Secure Vibe Coding and the 99%

WEBVTT
00:00:00.000 --> 00:00:03.600
Looks like we've democratized development, but we haven't necessarily democratized security.
00:00:04.000 --> 00:00:10.960
Person that has never hacked before now can provision the AI model that has all the hacking knowledge in the world, and it's relentless.
00:00:11.039 --> 00:00:13.119
It's just, you know, hacking at the cost of electricity.
00:00:13.439 --> 00:00:16.160
Every employee by putting an app is effectively a new vendor.
00:00:16.320 --> 00:00:19.760
The whole departments may start to look like uh mini vendors that you need governance for.
00:00:19.920 --> 00:00:24.079
For Cisco that's listening and discovered, you know, 40 new internal apps, you know, what do they do about that?
00:00:24.239 --> 00:00:31.280
I think it's a combination of platform capabilities, of uh good governance, and the guardrails we can establish for them.
00:00:31.440 --> 00:00:35.600
So a lot of enterprises realizing, well, we don't have other choice.
00:00:35.679 --> 00:00:39.520
We need to provide the technology to people we work with in a controlled manner.
00:00:41.520 --> 00:00:44.399
What deserves a hard block versus what is the top guard?
00:00:45.359 --> 00:00:47.520
Uh that's a million-dollar question.
00:01:03.920 --> 00:01:05.920
Thank you for joining the Resilient Cyber Show.
00:01:06.000 --> 00:01:09.280
My name is Chris Hughes, and today I'm joined by Igor Andrewschenko from Lovable.
00:01:09.359 --> 00:01:10.239
Igor, thanks for being here.
00:01:10.480 --> 00:01:11.040
Thanks for having me.
00:01:11.200 --> 00:01:12.480
Yeah, I've been excited to chat with you.
00:01:12.560 --> 00:01:16.879
I've been chasing you down via LinkedIn uh, you know, for a while now, uh, but I finally got you here.
00:01:16.959 --> 00:01:24.079
But for folks that don't know you, don't follow you on you know social media or any platforms or talks you've given and things like that, can you tell us a bit about yourself and the team?
00:01:24.319 --> 00:01:25.280
Yeah, uh gladly.
00:01:25.359 --> 00:01:26.640
Uh and yeah, I think it's funny.
00:01:26.799 --> 00:01:31.599
Funny thing is I think I have your first message back in February or something, and we were like, yeah, we should talk.
00:01:31.760 --> 00:01:36.879
And now here we are, the August, you know, the at the end of the end of uh summer, uh better late than never.
00:01:37.040 --> 00:01:41.359
Uh but uh yeah, to to those who don't know me, and I think that's this are the most of you.
00:01:41.519 --> 00:01:43.439
Um I'm Igor Andrishenko.
00:01:43.519 --> 00:01:45.760
I'm uh head of security and CISO at Lovable.
00:01:46.319 --> 00:01:49.840
I've been in the role for one year and one month, roughly.
00:01:50.000 --> 00:01:54.640
And then you know, in the um startup years, in the AI startup years, it's like eternity.
00:01:54.799 --> 00:01:57.359
So I've joined uh as a first security hire.
00:01:57.599 --> 00:02:06.719
So I've came to a very, very, you know, kind of starting state of security, and I managed to build it from the ground up to 20 plus people.
00:02:06.799 --> 00:02:08.159
Now the team is 20 plus people.
00:02:08.240 --> 00:02:14.800
We cover all the areas from product security to GRC, we also run IT, we run platform safety.
00:02:14.960 --> 00:02:20.560
Um, so we have a pretty diverse team, and that's why that's because we have so many diverse challenges, right?
00:02:20.719 --> 00:02:34.479
Uh, but uh before you before jumping to this uh you know RocketShip, the AI first company, I've spent five months at uh being CCO of Sana, uh Sana AI, acquired by workday, another AI company, more on the enterprise AI side.
00:02:34.639 --> 00:02:37.840
Before that, I was a CCO of company called Telavox.
00:02:37.919 --> 00:02:43.759
Um, most of you don't know it, but it's um European digital mobile telco operator, right?
00:02:43.840 --> 00:02:48.560
So there is there is a bit of like resilience and cyber and critical infrastructure there.
00:02:48.719 --> 00:02:52.800
Um, so more than million, a couple of million subscribers across Europe.
00:02:52.879 --> 00:03:07.360
So it's kind of like this business mobile virtual uh operator where like uh some really um critical services were routed through it, like police or I know some hospitals in some parts of Sweden were using it as their main mobile connection, right?
00:03:07.439 --> 00:03:09.280
And like things that run in ambulances.
00:03:09.520 --> 00:03:10.879
So I think that was pretty interesting.
00:03:11.039 --> 00:03:16.560
Before that, I did another telco gig, and before that I was at uh at Shopify as uh in Montreal.
00:03:16.719 --> 00:03:22.879
I lived in Montreal and Quebec uh for two and a half years doing uh infrastructure security, leading a team on the infrastructure security side.
00:03:22.960 --> 00:03:24.800
And overall, my background is from engineering.
00:03:24.879 --> 00:03:27.680
I come up with from what was called DevOps, right?
00:03:27.759 --> 00:03:29.520
I don't think anyone knows what it is anymore.
00:03:29.680 --> 00:03:34.319
Like we have all the only youngsters in the audience, but back in the day, DevOps was young and cool.
00:03:34.400 --> 00:03:39.439
Um, so yeah, so builds, integrations, platform things, you know, you name it.
00:03:39.520 --> 00:03:40.639
Um that was my thing.
00:03:40.719 --> 00:03:42.000
And then I switched to security.
00:03:42.159 --> 00:03:44.000
So yeah, and originally I'm from Ukraine.
00:03:44.159 --> 00:03:48.080
Um yeah, uh moved to moved to Finland in 2013.
00:03:48.319 --> 00:03:50.960
So yeah, um have seen the world.
00:03:51.599 --> 00:03:52.000
Yeah, yeah.
00:03:52.159 --> 00:03:54.080
You've been around and done quite a few things.
00:03:54.159 --> 00:04:01.280
And uh it's funny that you know I don't often feel old in this uh in the professional sense, but it's funny that DevOps is now kind of uh a dated thing.
00:04:01.439 --> 00:04:07.120
Like it it shows you how quickly, you know, uh IT, software engineering, development, cybersecurity is uh evolving.
00:04:07.280 --> 00:04:12.080
And speaking of evolving, like I was looking into the everyone's familiar with lovable, I think most people are.
00:04:12.159 --> 00:04:20.079
Uh and I know you guys had a massive like uh Series C announcement recently, uh insane valuation, incredible growth in terms of revenue and ARR, things like that.
00:04:20.160 --> 00:04:27.360
Uh and I read that the team I think is is you know expanding from you know uh several hundred folks to hundreds of more by the end of the year.
00:04:27.439 --> 00:04:44.639
And I was thinking like from the CISO's perspective, like you know, before we get into lovable, the platform and the you know kind of vibe coding and all that, uh, how do you think about that in it as a CISO internally in the enterprise of like, you know, you guys are getting ready to onboard hundreds of more employees and staff, and you know, that comes with an incredible amount of you know security concerns and considerations as well.
00:04:45.040 --> 00:04:47.600
When I joined, we were around 40 people, right?
00:04:47.759 --> 00:04:51.920
Now we are like we have 400 laptops in MGM system.
00:04:52.000 --> 00:04:53.839
That's like that's the real count of things.
00:04:54.000 --> 00:05:02.000
So that includes contractors, that includes uh different types of workers, but again, like we're dealing with 400 entities and we are not stopping our growth.
00:05:02.160 --> 00:05:13.680
So I will not tell you the end goal targets for like hiring and growth, uh, or at least like open head counts, but we are we are expanding massively and you know within the year to grow almost 10x, right?
00:05:13.839 --> 00:05:16.399
Not like this is this is the 10x uh company.
00:05:16.639 --> 00:05:20.480
The famous 10x engineer is already a reality, people building with AI.
00:05:20.639 --> 00:05:26.879
Now we are a 10x company that you know you join it in one state one year after it's 10x uh from its previous state.
00:05:27.040 --> 00:05:32.959
And I think we actually we've been like two or three different companies on that way because you join like early stage startup, right?
00:05:33.199 --> 00:05:37.920
Then suddenly you end up in like 100 people company, and that's I think where things start to break.
00:05:38.079 --> 00:05:49.519
And I think this is like like there are some milestones to every company, and I think as a CISO we should always like acknowledge that you know, we don't do our work in some kind of vacuum or like a theoretical space, right?
00:05:49.600 --> 00:05:55.600
It's always practical, it's always who are we protecting, uh, what we're protecting, what we're protecting against.
