Transcrição completa de Everything Is Being Recorded

built uh in China and kind of building their own software around and in them. 00:04:34.079 --> 00:04:42.160 And then I've worked with companies that uh like OneX that are just like doing the full stack from bottom to top on their own. 00:04:42.160 --> 00:04:47.279 And there are a ton of really interesting security issues when you start talking about humanoid robots. 00:04:47.279 --> 00:04:53.839 The closest analogy would be to some of the self-driving uh car situations we have on the road. 00:04:53.839 --> 00:04:56.879 Technically, those are robots on wheels. 00:04:56.879 --> 00:05:06.160 And if you step back and think about it from a technical standpoint, you have all the same issues, except that the humanoid robots are coming inside the house. 00:05:06.160 --> 00:05:13.199 So from a physical standpoint, they have to navigate kids and dogs and human beings and not breaking glassware. 00:05:13.199 --> 00:05:19.040 And the human household is is not designed for robots that are clumsy. 00:05:19.040 --> 00:05:20.879 But there's also all kinds of risk. 00:05:20.879 --> 00:05:26.480 You know, we think about them when we bring cameras into our house for security or something like that. 00:05:26.480 --> 00:05:40.399 When we bring uh these next gen toys that talk to our kids, AI tools, voice systems, like the privacy implications that putting this technology in our house raises so many different things. 00:05:40.399 --> 00:05:44.560 So when you think about like setting up security, it's it's complicated. 00:05:44.560 --> 00:05:47.680 Of course, you need that company to have all the security that any company has. 00:05:47.680 --> 00:05:54.480 So like the enterprise security, but product security, hiring for those companies, you need people who've worked on things in the physical world. 00:05:54.480 --> 00:05:58.399 They've people who've thought about how do I communicate with the robot? 00:05:58.399 --> 00:06:05.839 How like what if the robot's only on Wi-Fi and it goes to take out the trash and it loses its Wi-Fi connectivity standing out at the street corner? 00:06:05.839 --> 00:06:06.480 You know what I mean? 00:06:06.480 --> 00:06:08.480 Like there's so many things that can happen. 00:06:08.480 --> 00:06:11.199 Uh, how do we do software updates over the air? 00:06:11.199 --> 00:06:13.040 Do we allow software updates? 00:06:13.040 --> 00:06:17.839 What type of kind of VPN are we going to use for connecting and communicating with the robot? 00:06:17.839 --> 00:06:22.240 How do we do customer support for a robot inside someone's house? 00:06:22.240 --> 00:06:27.360 Do we allow uh humans to have uh visibility into what's happening with every robot? 00:06:27.360 --> 00:06:29.120 That's pretty crazy. 00:06:29.120 --> 00:06:31.680 You know, so there's there's just a million implications. 00:06:31.680 --> 00:06:33.040 That's what makes it fun. 00:06:33.680 --> 00:06:37.279 How far are we away from that reality, do you think? 00:06:37.920 --> 00:06:47.439 Oh,

I think that there are multiple companies here in the Bay Area that have humanoid robots operating inside households in kind of like pilot programs and things like that. 00:06:48.079 --> 00:06:48.560 Wow. 00:06:48.560 --> 00:06:49.439 Awesome. 00:06:49.439 --> 00:06:51.360 What a what a world to live in. 00:06:51.360 --> 00:06:54.800 Uh wearables and note takers. 00:06:54.800 --> 00:06:56.959 You spoke about it at unprompted. 00:06:56.959 --> 00:07:01.279 Would you mind just summing up what you said at that talk and where you stand on that position? 00:07:01.279 --> 00:07:05.439 Because that's a very uh that's happening right now, whether we like it or not, right? 00:07:05.680 --> 00:07:06.000 Yeah. 00:07:06.319 --> 00:07:06.560 Yeah. 00:07:06.639 --> 00:07:09.600 Well, first of all, um the unprompted conference. 00:07:09.600 --> 00:07:18.079 If anybody hasn't heard of it, who's interested in AI security, all the videos from the conference are live, and there were so many better talks than my talk. 00:07:18.079 --> 00:07:19.839 It was just like so much energy. 00:07:19.839 --> 00:07:30.879 So it was in the context of that that um Gotti, who was running the whole conference, he's like, he and I had written an article a year before on AI note takers. 