Jon McLachlan: it's much better at writing code than I am. Much better.
Aaron Mog: Right. Yeah, me too.
Jon McLachlan: And I've I spent you know, a whole career like as an engineer writing code. but I'm not afraid But when a board of directors says this to the CEO and the CEO says this to the senior, VPs and the senior VPs tell it to the directors, what does that mean?
Aaron Mog: Right.
Jon McLachlan: because that has to be balanced with don't screw up the money tree, there is so much change that we're we haven't even begun to see. And it's I don't know, sometimes people like that the iceberg analogy of like here's what we can see here, you know, here's what's coming underneath the water. I think it's it's more like a snowflake that's sitting on the very top of the the iceberg.
Aaron Mog: Hey everybody, welcome to the ZeroSum podcast. I'm your host, Aaron Mog. thank you so much for joining us and and listening to our our our little podcast here. really excited and interested and intrigued to have John McLachlan on the on the podcast today. I was just talking with John before I get started. I don't know him that well, so I'm super excited to kind of dig into his perspective on our industry and he's sort of a I would deem you a renaissance man of that you do podcasts, did you do
Jon McLachlan: Ha.
Aaron Mog: business, did you do advisors?
Jon McLachlan: no, thank you so much for having me, Aaron. all the gratitude in the world. It's an honor to be here on your show.
Aaron Mog: Thank you so much. so I'm gonna let you introduce yourself because I don't think I'll do it justice just because I I don't know you that well. But I would say what drew me, what made you me wanna have you on is I think just the diversity of your perspective and how intertwined you are with startups in our industry and writing and your business partners who help write and all these sort things. So maybe you could give us just like a quick two minutes or whatever on how you got here and then we'll dive right into it.
Jon McLachlan: Yeah, love it. I'll I'll keep it short, elevator pitch version. So I'm from Minnesota originally. You might be able to hear
Aaron Mog: Love it.
Jon McLachlan: some of that that Minnesotan twang. And for the longest time, you know, as far back as I can remember, I've always been irrationally excited about all things security. So that's either a blessing or a curse, do you know, depending on how you look at
Aaron Mog: Pets.
Jon McLachlan: it. but it drew me you know into this space and because I studied computer science and sort of went through sort of those technical programs and was an engineer right out of school, still kept pushing that passion button, security. So have always been in security, have been, you know, blessed to always find that intersection between like the skill set and the passion. and so after school, I ended up at Apple. I worked on iTunes security back when that was a cool place to get your music and then later your movies and your books and the in-app purchases and all that stuff. It all has a bunch of security on it. Then I joined my first startup, it was Symphony Communication. That's where I had the great honor and pleasure to meet a ton of amazing people, but one of them in particular was my chosen family brother now and co-founder of all of the companies that have the honor and pleasure to build together. with sasha sinkovich and after that after symphony been in and out of you know startups that you'd never recognize the name of all security things you know either leading security teams or engineering teams at security companies and then throwing in some big companies in there every once in a while like Peer Storage or Robinhood and today I'm the co-founder of Why Security. We have a Team of 50, more than 50 now today, actually, security operators. We can go into another company and actually operate their entire security function. So we have dozens of partners where we are their security team. We also operate cyberbase.ai, which helps accelerate your go-to-market security posture. So help answer due diligence questionnaires and redline contracts. To make sure they're aligned with your organizational security commitments.
Aaron Mog: That's awesome. And you also have a podcast, right?
Jon McLachlan: yeah. Yeah, there's a podcast in there too. the security podcast of Silicon Valley.
Aaron Mog: Yeah.
Jon McLachlan: just because why not?
Aaron Mog: Yeah, no, I I love it. I've listened to a bunch of it. I think you guys have great guests and really insightful people dealing with this new generation of security. So everybody should should give that a listen. Obviously, I'll I'll connect everybody who's listening to this show to that content. That's a very interesting and broad perspective on our industry coming up at it as a practitioner and now being an entrepreneur and being a content producer. I one of the questions I love to ask, because I'm I am like you, I love all things security most days. but I I
Jon McLachlan: Mondays the best yeah.
Aaron Mog: love to get a take. where do you think we're at? how are you feeling about cyber? Obviously, we're going through this crazy AI hype cycle and change, but at the end of the day, we're here to protect people. how do you how are you feeling about it today? Positive, negative, excited, worried? where are you at? Okay.
Jon McLachlan: Super excited. Just like there is so much change that we're we haven't even begun to see. And it's I don't know, sometimes people like that the iceberg analogy of like here's what we can see here, you know, here's what's coming underneath the water. I think it's it's more like a snowflake that's sitting on the very top of the the iceberg. It's kind of like where we're at with that wave of change. I really see it it's very fundamental to how we organize information, right? 'Cause LLMs are just incredibly powerful and they're they're about to change everything, right? So it couldn't be more excited. There's a there's a piece of me that's a realist and a pragmatic, yeah, very pragmatic and and grounded and and I understand that there are are huge risks, you know, on the line and and that just raises the stakes for Everything that's about to happen, so
Aaron Mog: It's lot of pressure to get it right, I think, for us in cyber, because it it does have the potential to go poorly or be overwhelming or crash us out, whatever terminology you want to use. And I've had very
Jon McLachlan: Yep. Yep.
Aaron Mog: serious security experts on this show and in private conversations, everybody's one foot in both sides of it, I think to a certain extent of hype and happiness and joy of what we can do, and the fear of are we really ready for this and all that kind of stuff? So I and I'm fascinated because you're In Silicon Valley, you're in the the center of the pipe, right? And you're dealing with this. When you go talk to customers, of yours that are outside Silicon Valley or people that are outside Silicon Valley, obviously there's a little more skepticism. But it's gotta be exciting to be in Silicon Valley right now. this is a a a gold rush I haven't seen since probably the original web companies, right? it's just the amount of money flowing in and the money like like is that How worried are you it's getting a little too hypey, a little too frothy, I guess. are you are you looking around Silicon Valley going like, all right, should a startup with two people and no idea really get $30 million? Like how are you feeling about that part of it? Like, do you think we're acting irresponsibly?
Jon McLachlan: Well, like VCs are always gonna have a bit of FOMO and and throw money around, you know. It
Aaron Mog: Sure. Yeah.
Jon McLachlan: it's kind of just they're and they wanna get in front of these things, you know. I I think from a security perspective as a community, I get a really strong sense that we also wanna get in front of these things, you know, but what does that mean and how do we do that and how do we function together as we do that? I don't I wouldn't say LLMs really scare me. I I would I would just describe it as like a a really powerful tool that everyone is gonna have access to. You know, it's not entirely democratized. there are some limiting factors in terms of guardrails, And at the end of the day, because it's a tool, it's totally agnostic to intent, right? So when good guys pick it up and start using it, really good things are gonna happen. But when, you know, it turns out the world has a couple evil people in it, when you know evil people pick it up, really nasty things might happen. So if you take that perspective that security is kind of like a battlefield between good and evil.
Aaron Mog: Mm.
Jon McLachlan: the tools are just changing, you know, out from underneath our feet. Yeah. So as long as both sides pick it up, there's not going to be a huge asymmetry. I think that in the long term, as long as both sides pick it up, what we're gonna see is everything that was going to happen, that was going to happen, is still going to happen. It's just gonna happen in a much more compressed timeline. Which is great news for us because within our finite lifetimes we'll get to see a lot more. We'll get to see a lot more progress. A lot more
Aaron Mog: Yeah.