00:05:55.759 --> 00:06:05.920
And when you're like 40, 40 people company, you have different types of adversaries compared to you know 400 and having all this massive announcement being on like all these front pages and so on.
00:06:06.079 --> 00:06:10.000
So overall, it's been a very um very wild ride.
00:06:10.160 --> 00:06:16.639
I think what helped a lot is, of course, one is understanding where the business is going, and we've seen the numbers, right?
00:06:16.720 --> 00:06:18.800
We've seen the numbers before anyone else.
00:06:18.959 --> 00:06:25.199
We could project that you know, if we don't mess up, we will be in a year, we will be 10x company, right?
00:06:25.279 --> 00:06:28.319
So that was that's that's crazy, but it's also expected.
00:06:28.480 --> 00:06:36.399
So as a CISO, you just need to build your company, so build your security program to cater for probably 15x company, right?
00:06:36.480 --> 00:06:41.920
If you expect to be 10x, if you like add extra on top for extra resilience, then you'll be fine.
00:06:42.079 --> 00:06:43.600
Uh, did we succeed at that?
00:06:43.759 --> 00:06:48.000
I think at some points, yes, at some points, you know, I wish we did things differently.
00:06:48.160 --> 00:06:52.639
Uh, but I think one uh one area where we grew more than 10x is hiring.
00:06:52.720 --> 00:06:58.720
So we went from one person to like I think with all the offers sent out, we have like 25-ish now.
00:06:58.879 --> 00:07:00.800
So we grew almost like 25x.
00:07:00.879 --> 00:07:05.600
And I felt like at different stages of the growth, you know, the growth doesn't go linearly, right?
00:07:05.759 --> 00:07:15.519
Let's say there is a sales motion, there is a new office opening, let's say in the US or in Europe, then you immediately get like plus 50 people suddenly, and then then things start to break, right?
00:07:15.759 --> 00:07:34.319
So I did feel at some uh uh at the feeling at some point in time uh where you know I felt like you know we're at our capacity or like we are so overutilized that no weekend work, no like you know, 24-7 work, or like AI agents cannot help, and we kind of start falling behind.
00:07:34.480 --> 00:07:37.600
And I think you know that's uh that's where two things need to happen.
00:07:37.680 --> 00:07:43.040
You need to still invest in hiring because you know humans drive agents so far, not vice versa.
00:07:43.120 --> 00:07:46.480
Uh so you need good, you need great people in the place.
00:07:46.800 --> 00:07:55.120
Um, and then another thing is of course, you need you need to reinvent yourself, you need to reinvent your team, you need to understand how you work with things, right?
00:07:55.199 --> 00:08:01.839
If you have too many requests around certain areas, right let's figure out what the technology can help us with.
00:08:02.000 --> 00:08:12.959
And AI has been a great helper in that, kind of kind of trying to solve old problems, like new problems for us, old problems for others, probably, um, so that we don't we don't break.
00:08:13.120 --> 00:08:16.560
And again, like necessity is the greatest driver of innovation.
00:08:16.720 --> 00:08:23.519
So I think we've been able to innovate internally around like you know, doing security reviews, uh running IT with very slim team.
00:08:23.600 --> 00:08:47.120
We had one person running our IT for almost a year, for instance, and you know, just trying to break the old stereotypes, like you don't need a team of 50 IAM experts to do certain things, but you do need key people in the key areas that know how to do their job really, really well and also are open to the same notion of okay, we are here all we are all beginners, right?
00:08:47.200 --> 00:08:51.440
We're all experts, but also we are beginners at this AI stage security.
00:08:51.679 --> 00:09:04.559
So let's let's be open, let's not kind of let's not bring our old biases into the workspace, into the solution space, and let's try, you know, some of the solutions they can be extremely simple with AI and they they just drive a lot of value.
00:09:04.799 --> 00:09:07.360
So yeah, we just need to discover them and magic happens.
00:09:07.679 --> 00:09:08.639
Yeah, I love that framing.
00:09:08.720 --> 00:09:14.559
And uh so I was digging into some of your previous interviews and and public, you know, uh discussions you've done and things like that.
00:09:14.720 --> 00:09:21.759
And you had uh a conversation, I believe, earlier this year with the team at Wiz, I think it was, uh, where you used this phrase uh soft guardrails.
00:09:22.000 --> 00:09:27.759
And you you made an argument basically that hard blocks, you know, just create friction that AI existed workflows route around.
00:09:27.919 --> 00:09:33.200
And when I read that, you know, uh it's funny you mentioned DevOps and reinventing ourselves and then learning new ways.
00:09:33.279 --> 00:09:35.279
Uh, because like there's a there's two kind of framings.
00:09:35.440 --> 00:09:42.320
One is soft boundaries or soft guardrails versus like hard boundaries with agents in terms of what they can or can't do in an environment and things like that.
00:09:42.480 --> 00:09:49.840
But I also I thought of, in the sense of DevOps and DevSecOps and things that I've worked on, like like probably similar to you in CSD and all these kind of things.
00:09:50.000 --> 00:09:56.639
When we do implement uh you know these hard blocks within development workflows and things like that, as you said, we just get worked around.
00:09:56.720 --> 00:10:01.200
Uh developers go around us, it proliferates shadow usage, they don't engage us.
00:10:01.279 --> 00:10:04.320
Uh it's like we're almost to our own detriment in terms of security.
00:10:04.480 --> 00:10:15.279
I'm curious like how you were thinking about that phrase when you used it, and then also how you try to, you know, how you try to implement it at levelable, like what uh deserves a hard block versus what you know is a soft, a soft guardrail, for example.
00:10:15.600 --> 00:10:18.799
Yeah, that's uh that's a million-dollar question, right?
00:10:19.039 --> 00:10:29.039
So I think it's uh the the the best the best solutions or the best kind of answers because it's it all depends on what problem are we solving, right?
00:10:29.440 --> 00:10:36.000
If our developers are moving too fast or too slow, or are we breaking production with our AI agents, right?
00:10:36.080 --> 00:10:37.840
Those are different types of problems to solve.
00:10:38.000 --> 00:10:41.759
Of course, there is some sort of general AI adoption uh problem.
00:10:42.000 --> 00:10:56.399
With AI adoption, I mean let's say you're an enterprise, you've heard a lot about uh how great AI is, you have friends who had managed to build 10x, 20x companies, all great, but now you you need to bring AI into your workspace and workplace.
00:10:56.559 --> 00:10:57.759
Uh, how do you do that, right?
00:10:57.840 --> 00:11:02.879
You need inventory, you need visibility, you need some kind of guardrails, you need to start somewhere.
00:11:03.120 --> 00:11:13.600
Um, so again, like I think my first uh intuitive uh uh approach to this would be just clearly define what are we solving and for whom with the AI, right?
00:11:13.759 --> 00:11:24.399
And I think a lot of this you know token maxing discussions and general, like the AI adoption driven by fear of missing out, FOMO, um, is just wrong from that perspective, right?
00:11:24.559 --> 00:11:29.279
It's not about who uses AI more, it's more like what value do you get out of it.
00:11:29.440 --> 00:11:33.360
And like when looking at you know internal usage of AI at Lovable, right?
00:11:33.440 --> 00:11:34.720
I could see like numbers.
00:11:34.960 --> 00:11:48.399
Some people spend, I don't know, tens of thousands of dollars of to worth of tokens every every month, and some spend just thousands or hundreds, and sometimes you know, like you know, those are all great people, right?
00:11:48.559 --> 00:11:52.000
And there's all great contributors, it's just such different ways of work.
00:11:52.159 --> 00:11:59.759
So, but again, I think AI just emphasizes the need for solved guardrails because previously we lived in a very deterministic world, right?
00:12:00.000 --> 00:12:03.440
So you had static analysis, it was called static for a reason.
00:12:03.600 --> 00:12:04.399
There are rules.
00:12:04.559 --> 00:12:06.960
If something falls outside of the rules, it's not found.
00:12:07.120 --> 00:12:09.919
If the rules find it, you know, there is some pattern matching.
00:12:10.080 --> 00:12:15.279
That was, you know, we can argue whether it worked really well or not, but it was very deterministic, right?
00:12:15.360 --> 00:12:17.279
It's the same result all over again.
00:12:17.440 --> 00:12:20.080
Um, so that was the age of hardware guy rails, right?
00:12:20.159 --> 00:12:32.399
You cannot have an adaptive kind of policy that says, well, I can look at your intention and your job description and at what you're trying to achieve, and probably this is not what you want to do, right?
00:12:32.639 --> 00:12:34.399
This is how humans think, right?
00:12:34.639 --> 00:12:46.799
Let's say you have an intern, and then you you kind of like onboard them into the system or into the your work or their line of work, and then you just sit with them, and then you tell them, okay, probably here you can use it differently, right?
