WEBVTT
00:00:03.359 --> 00:00:13.359
From our headquarters in Oslo, Norway, and on behalf of our host, Robby Peralta, welcome to the mnemonic security podcast.
00:00:15.199 --> 00:00:23.760
There are security leaders who manage incidents, and then there are security leaders who become the incident that everyone else studies.
00:00:23.760 --> 00:00:29.120
Today's guest started his career as a federal cybercrime prosecutor.
00:00:29.120 --> 00:00:34.880
He eventually moved on to important positions within eBay, PayPal, and Airbnb.
00:00:34.880 --> 00:00:47.039
He was the chief security officer for Facebook, advised the Obama White House on national security policy, and then he landed a job at Uber as the chief security officer.
00:00:47.039 --> 00:00:50.560
His time there has been highly publicized.
00:00:50.560 --> 00:00:54.799
I wouldn't do him justice by trying to sum it all up in a few lines.
00:00:54.799 --> 00:00:56.880
But the short version is this.
00:00:56.880 --> 00:01:02.799
Joe Sullivan became a case study that changed how security leaders think about personal risk.
00:01:02.799 --> 00:01:16.640
After Uber's 2016 breach, he found himself at the center of a legal battle that lasted years and became one of the first security executives to be criminally prosecuted over the handling of a cybersecurity incident.
00:01:16.640 --> 00:01:21.200
The case that sent a shockwave through the entire CISO community.
00:01:21.200 --> 00:01:24.879
I haven't asked him if he thinks the story had a happy ending.
00:01:24.879 --> 00:01:30.079
But the legal battle eventually concluded and a lot of lessons were learned.
00:01:30.079 --> 00:01:35.359
And one thing I can say is that he appears to be doing just fine.
00:01:35.359 --> 00:01:37.840
What a life so far.
00:01:37.840 --> 00:01:39.200
And you're not done yet.
00:01:39.519 --> 00:01:42.000
Nope, still working, still having fun.
00:01:42.319 --> 00:01:42.959
Still kicking.
00:01:42.959 --> 00:01:44.000
So what are you up to these days?
00:01:44.000 --> 00:01:45.280
What are you finding fun?
00:01:45.599 --> 00:01:48.319
Basically, I do like three or four jobs.
00:01:48.319 --> 00:01:52.159
So I am running the security consulting business, Joe Sullivan Security.
00:01:52.159 --> 00:01:54.000
And there's really three parts to that.
00:01:54.000 --> 00:01:57.200
Part one is I help companies build out their security.
00:01:57.200 --> 00:02:06.799
Being situated here in Silicon Valley, I often get approached by startups that, you know, they've hit product market fit, they've gotten a lot of funding, and they need to grow up fast.
00:02:06.799 --> 00:02:21.280
So over the last few years, uh, I have built out a team of like five of us who will go into a fast-growing startup and will literally interview and hire people for them, set up their security foundations, and sometimes set up their IT foundations as well.
00:02:21.280 --> 00:02:28.240
Examples would be companies that you know, maybe they're just like five people, but they get 100 million in funding.
00:02:28.240 --> 00:02:34.319
Why would a VC give them 100 million in funding to grow up and build a company and kind of define a category really fast?
00:02:34.319 --> 00:02:39.360
So they they turn to us and say, build us a security and IT department in six months.
00:02:39.360 --> 00:02:40.800
So do a lot of that.
00:02:40.800 --> 00:02:46.879
That's kind of fun because we get to experiment with different technologies, different tech stacks, different types of companies.
00:02:46.879 --> 00:02:57.280
We've been doing it for companies ranging from like AI companies to next gen electric car battery companies to VTOL taxis, uh, humanoid robot companies.
00:02:57.280 --> 00:02:59.919
We've been inside all kinds of different companies helping them.
00:02:59.919 --> 00:03:02.159
And the challenges are different at each one.
00:03:02.159 --> 00:03:03.919
So that's that's a lot of fun.
00:03:03.919 --> 00:03:09.439
Also, do some mentoring and working on security strategy for companies.
00:03:09.439 --> 00:03:14.479
So less hands-on with those, more kind of spending time with the CISO and the exec team.
00:03:14.479 --> 00:03:21.680
Sometimes the exec team reaches out to me and says, Hey, Joe, can can you tell us if our security team knows what they're doing?
00:03:21.680 --> 00:03:24.560
Uh it's like they speak two different languages.
00:03:24.560 --> 00:03:27.919
The security team talks a language, the CISO talks a language.
00:03:27.919 --> 00:03:30.560
It's very technical, it's very jargon heavy.
00:03:30.560 --> 00:03:36.400
And the board and the CEO in 2026, they they can't be hands-off anymore.
00:03:36.400 --> 00:03:39.439
They need to know that the security organization has its act together.
00:03:39.439 --> 00:03:40.560
There's too much risk.
00:03:40.560 --> 00:03:49.280
And then the third thing I do in the security consulting business is I I get asked to go speak at conferences and things and talk about themes.
00:03:49.280 --> 00:04:00.800
And I really enjoy that because uh most security people are embedded inside a single organization, whether in government or the private sector, and they're they're very limited in what they can say and be opinionated about.
00:04:00.800 --> 00:04:04.719
And I have the flexibility of being an independent voice.
00:04:04.719 --> 00:04:06.240
I can say whatever I want.
00:04:06.240 --> 00:04:08.159
And uh I'm enjoying that.
00:04:08.639 --> 00:04:08.879
Cool.
00:04:08.879 --> 00:04:12.159
Well, thank you so much again for being with us here today.
00:04:12.159 --> 00:04:13.840
You just mentioned humanoids.
00:04:13.840 --> 00:04:16.240
How do you think about security in humanoids?
00:04:16.720 --> 00:04:21.680
Yeah, so there are lots of different approaches to humanoids, uh robots happening right now.
00:04:21.680 --> 00:04:34.079
I've talked to and spent some time with some companies that are taking and kind of leveraging the physical robots that were built uh in China and kind of building their own software around and in them.
00:04:34.079 --> 00:04:42.160
And then I've worked with companies that uh like OneX that are just like doing the full stack from bottom to top on their own.
00:04:42.160 --> 00:04:47.279
And there are a ton of really interesting security issues when you start talking about humanoid robots.
00:04:47.279 --> 00:04:53.839
The closest analogy would be to some of the self-driving uh car situations we have on the road.
00:04:53.839 --> 00:04:56.879
Technically, those are robots on wheels.
00:04:56.879 --> 00:05:06.160
And if you step back and think about it from a technical standpoint, you have all the same issues, except that the humanoid robots are coming inside the house.
00:05:06.160 --> 00:05:13.199
So from a physical standpoint, they have to navigate kids and dogs and human beings and not breaking glassware.
00:05:13.199 --> 00:05:19.040
And the human household is is not designed for robots that are clumsy.
00:05:19.040 --> 00:05:20.879
But there's also all kinds of risk.
00:05:20.879 --> 00:05:26.480
You know, we think about them when we bring cameras into our house for security or something like that.
00:05:26.480 --> 00:05:40.399
When we bring uh these next gen toys that talk to our kids, AI tools, voice systems, like the privacy implications that putting this technology in our house raises so many different things.
00:05:40.399 --> 00:05:44.560
So when you think about like setting up security, it's it's complicated.
00:05:44.560 --> 00:05:47.680
Of course, you need that company to have all the security that any company has.
00:05:47.680 --> 00:05:54.480
So like the enterprise security, but product security, hiring for those companies, you need people who've worked on things in the physical world.
00:05:54.480 --> 00:05:58.399
They've people who've thought about how do I communicate with the robot?
00:05:58.399 --> 00:06:05.839
How like what if the robot's only on Wi-Fi and it goes to take out the trash and it loses its Wi-Fi connectivity standing out at the street corner?
00:06:05.839 --> 00:06:06.480
You know what I mean?
00:06:06.480 --> 00:06:08.480
Like there's so many things that can happen.
00:06:08.480 --> 00:06:11.199
Uh, how do we do software updates over the air?
00:06:11.199 --> 00:06:13.040
Do we allow software updates?
00:06:13.040 --> 00:06:17.839
What type of kind of VPN are we going to use for connecting and communicating with the robot?
00:06:17.839 --> 00:06:22.240
How do we do customer support for a robot inside someone's house?
00:06:22.240 --> 00:06:27.360
Do we allow uh humans to have uh visibility into what's happening with every robot?
00:06:27.360 --> 00:06:29.120
That's pretty crazy.
00:06:29.120 --> 00:06:31.680
You know, so there's there's just a million implications.
00:06:31.680 --> 00:06:33.040
That's what makes it fun.
00:06:33.680 --> 00:06:37.279
How far are we away from that reality, do you think?
00:06:37.920 --> 00:06:47.439
Oh, I think that there are multiple companies here in the Bay Area that have humanoid robots operating inside households in kind of like pilot programs and things like that.
00:06:48.079 --> 00:06:48.560
Wow.
00:06:48.560 --> 00:06:49.439
Awesome.
00:06:49.439 --> 00:06:51.360
What a what a world to live in.
00:06:51.360 --> 00:06:54.800
Uh wearables and note takers.
00:06:54.800 --> 00:06:56.959
You spoke about it at unprompted.
00:06:56.959 --> 00:07:01.279
Would you mind just summing up what you said at that talk and where you stand on that position?
00:07:01.279 --> 00:07:05.439
Because that's a very uh that's happening right now, whether we like it or not, right?
00:07:05.680 --> 00:07:06.000
Yeah.
00:07:06.319 --> 00:07:06.560
Yeah.
00:07:06.639 --> 00:07:09.600
Well, first of all, um the unprompted conference.
00:07:09.600 --> 00:07:18.079
If anybody hasn't heard of it, who's interested in AI security, all the videos from the conference are live, and there were so many better talks than my talk.
00:07:18.079 --> 00:07:19.839
It was just like so much energy.
00:07:19.839 --> 00:07:30.879
So it was in the context of that that um Gotti, who was running the whole conference, he's like, he and I had written an article a year before on AI note takers.
00:07:30.879 --> 00:07:32.160
We published it.
00:07:32.160 --> 00:07:39.360
And, you know, it was kind of like a first look at all these AI note takers are exploding across all of our meetings.
00:07:39.360 --> 00:07:50.720
You could barely ever join a conference call without somebody's AI note taker jumping in and being part of the attendee list and you know, and and dealing with that and wondering about it.
00:07:50.720 --> 00:07:58.160
I realized this is the first place where AI is actually injecting itself into our daily workflows.
00:07:58.160 --> 00:08:03.680
And it seems like the security team isn't doing anything to put controls in place.
00:08:03.680 --> 00:08:08.240
And and so Gotti and I stepped back and thought about it like, what are the risks?
00:08:08.240 --> 00:08:10.079
And it turns out it's really interesting.
00:08:10.079 --> 00:08:13.920
You know, there are a whole bunch of risks around AI note takers.
00:08:13.920 --> 00:08:18.800
Uh, you know, it's number one it's recording everything.
00:08:18.800 --> 00:08:20.480
And I live in California.
00:08:20.480 --> 00:08:24.560
Do you know if in order for me to record you, I need your consent up front.
00:08:24.560 --> 00:08:28.480
So it's like a legal issue there that like half the country has to deal with.
00:08:28.480 --> 00:08:30.800
Uh, and like, how are you being transparent about that?
00:08:30.800 --> 00:08:35.759
And then it it becomes corporate data, you know, it's like it's and it's sensitive data.
00:08:35.759 --> 00:08:37.039
Where is it being stored?
00:08:37.039 --> 00:08:38.000
Who has access to it?
00:08:38.000 --> 00:08:40.000
Who's doing the rule-based access control?
00:08:40.000 --> 00:08:42.799
And then you start thinking about the security implications.
00:08:42.799 --> 00:08:48.480
Okay, it turns out, and there are actually studies on this, that AI note-takers can be gamed.
00:08:48.480 --> 00:08:59.360
You can prompt inject them, you can manipulate the uh, you know, steer the algorithm so that it thinks that whatever you say is the most important thing from the meeting.
00:08:59.360 --> 00:09:00.399
So the takeaways.