00:07:30.879 --> 00:07:32.160 We published it. 00:07:32.160 --> 00:07:39.360 And, you know, it was kind of like a first look at all these AI note takers are exploding across all of our meetings. 00:07:39.360 --> 00:07:50.720 You could barely ever join a conference call without somebody's AI note taker jumping in and being part of the attendee list and you know, and and dealing with that and wondering about it. 00:07:50.720 --> 00:07:58.160 I realized this is the first place where AI is actually injecting itself into our daily workflows. 00:07:58.160 --> 00:08:03.680 And it seems like the security team isn't doing anything to put controls in place. 00:08:03.680 --> 00:08:08.240 And and so Gotti and I stepped back and thought about it like, what are the risks? 00:08:08.240 --> 00:08:10.079 And it turns out it's really interesting. 00:08:10.079 --> 00:08:13.920 You know, there are a whole bunch of risks around AI note takers. 00:08:13.920 --> 00:08:18.800 Uh, you know, it's number one it's recording everything. 00:08:18.800 --> 00:08:20.480 And I live in California. 00:08:20.480 --> 00:08:24.560 Do you know if in order for me to record you, I need your consent up front. 00:08:24.560 --> 00:08:28.480 So it's like a legal issue there that like half the country has to deal with. 00:08:28.480 --> 00:08:30.800 Uh, and like, how are you being transparent about that? 00:08:30.800 --> 00:08:35.759 And then it it becomes corporate data, you know, it's like it's and it's sensitive data. 00:08:35.759 --> 00:08:37.039 Where is it being stored? 00:08:37.039 --> 00:08:38.000 Who has access to it? 00:08:38.000 --> 00:08:40.000 Who's doing the rule-based access control? 00:08:40.000 --> 00:08:42.799 And then you start thinking about the security implications. 00:08:42.799 --> 00:08:48.480 Okay, it turns out, and there are actually studies on this, that AI note-takers can be gamed. 00:08:48.480 --> 00:08:59.360 You can prompt inject them, you can manipulate the uh, you know, steer the algorithm so that it thinks that whatever you say is the most important thing from the meeting. 00:08:59.360 --> 00:09:00.399 So the takeaways. 00:09:00.399 --> 00:09:12.159 And so I started digging in, and Guy and I just realized like this this is such a simple, annoying little thing that showed up in our life, but nobody's actually doing the homework around it. 00:09:12.159 --> 00:09:18.080 And like security teams have had like in 2024 and 25 were a little like hands-off around AI. 00:09:18.080 --> 00:09:26.320 And it was like, wait a minute, here's a really easy way for you to kind of get your hands dirty, like dealing with AI from a policy and risk standpoint. 00:09:26.320 --> 00:09:27.759 So we wrote that article. 00:09:27.759 --> 00:09:35.279 I prepared the talk thinking this is just like some little meetup of all of you know a bunch of our friends and to talk about AI. 00:09:35.279 --> 00:09:40.159 I didn't realize it was going to be like the most paid attention to conference of 2026. 00:09:40.159 --> 00:09:47.679 And so I I roll in and I'm doing this little talk on AI note takers that that, you know, and I'm surrounded by these amazing talks. 00:09:47.679 --> 00:09:50.000 And I was like, I should have put more effort into this. 00:09:50.000 --> 00:09:57.759 But actually, I got a lot of positive feedback afterwards that like I've had so many people message me, like, oh, I totally gamed the note-taker at that meeting. 00:09:57.759 --> 00:09:59.519 I was the first person in that meeting. 00:09:59.519 --> 00:10:00.639 No one else was there. 00:10:00.639 --> 00:10:06.159 I told it like five minutes of my thoughts before anybody else showed up, and all my stuff got captured. 00:10:06.159 --> 00:10:13.039 Or I figured out how to uh make it so that the note taker didn't take any notes because I wanted to frustrate everybody. 00:10:13.039 --> 00:10:17.440 Like it, I inspired a bunch of people to do a bunch of annoying things, apparently. 00:10:18.000 --> 00:10:21.679 Have you talked to any of CISOs that actually put any guardrails in place for that? 00:10:22.080 --> 00:10:22.960 Yeah, quite a bit. 00:10:22.960 --> 00:10:25.600 And I'm seeing it more and more in different contexts. 00:10:25.600 --> 00:10:44.799 Like organizations are becoming much more thoughtful and disciplined about like selecting an AI note taker that's going to be their official note taker, prohibiting all the other ones, developing policies for how are you going to deal with when the other company has a note taker, get making sure you request a copy of everything, set it up in such a way that you automatically get those copies. 00:10:44.799 --> 00:10:51.679 So you keep your own independent version of it, giving