00:12:46.879 --> 00:12:49.360
And that's where uh they become efficient.
00:12:49.519 --> 00:12:52.399
So I could see the soft guard as being something like that.
00:12:52.480 --> 00:13:13.440
So literally like babysitting your your intern, uh, where if there is some sort of AI, LLM judge in place, if there is enough context to understand for what kind of again, what are we achieving, what is the person role, what is the person working towards, or what are we expecting them to work toward work towards, or their agent, right?
00:13:13.600 --> 00:13:15.600
That could be also applicable to their agent.
00:13:15.679 --> 00:13:20.480
Um, then it's easier to identify what are we what should should we allow.
00:13:20.639 --> 00:13:27.440
And the list of allowed things, it's kind of endless in a way, because there are so many different ways to solve a problem.
00:13:27.679 --> 00:13:40.320
And we don't want to limit creativity, especially you know, at places like Lovable, where everything that's built is built because of creativity, like those numbers, serious C, we don't care about them like honestly, that much.
00:13:40.399 --> 00:13:41.759
It's not like the end goal, right?
00:13:41.840 --> 00:13:50.320
The end goal is empowering 99% to be able to build anything, and for that, for uh in reinventing that for understanding how we can get there, it requires a lot of creativity.
00:13:50.399 --> 00:14:05.600
So if I just put hard guy rails saying, okay, no, no, nothing that's you know, outside of this 100 rules, uh, we'll just miss out on a lot of speed, we'll miss out on a lot of opportunities, and great things just will not just happen, you know.
00:14:05.679 --> 00:14:08.960
They they will just, you know, we will not even know they didn't happen.
00:14:09.039 --> 00:14:20.159
We will just see, okay, our quality of you know product, uh or like at least like our numbers, you know, in terms of customer satisfaction and product adoption, they not the same as as before.
00:14:20.320 --> 00:14:27.840
And one of the reasons could be that you know we put too many guardrails, we slow down the creativity, the execution speed too much, right?
00:14:28.080 --> 00:14:33.919
Again, we are all in the security domain, so we all think there is another part to this equation, right?
00:14:34.000 --> 00:14:35.519
We how much risk do we accept?
00:14:35.679 --> 00:14:45.039
And this is, I think, where um where the soft guardrail concept works nicely with um business risk approach.
00:14:45.200 --> 00:14:47.759
So, as a business, you have your goals.
00:14:48.000 --> 00:14:51.039
Like, our goal is clear, we want to enable 99%.
00:14:51.440 --> 00:14:52.320
How do we do it?
00:14:52.480 --> 00:14:53.679
That's secret, of course.
00:14:53.840 --> 00:15:02.639
We won't share like our internal roadmaps and everything, but still you can draw the line from there to your risks, like risks in your risk registry.
00:15:02.720 --> 00:15:08.960
And from there, you can identify what are the threats coming out of people running AI, right?
00:15:09.200 --> 00:15:21.279
You can understand that because of you know, like kind of how those business goals can be endangered by people running AI without any guardrails, and then you can be like, okay, what what kind of behaviors do we want to promote?
00:15:21.440 --> 00:15:24.000
And you build soft guardrails around them.
00:15:24.159 --> 00:15:32.559
So, and I know I spoke to some uh founder yesterday in the space who are doing something like that, you know, with uh with the guardrails.
00:15:32.879 --> 00:15:34.960
Um, you can build it yourself.
00:15:35.039 --> 00:15:59.360
Um, it just you know, clod uh or um cursor or lovable, you know, with there are always these hooks, there are always ways to understand what's uh what AI is doing or prevent uh next command from executing, you can always send that data to uh to your CM, to your intelligent systems, you put LM judge on top of it, and you provide a lot of context, and then you identify behavioral policies.
00:15:59.440 --> 00:16:08.720
But I do I do have the strong conviction that uh most of the guardrails will be soft guardrails very soon, but we still need hard uh guardrails as well.
00:16:08.879 --> 00:16:16.240
Because as we've seen uh with Hug and Face incident, with other incidents where I agents just they very they're super creative, right?
00:16:16.320 --> 00:16:26.480
So we take human creativity and we multiply it by agent creativity, and sometimes those things, you know, this is where like agent doesn't have good enough judgment to not do something.
00:16:26.639 --> 00:16:32.480
And we need to understand that that would be a great hard guardrail, meaning that this should never happen.
00:16:32.559 --> 00:16:52.000
But again, if we think about that picture with business goals, risks, threats, controls, you know, the whole business risk management uh approach, what should never happen is already coded, codified, and coded somehow into your business risk approach, if it's done correctly, if it's done deeply enough.
00:16:52.159 --> 00:16:53.600
So this is what we were trying to do.
00:16:53.679 --> 00:17:02.720
We're trying to understand like given where we are going, what should AI never be able to do in order for us not to uh fail at where we are going?
00:17:02.879 --> 00:17:09.279
And some of those things would be never escape sandbox, and um, and how do how would AI escape sandbox?
00:17:09.359 --> 00:17:15.119
And there's like you need, of course, to do a lot of work with your security team, with your IT teams to understand those services.
00:17:15.440 --> 00:17:21.119
But I think again, like thinking about trust, which trust boundaries should never be crossed and iterating from there.
00:17:21.200 --> 00:17:29.599
So that would be absolutely like, for instance, your product uh can have a very powerful CLI that allows very kind of admin level operation.
00:17:29.680 --> 00:17:36.079
So, what happens if you let your agent um run that CLI as a with developer credentials?
00:17:36.240 --> 00:17:37.440
Probably nothing good, right?
00:17:37.519 --> 00:17:47.759
So maybe some good hard guardrail is limiting destructive commands from CLI or entire C like kind of not letting AI to use CLI entirely, right?
00:17:48.000 --> 00:18:04.000
That would be a good example, and then rely on on soft guardrails for more kind of open-ended behavioralistic uh matching of what people should do versus what they shouldn't do to achieve those goals that you also make those guardrails aware of.
00:18:04.160 --> 00:18:06.160
So yeah, that's uh a lot to unpack there.
00:18:06.240 --> 00:18:10.480
You used a phrase that I wanted to kind of um double double down on or kind of go a little deeper on.
00:18:10.559 --> 00:18:12.319
You talked about uh empowering the 99%.
00:18:12.799 --> 00:18:18.240
Um and we've heard this you know uh talked about a lot lately with like uh low-code, no code, citizen development.
00:18:18.400 --> 00:18:22.319
Um, you know, I feel like we've democrated everyone could be a builder, like these kind of phrases, right?
00:18:22.480 --> 00:18:25.119
Uh with AI and development tools.
00:18:25.279 --> 00:18:30.480
You know, and and I I feel like we've democratized development, but we haven't necessarily democratized uh security, right?
00:18:30.559 --> 00:18:38.319
Because it's a specialized domain and you know, it it's not widespread in the sense that everyone can just pick up a tool and do it like you can with you know, kind of creating code in natural language now.
00:18:38.400 --> 00:18:51.200
Um and lovable is in this unique situation where um you have internal security considerations and things like you talked about of scaling the team and the pr in the program and and things like that, but you're also like a platform provider for the community for that for that 99%.
00:18:51.920 --> 00:18:57.359
Um and it reminds me of like the shared responsibility model of the days have passed, uh, you know, in the cloud days, right?
00:18:57.440 --> 00:19:00.319
Uh but it's this new paradigm for AI driven development.
00:19:00.480 --> 00:19:19.759
Um, you know, how do you think of that that shared responsibility model between like, you know, lovable as a platform in terms of your security uh configurations, requirements, you know, baselines, et cetera, and then what is left to the the community, the 99%, who many of whom uh aren't developers by nature or aren't definitely not security practitioners by nature.
00:19:19.839 --> 00:19:20.799
Like, how do you think of that?
00:19:21.200 --> 00:19:24.720
I think about it every day, you know, not joking even.
00:19:24.799 --> 00:19:30.160
And what's interesting, I had this opportunity to see it evolving, right?
00:19:30.240 --> 00:19:42.720
So when I joined, when we were like very limited as a development team, as a security team, we we were trying to understand how can we empower 99%, because that has been the goal from the beginning.
00:19:42.960 --> 00:19:49.119
So when the product was driven by one person, when Anton just and Fabian were starting to create it, right?
00:19:49.200 --> 00:19:51.920
Two people got together, it was the goal back then.
00:19:52.160 --> 00:20:01.599
So at the beginning, we were like, okay, we provide people tools, we provide good tools, we provide good primitives, and people will figure it out, right?
00:20:01.759 --> 00:20:09.680
We tell them there is a security bug in your project, here is a nice button, click here to fix it, and then AI tries to fix it, right?