00:09:00.399 --> 00:09:12.159
And so I started digging in, and Guy and I just realized like this this is such a simple, annoying little thing that showed up in our life, but nobody's actually doing the homework around it.
00:09:12.159 --> 00:09:18.080
And like security teams have had like in 2024 and 25 were a little like hands-off around AI.
00:09:18.080 --> 00:09:26.320
And it was like, wait a minute, here's a really easy way for you to kind of get your hands dirty, like dealing with AI from a policy and risk standpoint.
00:09:26.320 --> 00:09:27.759
So we wrote that article.
00:09:27.759 --> 00:09:35.279
I prepared the talk thinking this is just like some little meetup of all of you know a bunch of our friends and to talk about AI.
00:09:35.279 --> 00:09:40.159
I didn't realize it was going to be like the most paid attention to conference of 2026.
00:09:40.159 --> 00:09:47.679
And so I I roll in and I'm doing this little talk on AI note takers that that, you know, and I'm surrounded by these amazing talks.
00:09:47.679 --> 00:09:50.000
And I was like, I should have put more effort into this.
00:09:50.000 --> 00:09:57.759
But actually, I got a lot of positive feedback afterwards that like I've had so many people message me, like, oh, I totally gamed the note-taker at that meeting.
00:09:57.759 --> 00:09:59.519
I was the first person in that meeting.
00:09:59.519 --> 00:10:00.639
No one else was there.
00:10:00.639 --> 00:10:06.159
I told it like five minutes of my thoughts before anybody else showed up, and all my stuff got captured.
00:10:06.159 --> 00:10:13.039
Or I figured out how to uh make it so that the note taker didn't take any notes because I wanted to frustrate everybody.
00:10:13.039 --> 00:10:17.440
Like it, I inspired a bunch of people to do a bunch of annoying things, apparently.
00:10:18.000 --> 00:10:21.679
Have you talked to any of CISOs that actually put any guardrails in place for that?
00:10:22.080 --> 00:10:22.960
Yeah, quite a bit.
00:10:22.960 --> 00:10:25.600
And I'm seeing it more and more in different contexts.
00:10:25.600 --> 00:10:44.799
Like organizations are becoming much more thoughtful and disciplined about like selecting an AI note taker that's going to be their official note taker, prohibiting all the other ones, developing policies for how are you going to deal with when the other company has a note taker, get making sure you request a copy of everything, set it up in such a way that you automatically get those copies.
00:10:44.799 --> 00:10:51.679
So you keep your own independent version of it, giving the teams guidelines on which types of meetings are okay for note takers and not.
00:10:51.679 --> 00:11:01.360
You know, like I work at a VC part-time, helping them on investing, and they have very clear policies around what you can and cannot use note takers for.
00:11:01.360 --> 00:11:07.519
Yeah, they don't run note takers during board meetings, they don't run note takers during situations where there's attorney-client privilege.
00:11:07.519 --> 00:11:17.279
You know, they they have to be thoughtful about this stuff because we're discovering that like attorney-client privilege gets blown up when AI gets involved sometimes.
00:11:17.279 --> 00:11:22.000
And, you know, the the law in court cases is evolving very quickly there.
00:11:22.000 --> 00:11:40.720
So um not an expert on that side, but it's another example of a situation where we need to when we work on our policies for security, we need to loop in legal and have them part of the process because they're not paying attention to all these AI note takers and the risks that happen with them unless we pull them into the conversation.
00:11:40.720 --> 00:11:48.799
So I I think that we're uh we're getting much more uh official and thoughtful about the use of these note takers.
00:11:48.799 --> 00:12:10.720
Come companies that are in the defense defense tech space that have to comply with CMMC and some of these other really strict government standards have to have even more careful policies around what is and what isn't recorded, how and whether they have to segregate their recordings for you know for the different environments and keep them in separate places and have role-based access control.
00:12:10.720 --> 00:12:16.159
Like there's a lot going on, I think, as as companies have gotten more mature about this stuff.
00:12:17.200 --> 00:12:22.960
I've been in meetings where right when you see it's being recorded, you get kind of scared, but then you also kind of become more professional, at least me.
00:12:22.960 --> 00:12:25.039
That's just like, okay, I'm being recorded.
00:12:25.039 --> 00:12:28.960
Uh what is the worst that can happen, just so that that point is covered.
00:12:29.519 --> 00:12:42.240
I always remember the Sony case from like 12 or 13 years ago when North Korea hit uh Sony in response to them putting out that movie that was uh viewed as derogatory towards their leader.
00:12:42.240 --> 00:12:44.320
Two things happened there, right?
00:12:44.320 --> 00:12:51.600
It was a destructive malware situation where they wiped out a bunch of their systems, but they also dumped all of their email publicly.
00:12:51.600 --> 00:12:58.960
And I remember talking to executives at the time from different companies and talking about like what was the most shocking thing about that to you?
00:12:58.960 --> 00:13:01.360
To me, it was very clearly the destructive attack.
00:13:01.360 --> 00:13:03.919
You know, we weren't in the world of ransomware that we're in right now.
00:13:03.919 --> 00:13:12.399
There had only been a few destructive attacks in history, you know, Saraudi Ramco and uh Las Vegas Sands and maybe the Maersk stuff.
00:13:12.399 --> 00:13:18.240
Like there just wasn't a lot of intentional destruction situations in cybersecurity.
00:13:18.240 --> 00:13:23.440
And and so to me, the Sony case stood for, wow, this is a scary new world.
00:13:23.440 --> 00:13:28.960
I need to be responsible for operational resilience and and really make sure that we we have this together.
00:13:28.960 --> 00:13:42.000
But then I would I talked to a bunch of other executives, like COOs, and I think I even talked to the woman who was the president of Sony who said who she lost her job over the pub public exposure of her emails.
00:13:42.000 --> 00:13:49.600
We say things in meetings, we say things in email that that uh are embarrassing and that we wish never would be seen.
00:13:49.600 --> 00:13:57.360
And so I think, you know, to a lot of executives, that's the scariest thing about these note-taking recordings.
00:13:57.360 --> 00:14:00.480
Uh it's the New York Times test.
00:14:00.480 --> 00:14:06.720
Would you feel comfortable if everything that was in said in all your meetings was put on the front cover of the New York Times?
00:14:06.720 --> 00:14:16.960
And a lot of companies have a lot of notes that have been recorded now that are subject to exposure and litigation and other things, or they could just be leaked or hacked.
00:14:16.960 --> 00:14:24.480
You know, if granola gets hacked, there's gonna be a lot of embarrassed executives in Silicon Valley because they all are using granola to record everything.
00:14:24.480 --> 00:14:28.080
You know, I was experimenting with the limitless uh app.
00:14:28.080 --> 00:14:28.879
I mentioned it.
00:14:28.879 --> 00:14:33.120
Uh I was wearing it on me, even though I didn't have it turned on when I gave that talk.
00:14:33.120 --> 00:14:41.200
Uh I also, you know, I have a plod now, which is a different wearable, because I'm always experimenting with and learning about these things.
00:14:41.200 --> 00:14:44.240
And and everything that they record can be exposed.
00:14:44.240 --> 00:14:45.919
And so there's a lot of risk in that.
00:14:45.919 --> 00:14:50.159
It might be might trigger reporting obligations because it's PII.
00:14:50.159 --> 00:14:55.519
It might trigger reporting obligations because you have contracts with your customers.
00:14:55.519 --> 00:14:58.080
And it it it might just be really embarrassing.
00:14:58.080 --> 00:15:06.639
So there's lots of different risks with this uh anytime we get into a new type of content being stored in our enterprise servers.
00:15:08.159 --> 00:15:10.559
I feel like note takers, that's a very business context.
00:15:10.559 --> 00:15:14.799
And then you have the wearable side, which is, I guess, your whole entire life.
00:15:14.799 --> 00:15:19.919
What is your how do you look at the security or the insecurity around that?
00:15:20.799 --> 00:15:28.720
Well, I think that um we're moving in this direction of being monitored all the time.
00:15:28.720 --> 00:15:35.759
And it's really, I think, uncomfortable to a lot of us who grew up in a privacy first era.
00:15:35.759 --> 00:15:40.559
The idea that um something is gonna be recording everything we do at work.
00:15:40.559 --> 00:15:46.000
Like if you if you look closely, that's the direction the AI first companies are going.
00:15:46.000 --> 00:15:59.759
Like I talk to CEOs who say, I want real-time monitoring of everything that's happening on every machine at my company and every meeting at my company, because we as humans lose a lot of that history and context.
00:15:59.759 --> 00:16:02.000
We talk about stuff and then we forget about it.
00:16:02.000 --> 00:16:08.879
And if I have AI recording everything, then we will get the power and benefit of that.
00:16:08.879 --> 00:16:18.240
You know, I like the call I had before this, I was talking with the head of application security, a company, and we're talking about the implications of AI on how AppSec is changing.
00:16:18.240 --> 00:16:32.799
And one of the things we were talking about is how PRDs uh documentation that we create before we write code, you can't train the AI on it because what we actually built with code for the last 20 years isn't reflected in the PRD or the Jira ticket.
00:16:32.799 --> 00:16:35.519
You know, that's aspirational, and then we go build.
00:16:35.519 --> 00:16:42.559
And so uh we can't actually learn that much from like our history of documentation.
00:16:42.559 --> 00:16:52.799
And so the AI first folks are saying, well, we should be recording everything in real time so we know what actually happened, and then we will be much more effective.
00:16:52.799 --> 00:16:58.480
And you see these stories of companies, you know, like Meta has been in the news for the last couple of weeks.
00:16:58.480 --> 00:17:10.000
This story keeps coming up about how the company asked employees to allow them to be monitored 24, you know, their entire time on the machine so that we can train AI based on its learnings from them.
00:17:10.000 --> 00:17:13.680
And I've heard variations of that from lots of different companies.
00:17:13.680 --> 00:17:23.359
But um, you know, we're moving towards computer vision models that are running, uh, capturing everything that happens on my screen all the time, not just the words being recorded.
00:17:23.359 --> 00:17:24.960
So that's their direction we're going.
00:17:24.960 --> 00:17:33.039
So I I think we're also coming at it at the same time from a consumer standpoint where multiple companies are putting out these glasses.
00:17:33.039 --> 00:17:40.799
Obviously, you know, the Meta Ray Band glasses and the Oakley's, you know, Snap has their spectacles, and there are a bunch of other ones that are coming out.
00:17:40.799 --> 00:17:45.680
We've heard that uh Apple wants to have cameras on the AirPods.
00:17:45.680 --> 00:17:56.559
Like there's lots of different wearable things happening coming at us from different directions with the idea that AI needs to consume all of this.
00:17:56.559 --> 00:18:01.119
And then remember, we started this conversation talking about robots.
00:18:01.119 --> 00:18:07.519
Uh humanoid robots, they need to function in the physical 3D world.
00:18:07.519 --> 00:18:12.319
Something I've been thinking about a lot is how every data center is full of 2D data.
00:18:12.319 --> 00:18:17.279
You know, most of the stuff that's been stored in data centers for the last couple of decades is about code.
00:18:17.279 --> 00:18:21.920
It's about words, it's about videos, it's about things we watch on a screen.
00:18:21.920 --> 00:18:30.079
Um, there's not a lot of data in data centers about how a waiter moves through a restaurant or how a waitress brings coffee to a table.
00:18:30.079 --> 00:18:37.519
But if we want to bring humanoid robots into restaurants, we need to actually map out all of that stuff and create the training data.
00:18:37.519 --> 00:18:40.079
There's only so far you can get with synthetic data.
00:18:40.079 --> 00:18:49.039
And so we're gonna see, you know, at restaurants, they're gonna start wearing wearable glasses to record more of what's happening.
00:18:49.039 --> 00:18:51.519
And so every time you sit in a restaurant, you're gonna be recorded.
00:18:51.519 --> 00:18:52.720
How are you gonna feel about that?
00:18:52.720 --> 00:18:59.519
You know, in the same way as we go through airports, we're recorded constantly now, or certain cities are we recorded all the time.
00:18:59.519 --> 00:19:03.680
Like the amount that we're recorded uh is gonna go up and up and up.