Jon McLachlan: is gonna happen. It's gonna keep us on our feet, And and that's a good thing. I think that's a good thing.
Aaron Mog: Yeah, I agree. I that's a great perspective is giving us the opportunity to see more in our lifetime. that being said, right, I think we're struggling with showing the good a little bit. I think a lot of the headlines are negative and becoming more like a negative, job loss and people being replaced, which isn't fundamentally the promise of AI. I think it's a marketing pitch, but you're in the heart of it, right? Because you are in your day job, in the in like how you your companies run. You're helping all these innovative companies like jump ahead, right? what does that look like? Like, how do you how do you do company security for companies that are going a trillion miles an hour in this era where nobody knows anything and we're all trying to figure it out? Like how how does that work? I'd love to sort of dive into that.
Jon McLachlan: Well, it's is tricky to stay on top of the change because
Aaron Mog: Yeah.
Jon McLachlan: the change is is not just changing at a typical pace like that we've seen in Silicon Valley before, which is a fast paced change anyway. Now it's changing but at an increasing rate. Right. And so the rate of change is increasing. And what that means is that things that look like opportunities today, you know, are not gonna be opportunities in a week or And so, from a founder's point of view, with an entrepreneurial mindset, you want to think about how that also changes things, right? and that presents a lot of like risk from a business point of view. If you're gonna go after a new thing, a new idea, this idea of having a moat or having something solid that you can build on that will last while you break into a new market, while you build the products, and of course, like. The way that you can build a company is now much faster. Like i everyone is an engineer, they just don't know it yet, right? And anyone can open up clawed code and and prompt it.
Aaron Mog: So that's it that's super fascinating because the other parts of business, right? The the finance, credit markets, security are sort of still very in some ways very traditional, but building has just changed dramatically, right? Like you said, anybody can build an app, you're writing millions of lines of code a day. Like we we aren't really gamed up for this, like in the sense of like the other levers of the business world hiring. For example, it doesn't move at AI speed yet. It's still this, you know, bogged down, you know, HR driven, compliance driven. And again, a lot of it for good reasons,
Jon McLachlan: That's right.
Aaron Mog: but like it doesn't move at AI velocity. And
Jon McLachlan: That's right.
Aaron Mog: you know, you sort of go to regular because like one of the things that's interesting to me, being a Midwesterner like you, is you know, you go to Silicon Valley and you hear this stuff, right? It's how fast it's going and all that. And then you kind of go to a regular company or a regular group, and they're like, Yeah, we're excited to try AI. It's like try AI, we're there. it's here. And so there is a little bit of a cognitive dissonance between hyper funded startups, not just in cyber, all parts of AI. And where 3M, you're a Minnesota boy, right? So where 3M is at with AI. Right? it's not the same place
Jon McLachlan: Nope.
Aaron Mog: for sure. It's a very different world. so are you finding, because obviously I'm sure you work with a lot of startups, that like the build parts fast, but the other parts require patience. is that something you see people struggle with? Because it doesn't go as fast as they want it to go. Yeah.
Jon McLachlan: Build is definitely fast. No, it doesn't. And why does it not go as fast as you want it to go? Is because is because, you know, when you work at a big company, like let's talk about 3M for a second. just to talk about a big company. Big company has been around for forever. you know, there's a lot of money that flows through that place, a lot of money that flows through like large companies just in general. And When you have that type of responsibility on your shoulders, it's you're gonna be a lot more methodical, you're gonna be risk adverse, you're gonna be thinking about all sorts of things that you you're not gonna be thinking about if you're just thinking about how do I stay alive for the next eighteen months. Right. And so as a i it's different like risk looks and feels very different depending on the context that you're you're looking at it from. lens that you have to look at it through. And so, a startup is super exciting and you can take lots of risks and you can build all of these things. And yeah, you can build them incredibly quickly. because you're you're racing against the clock to get these things to market, to build your feedback loops between like what is this potential customer going to say in this market versus what I actually built. And to build that feedback loop is your lifeline. You need to close those deals. So that you can demonstrate product market fit and whether you're gonna, you know, operate in the green with a whole bunch of initial customers or you know go back to the VCs and do another raise. That's a decision that you make on how you want to run the business. But from the enterprise perspective, like think about a company that's been around forever. You know, there's a huge amount of revenue that's coming in, they're very entrenched into what they do. Maybe 80% of that revenue comes from one particular service or product line. you have investors, maybe you're publicly traded, and you have to answer to them as the CEO. of course, something as amazing as as AI comes around and you're gonna get directives like, hey, go adopt this stuff. I wanna take advantage of some of these benefits, right? But when a board of directors says this to the CEO and the CEO says this to the senior, VPs and the senior VPs tell it to the directors, what does that mean?
Aaron Mog: Right.
Jon McLachlan: because that has to be balanced with don't screw up the money tree, right? And and you
Aaron Mog: Right, mission one. Yeah.
Jon McLachlan: have all of these people who, you know, at the end of the day, you don't go to a big company because you want to push the envelope and like take risks and be responsible. when things go sideways, because there's a lot on the line, and it's just a much more risk-adverse approach. And so when you look at a new technology from inside a big company, you're looking at through the lens of like how do I reduce that risk? How do I get some of this benefit and and make my life a little bit easier, a little bit better, and I can help the company move a little bit faster, but without risking my job, without risking. This revenue flow from the company without ending up in the hot seat, you know, with the the legal team or the security team, right?
Aaron Mog: Yeah, security is always there are things that big companies do to make it hard on startups, right? And and security's one of them. Payment terms and cash flows another like they squeeze you in different ways. So
Jon McLachlan: They do.
Aaron Mog: I I went to a CISO event not that long ago and I admonished all the CISOs in the room because they're complaining about, you know innovation and moving faster. And I'm like, how about all of you stand up for them in the purchasing process? How about you get them paid faster? How about you pay your damn bills instead of making it harder? there's all these complaints, especially in the Midwest, about why don't we have startups? And I'm like, well, because you don't foster it, right? When Google engages a startup, they pay their damn bills. so there's a lot of of friction there. So I assume
Jon McLachlan: Sure, yes.
Aaron Mog: when they come to you and a startup comes to you and wants security in a box, if you let me call that. Where it's like I need to mature fast. I need a a shortcut of a pathway through it. Is that your business is that how you think about it? Is like you're renting a grown up because you're not there yet? Is that what you think customers want? And
Jon McLachlan: Well, you certainly do, like we bring that fractional model to the entire security team. And so it's great.
Aaron Mog: Right, that's what yeah.