00:20:10.079 --> 00:20:18.000
What we learned is that uh very low percentage of people took advantage of that opportunity.
00:20:18.319 --> 00:20:20.400
Um, and there were like many reasons to that.
00:20:20.480 --> 00:20:22.720
We ran uh various researches on that.
00:20:22.880 --> 00:20:28.559
Uh one was that people were just um scared to break something that works, right?
00:20:28.880 --> 00:20:32.720
Another was that they were unsure what this all this is all about.
00:20:32.880 --> 00:20:36.480
Kind of, oh, security is scary, security is complicated.
00:20:36.720 --> 00:20:46.400
So for people, it was you know, it wasn't the most obvious thing, and uh they they what we were providing them, they not necessarily use those opportunities.
00:20:46.480 --> 00:20:58.319
So we realize that going kind of to to really empower 99%, we need to be even more responsible for um for the outcomes, right?
00:20:58.480 --> 00:21:04.160
It's not about saying like putting a stamp on the app saying this app is unhackable, right?
00:21:04.240 --> 00:21:05.200
That's impossible.
00:21:05.279 --> 00:21:11.039
We know all that on the secure system is one that is disconnected from any network, put in the Faraday cage, we're not going there.
00:21:11.279 --> 00:21:16.240
Um, but again, like we provide tools, but then there is an extra step to it.
00:21:16.480 --> 00:21:24.880
And um I think it uh kind of the the whole approach evolved around um the kind of the final destination of this.
00:21:25.039 --> 00:21:32.160
Where are we all going with how the would security on a platform like Lovable would look like, let's say in 12 months, right?
00:21:32.240 --> 00:21:44.000
And I have the strongest conviction that um everything um every security like security should be solved as a class of problems on lovable apps.
00:21:44.160 --> 00:21:44.559
Why?
00:21:44.799 --> 00:21:53.519
Because A, we have opinionated stack, meaning that you know we we know where the issues are coming from, we know the tech stack very well.
00:21:53.599 --> 00:22:00.720
Uh AI is very um much um optimized to create certain types of apps, certain Primitives, right?
00:22:00.799 --> 00:22:04.799
So we can provide it with a lot of secure building blocks, which we do today.
00:22:05.200 --> 00:22:07.599
Then we own, as you say, the full loop.
00:22:07.759 --> 00:22:15.039
So code generation, then we own a deployment, we own runtime, we own the full cycle of application.
00:22:15.599 --> 00:22:19.279
And this means that we can inject security at all levels.
00:22:19.519 --> 00:22:20.880
And we did this experiment.
00:22:20.960 --> 00:22:30.400
We in June this year we released a toggle in the uh in the settings um saying auto-fix security issues, right?
00:22:30.880 --> 00:22:49.759
This is our first step towards that grand vision of security being commoditized or like kind of um taking out like the builders should not worry about it too much, meaning that the platform should do their best to solve it for them, right?
00:22:49.920 --> 00:22:52.000
However, how do we solve it, right?
00:22:52.240 --> 00:22:56.000
The biggest uh value is in asking right questions.
00:22:56.079 --> 00:23:02.160
So it should ask the builder like we we took care of all the um obvious bugs automatically.
00:23:02.319 --> 00:23:04.880
Now there are a few things we want to clarify with you.
00:23:05.119 --> 00:23:07.920
Do you need this table to be private or public, right?
00:23:08.000 --> 00:23:09.200
What are you building, right?
00:23:09.279 --> 00:23:10.400
Let's let's talk about that.
00:23:10.480 --> 00:23:16.559
And based on that, uh the EI can make pretty good decisions about the security model of the application.
00:23:16.720 --> 00:23:22.240
So uh so essentially what we did, we shipped like there is uh behind the scenes, and like you can also find it in the UI.
00:23:22.400 --> 00:23:26.559
There is this every application when being scanned, uh, we build a security model of it.
00:23:26.640 --> 00:23:28.319
So essentially it's a threat model, right?
00:23:28.480 --> 00:23:31.599
Um, so what is important, what can go wrong, and so on.
00:23:31.759 --> 00:23:43.759
Um, and then based on that, we iterate, and then uh when scanners that we also keep developing find issues, if the toggle auto-fix toggle is on, um just issues are being taken care of.
00:23:43.839 --> 00:23:54.079
And since we own the full loop of development, uh we can, if if something breaks, the agent can spot it and fix it uh before user notices, right?
00:23:54.319 --> 00:24:09.359
So essentially we can arrive at self-securing, self-healing software that that you know pipe dream of many because we are in the lucky spot to have all control of all the layers, and we we also put that, you know.
00:24:09.680 --> 00:24:12.640
I think we could have stopped earlier, right, in this journey.
00:24:12.799 --> 00:24:18.079
We could say we could have said, you know, developers, like builders need to learn security.
00:24:18.240 --> 00:24:21.599
Here is the book, here is Madocs, go learn or something.
00:24:21.759 --> 00:24:25.359
Ask your AI agent to fix like secure it for you, right?
00:24:25.519 --> 00:24:28.880
But again, like I think there is some more like societal responsibility.
00:24:29.039 --> 00:24:35.839
So if we give people a tool, tool with so much power, with that comes quite some responsibility.
00:24:36.000 --> 00:24:45.200
So essentially, um, we're looking into solving security in these apps as a thing of its own, right?
00:24:45.359 --> 00:24:51.039
So ideally, there should be no security tab whatsoever in the app, and at least no security scan.
00:24:51.119 --> 00:25:02.240
Because if if if something is can can be found, then AI should be able to immediately fix it, and then the code generated should be as secure as possible from default, from from the get-go, and so on.
00:25:02.400 --> 00:25:20.079
So essentially, the people will be just presented with questions and business questions about their app, they will answer them, and then if we do it right, that the expectation of a person who's building and the result of the build by AI will be the same, right?
00:25:20.160 --> 00:25:22.000
And that's that's the end goal.
00:25:22.079 --> 00:25:31.200
Of course, it's hard to get there, and uh we're spending a lot of a lot of cycles thinking hard about it, but at least that's our conviction that it is possible.
00:25:31.519 --> 00:25:40.240
And as AI and LLMs uh improve, um, we get closer and closer there to improvement also of our harnesses and technology.
00:25:40.400 --> 00:25:41.599
Uh, but it's it is possible.
00:25:42.000 --> 00:25:44.799
Yeah, you said uh several things that really uh resonate with me.
00:25:44.880 --> 00:25:59.680
It's like what you're describing to me uh sounds like one, like leveraging your opportunity as a platform provider to make a systemic impact of security across the ecosystem by things like secure defaults and and making it, as you said, it's almost invisible to the user in many ways.
00:25:59.839 --> 00:26:03.680
Like good security it it rather than being a friction point, it should be almost invisible to the user.
00:26:03.839 --> 00:26:07.599
They don't necessarily it's abstracted from them, at least to the extent that it's possible, right?
00:26:07.759 --> 00:26:26.000
And then the things you were describing, like it really felt like secure by default, secure by design, things that have been championed by like Google and uh um Syssa under Ken Easterly, like these kind of concepts of uh software vendors and platform providers, you know, kind of making it uh invisible to the user and doing the right thing from the onset in terms of design and default configurations and things like that.
00:26:26.160 --> 00:26:40.319
But you also said something I want to ask a little bit about too is um, you know, obviously as a platform provider and what you all do with lovable, you sit a little bit closer to the model layer than maybe some of the you know users in the community, especially non-technical users who don't call kind of follow this so much.
00:26:40.480 --> 00:27:00.480
Um and there's been uh a lot of research on on this from AppSec vendors, from uh academia, you know, those kind of things that show that when it comes to the code that the models generate, it's still pretty mixed in terms like it's its quality and and capability and functionality has has seen great improvements, but security has kind of stayed somewhat relatively flat.
00:27:00.559 --> 00:27:02.000
And of course, it's a lot of reasons for that.
00:27:02.079 --> 00:27:05.680
It's trending on vast open source data sets that have vulnerabilities and flaws in it.
00:27:05.839 --> 00:27:13.359
Uh maybe the user didn't ask for the right thing in the right way with security context as part of the request to the agent or the you know development tools.
00:27:13.519 --> 00:27:27.359
Um, do you think we'll see a place where the models get so good that it's producing, you know, uh overwhelmingly secure code by default, and or you guys are able to do some of what you said, which is you know, you're kind of fixing it on the fly for the user, so they don't even need to necessarily worry about it.
00:27:27.519 --> 00:27:32.000
How do you think about like like models uh producing secure code kind of implicitly on their own?
00:27:32.400 --> 00:27:33.119
It is possible.
00:27:33.279 --> 00:27:34.480
That's that's my answer, right?