the teams guidelines on which types of meetings are okay for note takers and not. 00:10:51.679 --> 00:11:01.360 You know, like I work at a VC part-time, helping them on investing, and they have very clear policies around what you can and cannot use note takers for. 00:11:01.360 --> 00:11:07.519 Yeah, they don't run note takers during board meetings, they don't run note takers during situations where there's attorney-client privilege. 00:11:07.519 --> 00:11:17.279 You know, they they have to be thoughtful about this stuff because we're discovering that like attorney-client privilege gets blown up when AI gets involved sometimes. 00:11:17.279 --> 00:11:22.000 And, you know, the the law in court cases is evolving very quickly there. 00:11:22.000 --> 00:11:40.720 So um not an expert on that side, but it's another example of a situation where we need to when we work on our policies for security, we need to loop in legal and have them part of the process because they're not paying attention to all these AI note takers and the risks that happen with them unless we pull them into the conversation. 00:11:40.720 --> 00:11:48.799 So I I think that we're uh we're getting much more uh official and thoughtful about the use of these note takers. 00:11:48.799 --> 00:12:10.720 Come companies that are in the defense defense tech space that have to comply with CMMC and some of these other really strict government standards have to have even more careful policies around what is and what isn't recorded, how and whether they have to segregate their recordings for you know for the different environments and keep them in separate places and have role-based access control. 00:12:10.720 --> 00:12:16.159 Like there's a lot going on, I think, as as companies have gotten more mature about this stuff. 00:12:17.200 --> 00:12:22.960 I've been in meetings where right when you see it's being recorded, you get kind of scared, but then you also kind of become more professional, at least me. 00:12:22.960 --> 00:12:25.039 That's just like, okay, I'm being recorded. 00:12:25.039 --> 00:12:28.960 Uh what is the worst that can happen, just so that that point is covered. 00:12:29.519 --> 00:12:42.240 I always remember the Sony case from like 12 or 13 years ago when North Korea hit uh Sony in response to them putting out that movie that was uh viewed as derogatory towards their leader. 00:12:42.240 --> 00:12:44.320 Two things happened there, right? 00:12:44.320 --> 00:12:51.600 It was a destructive malware situation where they wiped out a bunch of their systems, but they also dumped all of their email publicly. 00:12:51.600 --> 00:12:58.960 And I remember talking to executives at the time from different companies and talking about like what was the most shocking thing about that to you? 00:12:58.960 --> 00:13:01.360 To me, it was very clearly the destructive attack. 00:13:01.360 --> 00:13:03.919 You know, we weren't in the world of ransomware that we're in right now. 00:13:03.919 --> 00:13:12.399 There had only been a few destructive attacks in history, you know, Saraudi Ramco and uh Las Vegas Sands and maybe the Maersk stuff. 00:13:12.399 --> 00:13:18.240 Like there just wasn't a lot of intentional destruction situations in cybersecurity. 00:13:18.240 --> 00:13:23.440 And and so to me, the Sony case stood for, wow, this is a scary new world. 00:13:23.440 --> 00:13:28.960 I need to be responsible for operational resilience and and really make sure that we we have this together. 00:13:28.960 --> 00:13:42.000 But then I would I talked to a bunch of other executives, like COOs, and I think I even talked to the woman who was the president of Sony who said who she lost her job over the pub public exposure of her emails. 