Jon McLachlan: Yeah, that virtual CISO model I think is great because, you know, a lot of the a lot of startups do not need even a full time CISO, you know, and and security folks. We're we're hard to find, we're hard to come by, we're kind of finicky, we expensive, you know. so if you have that fractional model, you can reduce a lot of those pain points. We bring that fractional model to the entire team. So that, when you decide, okay, here's our strategy, let's move on this. You don't have to pull your engineers or or your HR folks or your, you know, operations folks off of your core function. You can just it take this little, you know, project that's nice contained unit, let Y security do it, we can execute, and then we pull back down to a maintenance mode once we declare success. So that model works really well for startups. because you have to pivot and you have to take risks and all of those sorts of things. then you have to move fast and be flexible. When you think about, okay, how do I how do I engage with a big company? From a founder's point of view, there's two ways to see security, right? You can see it as overhead, as something that you have to do. You can see it, you take this perspective my goodness, we have all of the super sensitive data. I guess I have to secure it. Like, what does that mean? Let's try to reduce the cost, let's reduce the expenses and and do what we need to do, but do it in a very minimalist way. And that's one way to see security. A lot of people do see security that way. The way that I like to view security is as an investment. Right. So as a founder, you can, you know, instead of zooming in right in on security, you can talk about, okay, what do we want to do as a business? And all f all like all startups they need to grow. And so, okay. Then the question becomes how do we connect security to our growth? And you connect security to your growth by looking at the market that you want to sell into, understanding the type of data. That those customers are gonna put into your system and understand where is that bar for how do they protect that data. Because that's the bar that's gonna be applied, you know, on the deal. And that's what's gonna cause friction if there's a huge difference between the bar that they're holding, you know, that they've set for themselves and how to protect that data versus how internally we're protecting that same data that just ends up in our systems. And so understand all of those things. That's what a virtual CISO is really good for. And then you have to build that, build those controls, build that out so that you do actually protect that data, can pass a rigorous audit at that same level of the market that you're trying to sell into. And then it becomes an investment. Yeah, there's a cost to building that stuff, but you pay that cost and you don't see it. as overhead, see it as investment. And when you see it as investment, there's an expectation that you'll cash in on it. And so when there's an expectation that you're going to cash in on this amazing thing that you've just built, you tend to take it, the next step because after you build the program, that's just the beginning of, the okay. Cash in on the investment means bringing it to market, means write the white paper, go to some security conferences, get your trust center set up. Put a a an enterprise, you know, security page up on your website. Maybe even change your header so that compared to the market competition that's out there, it's very clear that you're the least risky. So that when these people that work for, you know, 3M or Apple or Google or whatever big legacy company that you want to point out look at your little startup. They're gonna see like, this is actually like They're taking security seriously. That's the initial, cha-ching on your investment. It's you're gonna cash in on that a little bit, and that will lead to the next step, which is like, okay, let's look at the details. And they look at the details if it if you've right sized it and you understand like how that industry protects their data, and you understand like where that bar is, and you've built something that accommodates those expectations, you'll close the deal. It's it's really simple. There's friction because we screw that up all of the time.
Aaron Mog: Yes, we did.
Jon McLachlan: Yeah. And that's okay. Like we're imperfect, we're human, but you know, when pull in experts that have, you know, worked in those big companies, you're essentially pulling in people who have been there, done that, got the t-shirt, and they were just on the other side of the deal. You know. So that's why. That's why always encourage people, in the security profession to try both. Try both startups and try big companies, because they're so different. You get different experiences with both. And it's so important to see those values like at play. So you really understand things deeply once you once you do.
Aaron Mog: So and this is interesting to me because you hear about this new vision of the one person billion dollar company or the ten person billion dollar company, whatever Altman or whoever's spilling out. But regardless, skinny is good, right? So less people, which in the era of token burn, I'm not sure people are the most expensive thing anymore, but whatever. But you think about I'm
Jon McLachlan: That's so true.
Aaron Mog: yeah, like you think about consuming services, right? We consume LMs, we consume cloud hosting, we consume productivity. do you think now with this new era of of taking the stuff that we know and our CISO friends and stuff and turning into agents and good guy, do you think you can turn security into maybe a little bit more of a consumption engine, a little bit more of an on-demand flex up, flex down? You know, I I go buy my cloud servers, I go buy, you know, ramp for expenses, and I buy You guys for security and it just goes up and down as I need it because it's so gentle. Not that people won't be there, but I I I think you guys are doing this as questionnaires because I I I built a third-party risk management company years ago called Third Party Trust that ended up getting acquired. But I'm fascinated by TPRM and that world. And it hasn't really changed as much as I hoped. But do you think that can happen? Do you feel like that's on the roadmap?
Jon McLachlan: my god, absolutely it's going to happen. We're we're seeing it happen. anyone that's not using, you know, LLMs to help them answer those due diligence questionnaires and the redline some contracts to make sure that what's in a contract is aligned with your your actual operational security commitments or even like just regular operational commitments like SLAs or whatever. you might be spending some time that you could get back doing other things. And yeah, we're gonna see that, not just in our lifetimes, but we're but we're seeing the adoption of that, like you know, first with startups and then I think larger organizations are gonna start adopting it too, because you'll you'll be able to do less with more. Or flip that, you'll be able to do more with less. I suppose
Aaron Mog: Right. Or potentially the other way. We'll see. It depends on how bad the AI is. no, because I think you know, I always look at these things and go like the the people new today will be the giants of tomorrow. That's how life works, right? Like either they get acquired or they become like, you know, you and I have been doing this long enough to remember when Palo was like tiny and Crowdstrike was tiny, Georgia's like running around town saying semantics sucks and you know, it's like these things come from tiny and then evolve into the big boys. And so if those companies
Jon McLachlan: They do, yeah.
Aaron Mog: are native AI, then theoretically your security team should be native AI and and grow. we're seeing this and go to market for sure. that's more what I work in with companies. And it's like I can service four or five startups today in a way that I I couldn't have done three years ago, four years ago for all the content I put out. And I think it just wouldn't have worked. And I'm not a CISO nice I am, but I I these days do more go to market. But like I think it's fascinating and I think really good CEOs are thinking about it versus maybe two, three years ago where it was like higher, higher, higher, like grow, get bigger. I mean, you guys have you and I've both seen this where like a CISO joins a startup that just isn't ready to have a CISO and like they get bored and they get antsy and they end
Jon McLachlan: Sure. Yeah. yeah. Yeah.
Aaron Mog: up becoming sales engineers. Like all these things that happen to us when we joined startups. Do you find that and this is more selfish question for me and my friends, do you find that people doing fractional are a little happier than people joining one startup?
Jon McLachlan: I I hope people are are happy with everything that they're doing. Happy people tend to be easier to work with, they get more done, they're better at it, you know, all of all of those good things come from happiness. in terms of like being efficient and and just because like every everything can be coded with an LLM now, like it doesn't mean that we're not we're not
Aaron Mog: Right. Right. Yeah, well that's the era we're in.
Jon McLachlan: hiring engineers anymore.
Aaron Mog: Right.