00:19:03.680 --> 00:19:18.240
And, you know, I was reading an article last night about Flock, which is capturing data on vehicle traffic and its impact on reducing crime, is like the statistics are overwhelmingly positive when you roll it out, how much uh crime goes down.
00:19:18.240 --> 00:19:27.039
But on the flip side, uh the communities are backlashing against products like that right now because it feels like we're moving more into surveillance state.
00:19:27.039 --> 00:19:39.519
I think meeting note takers are just like scratching the surface of this new world that we're heading into, where society hasn't really put down its foot and said, like, here's the line.
00:19:39.519 --> 00:19:53.119
And in fact, as someone who spent a lot of time traveling around the planet and being in different countries, like we all philosophically, on a country by country basis, have very different perspectives on government uh visibility into our private lives.
00:19:53.119 --> 00:20:03.119
In the United States, I think we we are absurdly comfortable with letting corporations take access to a lot of our personal data, and we are very uncomfortable with our government.
00:20:03.119 --> 00:20:14.000
Whereas I found like it's a gross generalization, but I found the opposite to be true in Europe, where we're much more comfortable with government access to our data and very uncomfortable with corporate access to our data.
00:20:14.000 --> 00:20:17.519
And it's a sliding scale in every country where it's slightly different.
00:20:17.519 --> 00:20:28.000
But AI is going to force us to have a bigger conversation about this more consistently because the ground's shifting beneath our feet right now really quickly.
00:20:28.400 --> 00:20:29.920
Is anybody having those conversations?
00:20:29.920 --> 00:20:32.319
This is the first conversation I'm having about it.
00:20:33.279 --> 00:20:44.240
Well, I I I I go back to, you know, when I wrote uh Gaudi and I wrote the original article, we were thinking about it in this very micro context of like all of our meetings are suddenly becoming recorded.
00:20:44.240 --> 00:20:52.880
And as you said, it's the first few times you roll into a meeting and you pop open the uh the video recording conf stuff and you realize you're being recorded.
00:20:52.880 --> 00:20:58.240
For like a second there, you're like, uh Should I say something?
00:20:58.240 --> 00:20:59.440
Should I say something?
00:20:59.440 --> 00:21:00.400
Should I block it?
00:21:00.400 --> 00:21:01.519
Should I be opposed to it?
00:21:01.519 --> 00:21:03.200
What's the what how should I feel about this?
00:21:03.200 --> 00:21:05.920
And then five minutes later you forget and you're just doing your meeting, right?
00:21:05.920 --> 00:21:08.799
And then you get the meeting notes and you're like, oh, this was useful.
00:21:08.799 --> 00:21:17.119
Oh, and then you're like, oh, I'm glad that it didn't capture those for that five-minute chat at the beginning where we were talking about my weekend and how hungover I was, or whatever it was.
00:21:17.119 --> 00:21:17.920
You know what I mean?
00:21:17.920 --> 00:21:26.799
Like, there's a lot of us just kind of like flipping through it really fast and accepting the new normal because it's incremental.
00:21:26.799 --> 00:21:34.880
And it's but it's gonna keep being incremental until it's massive in in terms of the amount of change that's happened.
00:21:34.880 --> 00:21:43.519
In the corporate context, it's easy for the CEO and everyone to see like this is like increasing our productivity and our throughput as an organization.
00:21:43.519 --> 00:21:44.480
We got to do this.
00:21:44.480 --> 00:21:48.640
If we don't if if our competitors are doing it and we're not, then we're gonna lose.
00:21:48.640 --> 00:21:53.359
And so, like everything tilts towards adoption of these things.
00:21:53.359 --> 00:21:59.680
Uh and um, you know, in the personal wearables, I think we're a little bit behind the you.
00:21:59.680 --> 00:22:09.440
You know, the effective corporate wearables, if we call these meeting note takers wearables to a certain extent, we got a ways to go on the on the non-business side.
00:22:09.440 --> 00:22:12.079
But lots of people are embracing and using these technologies.
00:22:12.079 --> 00:22:18.480
And you know, a lot of these cars that are around us, think about how many cameras are on a Tesla that are recording us all the time.
00:22:18.480 --> 00:22:28.240
How frequently does Tesla get subpoenaed by law enforcement for a crime that happened within a a a distance of a Tesla, even though the Tesla had nothing to do with the crime.
00:22:28.240 --> 00:22:33.519
Uh, you know, storekeepers with their cameras are getting subpoenaed all the time.
00:22:33.519 --> 00:22:37.359
Like a lot of of our life around us is being recorded already.
00:22:37.359 --> 00:22:45.279
You know, the ring doorbells, the nest doorbells, lots of data is starting to accumulate around us.
00:22:45.279 --> 00:22:47.440
Uh, and it's it's not slowing down.
00:22:47.440 --> 00:22:48.880
So it's kind of scary.
00:22:48.880 --> 00:22:51.920
And it and it just means that we have to be intentional about it.
00:22:51.920 --> 00:22:54.160
And that's what was the the core point.
00:22:54.160 --> 00:22:58.319
Like, we didn't set out to write like the uniform policy for all companies.
00:22:58.319 --> 00:23:01.440
What we were trying to do is just get everybody to pay attention to what's happening.
00:23:01.440 --> 00:23:04.240
And that was the point of the talk, too.
00:23:04.240 --> 00:23:20.799
Uh, you know, when I did the talk at unprompted, I probably spent like a third of the talk at the beginning and end just trying to like zoom out and say, like, no-takers is is our first opportunity to exercise our brain around risk and and and culture.
00:23:20.799 --> 00:23:25.680
But like, this is a much bigger conversation that we need to be having over the next couple of years.
00:23:26.880 --> 00:23:29.279
AI kind of got dumped on security, I feel like.
00:23:29.279 --> 00:23:29.920
I'm not sure.
00:23:29.920 --> 00:23:31.359
Would you would you agree on that?
00:23:31.359 --> 00:23:40.480
That AI sort of has fallen in the hands or the responsibility of security leaders, or how's that look for you?
00:23:40.960 --> 00:23:46.160
Yeah, I would say two years ago, CISOs were in the AI is not my problem.
00:23:46.160 --> 00:23:51.359
Uh, and that it's done a it's been a 180 degree swing in 2026.
00:23:51.359 --> 00:23:53.279
And it was fairly predictable.
00:23:53.279 --> 00:23:58.400
I was telling everybody this that, you know, security leaders should be owning AI risk.
00:23:58.400 --> 00:24:01.359
Uh, like look at it from a CEO standpoint.
00:24:01.359 --> 00:24:07.440
Yeah, if I'm a CEO of a company, I need somebody who's driving innovation, so I've got a CTO and a CIO.
00:24:07.440 --> 00:24:14.160
I've I need somebody who's driving revenue, so I've got my business leaders, my chief revenue officer, my salespeople.
00:24:14.160 --> 00:24:18.319
I need people who are like keeping track of what's working and not.
00:24:18.319 --> 00:24:21.279
And that's HR and finance and legal.
00:24:21.279 --> 00:24:26.559
Uh, you know, and legal and finance also are responsible for managing sites of risk.
00:24:26.559 --> 00:24:32.160
But like the typical business in 2026 has a lot more technical risk than ever before.
00:24:32.160 --> 00:24:36.960
Like one of the biggest risks for companies is uh a ransomware takedown.
00:24:36.960 --> 00:24:42.160
Look what happened to Jaguar Land Rover last year, Marks and Spencer or Kupang.
00:24:42.160 --> 00:24:57.440
There's so many of these companies that have been hit by ransomware, and the operational impact is that their factories shut down, their supply chain uh went out of business, uh, their customers were left unable to get their cars repaired or even buy a car.
00:24:57.440 --> 00:25:02.079
And so security has become much more important, cybersecurity.
00:25:02.079 --> 00:25:05.200
And then you look at all this AI transformation stuff.
00:25:05.200 --> 00:25:10.160
The CEO doesn't want to hire another technical risk leader to manage AI risk.
00:25:10.160 --> 00:25:12.640
So they're turning to the CISO because that's been their job.
00:25:12.640 --> 00:25:16.000
Your job is to make sure that all the technology doesn't destroy us.
00:25:16.000 --> 00:25:23.839
Like it's it shouldn't be like, I need to hire someone who makes sure that the AI technology doesn't destroy us is different from cybersecurity.
00:25:23.839 --> 00:25:27.680
It's not that different in the in the eyes of the board and the CEO.
00:25:27.680 --> 00:25:29.359
It's a form of technical risk.
00:25:29.359 --> 00:25:32.240
I want one person, one neck to choke.
00:25:32.240 --> 00:25:34.640
And so that's become the security leader.
00:25:34.640 --> 00:25:51.440
The interesting twist, I think, that we didn't anticipate as much is that CEOs are also turning to the CISOs and the security leaders to help drive the innovative change in AI, because a lot more security leaders also own IT than did a decade ago.
00:25:51.440 --> 00:26:04.799
That is 100% a trend that we see in Silicon Valley is that young companies, like when I go in and build help build security, I'm typically building IT as well, and it's all sitting under a technical security person.
00:26:04.799 --> 00:26:12.960
Many of the IT leaders and modern companies grew up in security rather than IT and have responsible responsibility for both now.
00:26:12.960 --> 00:26:24.160
Uh traditional larger companies still have that CIO, but they've been getting squeezed uh and their roles have gotten narrower with, you know, the SaaS and cloud infrastructure.
00:26:24.160 --> 00:26:29.119
So those um CIOs have smaller organizations and less budget for innovation.
00:26:29.119 --> 00:26:39.759
Uh and yet in 2026, the biggest pressure on every company is to integrate AI and evolve how your workforce uses technology to be, you know, effective.
00:26:39.759 --> 00:26:43.839
So a lot happening right now and a lot of pressure on CISOs.
00:26:44.400 --> 00:26:47.039
You make me realize come to a lot of realizations today.
00:26:47.039 --> 00:26:50.480
We've always been, I mean, I've only been security for like 10 years.
00:26:50.480 --> 00:26:53.759
But when I started in security, it was like, yeah, nobody listens to us.
00:26:53.759 --> 00:26:56.160
We deserve more power or more influence.
00:26:56.160 --> 00:27:02.880
And boom, I did I just realized now one of my clients, the, you know, my the CISO now became the CTO.
00:27:02.880 --> 00:27:23.839
Uh I guess my question to you now is having been through what you've been through, how do you, for those that aren't comfortable with taking that responsibility and that risk, like how should a CISO handle their new job responsibility that they weren't that they aren't aware that they have or haven't been given or paid for?
00:27:24.799 --> 00:27:30.160
Yeah, I I think that uh it's a huge opportunity and we have to rise up to it.
00:27:30.160 --> 00:27:43.119
This is uh you're right, it's what we've always been asking for is to get a seat at the table and to be able to have influence in the direction that the whole organization goes.
00:27:43.119 --> 00:27:45.440
So this is our this is our chance.
00:27:45.440 --> 00:27:46.799
We have to step up.
00:27:46.799 --> 00:27:49.839
And if we do, the rewards are will be there.
00:27:49.839 --> 00:27:52.720
If we don't, someone else is gonna step up.
00:27:52.720 --> 00:28:00.960
Uh it's just a it companies need people, governments need people who are gonna step up and and and take responsibility in the space.
00:28:00.960 --> 00:28:08.000
And if the if our best people don't do it, then blessed good people are gonna do do it, and that's not gonna be good for anybody.
00:28:08.000 --> 00:28:12.400
Because, you know, there's always somebody who's willing to take the role, even if they're not qualified.
00:28:12.400 --> 00:28:22.640
And I'd rather have the people who have the experience uh and the judgment uh have the confidence to take the role and and believe in themselves.
00:28:23.440 --> 00:28:28.000
What are you talking to CISOs all the time in your in your through a company?
00:28:28.000 --> 00:28:29.279
What are they asking me of you?
00:28:29.279 --> 00:28:32.480
Is it more personal or more technical, the the questions you're being asked?
00:28:33.279 --> 00:28:34.240
It's both.
00:28:34.240 --> 00:28:42.319
Um it's both, you know, when I first started, we would I would get together with other CISOs and they'd be like, I don't get to present to the board.
00:28:42.319 --> 00:28:43.920
I never even talk to my CFO.