00:13:42.000 --> 00:13:49.600 We say things in meetings, we say things in email that that uh are embarrassing and that we wish never would be seen. 00:13:49.600 --> 00:13:57.360 And so I think, you know, to a lot of executives, that's the scariest thing about these note-taking recordings. 00:13:57.360 --> 00:14:00.480 Uh it's the New York Times test. 00:14:00.480 --> 00:14:06.720 Would you feel comfortable if everything that was in said in all your meetings was put on the front cover of the New York Times? 00:14:06.720 --> 00:14:16.960 And a lot of companies have a lot of notes that have been recorded now that are subject to exposure and litigation and other things, or they could just be leaked or hacked. 00:14:16.960 --> 00:14:24.480 You know, if granola gets hacked, there's gonna be a lot of embarrassed executives in Silicon Valley because they all are using granola to record everything. 00:14:24.480 --> 00:14:28.080 You know, I was experimenting with the limitless uh app. 00:14:28.080 --> 00:14:28.879 I mentioned it. 00:14:28.879 --> 00:14:33.120 Uh I was wearing it on me, even though I didn't have it turned on when I gave that talk. 00:14:33.120 --> 00:14:41.200 Uh I also, you know, I have a plod now, which is a different wearable, because I'm always experimenting with and learning about these things. 00:14:41.200 --> 00:14:44.240 And and everything that they record can be exposed. 00:14:44.240 --> 00:14:45.919 And so there's a lot of risk in that. 00:14:45.919 --> 00:14:50.159 It might be might trigger reporting obligations because it's PII. 00:14:50.159 --> 00:14:55.519 It might trigger reporting obligations because you have contracts with your customers. 00:14:55.519 --> 00:14:58.080 And it it it might just be really embarrassing. 00:14:58.080 --> 00:15:06.639 So there's lots of different risks with this uh anytime we get into a new type of content being stored in our enterprise servers. 00:15:08.159 --> 00:15:10.559 I feel like note takers, that's a very business context. 00:15:10.559 --> 00:15:14.799 And then you have the wearable side, which is, I guess, your whole entire life. 00:15:14.799 --> 00:15:19.919 What is your how do you look at the security or the insecurity around that? 00:15:20.799 -->

00:15:28.720 Well, I think that um we're moving in this direction of being monitored all the time. 00:15:28.720 --> 00:15:35.759 And it's really, I think, uncomfortable to a lot of us who grew up in a privacy first era. 00:15:35.759 --> 00:15:40.559 The idea that um something is gonna be recording everything we do at work. 00:15:40.559 --> 00:15:46.000 Like if you if you look closely, that's the direction the AI first companies are going. 00:15:46.000 --> 00:15:59.759 Like I talk to CEOs who say, I want real-time monitoring of everything that's happening on every machine at my company and every meeting at my company, because we as humans lose a lot of that history and context. 00:15:59.759 --> 00:16:02.000 We talk about stuff and then we forget about it. 00:16:02.000 --> 00:16:08.879 And if I have AI recording everything, then we will get the power and benefit of that. 00:16:08.879 --> 00:16:18.240 You know, I like the call I had before this, I was talking with the head of application security, a company, and we're talking about the implications of AI on how AppSec is changing. 00:16:18.240 --> 00:16:32.799 And one of the things we were talking about is how PRDs uh documentation that we create before we write code, you can't train the AI on it because what we actually built with code for the last 20 years isn't reflected in the PRD or the Jira ticket. 00:16:32.799 --> 00:16:35.519 You know, that's aspirational, and then we go build. 00:16:35.519 --> 00:16:42.559 And so uh we can't actually learn that much from like our history of documentation. 00:16:42.559 --> 00:16:52.799 And so the AI first folks are saying, well, we should be recording everything in real time so we know what actually happened, and then we will be much more effective. 00:16:52.799 --> 00:16:58.480 And you see these stories of companies, you know, like Meta has been in the news for the last couple of weeks. 