Jon McLachlan: It just changes things a little bit. It means instead of hiring the engineer that knows how to write code, we're hiring the engineer that understands how to use LLMs and is keeping up on the latest and greatest, you know, in in the agentic space and has a a strong preference that's loosely held around, okay, I want to use clot code or grokbot or whatever it happens to be. and plays with them kind of in a playful creative sense where it's not. you're not religiously bound to one thing, but because this space changes and evolves so quickly, I think finding those types of people are what companies maybe are who want to adopt and move fast are are doing now in the engineering space. and I I you know, it's not a far stretch to imagine how that is gonna like show up and apply itself to the security space. Or the sales space or the marketing space or whatever. All of these things that can be enhanced with all of these amazing tools, we're gonna see it. And it just so happened that we started with engineering, right? So all
Aaron Mog: Yeah. It was it's incredibly good at writing code. say you want about AI, but it's very, very good at writing code. So I totally understand why we started there. I I don't know if it's as good about the nuances of security yet. I think we're building custom models and so I do a lot around AI. I have an AI podcast. And so I talk to a lot of engineers and it's it's just like you said, it's literally the like the snowflake on top of the iceberg. it's we're nowhere. nobody knows what's gonna happen. It's totally but I'm So you're I think I'm with you that I'm excited about this. But at the same time, you have to do business, you have to raise money, you have to like do all these things that require a level of maturity. and, you know, I I had this conversation with a a really experienced AI security person. I'm like, one of the challenges of some of these new AI companies is they haven't paid the debt. They like, they're skipping to the front of the line of like growth and stuff like that. But if look at like a 3M or a Target or Walmart or eBay. They've had hundreds of breaches over the years they've had to deal with from small to big. They've got the battle wounds. so there's a maturity thing, but I think it's fascinating because at a certain level you can almost buy that. you can go to people that are are willing to fractionalize themselves and go like, hey man, you did it. Right. You were you went through breaches. You learned all this stuff. Like I don't need you all the time. I just need you part of the time. Right. And I think that that's true across the board. So when you do your podcast or when you talk to the c customer side of things, do you feel like big companies are getting more comfortable with that? the on demand model? Because historically they're not. Okay. Interesting.
Jon McLachlan: Yeah, I I think so. No, I I think so. I think yeah. we see it with with everyone who's a partner at White Security really benefits from and it's not just hey, you don't need me full time. It's like hey, if you're handling, two, three, four different pieces of the market, you're gonna get a better view. You're gonna get a higher level view, you'll be more strategic. Even
Aaron Mog: Mm-hmm.
Jon McLachlan: if you're operating something that's very technical, if you're doing that three or four times at three or four different places in an accelerated fashion, using, you know, taking full advantage of AI, all the made all automation that's out there, you're gonna see the same, you know, architectures three or four times, you know, more than if you were just doing it at one place. And so we're growing, like as humans, as professionals, we're growing much more quickly because we get to see Things at a much higher level. And so we're being more strategic. We're being more responsible for outcomes instead of responsible for technical grit, if if that makes sense. We're so there's n
Aaron Mog: Yeah. No, it totally does.
Jon McLachlan: there's there's new opportunities for us, for sure. And
Aaron Mog: So and I'm curious because one of the things that people ask me a lot about or in comments or notes to me, everything we're talking about creates an intense amount of fear, right, in people, right? I'm gonna get fired, I'm not gonna be able find a job. Are we going into this new era of everybody's 1099 all the time and like everybody's a free agent? But like when you get approached by that, like with like a from the top to the bottom as far as experience, like people who have been doing C C Cell work for a long time and are looking or people that are just getting into it, what's what are you telling them? What are if someone comes up to you at a con, they're like, Help, I don't know where I should focus my energy. What are you telling them?
Jon McLachlan: I I encourage folks to be be playful and approach this change that's coming from a sense of like just have fun with it. See where it can serve you. Like instead of you serving it, don't don't serve it. Don't don't serve the technology. We're not here to click buttons. Like the buttons are here to do things for us. So when I click it, like I expect something to happen. Focus on that. Focus on those outcomes. Focus on how we can participate in this wave of change. And
Aaron Mog: Yeah.
Jon McLachlan: I I I get it, there might be some fear that this thing is much better at writing code than I am. it's much better at writing code than I am. Much better.
Aaron Mog: Right. Yeah, me too.
Jon McLachlan: And I've I spent you know, a whole career like as an engineer writing code. but I'm not afraid of it. I'm grateful that I have this new tool that can help me like build systems. And that's what I mean by focus on the outcome. Think bigger picture. Answer the question, why are we writing the code? We're writing the code so that we can deliver this thing and this this thing is gonna go out there and help make our customers' lives better. It's gonna improve the life of some human somewhere. Whether that's, a customer who uses our tool who's gonna get their weekend back because our stuff doesn't break, on Saturday and Sunday, or whatever. Yeah, ideally.
Aaron Mog: Okay, ideally. Yeah.
Jon McLachlan: Maybe it will break a little bit less with agentic coded software, you know. It I don't know, maybe not. Depends on the architecture, right? So
Aaron Mog: Yeah, I you know sure.
Jon McLachlan: there's still hard questions out there that need deliberate thoughtfulness and and I don't think humans are going away. We're not gonna be like out of the picture. We're just it this is a shift that I'm sure seemed like a crazy huge shift. It it's like we're getting off of the assembly code that's on top of the CPUs directly. And now we're we're writing code in C. And shift happened, it was a huge shift because now we could use English and and these high-level if statements and and for loops that would get lowered by a compiler to machine level code. And no one needed to write assembly anymore after that stuff started to work and it was adopted. So all the people who like were writing assembly could write C. And they would understand what's happening underneath the hood at a very deep level, but they didn't go away. They just they just started operating at a higher level. And and then object-oriented codes came out and we started to think about writing code in terms of objects. I have a pizza. How many pieces of pepperoni are on my pizza? okay, I'll write an object for my pizza, whatever. It's it's the ability to level up. And it's just like with LLMs, everyone gets that ability to level up. Anyone that's that's working with something that has natural language in it, which is everybody. We're all
Aaron Mog: Right. Yeah.
Jon McLachlan: gonna get that opportunity. So there's that's what I mean. Like we're we're the snowflake on the top of this of the iceberg.
Aaron Mog: Yeah, I I like that. Nobody nobody knows anything yet, right? We're all still learning. But I I I
Jon McLachlan: We are, yeah.
Aaron Mog: I I love the idea of, you know, evolution versus destruction, which is kind of how I would summarize what you're saying. Like you there's so many things you can change into and learn. And I hear so much negativity from people who I think should know better. I'm like, it's just a different tool. And like you're you're sort of giving it you're giving it this power that maybe it deserves. I don't know. We'll see. But like At the end of the day, right, a lot of it is just code writing and content creation. And it's just not making decisions in business yet. And so I think we've got a long way to go. but that's it's great advice. And I know you and Sasha have written a lot about this. he wrote a great article about AI adoption that was like Zen and the art of AI adoption. That was fantastic. Everybody should read that. but I think you guys
Jon McLachlan: Thank you. Thank you.
Aaron Mog: put out a lot of great content. Obviously, I'll link to all of your stuff. everybody should listen to the podcast, everybody should should follow you guys on LinkedIn. I'm a big fan of of the materials. Hopefully at some point I get you and Sasha on on a pod and I could grill you both. but I I know I would be respectful of your time. Thank you so much for for taking some time to talk to us today. I really these days at AI, your positivity is very well received and I I really like it. So thanks for for doing that. Yeah.
Jon McLachlan: thank you. I just I've I've had so much negativity that's like it it rubs me the wrong way. And maybe it's like one of these, I don't know, mental illnesses that I have of seeing everything so positively. everything is everything has a silver lining in it. And yeah,
Aaron Mog: Yeah, no. I love it.
Jon McLachlan: I'm honestly I'm not afraid of of all of this change. So
Aaron Mog: That's that's good to hear. John, thank you so much, man, for for joining the podcast. I'll link to all your
Jon McLachlan: Huge thank you, Aaron.
Aaron Mog: sites and your communities on the in the description. thank you so much for being here.
Jon McLachlan: Really appreciate it. Thanks to all the listeners too. Huge thanks.