00:27:34.640 --> 00:27:35.279
It will be possible.
00:27:35.359 --> 00:27:38.319
We will see the day where the benchmarks will improve.
00:27:38.480 --> 00:27:52.640
I don't think we'll see 100%, you know, uh, or unless the, you know, it will be kind of the models will uh reward hack the benchmarks and they will know what exact code to produce to get scored, like very, very high scores, which they will absolutely do.
00:27:52.799 --> 00:28:04.240
Um, but in the kind of in the world where we add humans uh creativity to the mix, so we don't know what the human will build, how they will do it, but we know for sure that they will be creative.
00:28:04.400 --> 00:28:12.480
Um, I think um defense in depth is one of my favorite concepts, and this is exactly what we should um strive to build here.
00:28:12.640 --> 00:28:18.000
So essentially we have like at the center we have LLM, and LLM should generate reasonably secure code, right?
00:28:18.240 --> 00:28:27.680
Um, then we have uh the harness, uh we have security scanners, we have different tooling, and we have this loop between the user and the agent.
00:28:27.839 --> 00:28:33.359
So all of that together, it's absolutely possible to achieve secure software, right?
00:28:33.599 --> 00:28:36.319
So of course, like model models can improve.
00:28:36.400 --> 00:28:42.720
Like I feel like if if we're if the models stop developing today, if there's no more improvements, that's it.
00:28:43.119 --> 00:28:43.599
That's it.
00:28:43.839 --> 00:28:47.279
Big ceiling, nothing, nothing gets better, only worse.
00:28:47.440 --> 00:28:54.319
Um, I think we we could still achieve it, but it would be like quite a lot of engineering and fine-tuning and doing specific things.
00:28:54.480 --> 00:29:00.720
Um, but again, like I do I do still think that models have got some some improvement in them, maybe quite a lot.
00:29:01.039 --> 00:29:06.640
So that will that will help to make that core of that onion of defense and depth onion pretty strong.
00:29:06.720 --> 00:29:11.599
So whatever comes out is already secure to a large extent, very large extent.
00:29:11.680 --> 00:29:19.440
But still, I wouldn't I wouldn't uh rely on it as an only security layer in like our like offering, right?
00:29:19.680 --> 00:29:33.279
So with the scanners and the automation and everything that else that we offer, including specific kind of fine-tunes or uh harnesses or um knowledge files for different types of issues, uh we can we can get pretty pretty far.
00:29:33.440 --> 00:29:37.920
And again, but I think the the last missing bit is that auto improvement loop, right?
00:29:38.000 --> 00:29:59.440
Where we finally make the agent to understand what human wants from them and understand how to get there securely and actually look at the all the existing findings so far, generations, uh well, starting from call generation to what the scanners found, and just take it into account and improve, get better, get good at security.
00:29:59.599 --> 00:30:00.559
So that is that is possible.
00:30:00.640 --> 00:30:08.720
But again, there needs to be that part and the dialogue between the creator, the builder, and the agent when some things are unclear.
00:30:08.799 --> 00:30:09.599
Aaron Powell Yeah, well said.
00:30:09.759 --> 00:30:14.400
I think uh you know it's it's funny how a lot has changed, of course, in AI and akintic AI and things like that.
00:30:14.480 --> 00:30:27.279
But fundamental concepts like defense and depth and things you just talked about are still alive and well and will always be alive and well, uh, you know, regardless of the technological changes, like those fundamental concepts or primitives, as you call them earlier, I think are gonna uh persist no matter what.
00:30:27.599 --> 00:30:44.319
And as I said, I dug in some of your uh previous interviews and things you've said, and I hope I'm not misquoting you here, but like what you all do, this capability you provide of that that you know development for the 99%, um, it's amazing, but of course it has some implications for CISOs of organizations uh that find teams internally using these things.
00:30:44.559 --> 00:30:53.920
Like say that, you know, you you've you've said that uh every uh employee vibe coding an app is effectively a new vendor, and that whole departments may start to look like uh mini vendors that you need governance for.
00:30:54.079 --> 00:31:02.079
Uh for a CISO that's listening and discovered you know 40 new internal apps and marketing team spun up with Lovable uh last quarter, for example, like you know, what do they do about that?
00:31:02.160 --> 00:31:07.680
How do they kind of govern and and and secure that uh democratized uh capability within their enterprise?
00:31:08.079 --> 00:31:10.799
Um yeah, there is uh there is an answer to that.
00:31:10.880 --> 00:31:19.920
And uh I think it's a combination of uh platform capabilities, of uh good governance, and the guardrails we um can establish for them.
00:31:20.079 --> 00:31:27.119
Because um I I made another point recently that you know um if like technology is out there, right?
00:31:27.200 --> 00:31:31.359
The the genie is out of the box of out of the lamp, things are happening.
00:31:31.519 --> 00:31:39.519
So what we see a lot, or like a lot of customers come to us saying, like, you know, we've seen people using Lovable uh under the hood, right?
00:31:39.599 --> 00:31:43.279
So we got tired of it, it's impossible to stop, or like other tools, right?
00:31:43.359 --> 00:31:50.160
They can use the same way they can use any AI tool from their personal account, for they can use it on their phone, they can see that work.
00:31:50.240 --> 00:32:02.000
Okay, work does not allow using it, you know, in on their work computer, but they can do something on the phone, like take like you know, make a photo of the screen and then put it in uh Claude or Chat GPT or lovable, like build me a thing around it.
00:32:02.160 --> 00:32:04.559
And the intentions are mostly good, right?
00:32:04.640 --> 00:32:13.039
People are not are not malicious or malign, and they they want to solve problems, they want to be creative, they want to build something.
00:32:13.279 --> 00:32:17.599
So a lot of enterprises realizing well, we don't have other choice.
00:32:17.759 --> 00:32:25.119
We need to provide the technology to people we work with in a controlled manner, and it's all about what uh the platform offers, right?
00:32:25.200 --> 00:32:28.720
And then we've uh we spun up uh we spun up a pretty big team now.
00:32:28.880 --> 00:32:32.880
We were joking like half of the lobable has been working on enterprise security features now.
00:32:32.960 --> 00:32:52.559
Uh but the idea is that uh we looked at everything that people need to uh use AI securely for building websites, uh you know, slide decks, anything you can imagine um internally in the organizations and potentially publishing it on the internet if they want to go there, right?
00:32:52.720 --> 00:33:00.640
And everything like the core to the approach has been kind of the gradual maturation of people and their AI usage, right?
00:33:00.720 --> 00:33:12.640
So you start with people just trying it out by default, everything super private, like you know, in Google Docs, when you create a document, no one sees it, you can write anything you want, even your IT admin will not be able to see it.
00:33:12.880 --> 00:33:16.000
Then you can publish it, you can publish it to your org.
00:33:16.240 --> 00:33:19.039
So, again, pretty limited surface.
00:33:19.279 --> 00:33:24.000
Um people can interact with it if you published it, right?
00:33:24.400 --> 00:33:29.200
You need to be mindful of that, but it becomes kind of an internal information or internal tool.
00:33:29.359 --> 00:33:35.839
And then, of course, you can, if your organization allows it, and that's another kind of governance control that uh is possible to set.
00:33:35.920 --> 00:33:39.359
Uh, if your organization allows it, you can publish it externally on the internet.
00:33:39.519 --> 00:33:42.480
Many don't, many just uh want to play it safe.
00:33:42.640 --> 00:33:47.279
Let's say all the apps should be internal apps, um, which is their choice, right?
00:33:47.359 --> 00:33:56.640
In turn, like at Lowable, we do not have that limitation, but we of course uh we also shipped a lot of um functionality to monitor everything that's been published, right?
00:33:56.720 --> 00:34:15.039
Everything that's been built, um, and spot anything that should not be on the internet, anything that, let's say, we have things like PII scanner, we have things like security scanner, uh, and the combination of being on the internet with uh sensitive PII in it and security vulnerabilities, that's a bad combination, right?
00:34:15.280 --> 00:34:21.360
So we we can prevent uh prevent publishing with vulnerabilities, we can prevent publishing with PII.
00:34:21.519 --> 00:34:27.280
So you see, there's lots of controls, lots of like layers again in this defense and depth and this governance model.
00:34:27.440 --> 00:34:30.000
Uh and I think we just we just need to trust it.
00:34:30.079 --> 00:34:44.400
And we need to trust the combination of or like the total of uh an employee who's trying to do their job well, the AI as a technology that is helping them, and the platform that making sure it happens in the controlled manner.
00:34:44.639 --> 00:34:53.840
And yeah, I mean we are we are doing again, like we've spoke to great uh number of uh CISOs and CIOs about the same topic.