00:28:43.920 --> 00:28:50.799
I I'm buried under the CIO, and I just get a budget that's not good enough, and nobody asks me my opinion.
00:28:50.799 --> 00:28:52.720
Like that world's long gone.
00:28:52.720 --> 00:29:00.799
Now you see um the Treasury Department called the CEOs of all the biggest banks to Washington, D.C.
00:29:00.799 --> 00:29:02.720
two or three weeks ago.
00:29:02.720 --> 00:29:05.599
And why were they called to DC?
00:29:05.599 --> 00:29:08.000
To talk about cybersecurity.
00:29:08.000 --> 00:29:14.400
If you're the CEO of a bank, are you gonna show up and say, I don't even know who my CISO is.
00:29:14.400 --> 00:29:15.279
I've never met them.
00:29:15.279 --> 00:29:22.480
You're gonna show up and you will have you're gonna have your CISO on speed dial because you're you need to be fully briefed for that meeting.
00:29:22.480 --> 00:29:33.759
You need to come across as having your act together and that this so, like, uh it's funny, a couple of years ago I wrote uh an article kind of like as a retrospective on my case.
00:29:33.759 --> 00:29:35.759
I said the CEO is next.
00:29:35.759 --> 00:29:41.440
Because I was talking about how regulatory scrutiny is moving from the CISO to the CEO and the board.
00:29:41.440 --> 00:29:44.559
It's happened.
00:29:44.559 --> 00:29:51.599
CEOs are the one, you know, when when United Healthcare had their situation, it was the CEO who got yelled at before Congress, not the CISO.
00:29:51.599 --> 00:29:58.079
Uh when Treasury called the the large banks, they didn't ask for the CISOs, they asked for the CEOs.
00:29:58.079 --> 00:30:13.039
The expectation is that the CEO has a trusted conciliary for security, that they are working closely with them, making sure that they're supported and resourced, and the CEO is calibrating risk against all the other risks to the company.
00:30:13.039 --> 00:30:16.480
So it's a it's just a fundamentally different world in 2026.
00:30:16.480 --> 00:30:21.599
And it's uh and I think it's a great time to be in security because of that.
00:30:22.480 --> 00:30:29.359
I know a guy who has uh contributed to that new world we live in where the CISOs aren't getting yelled at anymore, it's a CEO.
00:30:29.359 --> 00:30:31.519
Uh I'm looking at him right now.
00:30:31.519 --> 00:30:34.480
So thank you for taking that one on the chin for all the CISOs out there.
00:30:34.480 --> 00:30:36.559
Uh one last question for you.
00:30:36.559 --> 00:30:46.240
Since I and you're a part of all these really cool startups that are revolutionalizing a part of the security stack using new AI technologies.
00:30:46.240 --> 00:30:53.039
Is there any area of the portfolio that you think AI is especially outperforming that anybody listening should go take a look at?
00:30:53.039 --> 00:30:56.319
I know that you're working with like AppSec and a bunch of different areas.
00:30:56.720 --> 00:30:57.359
Yeah.
00:30:57.359 --> 00:31:07.440
I it's one of the questions I uh ask every security leader when I'm working with them is are you f are you changing who you're hiring uh in 2026?
00:31:07.440 --> 00:31:13.119
Have you changed the job descriptions for your roles in 2026 because of AI?
00:31:13.119 --> 00:31:24.160
And in 2025, the answer was mostly no, I'm still hiring, you know, I'm I'm hiring detection engineers, I'm hiring AppSec engineers, I'm hiring compliance people.
00:31:24.160 --> 00:31:26.400
In 2026, the answer is changing.
00:31:26.400 --> 00:31:30.880
I'm hiring I'm hiring people who are really good using AI.
00:31:30.880 --> 00:31:34.160
I'm rethinking we're everyone's a builder now.
00:31:34.160 --> 00:31:36.079
I heard that on my last meeting.
00:31:36.079 --> 00:31:38.960
Everyone, you know, that was a security leader.
00:31:38.960 --> 00:31:41.119
So everyone is a builder now.
00:31:41.119 --> 00:31:44.880
Uh because and AppSec is a really great example.
00:31:44.880 --> 00:31:57.200
Like if we step back and and if I said to you or you said to me, what job has fundamentally changed more because of AI than any other job, I would say software engineer.
00:31:57.200 --> 00:32:06.720
Like so far, software engineer's job in 2026 is is more different than it was in 2023 than any other job because of AI, right?
00:32:06.720 --> 00:32:20.400
A lot of jobs like we're 20% better, we're using these like very cut still kind of primitive AI tools, we're we're experimenting with agentic solutions, but coding is so far ahead.
00:32:20.400 --> 00:32:25.440
Like the software engineer role at most companies has changed a lot.
00:32:25.440 --> 00:32:30.880
And so if you're the security team that's doing application security, what have you seen in 2026?
00:32:30.880 --> 00:32:44.960
You've seen that the volume of code that engineering is cranking out has gone up by like it hasn't doubled, it hasn't tripled, it's gone from like 250,000 lines of code to 2.5 million lines of code in a month.
00:32:44.960 --> 00:32:49.039
That's that's how significant the the volume change has been.
00:32:49.039 --> 00:32:54.960
And it's not like engineering has hired 10 times more people, they're just like cranking out 10 times more code.
00:32:54.960 --> 00:32:57.759
So how does the security team deal with that?
00:32:57.759 --> 00:33:12.319
The old kind of like, all right, we're gonna do our scanners, we're gonna do some manual code review, we're gonna like try and do some threat modeling, we're gonna hire some pen testers and we'll rely on bug bounty to find the rest.
00:33:12.319 --> 00:33:18.160
Like every every part of that is being stressed and reimagined right now.
00:33:18.160 --> 00:33:33.839
And like I'm on the board of an app sec company, and it feels like uh what customers want from an app security tool is uncertain in 2026.
00:33:33.839 --> 00:33:35.920
Like everything's evolving there.
00:33:35.920 --> 00:33:41.359
Uh what are the frontier model companies that are building these AI coding solutions?
00:33:41.359 --> 00:33:45.680
What are they gonna kind of like suck into their uh kind of solution?
00:33:45.680 --> 00:33:50.319
What's gonna be left for AppSec companies and AppSec teams to do?
00:33:50.319 --> 00:33:52.000
It's not it's not clear yet.
00:33:52.000 --> 00:33:58.240
Whereas the coding tools have gotten really good at coding, they haven't gotten really good at vulnerability remediation yet.
00:33:58.240 --> 00:34:05.440
And in fact, we're finding more vulnerabilities than ever, but the we're not getting any more efficient at fixing them yet.
00:34:05.440 --> 00:34:18.000
And so every security team is like throwing a lot, like pulling a lot of resources off of other things and putting them in vulnerabil vulnerable remediation in 2026, but it's still too manual.
00:34:18.000 --> 00:34:26.320
Uh and it's still on unclear like what you should what stack you should have for your app sec team in 2027.
00:34:27.360 --> 00:34:29.519
Have you met anybody that's done anything novel there?
00:34:29.840 --> 00:34:30.079
Yeah.
00:34:30.079 --> 00:34:38.639
I most of the companies that are doing it well are investing in building kind of harnesses, I think is the terminology everyone's using right now.
00:34:38.639 --> 00:34:47.519
But think of it as basically the the structure around the model to make the model effective in your environment.
00:34:47.519 --> 00:34:49.679
Uh that's part one.
00:34:49.679 --> 00:34:54.079
Part two is building out kind of like some sense of internal context.
00:34:54.079 --> 00:35:02.159
Like looking at code in the abstract after it's written, you're not going to identify all the most important vulnerabilities.
00:35:02.159 --> 00:35:07.840
It's only in the context of like the infrastructure and the environment that you really come to understand.
00:35:07.840 --> 00:35:10.719
Like it's one thing to identify there's a vulnerability.
00:35:10.719 --> 00:35:14.320
It's another thing to understand where where the fix should be applied.
00:35:14.320 --> 00:35:20.960
Should it be applied right down, you know, right there in the code right there, or is this something that should be fixed as a systemic level?
00:35:20.960 --> 00:35:31.440
That's where the app sec engineers, you know, with experience are adding a lot of value and that we're gonna have to continue to see that like people aren't stopping hiring app sec engineers.
00:35:31.440 --> 00:35:32.000
It's the opposite.
00:35:32.000 --> 00:35:39.920
AppSec engineering roles are uh becoming even harder to fill, and the people who are good at that are getting paid more than ever.
00:35:39.920 --> 00:35:44.000
So there are definite things that organizations can do.
00:35:44.000 --> 00:35:52.400
Like that, you know, Cloudflare came out with a blog post earlier this week that a lot of people thought was interesting because it talked about essentially how they built the harness for Mitos.
00:35:52.400 --> 00:35:57.920
Uh that's exactly the type of thing that lots of companies should have been doing and should be doing.
00:35:57.920 --> 00:36:04.000
And I I saw somebody else just took Cloudflare's blog post and threw it in Claude and said, build me what Cloudflare has.
00:36:04.000 --> 00:36:15.360
I don't know that you're gonna get there with with that, but uh you that's the direction that people should be thinking, you know, instead of just waiting for for someone else to solve the problem for them.
00:36:16.800 --> 00:36:21.920
Do you have any other closing thoughts that you'd like to leave whoever's listening to this with?
00:36:22.800 --> 00:36:23.199
Yeah.
00:36:23.199 --> 00:36:29.039
I I I think if you you could take this conversation and you could be like, wow, this is a scary place.
00:36:29.039 --> 00:36:37.280
2026, AI is disrupting everything that's happening in in the business world, and you could be like discouraged by that.
00:36:37.280 --> 00:36:42.079
Or you could listen to the conversation and then think, wow, this is a great opportunity.
00:36:42.079 --> 00:36:48.159
You know, AI uh is is opening up opportunities for a lot of us to do things that we haven't done before.
00:36:48.159 --> 00:36:52.559
Like, like that person said to me this morning, um, my whole team is builders now.
00:36:52.559 --> 00:36:57.840
Security people didn't get to think of themselves as builders before, but being a builder is is is fun.
00:36:57.840 --> 00:36:58.960
It's exciting.
00:36:58.960 --> 00:37:08.480
Uh, you know, oftentimes the security team is culturally not aligned with the rest of the company because the rest of the company is building something and the rest of the company gets excited when they ship a product.
00:37:08.480 --> 00:37:14.800
Security team feels like unrecognized, uh, disconnected from like the business success.
00:37:14.800 --> 00:37:33.599
Uh, this is our chance to be part of the team that's building for the company uh and to reframe where we sit uh in in a way that's positive and that will get us more resources and more support and ultimately more secure products that can you know distribute out to the world, which is what we that's why we get up every day.
00:37:33.599 --> 00:37:38.960
So uh I think in 2026, we can't get discouraged by the pace of change.
00:37:38.960 --> 00:37:50.719
We should get excited, we should be embracing it, we should find our curiosity, uh, and we should be uh setting aside time every week to explore and experiment and to grow and not just do work.
00:37:52.159 --> 00:37:53.440
Man, it's Friday.
00:37:53.440 --> 00:37:55.679
It's the first day of summer out here in London.
00:37:55.679 --> 00:38:00.480
I just had a podcast for Joe Sullivan and ended on a lovely, great, happy note.
00:38:00.480 --> 00:38:08.000
Thank you so much for your time today and for everything you do for your Ukraine, everything you do for the security community and everything you've done for CISOs out there.
00:38:08.000 --> 00:38:11.679
Thank you so much, Joe, and take care of yourself and have a lovely weekend.
00:38:11.679 --> 00:38:12.480
You too.
00:38:12.480 --> 00:38:13.760
Thanks for having me on.
00:38:13.760 --> 00:38:14.880
Thanks.
00:38:15.920 --> 00:38:17.760
Well, that's all for today, folks.
00:38:17.760 --> 00:38:20.480
Thank you for tuning in to the mnemonic security podcast.
00:38:20.480 --> 00:38:29.920
If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us a mail to podcastnemonic.no.
00:38:29.920 --> 00:38:31.679
Thank you for listening.
00:38:31.679 --> 00:38:33.360
We'll see you next time.