Aaron Mog: Right. Yeah, me too.
Jon McLachlan: And I've I spent you know, a whole career like as an engineer writing code. but I'm not afraid But when a board of directors says this to the CEO and the CEO says this to the senior, VPs and the senior VPs tell it to the directors, what does that mean?
Aaron Mog: Right.
Jon McLachlan: because that has to be balanced with don't screw up the money tree, there is so much change that we're we haven't even begun to see. And it's I don't know, sometimes people like that the iceberg analogy of like here's what we can see here, you know, here's what's coming underneath the water. I think it's it's more like a snowflake that's sitting on the very top of the the iceberg.
Aaron Mog: Hey everybody, welcome to the ZeroSum podcast. I'm your host, Aaron Mog. thank you so much for joining us and and listening to our our our little podcast here. really excited and interested and intrigued to have John McLachlan on the on the podcast today. I was just talking with John before I get started. I don't know him that well, so I'm super excited to kind of dig into his perspective on our industry and he's sort of a I would deem you a renaissance man of that you do podcasts, did you do
Jon McLachlan: Ha.
Aaron Mog: business, did you do advisors?
Jon McLachlan: no, thank you so much for having me, Aaron. all the gratitude in the world. It's an honor to be here on your show.
Aaron Mog: Thank you so much. so I'm gonna let you introduce yourself because I don't think I'll do it justice just because I I don't know you that well. But I would say what drew me, what made you me wanna have you on is I think just the diversity of your perspective and how intertwined you are with startups in our industry and writing and your business partners who help write and all these sort things. So maybe you could give us just like a quick two minutes or whatever on how you got here and then we'll dive right into it.
Jon McLachlan: Yeah, love it. I'll I'll keep it short, elevator pitch version. So I'm from Minnesota originally. You might be able to hear
Aaron Mog: Love it.
Jon McLachlan: some of that that Minnesotan twang. And for the longest time, you know, as far back as I can remember, I've always been irrationally excited about all things security. So that's either a blessing or a curse, do you know, depending on how you look at
Aaron Mog: Pets.
Jon McLachlan: it. but it drew me you know into this space and because I studied computer science and sort of went through sort of those technical programs and was an engineer right out of school, still kept pushing that passion button, security. So have always been in security, have been, you know, blessed to always find that intersection between like the skill set and the passion. and so after school, I ended up at Apple. I worked on iTunes security back when that was a cool place to get your music and then later your movies and your books and the in-app purchases and all that stuff. It all has a bunch of security on it. Then I joined my first startup, it was Symphony Communication. That's where I had the great honor and pleasure to meet a ton of amazing people, but one of them in particular was my chosen family brother now and co-founder of all of the companies that have the honor and pleasure to build together. with sasha sinkovich and after that after symphony been in and out of you know startups that you'd never recognize the name of all security things you know either leading security teams or engineering teams at security companies and then throwing in some big companies in there every once in a while like Peer Storage or Robinhood and today I'm the co-founder of Why Security. We have a Team of 50, more than 50 now today, actually, security operators. We can go into another company and actually operate their entire security function. So we have dozens of partners where we are their security team. We also operate cyberbase.ai, which helps accelerate your go-to-market security posture. So help answer due diligence questionnaires and redline contracts. To make sure they're aligned with your organizational security commitments.
Aaron Mog: That's awesome. And you also have a podcast, right?
Jon McLachlan: yeah. Yeah, there's a podcast in there too. the security podcast of Silicon Valley.
Aaron Mog: Yeah.
Jon McLachlan: just because why not?
Aaron Mog: Yeah, no, I I love it. I've listened to a bunch of it. I think you guys have great guests and really insightful people dealing with this new generation of security. So everybody should should give that a listen. Obviously, I'll I'll connect everybody who's listening to this show to that content. That's a very interesting and broad perspective on our industry coming up at it as a practitioner and now being an entrepreneur and being a content producer. I one of the questions I love to ask, because I'm I am like you, I love all things security most days. but I I
Jon McLachlan: Mondays the best yeah.
Aaron Mog: love to get a take. where do you think we're at? how are you feeling about cyber? Obviously, we're going through this crazy AI hype cycle and change, but at the end of the day, we're here to protect people. how do you how are you feeling about it today? Positive, negative, excited, worried? where are you at? Okay.
Jon McLachlan: Super excited. Just like there is so much change that we're we haven't even begun to see. And it's I don't know, sometimes people like that the iceberg analogy of like here's what we can see here, you know, here's what's coming underneath the water. I think it's it's more like a snowflake that's sitting on the very top of the the iceberg. It's kind of like where we're at with that wave of change. I really see it it's very fundamental to how we organize information, right? 'Cause LLMs are just incredibly powerful and they're they're about to change everything, right? So it couldn't be more excited. There's a there's a piece of me that's a realist and a pragmatic, yeah, very pragmatic and and grounded and and I understand that there are are huge risks, you know, on the line and and that just raises the stakes for Everything that's about to happen, so
Aaron Mog: It's lot of pressure to get it right, I think, for us in cyber, because it it does have the potential to go poorly or be overwhelming or crash us out, whatever terminology you want to use. And I've had very
Jon McLachlan: Yep. Yep.
Aaron Mog: serious security experts on this show and in private conversations, everybody's one foot in both sides of it, I think to a certain extent of hype and happiness and joy of what we can do, and the fear of are we really ready for this and all that kind of stuff? So I and I'm fascinated because you're In Silicon Valley, you're in the the center of the pipe, right? And you're dealing with this. When you go talk to customers, of yours that are outside Silicon Valley or people that are outside Silicon Valley, obviously there's a little more skepticism. But it's gotta be exciting to be in Silicon Valley right now. this is a a a gold rush I haven't seen since probably the original web companies, right? it's just the amount of money flowing in and the money like like is that How worried are you it's getting a little too hypey, a little too frothy, I guess. are you are you looking around Silicon Valley going like, all right, should a startup with two people and no idea really get $30 million? Like how are you feeling about that part of it? Like, do you think we're acting irresponsibly?
Jon McLachlan: Well, like VCs are always gonna have a bit of FOMO and and throw money around, you know. It
Aaron Mog: Sure. Yeah.
Jon McLachlan: it's kind of just they're and they wanna get in front of these things, you know. I I think from a security perspective as a community, I get a really strong sense that we also wanna get in front of these things, you know, but what does that mean and how do we do that and how do we function together as we do that? I don't I wouldn't say LLMs really scare me. I I would I would just describe it as like a a really powerful tool that everyone is gonna have access to. You know, it's not entirely democratized. there are some limiting factors in terms of guardrails, And at the end of the day, because it's a tool, it's totally agnostic to intent, right? So when good guys pick it up and start using it, really good things are gonna happen. But when, you know, it turns out the world has a couple evil people in it, when you know evil people pick it up, really nasty things might happen. So if you take that perspective that security is kind of like a battlefield between good and evil.
Aaron Mog: Mm.
Jon McLachlan: the tools are just changing, you know, out from underneath our feet. Yeah. So as long as both sides pick it up, there's not going to be a huge asymmetry. I think that in the long term, as long as both sides pick it up, what we're gonna see is everything that was going to happen, that was going to happen, is still going to happen. It's just gonna happen in a much more compressed timeline. Which is great news for us because within our finite lifetimes we'll get to see a lot more. We'll get to see a lot more progress. A lot more
Aaron Mog: Yeah.