00:34:54.000 --> 00:35:05.039
And all they all they want is pretty much a certain number of controls, and we um we already get in much fewer requests uh than earlier, so it seems like things are working.
00:35:05.199 --> 00:35:17.679
Um and yeah, but I also could uh could summarize it as you know, everyone wants minimal attack surface, everyone wants secure by design, by default code, everyone wants uh minimal blast radius.
00:35:17.760 --> 00:35:27.039
So if you know if this thing explodes, no one else could like no one is hurt, uh, and everyone's wants uh everyone wants a good visibility into what's happening.
00:35:27.360 --> 00:35:34.159
So audit logs, uh application logs, uh, some sort of monitoring and uh alerting on top of that.
00:35:34.320 --> 00:35:47.119
And you know, that's that's it it's a pretty simple formula on the Kai level, but you know it's uh it gets uh tricky as we get to the detail into the details, but again, for every organization, the the answer is a bit different.
00:35:47.280 --> 00:35:49.519
But I think uh those were the main uh rules to follow.
00:35:49.920 --> 00:35:53.519
Yeah, it's a good framing in the sense that uh it's it's simple, but not necessarily easy.
00:35:53.599 --> 00:35:57.440
The devil's in the details in terms of implementation and execution and things like that.
00:35:57.599 --> 00:36:05.440
Um the speaking of controls, the last couple of questions I wanted to ask you um are a little bit in the vein of uh you know regulation, governance, risk, and compliance.
00:36:05.519 --> 00:36:07.119
One's internal, one's external.
00:36:07.280 --> 00:36:08.800
I'll start with the internal one.
00:36:08.880 --> 00:36:13.039
Um you all have some uh again, you're building out your security team and capabilities pretty quickly.
00:36:13.119 --> 00:36:30.719
Uh you have some folks in my network who I think have joined your team and I think uh seen you and and others speak about uh a concept of uh GRC engineering, which is you know taking governance, risk, and compliance from maybe a paper-based, uh, you know, cumbersome, tedious activity that's not really technical to moving it to more of a engineering discipline.
00:36:30.880 --> 00:36:37.760
Um, you know, how do you think of that concept of GRC engineering in terms of uh how you build that internally at your at your organization at Lovable?
00:36:38.000 --> 00:36:42.880
Like how do how do you guys approach uh governance, risk, and compliance from like maybe from an engineering uh perspective?
00:36:43.280 --> 00:36:43.519
Okay.
00:36:43.679 --> 00:36:46.320
Uh let me take 10 steps back.
00:36:46.480 --> 00:36:53.119
I know it will be a massive detour, but this was something that I've been thinking super hard um for the past week.
00:36:53.440 --> 00:36:58.159
Well, not week, I mean months, but actually putting it in writing and just publishing the blog.
00:36:58.400 --> 00:37:02.320
But my biggest kind of, you know, why are we doing why we why would we exist?
00:37:02.400 --> 00:37:03.679
Why security teams need it?
00:37:03.760 --> 00:37:09.280
Because there are certain threats, there are certain risks out there that can endanger the organizational success, right?
00:37:09.360 --> 00:37:10.639
That's that's our goal, right?
00:37:10.800 --> 00:37:15.760
Not to be in the podcast or like, you know, like build something cool, no one cares, right?
00:37:15.840 --> 00:37:18.719
Like what we really are here, we're like risk reducers.
00:37:18.800 --> 00:37:20.400
Uh, and we need to get it right.
00:37:20.480 --> 00:37:28.960
We need to make sure we do not take too much unacceptable risk, we need to make sure we do um, yeah, we we integrate with how organization works and so on and so forth.
00:37:29.119 --> 00:37:41.199
But now here is a curveball coming our way very quick, or more like asteroids uh um coming at Earth, and now we have to like scramble and shoot it to the down before it hits us, right?
00:37:41.360 --> 00:37:44.079
The asteroid is the AI-powered attackers.
00:37:44.159 --> 00:37:47.440
Um AI-powered attackers are out there to get us all.
00:37:47.599 --> 00:38:09.119
Um, you know, you don't need to be some kind of guru to understand that, yeah, if you can tell AI um, well, hack or like like just just you know get uh some token from that system, and here's the system which is black box, the AI, unless it has like very good guardrails around it, their base model, it will go and try to invent all possible ways to get in, right?
00:38:09.440 --> 00:38:10.880
Then you can add a harness.
00:38:11.119 --> 00:38:17.119
Let's say you put LLM model and you have a good harness that is optimized for well, red teaming.
00:38:17.280 --> 00:38:18.400
What happens then, right?
00:38:18.480 --> 00:38:30.159
So without much skill, like you don't need to know how SSH works, you don't need to know like how you know, I don't know, binary reversing works, but you now have the superpowers.
00:38:30.239 --> 00:38:37.360
And let's say you have morals that allow you to attack other people's system for profit, right?
00:38:37.519 --> 00:38:42.559
For your own profit, for your own good, um, without asking people about that, right?
00:38:42.880 --> 00:38:49.920
Then what happens is just literally like everyone out there becomes a big threat to a company.
00:38:50.079 --> 00:39:03.440
So AI-powered attackers, uh, with improvement of the models, with democratization of access, with open models like recent Quen model can already run on their pretty powerful gaming laptop, but still it's doable, and you just run from there.
00:39:03.519 --> 00:39:09.840
And it has uh we already seen gel broken uh Quen before that has no guardrails, it has like no filter.
00:39:09.920 --> 00:39:12.000
There are some sometimes there are people like that, you know.
00:39:12.079 --> 00:39:15.599
Now there is a model with no filter whatsoever, uh, pretty scary.
00:39:15.760 --> 00:39:17.440
So it's all coming for all of us.
00:39:17.599 --> 00:39:25.760
And my main kind of uh realization from it was that the one thing that can save us is actually the good old defense and depth approach.
00:39:25.920 --> 00:39:29.920
But with the trick, because previously, how does the defense in depth work?
00:39:30.159 --> 00:39:32.159
And I I promise this will end up with compliance, right?
00:39:32.239 --> 00:39:33.519
There is a compliance in the end.
00:39:33.679 --> 00:39:35.679
So uh, how does defense and depth work, right?
00:39:35.760 --> 00:39:57.280
You have these layers, and a lot of organizations, like at least like from my experience and talking to my colleagues, it was about like, okay, we we have these controls, we have these tools in place, and we can kind of like slap a lot of controls on this layer, a lot of controls on this layer, and then like it would just slow down attackers so much that they will bulk down in the defenses, we will detect them, we will jack them, right?
00:39:57.440 --> 00:40:06.639
So, but overall, like the each layer's performance or quality or perfection of each layer has never been the end goal because we we felt it's enough, right?
00:40:06.719 --> 00:40:07.760
It's good enough.
00:40:07.920 --> 00:40:10.000
But now good enough has changed.
00:40:10.159 --> 00:40:21.280
So now good enough became whoa, that's a person that has never hacked before, now can provision the AI model that has all the hacking knowledge in the world, and it's relentless.
00:40:21.360 --> 00:40:23.440
It's just you know, hacking at the cost of electricity.
00:40:23.519 --> 00:40:26.639
That's essentially what we are looking at with advanced capabilities.
00:40:26.800 --> 00:40:30.559
So if there is a gap in that layer, it will find it.
00:40:30.719 --> 00:40:36.079
And then there is another layer, and if there is a gap in that layer, it will find it, and it will find it, and it will do it pretty quickly.
00:40:36.239 --> 00:40:39.440
So my realization was that okay, we need pretty good layers.
00:40:39.519 --> 00:40:44.320
We need to measure, we need better controls, more intentional, with better coverage.
00:40:44.480 --> 00:40:56.239
So essentially, what we need to build is that each layer should have close to like 99% or 95%, 97%, depends on like where you are, like who's your uh attacker, uh, control efficiency.
00:40:56.400 --> 00:41:02.960
Meaning that if you have MFA, if you have EDR running on your laptops, right, those need to be everywhere.
00:41:03.119 --> 00:41:09.440
You cannot just like run it on just core employees or contractors, but not that group, and so on, right?
00:41:09.519 --> 00:41:21.039
So we need to ensure that the controls really cover what they they should, that we know where the gaps are, and we have a plan to address it, or some kind of mitigating control.
00:41:21.360 --> 00:41:27.360
And we need to be able to ensure like you know measure and validate the efficiency of each layer.
00:41:27.599 --> 00:41:33.679
So, and by doing that, we would enhance the layers and we would make it harder again.
00:41:33.760 --> 00:41:44.880
It's all about uh kind of the the bulking down the attackers and the layers so that we can inject eject them um when we realize okay, somebody's somebody's out there for us at the machine speed.