00:00:03.359 --> 00:00:13.359
From our headquarters in Oslo, Norway, and on behalf of our host, Robby Peralta, welcome to the mnemonic security podcast.
00:00:15.199 --> 00:00:23.760
There are security leaders who manage incidents, and then there are security leaders who become the incident that everyone else studies.
00:00:23.760 --> 00:00:29.120
Today's guest started his career as a federal cybercrime prosecutor.
00:00:29.120 --> 00:00:34.880
He eventually moved on to important positions within eBay, PayPal, and Airbnb.
00:00:34.880 --> 00:00:47.039
He was the chief security officer for Facebook, advised the Obama White House on national security policy, and then he landed a job at Uber as the chief security officer.
00:00:47.039 --> 00:00:50.560
His time there has been highly publicized.
00:00:50.560 --> 00:00:54.799
I wouldn't do him justice by trying to sum it all up in a few lines.
00:00:54.799 --> 00:00:56.880
But the short version is this.
00:00:56.880 --> 00:01:02.799
Joe Sullivan became a case study that changed how security leaders think about personal risk.
00:01:02.799 --> 00:01:16.640
After Uber's 2016 breach, he found himself at the center of a legal battle that lasted years and became one of the first security executives to be criminally prosecuted over the handling of a cybersecurity incident.
00:01:16.640 --> 00:01:21.200
The case that sent a shockwave through the entire CISO community.
00:01:21.200 --> 00:01:24.879
I haven't asked him if he thinks the story had a happy ending.
00:01:24.879 --> 00:01:30.079
But the legal battle eventually concluded and a lot of lessons were learned.
00:01:30.079 --> 00:01:35.359
And one thing I can say is that he appears to be doing just fine.
00:01:35.359 --> 00:01:37.840
What a life so far.
00:01:37.840 --> 00:01:39.200
And you're not done yet.
00:01:39.519 --> 00:01:42.000
Nope, still working, still having fun.
00:01:42.319 --> 00:01:42.959
Still kicking.
00:01:42.959 --> 00:01:44.000
So what are you up to these days?
00:01:44.000 --> 00:01:45.280
What are you finding fun?
00:01:45.599 --> 00:01:48.319
Basically, I do like three or four jobs.
00:01:48.319 --> 00:01:52.159
So I am running the security consulting business, Joe Sullivan Security.
00:01:52.159 --> 00:01:54.000
And there's really three parts to that.
00:01:54.000 --> 00:01:57.200
Part one is I help companies build out their security.
00:01:57.200 --> 00:02:06.799
Being situated here in Silicon Valley, I often get approached by startups that, you know, they've hit product market fit, they've gotten a lot of funding, and they need to grow up fast.
00:02:06.799 --> 00:02:21.280
So over the last few years, uh, I have built out a team of like five of us who will go into a fast-growing startup and will literally interview and hire people for them, set up their security foundations, and sometimes set up their IT foundations as well.
00:02:21.280 --> 00:02:28.240
Examples would be companies that you know, maybe they're just like five people, but they get 100 million in funding.
00:02:28.240 --> 00:02:34.319
Why would a VC give them 100 million in funding to grow up and build a company and kind of define a category really fast?
00:02:34.319 --> 00:02:39.360
So they they turn to us and say, build us a security and IT department in six months.
00:02:39.360 --> 00:02:40.800
So do a lot of that.
00:02:40.800 --> 00:02:46.879
That's kind of fun because we get to experiment with different technologies, different tech stacks, different types of companies.
00:02:46.879 --> 00:02:57.280
We've been doing it for companies ranging from like AI companies to next gen electric car battery companies to VTOL taxis, uh, humanoid robot companies.
00:02:57.280 --> 00:02:59.919
We've been inside all kinds of different companies helping them.
00:02:59.919 --> 00:03:02.159
And the challenges are different at each one.
00:03:02.159 --> 00:03:03.919
So that's that's a lot of fun.
00:03:03.919 --> 00:03:09.439
Also, do some mentoring and working on security strategy for companies.
00:03:09.439 --> 00:03:14.479
So less hands-on with those, more kind of spending time with the CISO and the exec team.
00:03:14.479 --> 00:03:21.680
Sometimes the exec team reaches out to me and says, Hey, Joe, can can you tell us if our security team knows what they're doing?
00:03:21.680 --> 00:03:24.560
Uh it's like they speak two different languages.
00:03:24.560 --> 00:03:27.919
The security team talks a language, the CISO talks a language.
00:03:27.919 --> 00:03:30.560
It's very technical, it's very jargon heavy.
00:03:30.560 --> 00:03:36.400
And the board and the CEO in 2026, they they can't be hands-off anymore.
00:03:36.400 --> 00:03:39.439
They need to know that the security organization has its act together.
00:03:39.439 --> 00:03:40.560
There's too much risk.
00:03:40.560 --> 00:03:49.280
And then the third thing I do in the security consulting business is I I get asked to go speak at conferences and things and talk about themes.
00:03:49.280 --> 00:04:00.800
And I really enjoy that because uh most security people are embedded inside a single organization, whether in government or the private sector, and they're they're very limited in what they can say and be opinionated about.
00:04:00.800 --> 00:04:04.719
And I have the flexibility of being an independent voice.
00:04:04.719 --> 00:04:06.240
I can say whatever I want.
00:04:06.240 --> 00:04:08.159
And uh I'm enjoying that.
00:04:08.639 --> 00:04:08.879
Cool.
00:04:08.879 --> 00:04:12.159
Well, thank you so much again for being with us here today.
00:04:12.159 --> 00:04:13.840
You just mentioned humanoids.
00:04:13.840 --> 00:04:16.240
How do you think about security in humanoids?
00:04:16.720 --> 00:04:21.680
Yeah, so there are lots of different approaches to humanoids, uh robots happening right now.
00:04:21.680 --> 00:04:34.079
I've talked to and spent some time with some companies that are taking and kind of leveraging the physical robots that were built uh in China and kind of building their own software around and in them.
00:04:34.079 --> 00:04:42.160
And then I've worked with companies that uh like OneX that are just like doing the full stack from bottom to top on their own.
00:04:42.160 --> 00:04:47.279
And there are a ton of really interesting security issues when you start talking about humanoid robots.
00:04:47.279 --> 00:04:53.839
The closest analogy would be to some of the self-driving uh car situations we have on the road.
00:04:53.839 --> 00:04:56.879
Technically, those are robots on wheels.
00:04:56.879 --> 00:05:06.160
And if you step back and think about it from a technical standpoint, you have all the same issues, except that the humanoid robots are coming inside the house.
00:05:06.160 --> 00:05:13.199
So from a physical standpoint, they have to navigate kids and dogs and human beings and not breaking glassware.
00:05:13.199 --> 00:05:19.040
And the human household is is not designed for robots that are clumsy.
00:05:19.040 --> 00:05:20.879
But there's also all kinds of risk.
00:05:20.879 --> 00:05:26.480
You know, we think about them when we bring cameras into our house for security or something like that.
00:05:26.480 --> 00:05:40.399
When we bring uh these next gen toys that talk to our kids, AI tools, voice systems, like the privacy implications that putting this technology in our house raises so many different things.
00:05:40.399 --> 00:05:44.560
So when you think about like setting up security, it's it's complicated.
00:05:44.560 --> 00:05:47.680
Of course, you need that company to have all the security that any company has.
00:05:47.680 --> 00:05:54.480
So like the enterprise security, but product security, hiring for those companies, you need people who've worked on things in the physical world.
00:05:54.480 --> 00:05:58.399
They've people who've thought about how do I communicate with the robot?
00:05:58.399 --> 00:06:05.839
How like what if the robot's only on Wi-Fi and it goes to take out the trash and it loses its Wi-Fi connectivity standing out at the street corner?
00:06:05.839 --> 00:06:06.480
You know what I mean?
00:06:06.480 --> 00:06:08.480
Like there's so many things that can happen.
00:06:08.480 --> 00:06:11.199
Uh, how do we do software updates over the air?
00:06:11.199 --> 00:06:13.040
Do we allow software updates?
00:06:13.040 --> 00:06:17.839
What type of kind of VPN are we going to use for connecting and communicating with the robot?
00:06:17.839 --> 00:06:22.240
How do we do customer support for a robot inside someone's house?
00:06:22.240 --> 00:06:27.360
Do we allow uh humans to have uh visibility into what's happening with every robot?
00:06:27.360 --> 00:06:29.120
That's pretty crazy.
00:06:29.120 --> 00:06:31.680
You know, so there's there's just a million implications.
00:06:31.680 --> 00:06:33.040
That's what makes it fun.
00:06:33.680 --> 00:06:37.279
How far are we away from that reality, do you think?
00:06:37.920 --> 00:06:47.439
Oh, I think that there are multiple companies here in the Bay Area that have humanoid robots operating inside households in kind of like pilot programs and things like that.
00:06:48.079 --> 00:06:48.560
Wow.
00:06:48.560 --> 00:06:49.439
Awesome.
00:06:49.439 --> 00:06:51.360
What a what a world to live in.
00:06:51.360 --> 00:06:54.800
Uh wearables and note takers.
00:06:54.800 --> 00:06:56.959
You spoke about it at unprompted.
00:06:56.959 --> 00:07:01.279
Would you mind just summing up what you said at that talk and where you stand on that position?
00:07:01.279 --> 00:07:05.439
Because that's a very uh that's happening right now, whether we like it or not, right?
00:07:05.680 --> 00:07:06.000
Yeah.
00:07:06.319 --> 00:07:06.560
Yeah.
00:07:06.639 --> 00:07:09.600
Well, first of all, um the unprompted conference.
00:07:09.600 --> 00:07:18.079
If anybody hasn't heard of it, who's interested in AI security, all the videos from the conference are live, and there were so many better talks than my talk.
00:07:18.079 --> 00:07:19.839
It was just like so much energy.
00:07:19.839 --> 00:07:30.879
So it was in the context of that that um Gotti, who was running the whole conference, he's like, he and I had written an article a year before on AI note takers.
00:07:30.879 --> 00:07:32.160
We published it.
00:07:32.160 --> 00:07:39.360
And, you know, it was kind of like a first look at all these AI note takers are exploding across all of our meetings.
00:07:39.360 --> 00:07:50.720
You could barely ever join a conference call without somebody's AI note taker jumping in and being part of the attendee list and you know, and and dealing with that and wondering about it.
00:07:50.720 --> 00:07:58.160
I realized this is the first place where AI is actually injecting itself into our daily workflows.
00:07:58.160 --> 00:08:03.680
And it seems like the security team isn't doing anything to put controls in place.
00:08:03.680 --> 00:08:08.240
And and so Gotti and I stepped back and thought about it like, what are the risks?
00:08:08.240 --> 00:08:10.079
And it turns out it's really interesting.
00:08:10.079 --> 00:08:13.920
You know, there are a whole bunch of risks around AI note takers.
00:08:13.920 --> 00:08:18.800
Uh, you know, it's number one it's recording everything.
00:08:18.800 --> 00:08:20.480
And I live in California.
00:08:20.480 --> 00:08:24.560
Do you know if in order for me to record you, I need your consent up front.
00:08:24.560 --> 00:08:28.480
So it's like a legal issue there that like half the country has to deal with.
00:08:28.480 --> 00:08:30.800
Uh, and like, how are you being transparent about that?
00:08:30.800 --> 00:08:35.759
And then it it becomes corporate data, you know, it's like it's and it's sensitive data.
00:08:35.759 --> 00:08:37.039
Where is it being stored?
00:08:37.039 --> 00:08:38.000
Who has access to it?
00:08:38.000 --> 00:08:40.000
Who's doing the rule-based access control?
00:08:40.000 --> 00:08:42.799
And then you start thinking about the security implications.
00:08:42.799 --> 00:08:48.480
Okay, it turns out, and there are actually studies on this, that AI note-takers can be gamed.
00:08:48.480 --> 00:08:59.360
You can prompt inject them, you can manipulate the uh, you know, steer the algorithm so that it thinks that whatever you say is the most important thing from the meeting.
00:08:59.360 --> 00:09:00.399
So the takeaways.