Jon McLachlan: is gonna happen. It's gonna keep us on our feet, And and that's a good thing. I think that's a good thing.
Aaron Mog: Yeah, I agree. I that's a great perspective is giving us the opportunity to see more in our lifetime. that being said, right, I think we're struggling with showing the good a little bit. I think a lot of the headlines are negative and becoming more like a negative, job loss and people being replaced, which isn't fundamentally the promise of AI. I think it's a marketing pitch, but you're in the heart of it, right? Because you are in your day job, in the in like how you your companies run. You're helping all these innovative companies like jump ahead, right? what does that look like? Like, how do you how do you do company security for companies that are going a trillion miles an hour in this era where nobody knows anything and we're all trying to figure it out? Like how how does that work? I'd love to sort of dive into that.
Jon McLachlan: Well, it's is tricky to stay on top of the change because
Aaron Mog: Yeah.
Jon McLachlan: the change is is not just changing at a typical pace like that we've seen in Silicon Valley before, which is a fast paced change anyway. Now it's changing but at an increasing rate. Right. And so the rate of change is increasing. And what that means is that things that look like opportunities today, you know, are not gonna be opportunities in a week or And so, from a founder's point of view, with an entrepreneurial mindset, you want to think about how that also changes things, right? and that presents a lot of like risk from a business point of view. If you're gonna go after a new thing, a new idea, this idea of having a moat or having something solid that you can build on that will last while you break into a new market, while you build the products, and of course, like. The way that you can build a company is now much faster. Like i everyone is an engineer, they just don't know it yet, right? And anyone can open up clawed code and and prompt it.
Aaron Mog: So that's it that's super fascinating because the other parts of business, right? The the finance, credit markets, security are sort of still very in some ways very traditional, but building has just changed dramatically, right? Like you said, anybody can build an app, you're writing millions of lines of code a day. Like we we aren't really gamed up for this, like in the sense of like the other levers of the business world hiring. For example, it doesn't move at AI speed yet. It's still this, you know, bogged down, you know, HR driven, compliance driven. And again, a lot of it for good reasons,
Jon McLachlan: That's right.
Aaron Mog: but like it doesn't move at AI velocity. And
Jon McLachlan: That's right.
Aaron Mog: you know, you sort of go to regular because like one of the things that's interesting to me, being a Midwesterner like you, is you know, you go to Silicon Valley and you hear this stuff, right? It's how fast it's going and all that. And then you kind of go to a regular company or a regular group, and they're like, Yeah, we're excited to try AI. It's like try AI, we're there. it's here. And so there is a little bit of a cognitive dissonance between hyper funded startups, not just in cyber, all parts of AI. And where 3M, you're a Minnesota boy, right? So where 3M is at with AI. Right? it's not the same place
Jon McLachlan: Nope.
Aaron Mog: for sure. It's a very different world. so are you finding, because obviously I'm sure you work with a lot of startups, that like the build parts fast, but the other parts require patience. is that something you see people struggle with? Because it doesn't go as fast as they want it to go. Yeah.
Jon McLachlan: Build is definitely fast. No, it doesn't. And why does it not go as fast as you want it to go? Is because is because, you know, when you work at a big company, like let's talk about 3M for a second. just to talk about a big company. Big company has been around for forever. you know, there's a lot of money that flows through that place, a lot of money that flows through like large companies just in general. And When you have that type of responsibility on your shoulders, it's you're gonna be a lot more methodical, you're gonna be risk adverse, you're gonna be thinking about all sorts of things that you you're not gonna be thinking about if you're just thinking about how do I stay alive for the next eighteen months. Right. And so as a i it's different like risk looks and feels very different depending on the context that you're you're looking at it from. lens that you have to look at it through. And so, a startup is super exciting and you can take lots of risks and you can build all of these things. And yeah, you can build them incredibly quickly. because you're you're racing against the clock to get these things to market, to build your feedback loops between like what is this potential customer going to say in this market versus what I actually built. And to build that feedback loop is your lifeline. You need to close those deals. So that you can demonstrate product market fit and whether you're gonna, you know, operate in the green with a whole bunch of initial customers or you know go back to the VCs and do another raise. That's a decision that you make on how you want to run the business. But from the enterprise perspective, like think about a company that's been around forever. You know, there's a huge amount of revenue that's coming in, they're very entrenched into what they do. Maybe 80% of that revenue comes from one particular service or product line. you have investors, maybe you're publicly traded, and you have to answer to them as the CEO. of course, something as amazing as as AI comes around and you're gonna get directives like, hey, go adopt this stuff. I wanna take advantage of some of these benefits, right? But when a board of directors says this to the CEO and the CEO says this to the senior, VPs and the senior VPs tell it to the directors, what does that mean?
Aaron Mog: Right.
Jon McLachlan: because that has to be balanced with don't screw up the money tree, right? And and you
Aaron Mog: Right, mission one. Yeah.
Jon McLachlan: have all of these people who, you know, at the end of the day, you don't go to a big company because you want to push the envelope and like take risks and be responsible. when things go sideways, because there's a lot on the line, and it's just a much more risk-adverse approach. And so when you look at a new technology from inside a big company, you're looking at through the lens of like how do I reduce that risk? How do I get some of this benefit and and make my life a little bit easier, a little bit better, and I can help the company move a little bit faster, but without risking my job, without risking. This revenue flow from the company without ending up in the hot seat, you know, with the the legal team or the security team, right?
Aaron Mog: Yeah, security is always there are things that big companies do to make it hard on startups, right? And and security's one of them. Payment terms and cash flows another like they squeeze you in different ways. So
Jon McLachlan: They do.
Aaron Mog: I I went to a CISO event not that long ago and I admonished all the CISOs in the room because they're complaining about, you know innovation and moving faster. And I'm like, how about all of you stand up for them in the purchasing process? How about you get them paid faster? How about you pay your damn bills instead of making it harder? there's all these complaints, especially in the Midwest, about why don't we have startups? And I'm like, well, because you don't foster it, right? When Google engages a startup, they pay their damn bills. so there's a lot of of friction there. So I assume
Jon McLachlan: Sure, yes.
Aaron Mog: when they come to you and a startup comes to you and wants security in a box, if you let me call that. Where it's like I need to mature fast. I need a a shortcut of a pathway through it. Is that your business is that how you think about it? Is like you're renting a grown up because you're not there yet? Is that what you think customers want? And
Jon McLachlan: Well, you certainly do, like we bring that fractional model to the entire security team. And so it's great.
Aaron Mog: Right, that's what yeah.