00:41:45.119 --> 00:41:49.519
Um, so how do we measure the control like how do we measure the control efficiency?
00:41:49.760 --> 00:41:50.880
JRC, right?
00:41:50.960 --> 00:41:52.960
That's that's that's what I was going to.
00:41:53.039 --> 00:42:14.400
So I think this this uh change, like post Metos World, you name it, like there are different um different names to it, or like advanced adversarial AIs, GRC will GRC engineering will shine if if done right, because then you can programmatically understand your layers, you can build like this graph of like what is where.
00:42:14.639 --> 00:42:21.360
If you look at uh you know your compliance uh software model, like that it already has all the data, right?
00:42:21.440 --> 00:42:24.960
You have your risks, you have your vendors, you have your controls.
00:42:25.280 --> 00:42:37.519
If you can kind of put them all into that um model and understand which layer uh is comprised of what controls and what is their efficiency, like in real life, and what is still missing.
00:42:37.679 --> 00:42:40.400
So look for threats that are not addressed, right?
00:42:40.559 --> 00:42:46.800
Risks that are accepted with too high risk score, and ask yourself is my layer actually uh holding?
00:42:46.960 --> 00:43:12.480
And ask your GRC engineering uh to build the the eval or like the the nice modern word for that, or KPI, the old old school word, uh but some validation score for each layer, and if you can get to the coverage saying, okay, my coverage is 80%, great, get it to 85, then get it to 90 next month, they get it to 99, right?
00:43:12.639 --> 00:43:14.960
And the the farther you go, the harder it gets.
00:43:15.119 --> 00:43:32.239
But overall, um, I think that's uh that's the GRC approach I see as uh helping uh companies because I think GRC has been associated a lot with kind of you know, you build a team, you put it in the dark corner of the office, they do their job, you forget about them because they do their job good, which is great.
00:43:32.400 --> 00:43:34.480
It means they're great, they do their job good.
00:43:34.639 --> 00:43:39.119
Well, but now GRC takes a bit, they're like, hello, we are here, we can help.
00:43:39.280 --> 00:43:42.800
Um, and they should help um kind of put it all together.
00:43:42.880 --> 00:43:46.480
And again, uh I started with this business risk model, right?
00:43:46.559 --> 00:43:48.639
This is where everything is rooted in.
00:43:48.800 --> 00:44:06.320
Um so if we start thinking about the business risks, uh then GRC is the obvious uh um obvious first class citizen in this ecosystem because it has understanding of Um, of risks, of compliance, pretty much efficiency of our controls around mitigating those risks.
00:44:06.480 --> 00:44:21.760
So you already have all the ingredients on the table, but it's more like you need to intentionally build the controls that enhance every layer, measure every layer efficiency, and then make sure you have enough monitoring to spot this, you know, AI-powered attacks and prevent them.
00:44:22.000 --> 00:44:28.079
So that's that's my answer about GRC, where it's all heading and where it exists in our world.
00:44:28.559 --> 00:44:34.079
What I liked about the answer is uh you know, there's often been like this derogatory phrase where it's like compliance doesn't equal security.
00:44:34.159 --> 00:44:49.760
And like maybe that was the case in the past, but what you just described with PRC engineering or how you envision it, really it's like uh leveraging governance, risk, and compliance, uh not not not necessarily just for compliance, but show the efficiency and effectiveness of your security controls in near real time.
00:44:49.840 --> 00:44:58.559
Uh and then well, what better way to prove the value of security than to be able to do that and see how effective your controls are, you know, how what level of coverage you have, like you just talked about.
00:44:58.639 --> 00:45:15.599
Um so I think that that's the direction that that governance, risk, and compliance needs to move, not only to be uh better from the compliance perspective and things like that, uh to move, but to move it to more of an engineering discipline and tie it to the security engineering and activities of the organization too, and uh showing the effectiveness of your security investments and things that you're doing in the enterprise.
00:45:15.679 --> 00:45:17.119
Um so I like that answer a lot.
00:45:17.360 --> 00:45:35.440
Last question I wanted to ask you before we uh wrap up here is uh maybe tied to broader regulatory landscape, uh, you know, I know of course your organization has roots in uh uh the EU and things like that, um, but even here in the US and abroad and other nations, um, you know, there's a lot of evolution around regulations and and software security and cyber and so on.
00:45:35.599 --> 00:45:52.079
Um, you know, when you look at lovable, where you have this empowerment of the 99%, uh, when you have regulations coming for software vendors or software manufacturers, as they may be called, how do you see that playing out from the regulatory perspective when it could just be a citizen developer who created some app and put it out there?
00:45:52.159 --> 00:46:05.280
They're not necessarily a quote unquote software vendor or software manufacturer, but they did produce software and put it out into the world and maybe people touch it, or maybe it has uh an impact on someone's PII or PHI or you know, financial data or whatever.
00:46:05.440 --> 00:46:08.960
Um how do you see that playing out in a regulate regulatory sense?
00:46:09.039 --> 00:46:12.400
Uh now that everyone can maybe be a software manufacturer andor vendor.
00:46:12.800 --> 00:46:20.800
Yeah, I think it resonates very well with the responsibility of the platform over different aspects of creation cycle, right?
00:46:20.960 --> 00:46:28.559
So for instance, internally, uh we have we we we do have a trust and safety department, we have policies of what's allowed, what's not.
00:46:28.719 --> 00:46:35.440
So for instance, some projects like you can build a Microsoft login page look alike, but you can only publish it internally.
00:46:35.599 --> 00:46:35.760
Right?
00:46:35.920 --> 00:46:41.840
The moment if you decide to publish it externally, it may fail because of automated uh checks and so on.
00:46:41.920 --> 00:46:54.639
Uh but we we do not uh we try not to limit too much what you can do internally on your like on your you know in your small cave where you're experimenting, but the moment you put it into the bigger world, there are certain obligations.
00:46:54.800 --> 00:47:01.119
And our goal, our task is to make it very, very clear what what it entails, right?
00:47:01.199 --> 00:47:16.639
And we want to do it, it's not yet in the product entirely, but we do have that vision of telling people early that you know you're building this thing, consider that certain um requirements will be put on you the moment you publish, right?
00:47:16.800 --> 00:47:20.000
So, for instance, uh we can uh take uh some regulated space, right?
00:47:20.239 --> 00:47:25.039
Healthcare data or um you know selling medical drugs.
00:47:25.199 --> 00:47:33.199
Um we've had some cases where we had to just take down um what people created because you know we need to see the evidence of a license for it.
00:47:33.280 --> 00:47:36.719
We need like now, you know, creation is easy, right?
00:47:36.800 --> 00:47:41.440
But before it starts earning money, we were like, okay, sorry, you can only build it internally.
00:47:41.599 --> 00:47:44.719
And that's the current uh there are some limitations.
00:47:44.800 --> 00:48:01.440
But again, we're looking to um to ease up the burden of regulations, and if we can ask those questions early enough, first of all, we can say, okay, if you want to build like a weapons, dark weapons marketplace, probably, you know, we're we're not friends, right?
00:48:02.079 --> 00:48:03.599
Please don't even try.
00:48:03.760 --> 00:48:11.679
Uh but then if if you have a license or you can apply for a license through us, um, or we can tell you where to apply it, right?
00:48:11.760 --> 00:48:23.920
That resonates very well with our narrative of like lovable being a co-founder, and that's one of the one of the pillars of the strategy, where it's like as a co-founder with some experience, we tell you that this will require a license, right?
00:48:24.000 --> 00:48:24.960
You can go and apply it.
00:48:25.039 --> 00:48:31.599
Here's the phone number, like here's a website, and people go apply, they get license, we do some sort of KYC on our end.
00:48:31.840 --> 00:48:33.519
Beautiful, everything works, right?
00:48:33.840 --> 00:48:35.119
That's one one side of it.
00:48:35.280 --> 00:48:38.159
Another is what is not dependent on us.
00:48:38.400 --> 00:48:45.360
So, you know, there is a Cyber Resilience Act, there is NIST2 in the EU, there is there is many like EU AI Act.
00:48:45.599 --> 00:48:53.360
Uh, so they all put certain like requirements, and sometimes you know, they're implicit, sometimes they're not very well known to creators.
00:48:53.599 --> 00:48:59.920
And uh what our goal is and always will be to make it known, right?
00:49:00.000 --> 00:49:07.519
So, again, understand what people are building, tell them this is these are the things you need to be aware of, and explain their responsibility.
00:49:07.599 --> 00:49:12.400
Because in the shared responsibility model, it's not only a platform that has responsibility, right?
00:49:12.480 --> 00:49:13.519
It's a creator as well.
00:49:13.679 --> 00:49:22.559
And the moment they start putting real people data into the into their um whatever they build, um, the moment they start to do certain uh actions, right?
