Why Security Always Failed and What Finally Changes That - with Justin Somaini

For 30 years, the security industry could never fully win. Justin Somaini explains what finally changes that.

Justin Somaini is one of the people who helped define the modern CISO role — former CISO of Symantec, Yahoo, SAP, and Box, and now a Partner at YL Ventures. In this episode, Aaron sits down with him for a genuinely optimistic conversation about why security has always fallen short, and why he believes we're at the most exciting inflection point in the industry's history.

Justin lays out his core thesis: security has never truly succeeded because of two structural problems — you can never hire enough people to review everything, and the industry never solved the "shared accountability" gap with engineering and IT. For the first time, he argues, AI can absorb the enormous amount of pattern-matching work that's always overwhelmed security teams — letting them finally operate at the scale the business actually demands.

We also get into how he learned to separate real founders from the hype (and the belief he had to unlearn), why "drop the first slide" is his number one pitch advice, how CISOs actually make buying decisions versus what they claim, and his honest take on where the funding market is heading. Plus: the first CISO ever, why word-of-mouth beats every marketing tactic, and what makes a startup worth betting on.

Guest: Justin Somaini, Partner at YL Ventures. Find him on LinkedIn or on his podcast, Somaini Trust Issues.

⏱️ CHAPTERS
00:00 Intro
01:38 Learning from Steve Katz, the first CISO ever
04:03 Why a 30-year veteran is optimistic right now
05:23 Why security has always failed — the two real reasons
07:42 How AI absorbs the work that overwhelms security teams
10:03 How to separate real founders from the hype
13:13 Salesperson, or a product engineer faking it?
16:15 "Drop the first slide" — fixing the founder pitch
18:20 Why first-time founders are like teenagers
22:10 The funding market and where it's headed
28:12 Need-to-have vs. nice-to-have
36:42 How CISOs actually make buying decisions
52:00 How to get anyone to care about what you're building
57:04 Where to find Justin