Jon McLachlan: Yeah, that virtual CISO model I think is great because, you know, a lot of the a lot of startups do not need even a full time CISO, you know, and and security folks. We're we're hard to find, we're hard to come by, we're kind of finicky, we expensive, you know. so if you have that fractional model, you can reduce a lot of those pain points. We bring that fractional model to the entire team. So that, when you decide, okay, here's our strategy, let's move on this. You don't have to pull your engineers or or your HR folks or your, you know, operations folks off of your core function. You can just it take this little, you know, project that's nice contained unit, let Y security do it, we can execute, and then we pull back down to a maintenance mode once we declare success. So that model works really well for startups. because you have to pivot and you have to take risks and all of those sorts of things. then you have to move fast and be flexible. When you think about, okay, how do I how do I engage with a big company? From a founder's point of view, there's two ways to see security, right? You can see it as overhead, as something that you have to do. You can see it, you take this perspective my goodness, we have all of the super sensitive data. I guess I have to secure it. Like, what does that mean? Let's try to reduce the cost, let's reduce the expenses and and do what we need to do, but do it in a very minimalist way. And that's one way to see security. A lot of people do see security that way. The way that I like to view security is as an investment. Right. So as a founder, you can, you know, instead of zooming in right in on security, you can talk about, okay, what do we want to do as a business? And all f all like all startups they need to grow. And so, okay. Then the question becomes how do we connect security to our growth? And you connect security to your growth by looking at the market that you want to sell into, understanding the type of data. That those customers are gonna put into your system and understand where is that bar for how do they protect that data. Because that's the bar that's gonna be applied, you know, on the deal. And that's what's gonna cause friction if there's a huge difference between the bar that they're holding, you know, that they've set for themselves and how to protect that data versus how internally we're protecting that same data that just ends up in our systems. And so understand all of those things. That's what a virtual CISO is really good for. And then you have to build that, build those controls, build that out so that you do actually protect that data, can pass a rigorous audit at that same level of the market that you're trying to sell into. And then it becomes an investment. Yeah, there's a cost to building that stuff, but you pay that cost and you don't see it. as overhead, see it as investment. And when you see it as investment, there's an expectation that you'll cash in on it. And so when there's an expectation that you're going to cash in on this amazing thing that you've just built, you tend to take it, the next step because after you build the program, that's just the beginning of, the okay. Cash in on the investment means bringing it to market, means write the white paper, go to some security conferences, get your trust center set up. Put a a an enterprise, you know, security page up on your website. Maybe even change your header so that compared to the market competition that's out there, it's very clear that you're the least risky. So that when these people that work for, you know, 3M or Apple or Google or whatever big legacy company that you want to point out look at your little startup. They're gonna see like, this is actually like They're taking security seriously. That's the initial, cha-ching on your investment. It's you're gonna cash in on that a little bit, and that will lead to the next step, which is like, okay, let's look at the details. And they look at the details if it if you've right sized it and you understand like how that industry protects their data, and you understand like where that bar is, and you've built something that accommodates those expectations, you'll close the deal. It's it's really simple. There's friction because we screw that up all of the time.
Aaron Mog: Yes, we did.
Jon McLachlan: Yeah. And that's okay. Like we're imperfect, we're human, but you know, when pull in experts that have, you know, worked in those big companies, you're essentially pulling in people who have been there, done that, got the t-shirt, and they were just on the other side of the deal. You know. So that's why. That's why always encourage people, in the security profession to try both. Try both startups and try big companies, because they're so different. You get different experiences with both. And it's so important to see those values like at play. So you really understand things deeply once you once you do.
Aaron Mog: So and this is interesting to me because you hear about this new vision of the one person billion dollar company or the ten person billion dollar company, whatever Altman or whoever's spilling out. But regardless, skinny is good, right? So less people, which in the era of token burn, I'm not sure people are the most expensive thing anymore, but whatever. But you think about I'm
Jon McLachlan: That's so true.
Aaron Mog: yeah, like you think about consuming services, right? We consume LMs, we consume cloud hosting, we consume productivity. do you think now with this new era of of taking the stuff that we know and our CISO friends and stuff and turning into agents and good guy, do you think you can turn security into maybe a little bit more of a consumption engine, a little bit more of an on-demand flex up, flex down? You know, I I go buy my cloud servers, I go buy, you know, ramp for expenses, and I buy You guys for security and it just goes up and down as I need it because it's so gentle. Not that people won't be there, but I I I think you guys are doing this as questionnaires because I I I built a third-party risk management company years ago called Third Party Trust that ended up getting acquired. But I'm fascinated by TPRM and that world. And it hasn't really changed as much as I hoped. But do you think that can happen? Do you feel like that's on the roadmap?
Jon McLachlan: my god, absolutely it's going to happen. We're we're seeing it happen. anyone that's not using, you know, LLMs to help them answer those due diligence questionnaires and the redline some contracts to make sure that what's in a contract is aligned with your your actual operational security commitments or even like just regular operational commitments like SLAs or whatever. you might be spending some time that you could get back doing other things. And yeah, we're gonna see that, not just in our lifetimes, but we're but we're seeing the adoption of that, like you know, first with startups and then I think larger organizations are gonna start adopting it too, because you'll you'll be able to do less with more. Or flip that, you'll be able to do more with less. I suppose
Aaron Mog: Right. Or potentially the other way. We'll see. It depends on how bad the AI is. no, because I think you know, I always look at these things and go like the the people new today will be the giants of tomorrow. That's how life works, right? Like either they get acquired or they become like, you know, you and I have been doing this long enough to remember when Palo was like tiny and Crowdstrike was tiny, Georgia's like running around town saying semantics sucks and you know, it's like these things come from tiny and then evolve into the big boys. And so if those companies
Jon McLachlan: They do, yeah.
Aaron Mog: are native AI, then theoretically your security team should be native AI and and grow. we're seeing this and go to market for sure. that's more what I work in with companies. And it's like I can service four or five startups today in a way that I I couldn't have done three years ago, four years ago for all the content I put out. And I think it just wouldn't have worked. And I'm not a CISO nice I am, but I I these days do more go to market. But like I think it's fascinating and I think really good CEOs are thinking about it versus maybe two, three years ago where it was like higher, higher, higher, like grow, get bigger. I mean, you guys have you and I've both seen this where like a CISO joins a startup that just isn't ready to have a CISO and like they get bored and they get antsy and they end
Jon McLachlan: Sure. Yeah. yeah. Yeah.
Aaron Mog: up becoming sales engineers. Like all these things that happen to us when we joined startups. Do you find that and this is more selfish question for me and my friends, do you find that people doing fractional are a little happier than people joining one startup?
Jon McLachlan: I I hope people are are happy with everything that they're doing. Happy people tend to be easier to work with, they get more done, they're better at it, you know, all of all of those good things come from happiness. in terms of like being efficient and and just because like every everything can be coded with an LLM now, like it doesn't mean that we're not we're not
Aaron Mog: Right. Right. Yeah, well that's the era we're in.
Jon McLachlan: hiring engineers anymore.
Aaron Mog: Right.