00:49:22.960 --> 00:49:27.039
Things can change very quickly for for kind of what they need to comply with.
00:49:27.280 --> 00:49:57.840
So my advice has always been that you know it's uh um treating treating building process, not as a one-way street where you put put just requirements on the system saying build me this, uh, but also asking questions, being curious, being like, you know, like based on what you've built so far, what you see in my app, um based that I'm you know, I'm let's say in Germany, anything I should be aware of, any regulations, anything that I need to know and how to minimize that risk coming out of it.
00:49:57.920 --> 00:50:05.760
So for instance, like um uh you mentioned CRA Cyber Resilience Act earlier when we talked, uh it has very clear uh requirements, right?
00:50:05.920 --> 00:50:09.840
Some reporting requirements, uh software bills of materials, yada yada.
00:50:10.320 --> 00:50:14.159
So most of it technically we can provide as a platform, we already do it.
00:50:14.320 --> 00:50:21.679
Um but then like reporting, let's say if there is a security incident in your app, that's your responsibility.
00:50:21.920 --> 00:50:34.800
So asking the agent to let you know what are your CRA responsibilities, or like what are the regulatory frameworks based on where you operate and what you build, it will tell you, okay, CRA might be a thing because you distribute software.
00:50:34.880 --> 00:50:40.159
Let's say you build like some app or agent and you ship it to someone else, so it applies, let's say so.
00:50:40.400 --> 00:50:48.000
And then we can um we can like the agent will tell you what what you need to do, and it's not super scary, it's not a crazy requirement.
00:50:48.239 --> 00:50:56.639
And I'm always trying to treat any regulations as some sort of you know improvement function, or like at least um they're there for a reason.
00:50:56.800 --> 00:50:58.559
So what are they trying to achieve?
00:50:58.719 --> 00:51:03.679
Okay, they're trying to mature the the creators of software, which is which is not a bad thing.
00:51:03.840 --> 00:51:11.119
Of course, we as a platform we provide some building blocks and uh ways for people to discover those requirements, and then we make it simpler.
00:51:11.360 --> 00:51:23.039
We don't we don't completely kind of do it for them uh because there's still their responsibility, but we can make it simpler to discover those requirements and to um to build um secure compliance software.
00:51:23.119 --> 00:51:29.280
And like recently we released uh for all the apps that want it, they can opt in to have their own trust center.
00:51:29.440 --> 00:51:37.760
So anything you build with us, you can build like a trust automatically deploy a trust center that showcases your compliance posture, right?
00:51:38.000 --> 00:51:45.039
And then that the that will be the biggest platform for making sure meeting those regulatory uh demands going forward.
00:51:45.199 --> 00:52:00.800
So this is where let's say you achieve CRA compliance uh just by yourself as the creator, you can put it there as kind of the statement and make it more, you know, your your users will trust you more, especially, you know, because you you've done the job.
00:52:00.880 --> 00:52:13.519
Uh, and there is a place where kind of showcase it and do it automatically because most of those requirements they're just being um being automatically discovered and automatically uh generated based on the app and the data in the app.
00:52:13.679 --> 00:52:14.960
So it's it's a pretty cool concept.
00:52:15.039 --> 00:52:16.719
It's kind of like you know, automating compliance.
00:52:16.800 --> 00:52:28.559
Again, you you mentioned GRC engineering, that's exactly what it's doing, but for customer apps and simplifying that regulatory burden and regulatory uh overhead um that people may have.
00:52:28.960 --> 00:52:34.960
That's such a I I gotta be honest, that was a really amazing answer because I wasn't quite sure how you all approach that yet, you know.
00:52:35.119 --> 00:52:51.440
Um but it's uh it goes back to like again, making security easy to do or making it uh I want to say abstract from the user, because in this case you're explicitly informing them of requirements they have to meet or uh regulatory you know things that that may uh be applicable to them depending on the use case of their application and the data and so on.
00:52:51.519 --> 00:53:03.199
Uh but you're at least bringing those things to the forefront there to of their attention and then help enabling them or empowering them how to meet those requirements because I've done a lot of work in compliance like HIPAA, HITRUS, FedRAMP, TOC2, like NIST RMF, you name it.
00:53:03.280 --> 00:53:04.400
And it's like it's complex.
00:53:04.480 --> 00:53:12.480
Like there's entire cottage industries built around just each of these uh frameworks, you know, of of consultant agencies and and and auditors and assessors, et cetera.
00:53:12.559 --> 00:53:19.360
Um so it's really cool to hear you guys are doing that for the community and like helping them understand how to navigate that, how to meet it, making it easier to meet these requirements.
00:53:19.599 --> 00:53:29.679
It sounds like a win-win, both from the compliance perspective of meeting the regulation, the compliance requirements as a platform provider is in terms of meeting your responsibilities and then also uh helping the users do it too.
00:53:29.840 --> 00:53:31.679
So that was a that was a super cool answer.
00:53:31.760 --> 00:53:33.599
Uh I'd love to hear how you guys are approaching that.
00:53:33.760 --> 00:53:35.280
Um, but that takes us to the end of the interview.
00:53:35.360 --> 00:53:36.800
That's uh the questions I had for you today.
00:53:36.880 --> 00:53:42.559
I'm glad I finally got some time with you after chasing you down on LinkedIn for you know six months or so, however long it's been.
00:53:42.719 --> 00:53:45.280
But uh, you know, thank you so much for joining me today, Igor.
00:53:45.360 --> 00:53:46.400
I really love the conversation.
00:53:46.639 --> 00:53:47.760
Yeah, it's been my pleasure.
00:53:47.840 --> 00:53:50.239
Thanks for um interesting questions, really.
00:53:50.320 --> 00:53:56.639
And um, you know, I I think like if I can have like just a few more uh a few more things to say.
00:53:56.800 --> 00:54:10.880
Um I think like you know, overall like vibe coding, it has uh you know, it's a bit like an interesting space to be because you know there's a lot of expectations, there is a lot of like kind of baseline distrust, or can this be a thing?
00:54:11.119 --> 00:54:21.360
And I think as the community and like builders and the platforms in the in the space, we should all treat each other uh with respect and with understanding that you know we're all in the same boat, right?
00:54:21.440 --> 00:54:33.679
So if if tomorrow some of our competitors you know fail miserably, I'll tell you this, we will be impacted immediately because you know people will ask questions, oh, that happened to them, how do you sure you it doesn't happen to you?
00:54:33.760 --> 00:54:34.880
And vice versa, right?
00:54:35.039 --> 00:54:43.199
So overall, I think there is some job in the community of vibe coders and vibe coding platforms to um to support the end goals, right?
00:54:43.280 --> 00:54:54.079
We all want to democratize the creation, we want to put human first, we want the humans, like you know, people who had no idea that they were able to build such beautiful things, they will have that opportunity.
00:54:54.159 --> 00:55:00.400
So we just need to bring it to them and hear them out and you know, build a good build something that helps them.
00:55:00.639 --> 00:55:02.880
So I think that's our job, that's our mission.
00:55:03.039 --> 00:55:15.440
And we all should just like you know, kind of um huddle together and like just like you know, uh push towards that mission because you know I think if we do it well, uh the world will change for better, and that's all uh all that matters at the end of the day.
00:55:15.760 --> 00:55:16.960
Yeah, no argument from me on that.
00:55:17.039 --> 00:55:21.280
And it's funny, uh earlier I said like we had democratize development, but not democratize security.
00:55:21.440 --> 00:55:32.559
But as we went through this conversation, you laid out several examples of how you guys are trying to do exactly that, which is really cool to hear from someone with you know that many users, a global uh uh consumer base of customers leveraging the platform.
00:55:32.800 --> 00:55:36.239
So it's awesome, and I look forward to keeping uh keeping track of what you all do and what you all build.
00:55:36.559 --> 00:55:41.360
Yeah, I hope to speak uh you know um about very different things, let's say in a year or something.
00:55:41.599 --> 00:55:42.239
Yeah, I'm sure that's a good idea.
00:55:42.559 --> 00:55:48.480
We have an opportunity to like you know look back and be like, oh, that was so naive, or oh, that was such a great insight, right?
00:55:48.800 --> 00:55:48.880
Yeah.
00:55:49.440 --> 00:55:55.039
The space is moving so fast, so I have no doubt a year from now the conversation will look a lot different in a lot of different ways for sure.
00:55:55.280 --> 00:55:55.360
Yeah.
00:55:58.960 --> 00:55:59.119
Yeah.
00:55:59.280 --> 00:56:00.000
Thanks for having me.
00:56:00.239 --> 00:56:00.639
Take care.
00:56:00.880 --> 00:56:01.519
Have a good one.