00:09:00.399 --> 00:09:12.159
And so I started digging in, and Guy and I just realized like this this is such a simple, annoying little thing that showed up in our life, but nobody's actually doing the homework around it.
00:09:12.159 --> 00:09:18.080
And like security teams have had like in 2024 and 25 were a little like hands-off around AI.
00:09:18.080 --> 00:09:26.320
And it was like, wait a minute, here's a really easy way for you to kind of get your hands dirty, like dealing with AI from a policy and risk standpoint.
00:09:26.320 --> 00:09:27.759
So we wrote that article.
00:09:27.759 --> 00:09:35.279
I prepared the talk thinking this is just like some little meetup of all of you know a bunch of our friends and to talk about AI.
00:09:35.279 --> 00:09:40.159
I didn't realize it was going to be like the most paid attention to conference of 2026.
00:09:40.159 --> 00:09:47.679
And so I I roll in and I'm doing this little talk on AI note takers that that, you know, and I'm surrounded by these amazing talks.
00:09:47.679 --> 00:09:50.000
And I was like, I should have put more effort into this.
00:09:50.000 --> 00:09:57.759
But actually, I got a lot of positive feedback afterwards that like I've had so many people message me, like, oh, I totally gamed the note-taker at that meeting.
00:09:57.759 --> 00:09:59.519
I was the first person in that meeting.
00:09:59.519 --> 00:10:00.639
No one else was there.
00:10:00.639 --> 00:10:06.159
I told it like five minutes of my thoughts before anybody else showed up, and all my stuff got captured.
00:10:06.159 --> 00:10:13.039
Or I figured out how to uh make it so that the note taker didn't take any notes because I wanted to frustrate everybody.
00:10:13.039 --> 00:10:17.440
Like it, I inspired a bunch of people to do a bunch of annoying things, apparently.
00:10:18.000 --> 00:10:21.679
Have you talked to any of CISOs that actually put any guardrails in place for that?
00:10:22.080 --> 00:10:22.960
Yeah, quite a bit.
00:10:22.960 --> 00:10:25.600
And I'm seeing it more and more in different contexts.
00:10:25.600 --> 00:10:44.799
Like organizations are becoming much more thoughtful and disciplined about like selecting an AI note taker that's going to be their official note taker, prohibiting all the other ones, developing policies for how are you going to deal with when the other company has a note taker, get making sure you request a copy of everything, set it up in such a way that you automatically get those copies.
00:10:44.799 --> 00:10:51.679
So you keep your own independent version of it, giving the teams guidelines on which types of meetings are okay for note takers and not.
00:10:51.679 --> 00:11:01.360
You know, like I work at a VC part-time, helping them on investing, and they have very clear policies around what you can and cannot use note takers for.
00:11:01.360 --> 00:11:07.519
Yeah, they don't run note takers during board meetings, they don't run note takers during situations where there's attorney-client privilege.
00:11:07.519 --> 00:11:17.279
You know, they they have to be thoughtful about this stuff because we're discovering that like attorney-client privilege gets blown up when AI gets involved sometimes.
00:11:17.279 --> 00:11:22.000
And, you know, the the law in court cases is evolving very quickly there.
00:11:22.000 --> 00:11:40.720
So um not an expert on that side, but it's another example of a situation where we need to when we work on our policies for security, we need to loop in legal and have them part of the process because they're not paying attention to all these AI note takers and the risks that happen with them unless we pull them into the conversation.
00:11:40.720 --> 00:11:48.799
So I I think that we're uh we're getting much more uh official and thoughtful about the use of these note takers.
00:11:48.799 --> 00:12:10.720
Come companies that are in the defense defense tech space that have to comply with CMMC and some of these other really strict government standards have to have even more careful policies around what is and what isn't recorded, how and whether they have to segregate their recordings for you know for the different environments and keep them in separate places and have role-based access control.
00:12:10.720 --> 00:12:16.159
Like there's a lot going on, I think, as as companies have gotten more mature about this stuff.
00:12:17.200 --> 00:12:22.960
I've been in meetings where right when you see it's being recorded, you get kind of scared, but then you also kind of become more professional, at least me.
00:12:22.960 --> 00:12:25.039
That's just like, okay, I'm being recorded.
00:12:25.039 --> 00:12:28.960
Uh what is the worst that can happen, just so that that point is covered.
00:12:29.519 --> 00:12:42.240
I always remember the Sony case from like 12 or 13 years ago when North Korea hit uh Sony in response to them putting out that movie that was uh viewed as derogatory towards their leader.
00:12:42.240 --> 00:12:44.320
Two things happened there, right?
00:12:44.320 --> 00:12:51.600
It was a destructive malware situation where they wiped out a bunch of their systems, but they also dumped all of their email publicly.
00:12:51.600 --> 00:12:58.960
And I remember talking to executives at the time from different companies and talking about like what was the most shocking thing about that to you?
00:12:58.960 --> 00:13:01.360
To me, it was very clearly the destructive attack.
00:13:01.360 --> 00:13:03.919
You know, we weren't in the world of ransomware that we're in right now.
00:13:03.919 --> 00:13:12.399
There had only been a few destructive attacks in history, you know, Saraudi Ramco and uh Las Vegas Sands and maybe the Maersk stuff.
00:13:12.399 --> 00:13:18.240
Like there just wasn't a lot of intentional destruction situations in cybersecurity.
00:13:18.240 --> 00:13:23.440
And and so to me, the Sony case stood for, wow, this is a scary new world.
00:13:23.440 --> 00:13:28.960
I need to be responsible for operational resilience and and really make sure that we we have this together.
00:13:28.960 --> 00:13:42.000
But then I would I talked to a bunch of other executives, like COOs, and I think I even talked to the woman who was the president of Sony who said who she lost her job over the pub public exposure of her emails.
00:13:42.000 --> 00:13:49.600
We say things in meetings, we say things in email that that uh are embarrassing and that we wish never would be seen.
00:13:49.600 --> 00:13:57.360
And so I think, you know, to a lot of executives, that's the scariest thing about these note-taking recordings.
00:13:57.360 --> 00:14:00.480
Uh it's the New York Times test.
00:14:00.480 --> 00:14:06.720
Would you feel comfortable if everything that was in said in all your meetings was put on the front cover of the New York Times?
00:14:06.720 --> 00:14:16.960
And a lot of companies have a lot of notes that have been recorded now that are subject to exposure and litigation and other things, or they could just be leaked or hacked.
00:14:16.960 --> 00:14:24.480
You know, if granola gets hacked, there's gonna be a lot of embarrassed executives in Silicon Valley because they all are using granola to record everything.
00:14:24.480 --> 00:14:28.080
You know, I was experimenting with the limitless uh app.
00:14:28.080 --> 00:14:28.879
I mentioned it.
00:14:28.879 --> 00:14:33.120
Uh I was wearing it on me, even though I didn't have it turned on when I gave that talk.
00:14:33.120 --> 00:14:41.200
Uh I also, you know, I have a plod now, which is a different wearable, because I'm always experimenting with and learning about these things.
00:14:41.200 --> 00:14:44.240
And and everything that they record can be exposed.
00:14:44.240 --> 00:14:45.919
And so there's a lot of risk in that.
00:14:45.919 --> 00:14:50.159
It might be might trigger reporting obligations because it's PII.
00:14:50.159 --> 00:14:55.519
It might trigger reporting obligations because you have contracts with your customers.
00:14:55.519 --> 00:14:58.080
And it it it might just be really embarrassing.
00:14:58.080 --> 00:15:06.639
So there's lots of different risks with this uh anytime we get into a new type of content being stored in our enterprise servers.
00:15:08.159 --> 00:15:10.559
I feel like note takers, that's a very business context.
00:15:10.559 --> 00:15:14.799
And then you have the wearable side, which is, I guess, your whole entire life.
00:15:14.799 --> 00:15:19.919
What is your how do you look at the security or the insecurity around that?
00:15:20.799 --> 00:15:28.720
Well, I think that um we're moving in this direction of being monitored all the time.
00:15:28.720 --> 00:15:35.759
And it's really, I think, uncomfortable to a lot of us who grew up in a privacy first era.
00:15:35.759 --> 00:15:40.559
The idea that um something is gonna be recording everything we do at work.
00:15:40.559 --> 00:15:46.000
Like if you if you look closely, that's the direction the AI first companies are going.
00:15:46.000 --> 00:15:59.759
Like I talk to CEOs who say, I want real-time monitoring of everything that's happening on every machine at my company and every meeting at my company, because we as humans lose a lot of that history and context.
00:15:59.759 --> 00:16:02.000
We talk about stuff and then we forget about it.
00:16:02.000 --> 00:16:08.879
And if I have AI recording everything, then we will get the power and benefit of that.
00:16:08.879 --> 00:16:18.240
You know, I like the call I had before this, I was talking with the head of application security, a company, and we're talking about the implications of AI on how AppSec is changing.
00:16:18.240 --> 00:16:32.799
And one of the things we were talking about is how PRDs uh documentation that we create before we write code, you can't train the AI on it because what we actually built with code for the last 20 years isn't reflected in the PRD or the Jira ticket.
00:16:32.799 --> 00:16:35.519
You know, that's aspirational, and then we go build.
00:16:35.519 --> 00:16:42.559
And so uh we can't actually learn that much from like our history of documentation.
00:16:42.559 --> 00:16:52.799
And so the AI first folks are saying, well, we should be recording everything in real time so we know what actually happened, and then we will be much more effective.
00:16:52.799 --> 00:16:58.480
And you see these stories of companies, you know, like Meta has been in the news for the last couple of weeks.
00:16:58.480 --> 00:17:10.000
This story keeps coming up about how the company asked employees to allow them to be monitored 24, you know, their entire time on the machine so that we can train AI based on its learnings from them.
00:17:10.000 --> 00:17:13.680
And I've heard variations of that from lots of different companies.
00:17:13.680 --> 00:17:23.359
But um, you know, we're moving towards computer vision models that are running, uh, capturing everything that happens on my screen all the time, not just the words being recorded.
00:17:23.359 --> 00:17:24.960
So that's their direction we're going.
00:17:24.960 --> 00:17:33.039
So I I think we're also coming at it at the same time from a consumer standpoint where multiple companies are putting out these glasses.
00:17:33.039 --> 00:17:40.799
Obviously, you know, the Meta Ray Band glasses and the Oakley's, you know, Snap has their spectacles, and there are a bunch of other ones that are coming out.
00:17:40.799 --> 00:17:45.680
We've heard that uh Apple wants to have cameras on the AirPods.
00:17:45.680 --> 00:17:56.559
Like there's lots of different wearable things happening coming at us from different directions with the idea that AI needs to consume all of this.
00:17:56.559 --> 00:18:01.119
And then remember, we started this conversation talking about robots.
00:18:01.119 --> 00:18:07.519
Uh humanoid robots, they need to function in the physical 3D world.
00:18:07.519 --> 00:18:12.319
Something I've been thinking about a lot is how every data center is full of 2D data.
00:18:12.319 --> 00:18:17.279
You know, most of the stuff that's been stored in data centers for the last couple of decades is about code.
00:18:17.279 --> 00:18:21.920
It's about words, it's about videos, it's about things we watch on a screen.
00:18:21.920 --> 00:18:30.079
Um, there's not a lot of data in data centers about how a waiter moves through a restaurant or how a waitress brings coffee to a table.
00:18:30.079 --> 00:18:37.519
But if we want to bring humanoid robots into restaurants, we need to actually map out all of that stuff and create the training data.
00:18:37.519 --> 00:18:40.079
There's only so far you can get with synthetic data.
00:18:40.079 --> 00:18:49.039
And so we're gonna see, you know, at restaurants, they're gonna start wearing wearable glasses to record more of what's happening.
00:18:49.039 --> 00:18:51.519
And so every time you sit in a restaurant, you're gonna be recorded.
00:18:51.519 --> 00:18:52.720
How are you gonna feel about that?
00:18:52.720 --> 00:18:59.519
You know, in the same way as we go through airports, we're recorded constantly now, or certain cities are we recorded all the time.
00:18:59.519 --> 00:19:03.680
Like the amount that we're recorded uh is gonna go up and up and up.