Jon McLachlan: It just changes things a little bit. It means instead of hiring the engineer that knows how to write code, we're hiring the engineer that understands how to use LLMs and is keeping up on the latest and greatest, you know, in in the agentic space and has a a strong preference that's loosely held around, okay, I want to use clot code or grokbot or whatever it happens to be. and plays with them kind of in a playful creative sense where it's not. you're not religiously bound to one thing, but because this space changes and evolves so quickly, I think finding those types of people are what companies maybe are who want to adopt and move fast are are doing now in the engineering space. and I I you know, it's not a far stretch to imagine how that is gonna like show up and apply itself to the security space. Or the sales space or the marketing space or whatever. All of these things that can be enhanced with all of these amazing tools, we're gonna see it. And it just so happened that we started with engineering, right? So all
Aaron Mog: Yeah. It was it's incredibly good at writing code. say you want about AI, but it's very, very good at writing code. So I totally understand why we started there. I I don't know if it's as good about the nuances of security yet. I think we're building custom models and so I do a lot around AI. I have an AI podcast. And so I talk to a lot of engineers and it's it's just like you said, it's literally the like the snowflake on top of the iceberg. it's we're nowhere. nobody knows what's gonna happen. It's totally but I'm So you're I think I'm with you that I'm excited about this. But at the same time, you have to do business, you have to raise money, you have to like do all these things that require a level of maturity. and, you know, I I had this conversation with a a really experienced AI security person. I'm like, one of the challenges of some of these new AI companies is they haven't paid the debt. They like, they're skipping to the front of the line of like growth and stuff like that. But if look at like a 3M or a Target or Walmart or eBay. They've had hundreds of breaches over the years they've had to deal with from small to big. They've got the battle wounds. so there's a maturity thing, but I think it's fascinating because at a certain level you can almost buy that. you can go to people that are are willing to fractionalize themselves and go like, hey man, you did it. Right. You were you went through breaches. You learned all this stuff. Like I don't need you all the time. I just need you part of the time. Right. And I think that that's true across the board. So when you do your podcast or when you talk to the c customer side of things, do you feel like big companies are getting more comfortable with that? the on demand model? Because historically they're not. Okay. Interesting.
Jon McLachlan: Yeah, I I think so. No, I I think so. I think yeah. we see it with with everyone who's a partner at White Security really benefits from and it's not just hey, you don't need me full time. It's like hey, if you're handling, two, three, four different pieces of the market, you're gonna get a better view. You're gonna get a higher level view, you'll be more strategic. Even
Aaron Mog: Mm-hmm.
Jon McLachlan: if you're operating something that's very technical, if you're doing that three or four times at three or four different places in an accelerated fashion, using, you know, taking full advantage of AI, all the made all automation that's out there, you're gonna see the same, you know, architectures three or four times, you know, more than if you were just doing it at one place. And so we're growing, like as humans, as professionals, we're growing much more quickly because we get to see Things at a much higher level. And so we're being more strategic. We're being more responsible for outcomes instead of responsible for technical grit, if if that makes sense. We're so there's n
Aaron Mog: Yeah. No, it totally does.
Jon McLachlan: there's there's new opportunities for us, for sure. And
Aaron Mog: So and I'm curious because one of the things that people ask me a lot about or in comments or notes to me, everything we're talking about creates an intense amount of fear, right, in people, right? I'm gonna get fired, I'm not gonna be able find a job. Are we going into this new era of everybody's 1099 all the time and like everybody's a free agent? But like when you get approached by that, like with like a from the top to the bottom as far as experience, like people who have been doing C C Cell work for a long time and are looking or people that are just getting into it, what's what are you telling them? What are if someone comes up to you at a con, they're like, Help, I don't know where I should focus my energy. What are you telling them?
Jon McLachlan: I I encourage folks to be be playful and approach this change that's coming from a sense of like just have fun with it. See where it can serve you. Like instead of you serving it, don't don't serve it. Don't don't serve the technology. We're not here to click buttons. Like the buttons are here to do things for us. So when I click it, like I expect something to happen. Focus on that. Focus on those outcomes. Focus on how we can participate in this wave of change. And
Aaron Mog: Yeah.
Jon McLachlan: I I I get it, there might be some fear that this thing is much better at writing code than I am. it's much better at writing code than I am. Much better.
Aaron Mog: Right. Yeah, me too.
Jon McLachlan: And I've I spent you know, a whole career like as an engineer writing code. but I'm not afraid of it. I'm grateful that I have this new tool that can help me like build systems. And that's what I mean by focus on the outcome. Think bigger picture. Answer the question, why are we writing the code? We're writing the code so that we can deliver this thing and this this thing is gonna go out there and help make our customers' lives better. It's gonna improve the life of some human somewhere. Whether that's, a customer who uses our tool who's gonna get their weekend back because our stuff doesn't break, on Saturday and Sunday, or whatever. Yeah, ideally.
Aaron Mog: Okay, ideally. Yeah.
Jon McLachlan: Maybe it will break a little bit less with agentic coded software, you know. It I don't know, maybe not. Depends on the architecture, right? So
Aaron Mog: Yeah, I you know sure.
Jon McLachlan: there's still hard questions out there that need deliberate thoughtfulness and and I don't think humans are going away. We're not gonna be like out of the picture. We're just it this is a shift that I'm sure seemed like a crazy huge shift. It it's like we're getting off of the assembly code that's on top of the CPUs directly. And now we're we're writing code in C. And shift happened, it was a huge shift because now we could use English and and these high-level if statements and and for loops that would get lowered by a compiler to machine level code. And no one needed to write assembly anymore after that stuff started to work and it was adopted. So all the people who like were writing assembly could write C. And they would understand what's happening underneath the hood at a very deep level, but they didn't go away. They just they just started operating at a higher level. And and then object-oriented codes came out and we started to think about writing code in terms of objects. I have a pizza. How many pieces of pepperoni are on my pizza? okay, I'll write an object for my pizza, whatever. It's it's the ability to level up. And it's just like with LLMs, everyone gets that ability to level up. Anyone that's that's working with something that has natural language in it, which is everybody. We're all
Aaron Mog: Right. Yeah.
Jon McLachlan: gonna get that opportunity. So there's that's what I mean. Like we're we're the snowflake on the top of this of the iceberg.
Aaron Mog: Yeah, I I like that. Nobody nobody knows anything yet, right? We're all still learning. But I I I
Jon McLachlan: We are, yeah.
Aaron Mog: I I love the idea of, you know, evolution versus destruction, which is kind of how I would summarize what you're saying. Like you there's so many things you can change into and learn. And I hear so much negativity from people who I think should know better. I'm like, it's just a different tool. And like you're you're sort of giving it you're giving it this power that maybe it deserves. I don't know. We'll see. But like At the end of the day, right, a lot of it is just code writing and content creation. And it's just not making decisions in business yet. And so I think we've got a long way to go. but that's it's great advice. And I know you and Sasha have written a lot about this. he wrote a great article about AI adoption that was like Zen and the art of AI adoption. That was fantastic. Everybody should read that. but I think you guys
Jon McLachlan: Thank you. Thank you.
Aaron Mog: put out a lot of great content. Obviously, I'll link to all of your stuff. everybody should listen to the podcast, everybody should should follow you guys on LinkedIn. I'm a big fan of of the materials. Hopefully at some point I get you and Sasha on on a pod and I could grill you both. but I I know I would be respectful of your time. Thank you so much for for taking some time to talk to us today. I really these days at AI, your positivity is very well received and I I really like it. So thanks for for doing that. Yeah.
Jon McLachlan: thank you. I just I've I've had so much negativity that's like it it rubs me the wrong way. And maybe it's like one of these, I don't know, mental illnesses that I have of seeing everything so positively. everything is everything has a silver lining in it. And yeah,
Aaron Mog: Yeah, no. I love it.
Jon McLachlan: I'm honestly I'm not afraid of of all of this change. So
Aaron Mog: That's that's good to hear. John, thank you so much, man, for for joining the podcast. I'll link to all your
Jon McLachlan: Huge thank you, Aaron.
Aaron Mog: sites and your communities on the in the description. thank you so much for being here.
Jon McLachlan: Really appreciate it. Thanks to all the listeners too. Huge thanks.
