shocked about it, but the online payments adoption was mainly going through with like Snapchat and kind of all the like sexual industry. Well, yeah, I mean, you look at just the take morality aside, right? Just the dollar value of OnlyFans in terms of the amount of money going through there, right? Like you need money for innovation. So it's not a surprise that those are industries that drive it. And talk about somewhere that privacy makes a big difference. I think you'd see if there's ever a company out there that wants to keep their data safe and secure.

50:46That's an industry that wants to do it.

50:48Shamil Malachiyev: Yeah. Keep it on paper. You just stuck it away. Well, I do wonder, right? Like identity in particular with deepfakes and all the rest, it seems like it's full circle now. For us, one of the many ways that we're helping to protect against threats on identity is to make, if you want to pick up your laptop, depending on what your role is, you need to come in person. We're not going to send it to you. And that's a remote role. That's an interesting topic. Right, where it is like you're right back full circle to it used to be it was fine. you could be online um but boy they get you know um the north korean it worker issue is any sort of i mean anyone that offers a remote role um and there's all sorts of you know anecdotal evidence around that but it's real and it's not i mean it's something that every org needs to combat and do you think that we'll see a lot of companies going back to like with software being on-prem and then people being inside the office and doing like you know with with the whole like film like snowed and you see everybody going through the metal detector coming back making sure they're in all like flash sticks going in and out because it does sound likely like when you're talking about having people come back to the office to make sure that you don't get a call from what it looks like to be your ceo with his voice because you know there are a lot of videos out of him or maybe like it's like i mean we've seen that exact you know like audio faked attempts you know it tends to be the stupid i want 10 000 gift cards or whatever so yeah there still needs to be more intelligence on the back end of it but that's not far off right learning every day the phishing attempts get better they get cleaner the llms help with that right because now all of a sudden your language can look exactly like whatever you know you could say i want you to write this with the tennessee dialect so that it matches where the person is it's not hard to spoof ips all the rest so i i think it becomes more important i'm never going to tell you going back to work like in office is going to be the solution we are i mean avanti's leaned in hard to the fact that we are a remote company i like being i mean again my hair's way to gray i i don't mind being in office if you have a team there i do think there's something to be said for the personal interaction i don't know that i could go back to work in an office five days a week i i i think it goes to like about everyone i think everybody's on the same kind of place but if you've got everyone there two days a week great but i also don't discount talent that lives in you know i've got a direct report under me that lives in outside of reno i'm in salt lake city our chief security officer is in colorado so for me the bulk of the people i deal with aren't in you know we're not physically close enough to be able to work together but i think the sum of the whole, as far as the team goes, is better than the individual parts.

53:43And we don't need to be in office that frequently. But I do think some true in-person to come pick up a laptop when you first start. And if it's someone who's going to see source code, if it's someone who's going to, you know, be in the weeds on security fixes for us, or have the ability to punch in, heaven forbid, you're a company who becomes a supply chain attack, right? But you hire a North Korean IT worker that has come in and then they put a backdoor in your software and you ship it to everyone. But I think paying for that plane ticket to fly them out to pick up their laptop looks a lot cheaper than that.

54:18Shamil Malachiyev: And what would you say about building trust? Because the way you told me the story of you coming to Avanti was with a friend who you've worked with for a very long time. And then there's a bit of trust. You're working together. You build that trust. Do you think it's as easy now or is it the same kind of level of trust when you work with a lot of people maybe even a year or two years but all you do is like weekly meets on zoom or teams is that the kind of like the same kind of level of trust do you think i don't think so i mean i think that that's something that we're all struggling with right is in trust company culture it's really hard to develop a company culture for a remote company i mean i can say that we work hard at it and it still isn't easy.

55:01It's not perfect. I'm sure if you, you know, surveyed the whole company, not everyone's going to be happy about it, but the overall, you need to put more thought into it. It needs to be more intentional. Like I, I make a point of, for my direct reports in terms of our, you know, we do a weekly one-on-one and obviously you'll have stuff you need to get through, but I like to have people work as adults. If you want to work at two in the morning, or you want to work at a coffee shop as long as you're secure and following all the guidelines, I don't care. Do what you want. Work the way you want. You need to take your kids to school.

55:37Great. And we can asynchronously look and make sure the work's working. So we can spend a portion of those one-on-ones. I want to make sure the mental health of the people I work for is still there. And I think that's a good place to develop that same trust. I've got one guy that works for me that lawn care is his favorite thing. He keeps an immaculate lawn. It looks like a golf course. And it's always interesting to me. I love to hear what people are interested in outside of work. If you've got kids and they're in the choir, they're playing a lacrosse team. I want to know about that so I can ask.

56:07And I think establishing some true listening and concern, understanding for people is important. I think any good HR team is going to tell you the same thing. also your ability to deliver performance reviews and help people manage through problems if you know them as a person it should be easier to do you know the termination may get tougher if it

56:32Shamil Malachiyev: comes to it because you're actually friends with someone but the ability to address you know performance isn't here maybe you'll know why maybe someone's going through a hard time at home and you can help them through that maybe someone is they're moving their grandma died who knows what it is, you know, don't pry if people don't want to know it, but knowing about your team, knowing about the real people you work with is, that's something that's near and dear to my heart. I think it's, especially in a tech space where people stare at screens all day. I think that it's really important. Yeah, I feel that too, in my company, because we also work in computers, like, remotely most of the time.

57:11Shamil Malachiyev: And as a closing remark, for, you know, a lot of people who will be listening will probably work in companies and are trying to push some sort of AI agency kind of solutions to kind of work within their companies. What kind of advice would you give them in terms of like preparation to make sure that whatever they try to add to the company is secure and it passes all of the security kind of verifications? Yeah, I think it gets back to go back to strong basics. I still think that is the critical piece. Strong understanding of what data you have, where it lives, where it's going to go, and how your agents are going to use it.

57:52I think that's probably the biggest thing that I would advise for folks is understand that, which isn't, I would have advised that before AI, but I think it becomes more and more important because, again, the speed and volume of things are going to break systems that aren't well-founded. and so get your foundations right learn to walk before you run and then i think you'll see once you're running you're going to pass the folks that didn't do that and it's it's going to happen quick but uh it'll it'll help in the long run awesome well ladies and gentlemen jack nelson

58:27Shamil Malachiyev: thank you so much man for coming to the show and sharing all of this it was uh this is fun i don't i don't get to do stuff like this very often so it's nice to have a conversation oh we'll keep bring you back in like when we hear more news uh i think with with the way is progressing uh we'll have a lot to talk about like i think almost every half a year i'm always happy to come back now it's been great thank you

59:06Thank you.

59:36Thank you.

1:00:06Thank you.

1:00:36Thank you.

1:01:06Thank you.

1:01:40Thank you.