00:19:03.680 --> 00:19:18.240
And, you know, I was reading an article last night about Flock, which is capturing data on vehicle traffic and its impact on reducing crime, is like the statistics are overwhelmingly positive when you roll it out, how much uh crime goes down.
00:19:18.240 --> 00:19:27.039
But on the flip side, uh the communities are backlashing against products like that right now because it feels like we're moving more into surveillance state.
00:19:27.039 --> 00:19:39.519
I think meeting note takers are just like scratching the surface of this new world that we're heading into, where society hasn't really put down its foot and said, like, here's the line.
00:19:39.519 --> 00:19:53.119
And in fact, as someone who spent a lot of time traveling around the planet and being in different countries, like we all philosophically, on a country by country basis, have very different perspectives on government uh visibility into our private lives.
00:19:53.119 --> 00:20:03.119
In the United States, I think we we are absurdly comfortable with letting corporations take access to a lot of our personal data, and we are very uncomfortable with our government.
00:20:03.119 --> 00:20:14.000
Whereas I found like it's a gross generalization, but I found the opposite to be true in Europe, where we're much more comfortable with government access to our data and very uncomfortable with corporate access to our data.
00:20:14.000 --> 00:20:17.519
And it's a sliding scale in every country where it's slightly different.
00:20:17.519 --> 00:20:28.000
But AI is going to force us to have a bigger conversation about this more consistently because the ground's shifting beneath our feet right now really quickly.
00:20:28.400 --> 00:20:29.920
Is anybody having those conversations?
00:20:29.920 --> 00:20:32.319
This is the first conversation I'm having about it.
00:20:33.279 --> 00:20:44.240
Well, I I I I go back to, you know, when I wrote uh Gaudi and I wrote the original article, we were thinking about it in this very micro context of like all of our meetings are suddenly becoming recorded.
00:20:44.240 --> 00:20:52.880
And as you said, it's the first few times you roll into a meeting and you pop open the uh the video recording conf stuff and you realize you're being recorded.
00:20:52.880 --> 00:20:58.240
For like a second there, you're like, uh Should I say something?
00:20:58.240 --> 00:20:59.440
Should I say something?
00:20:59.440 --> 00:21:00.400
Should I block it?
00:21:00.400 --> 00:21:01.519
Should I be opposed to it?
00:21:01.519 --> 00:21:03.200
What's the what how should I feel about this?
00:21:03.200 --> 00:21:05.920
And then five minutes later you forget and you're just doing your meeting, right?
00:21:05.920 --> 00:21:08.799
And then you get the meeting notes and you're like, oh, this was useful.
00:21:08.799 --> 00:21:17.119
Oh, and then you're like, oh, I'm glad that it didn't capture those for that five-minute chat at the beginning where we were talking about my weekend and how hungover I was, or whatever it was.
00:21:17.119 --> 00:21:17.920
You know what I mean?
00:21:17.920 --> 00:21:26.799
Like, there's a lot of us just kind of like flipping through it really fast and accepting the new normal because it's incremental.
00:21:26.799 --> 00:21:34.880
And it's but it's gonna keep being incremental until it's massive in in terms of the amount of change that's happened.
00:21:34.880 --> 00:21:43.519
In the corporate context, it's easy for the CEO and everyone to see like this is like increasing our productivity and our throughput as an organization.
00:21:43.519 --> 00:21:44.480
We got to do this.
00:21:44.480 --> 00:21:48.640
If we don't if if our competitors are doing it and we're not, then we're gonna lose.
00:21:48.640 --> 00:21:53.359
And so, like everything tilts towards adoption of these things.
00:21:53.359 --> 00:21:59.680
Uh and um, you know, in the personal wearables, I think we're a little bit behind the you.
00:21:59.680 --> 00:22:09.440
You know, the effective corporate wearables, if we call these meeting note takers wearables to a certain extent, we got a ways to go on the on the non-business side.
00:22:09.440 --> 00:22:12.079
But lots of people are embracing and using these technologies.
00:22:12.079 --> 00:22:18.480
And you know, a lot of these cars that are around us, think about how many cameras are on a Tesla that are recording us all the time.
00:22:18.480 --> 00:22:28.240
How frequently does Tesla get subpoenaed by law enforcement for a crime that happened within a a a distance of a Tesla, even though the Tesla had nothing to do with the crime.
00:22:28.240 --> 00:22:33.519
Uh, you know, storekeepers with their cameras are getting subpoenaed all the time.
00:22:33.519 --> 00:22:37.359
Like a lot of of our life around us is being recorded already.
00:22:37.359 --> 00:22:45.279
You know, the ring doorbells, the nest doorbells, lots of data is starting to accumulate around us.
00:22:45.279 --> 00:22:47.440
Uh, and it's it's not slowing down.
00:22:47.440 --> 00:22:48.880
So it's kind of scary.
00:22:48.880 --> 00:22:51.920
And it and it just means that we have to be intentional about it.
00:22:51.920 --> 00:22:54.160
And that's what was the the core point.
00:22:54.160 --> 00:22:58.319
Like, we didn't set out to write like the uniform policy for all companies.
00:22:58.319 --> 00:23:01.440
What we were trying to do is just get everybody to pay attention to what's happening.
00:23:01.440 --> 00:23:04.240
And that was the point of the talk, too.
00:23:04.240 --> 00:23:20.799
Uh, you know, when I did the talk at unprompted, I probably spent like a third of the talk at the beginning and end just trying to like zoom out and say, like, no-takers is is our first opportunity to exercise our brain around risk and and and culture.
00:23:20.799 --> 00:23:25.680
But like, this is a much bigger conversation that we need to be having over the next couple of years.
00:23:26.880 --> 00:23:29.279
AI kind of got dumped on security, I feel like.
00:23:29.279 --> 00:23:29.920
I'm not sure.
00:23:29.920 --> 00:23:31.359
Would you would you agree on that?
00:23:31.359 --> 00:23:40.480
That AI sort of has fallen in the hands or the responsibility of security leaders, or how's that look for you?
00:23:40.960 --> 00:23:46.160
Yeah, I would say two years ago, CISOs were in the AI is not my problem.
00:23:46.160 --> 00:23:51.359
Uh, and that it's done a it's been a 180 degree swing in 2026.
00:23:51.359 --> 00:23:53.279
And it was fairly predictable.
00:23:53.279 --> 00:23:58.400
I was telling everybody this that, you know, security leaders should be owning AI risk.
00:23:58.400 --> 00:24:01.359
Uh, like look at it from a CEO standpoint.
00:24:01.359 --> 00:24:07.440
Yeah, if I'm a CEO of a company, I need somebody who's driving innovation, so I've got a CTO and a CIO.
00:24:07.440 --> 00:24:14.160
I've I need somebody who's driving revenue, so I've got my business leaders, my chief revenue officer, my salespeople.
00:24:14.160 --> 00:24:18.319
I need people who are like keeping track of what's working and not.
00:24:18.319 --> 00:24:21.279
And that's HR and finance and legal.
00:24:21.279 --> 00:24:26.559
Uh, you know, and legal and finance also are responsible for managing sites of risk.
00:24:26.559 --> 00:24:32.160
But like the typical business in 2026 has a lot more technical risk than ever before.
00:24:32.160 --> 00:24:36.960
Like one of the biggest risks for companies is uh a ransomware takedown.
00:24:36.960 --> 00:24:42.160
Look what happened to Jaguar Land Rover last year, Marks and Spencer or Kupang.
00:24:42.160 --> 00:24:57.440
There's so many of these companies that have been hit by ransomware, and the operational impact is that their factories shut down, their supply chain uh went out of business, uh, their customers were left unable to get their cars repaired or even buy a car.
00:24:57.440 --> 00:25:02.079
And so security has become much more important, cybersecurity.
00:25:02.079 --> 00:25:05.200
And then you look at all this AI transformation stuff.
00:25:05.200 --> 00:25:10.160
The CEO doesn't want to hire another technical risk leader to manage AI risk.
00:25:10.160 --> 00:25:12.640
So they're turning to the CISO because that's been their job.
00:25:12.640 --> 00:25:16.000
Your job is to make sure that all the technology doesn't destroy us.
00:25:16.000 --> 00:25:23.839
Like it's it shouldn't be like, I need to hire someone who makes sure that the AI technology doesn't destroy us is different from cybersecurity.
00:25:23.839 --> 00:25:27.680
It's not that different in the in the eyes of the board and the CEO.
00:25:27.680 --> 00:25:29.359
It's a form of technical risk.
00:25:29.359 --> 00:25:32.240
I want one person, one neck to choke.
00:25:32.240 --> 00:25:34.640
And so that's become the security leader.
00:25:34.640 --> 00:25:51.440
The interesting twist, I think, that we didn't anticipate as much is that CEOs are also turning to the CISOs and the security leaders to help drive the innovative change in AI, because a lot more security leaders also own IT than did a decade ago.
00:25:51.440 --> 00:26:04.799
That is 100% a trend that we see in Silicon Valley is that young companies, like when I go in and build help build security, I'm typically building IT as well, and it's all sitting under a technical security person.
00:26:04.799 --> 00:26:12.960
Many of the IT leaders and modern companies grew up in security rather than IT and have responsible responsibility for both now.
00:26:12.960 --> 00:26:24.160
Uh traditional larger companies still have that CIO, but they've been getting squeezed uh and their roles have gotten narrower with, you know, the SaaS and cloud infrastructure.
00:26:24.160 --> 00:26:29.119
So those um CIOs have smaller organizations and less budget for innovation.
00:26:29.119 --> 00:26:39.759
Uh and yet in 2026, the biggest pressure on every company is to integrate AI and evolve how your workforce uses technology to be, you know, effective.
00:26:39.759 --> 00:26:43.839
So a lot happening right now and a lot of pressure on CISOs.
00:26:44.400 --> 00:26:47.039
You make me realize come to a lot of realizations today.
00:26:47.039 --> 00:26:50.480
We've always been, I mean, I've only been security for like 10 years.
00:26:50.480 --> 00:26:53.759
But when I started in security, it was like, yeah, nobody listens to us.
00:26:53.759 --> 00:26:56.160
We deserve more power or more influence.
00:26:56.160 --> 00:27:02.880
And boom, I did I just realized now one of my clients, the, you know, my the CISO now became the CTO.
00:27:02.880 --> 00:27:23.839
Uh I guess my question to you now is having been through what you've been through, how do you, for those that aren't comfortable with taking that responsibility and that risk, like how should a CISO handle their new job responsibility that they weren't that they aren't aware that they have or haven't been given or paid for?
00:27:24.799 --> 00:27:30.160
Yeah, I I think that uh it's a huge opportunity and we have to rise up to it.
00:27:30.160 --> 00:27:43.119
This is uh you're right, it's what we've always been asking for is to get a seat at the table and to be able to have influence in the direction that the whole organization goes.
00:27:43.119 --> 00:27:45.440
So this is our this is our chance.
00:27:45.440 --> 00:27:46.799
We have to step up.
00:27:46.799 --> 00:27:49.839
And if we do, the rewards are will be there.
00:27:49.839 --> 00:27:52.720
If we don't, someone else is gonna step up.
00:27:52.720 --> 00:28:00.960
Uh it's just a it companies need people, governments need people who are gonna step up and and and take responsibility in the space.
00:28:00.960 --> 00:28:08.000
And if the if our best people don't do it, then blessed good people are gonna do do it, and that's not gonna be good for anybody.
00:28:08.000 --> 00:28:12.400
Because, you know, there's always somebody who's willing to take the role, even if they're not qualified.
00:28:12.400 --> 00:28:22.640
And I'd rather have the people who have the experience uh and the judgment uh have the confidence to take the role and and believe in themselves.
00:28:23.440 --> 00:28:28.000
What are you talking to CISOs all the time in your in your through a company?
00:28:28.000 --> 00:28:29.279
What are they asking me of you?
00:28:29.279 --> 00:28:32.480
Is it more personal or more technical, the the questions you're being asked?
00:28:33.279 --> 00:28:34.240
It's both.
00:28:34.240 --> 00:28:42.319
Um it's both, you know, when I first started, we would I would get together with other CISOs and they'd be like, I don't get to present to the board.
00:28:42.319 --> 00:28:43.920
I never even talk to my CFO.
00:28:43.920 --> 00:28:50.799
I I'm buried under the CIO, and I just get a budget that's not good enough, and nobody asks me my opinion.
00:28:50.799 --> 00:28:52.720
Like that world's long gone.
00:28:52.720 --> 00:29:00.799
Now you see um the Treasury Department called the CEOs of all the biggest banks to Washington, D.C.
00:29:00.799 --> 00:29:02.720
two or three weeks ago.
00:29:02.720 --> 00:29:05.599
And why were they called to DC?
00:29:05.599 --> 00:29:08.000
To talk about cybersecurity.
00:29:08.000 --> 00:29:14.400
If you're the CEO of a bank, are you gonna show up and say, I don't even know who my CISO is.
00:29:14.400 --> 00:29:15.279
I've never met them.
00:29:15.279 --> 00:29:22.480
You're gonna show up and you will have you're gonna have your CISO on speed dial because you're you need to be fully briefed for that meeting.
00:29:22.480 --> 00:29:33.759
You need to come across as having your act together and that this so, like, uh it's funny, a couple of years ago I wrote uh an article kind of like as a retrospective on my case.
00:29:33.759 --> 00:29:35.759
I said the CEO is next.
00:29:35.759 --> 00:29:41.440
Because I was talking about how regulatory scrutiny is moving from the CISO to the CEO and the board.
00:29:41.440 --> 00:29:44.559
It's happened.
00:29:44.559 --> 00:29:51.599
CEOs are the one, you know, when when United Healthcare had their situation, it was the CEO who got yelled at before Congress, not the CISO.
00:29:51.599 --> 00:29:58.079
Uh when Treasury called the the large banks, they didn't ask for the CISOs, they asked for the CEOs.
00:29:58.079 --> 00:30:13.039
The expectation is that the CEO has a trusted conciliary for security, that they are working closely with them, making sure that they're supported and resourced, and the CEO is calibrating risk against all the other risks to the company.
00:30:13.039 --> 00:30:16.480
So it's a it's just a fundamentally different world in 2026.
00:30:16.480 --> 00:30:21.599
And it's uh and I think it's a great time to be in security because of that.
00:30:22.480 --> 00:30:29.359
I know a guy who has uh contributed to that new world we live in where the CISOs aren't getting yelled at anymore, it's a CEO.
00:30:29.359 --> 00:30:31.519
Uh I'm looking at him right now.
00:30:31.519 --> 00:30:34.480
So thank you for taking that one on the chin for all the CISOs out there.
00:30:34.480 --> 00:30:36.559
Uh one last question for you.
00:30:36.559 --> 00:30:46.240
Since I and you're a part of all these really cool startups that are revolutionalizing a part of the security stack using new AI technologies.
00:30:46.240 --> 00:30:53.039
Is there any area of the portfolio that you think AI is especially outperforming that anybody listening should go take a look at?
00:30:53.039 --> 00:30:56.319
I know that you're working with like AppSec and a bunch of different areas.
00:30:56.720 --> 00:30:57.359
Yeah.
00:30:57.359 --> 00:31:07.440
I it's one of the questions I uh ask every security leader when I'm working with them is are you f are you changing who you're hiring uh in 2026?
00:31:07.440 --> 00:31:13.119
Have you changed the job descriptions for your roles in 2026 because of AI?
00:31:13.119 --> 00:31:24.160
And in 2025, the answer was mostly no, I'm still hiring, you know, I'm I'm hiring detection engineers, I'm hiring AppSec engineers, I'm hiring compliance people.
00:31:24.160 --> 00:31:26.400
In 2026, the answer is changing.
00:31:26.400 --> 00:31:30.880
I'm hiring I'm hiring people who are really good using AI.
00:31:30.880 --> 00:31:34.160
I'm rethinking we're everyone's a builder now.
00:31:34.160 --> 00:31:36.079
I heard that on my last meeting.
00:31:36.079 --> 00:31:38.960
Everyone, you know, that was a security leader.
00:31:38.960 --> 00:31:41.119
So everyone is a builder now.
00:31:41.119 --> 00:31:44.880
Uh because and AppSec is a really great example.
00:31:44.880 --> 00:31:57.200
Like if we step back and and if I said to you or you said to me, what job has fundamentally changed more because of AI than any other job, I would say software engineer.
00:31:57.200 --> 00:32:06.720
Like so far, software engineer's job in 2026 is is more different than it was in 2023 than any other job because of AI, right?
00:32:06.720 --> 00:32:20.400
A lot of jobs like we're 20% better, we're using these like very cut still kind of primitive AI tools, we're we're experimenting with agentic solutions, but coding is so far ahead.
00:32:20.400 --> 00:32:25.440
Like the software engineer role at most companies has changed a lot.
00:32:25.440 --> 00:32:30.880
And so if you're the security team that's doing application security, what have you seen in 2026?
00:32:30.880 --> 00:32:44.960
You've seen that the volume of code that engineering is cranking out has gone up by like it hasn't doubled, it hasn't tripled, it's gone from like 250,000 lines of code to 2.5 million lines of code in a month.
00:32:44.960 --> 00:32:49.039
That's that's how significant the the volume change has been.
00:32:49.039 --> 00:32:54.960
And it's not like engineering has hired 10 times more people, they're just like cranking out 10 times more code.
00:32:54.960 --> 00:32:57.759
So how does the security team deal with that?
00:32:57.759 --> 00:33:12.319
The old kind of like, all right, we're gonna do our scanners, we're gonna do some manual code review, we're gonna like try and do some threat modeling, we're gonna hire some pen testers and we'll rely on bug bounty to find the rest.
00:33:12.319 --> 00:33:18.160
Like every every part of that is being stressed and reimagined right now.
00:33:18.160 --> 00:33:33.839
And like I'm on the board of an app sec company, and it feels like uh what customers want from an app security tool is uncertain in 2026.
00:33:33.839 --> 00:33:35.920
Like everything's evolving there.
00:33:35.920 --> 00:33:41.359
Uh what are the frontier model companies that are building these AI coding solutions?
00:33:41.359 --> 00:33:45.680
What are they gonna kind of like suck into their uh kind of solution?
00:33:45.680 --> 00:33:50.319
What's gonna be left for AppSec companies and AppSec teams to do?
00:33:50.319 --> 00:33:52.000
It's not it's not clear yet.
00:33:52.000 --> 00:33:58.240
Whereas the coding tools have gotten really good at coding, they haven't gotten really good at vulnerability remediation yet.
00:33:58.240 --> 00:34:05.440
And in fact, we're finding more vulnerabilities than ever, but the we're not getting any more efficient at fixing them yet.
00:34:05.440 --> 00:34:18.000
And so every security team is like throwing a lot, like pulling a lot of resources off of other things and putting them in vulnerabil vulnerable remediation in 2026, but it's still too manual.
00:34:18.000 --> 00:34:26.320
Uh and it's still on unclear like what you should what stack you should have for your app sec team in 2027.
00:34:27.360 --> 00:34:29.519
Have you met anybody that's done anything novel there?
00:34:29.840 --> 00:34:30.079
Yeah.
00:34:30.079 --> 00:34:38.639
I most of the companies that are doing it well are investing in building kind of harnesses, I think is the terminology everyone's using right now.
00:34:38.639 --> 00:34:47.519
But think of it as basically the the structure around the model to make the model effective in your environment.
00:34:47.519 --> 00:34:49.679
Uh that's part one.
00:34:49.679 --> 00:34:54.079
Part two is building out kind of like some sense of internal context.
00:34:54.079 --> 00:35:02.159
Like looking at code in the abstract after it's written, you're not going to identify all the most important vulnerabilities.
00:35:02.159 --> 00:35:07.840
It's only in the context of like the infrastructure and the environment that you really come to understand.
00:35:07.840 --> 00:35:10.719
Like it's one thing to identify there's a vulnerability.
00:35:10.719 --> 00:35:14.320
It's another thing to understand where where the fix should be applied.
00:35:14.320 --> 00:35:20.960
Should it be applied right down, you know, right there in the code right there, or is this something that should be fixed as a systemic level?
00:35:20.960 --> 00:35:31.440
That's where the app sec engineers, you know, with experience are adding a lot of value and that we're gonna have to continue to see that like people aren't stopping hiring app sec engineers.
00:35:31.440 --> 00:35:32.000
It's the opposite.
00:35:32.000 --> 00:35:39.920
AppSec engineering roles are uh becoming even harder to fill, and the people who are good at that are getting paid more than ever.
00:35:39.920 --> 00:35:44.000
So there are definite things that organizations can do.
00:35:44.000 --> 00:35:52.400
Like that, you know, Cloudflare came out with a blog post earlier this week that a lot of people thought was interesting because it talked about essentially how they built the harness for Mitos.
00:35:52.400 --> 00:35:57.920
Uh that's exactly the type of thing that lots of companies should have been doing and should be doing.
00:35:57.920 --> 00:36:04.000
And I I saw somebody else just took Cloudflare's blog post and threw it in Claude and said, build me what Cloudflare has.
00:36:04.000 --> 00:36:15.360
I don't know that you're gonna get there with with that, but uh you that's the direction that people should be thinking, you know, instead of just waiting for for someone else to solve the problem for them.
00:36:16.800 --> 00:36:21.920
Do you have any other closing thoughts that you'd like to leave whoever's listening to this with?
00:36:22.800 --> 00:36:23.199
Yeah.
00:36:23.199 --> 00:36:29.039
I I I think if you you could take this conversation and you could be like, wow, this is a scary place.
00:36:29.039 --> 00:36:37.280
2026, AI is disrupting everything that's happening in in the business world, and you could be like discouraged by that.
00:36:37.280 --> 00:36:42.079
Or you could listen to the conversation and then think, wow, this is a great opportunity.
00:36:42.079 --> 00:36:48.159
You know, AI uh is is opening up opportunities for a lot of us to do things that we haven't done before.
00:36:48.159 --> 00:36:52.559
Like, like that person said to me this morning, um, my whole team is builders now.
00:36:52.559 --> 00:36:57.840
Security people didn't get to think of themselves as builders before, but being a builder is is is fun.
00:36:57.840 --> 00:36:58.960
It's exciting.
00:36:58.960 --> 00:37:08.480
Uh, you know, oftentimes the security team is culturally not aligned with the rest of the company because the rest of the company is building something and the rest of the company gets excited when they ship a product.
00:37:08.480 --> 00:37:14.800
Security team feels like unrecognized, uh, disconnected from like the business success.
00:37:14.800 --> 00:37:33.599
Uh, this is our chance to be part of the team that's building for the company uh and to reframe where we sit uh in in a way that's positive and that will get us more resources and more support and ultimately more secure products that can you know distribute out to the world, which is what we that's why we get up every day.
00:37:33.599 --> 00:37:38.960
So uh I think in 2026, we can't get discouraged by the pace of change.
00:37:38.960 --> 00:37:50.719
We should get excited, we should be embracing it, we should find our curiosity, uh, and we should be uh setting aside time every week to explore and experiment and to grow and not just do work.
00:37:52.159 --> 00:37:53.440
Man, it's Friday.
00:37:53.440 --> 00:37:55.679
It's the first day of summer out here in London.
00:37:55.679 --> 00:38:00.480
I just had a podcast for Joe Sullivan and ended on a lovely, great, happy note.
00:38:00.480 --> 00:38:08.000
Thank you so much for your time today and for everything you do for your Ukraine, everything you do for the security community and everything you've done for CISOs out there.
00:38:08.000 --> 00:38:11.679
Thank you so much, Joe, and take care of yourself and have a lovely weekend.
00:38:11.679 --> 00:38:12.480
You too.
00:38:12.480 --> 00:38:13.760
Thanks for having me on.
00:38:13.760 --> 00:38:14.880
Thanks.
00:38:15.920 --> 00:38:17.760
Well, that's all for today, folks.
00:38:17.760 --> 00:38:20.480
Thank you for tuning in to the mnemonic security podcast.
00:38:20.480 --> 00:38:29.920
If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us a mail to podcastnemonic.no.
00:38:29.920 --> 00:38:31.679
Thank you for listening.
00:38:31.679 --> 00:38:33.360
We'll see you next time.