00:16:58.480 --> 00:17:10.000 This story keeps coming up about how the company asked employees to allow them to be monitored 24, you know, their entire time on the machine so that we can train AI based on its learnings from them. 00:17:10.000 --> 00:17:13.680 And I've heard variations of that from lots of different companies. 00:17:13.680 --> 00:17:23.359 But um, you know, we're moving towards computer vision models that are running, uh, capturing everything that happens on my screen all the time, not just the words being recorded. 00:17:23.359 --> 00:17:24.960 So that's their direction we're going. 00:17:24.960 --> 00:17:33.039 So I I think we're also coming at it at the same time from a consumer standpoint where multiple companies are putting out these glasses. 00:17:33.039 --> 00:17:40.799 Obviously, you know, the Meta Ray Band glasses and the Oakley's, you know, Snap has their spectacles, and there are a bunch of other ones that are coming out. 00:17:40.799 --> 00:17:45.680 We've heard that uh Apple wants to have cameras on the AirPods. 00:17:45.680 --> 00:17:56.559 Like

there's lots of different wearable things happening coming at us from different directions with the idea that AI needs to consume all of this. 00:17:56.559 --> 00:18:01.119 And then remember, we started this conversation talking about robots. 00:18:01.119 --> 00:18:07.519 Uh humanoid robots, they need to function in the physical 3D world. 00:18:07.519 --> 00:18:12.319 Something I've been thinking about a lot is how every data center is full of 2D data. 00:18:12.319 --> 00:18:17.279 You know, most of the stuff that's been stored in data centers for the last couple of decades is about code. 00:18:17.279 --> 00:18:21.920 It's about words, it's about videos, it's about things we watch on a screen. 00:18:21.920 --> 00:18:30.079 Um, there's not a lot of data in data centers about how a waiter moves through a restaurant or how a waitress brings coffee to a table. 00:18:30.079 --> 00:18:37.519 But if we want to bring humanoid robots into restaurants, we need to actually map out all of that stuff and create the training data. 00:18:37.519 --> 00:18:40.079 There's only so far you can get with synthetic data. 00:18:40.079 --> 00:18:49.039 And so we're gonna see, you know, at restaurants, they're gonna start wearing wearable glasses to record more of what's happening. 00:18:49.039 --> 00:18:51.519 And so every time you sit in a restaurant, you're gonna be recorded. 00:18:51.519 --> 00:18:52.720 How are you gonna feel about that? 00:18:52.720 --> 00:18:59.519 You know, in the same way as we go through airports, we're recorded constantly now, or certain cities are we recorded all the time. 00:18:59.519 --> 00:19:03.680 Like the amount that we're recorded uh is gonna go up and up and up. 00:19:03.680 --> 00:19:18.240 And, you know, I was reading an article last night about Flock, which is capturing data on vehicle traffic and its impact on reducing crime, is like the statistics are overwhelmingly positive when you roll it out, how much uh crime goes down. 00:19:18.240 --> 00:19:27.039 But on the flip side, uh the communities are backlashing against products like that right now because it feels like we're moving more into surveillance state. 00:19:27.039 --> 00:19:39.519 I think meeting note takers are just like scratching the surface of this new world that we're heading into, where society hasn't really put down its foot and said, like, here's the line. 00:19:39.519 --> 00:19:53.119 And in fact, as someone who spent a lot of time traveling around the planet and being in different countries, like we all philosophically, on a country by country basis, have very different perspectives on government uh visibility into our private lives. 00:19:53.119 --> 00:20:03.119 In the United States, I think we we are absurdly comfortable with letting corporations take access to a lot of our personal data, and we are very uncomfortable with our government. 00:20:03.119 --> 00:20:14.000 Whereas I found like it's a gross generalization, but I found the opposite to be true in Europe, where we're much more comfortable with government access to our data and very uncomfortable with corporate access to our data. 00:20:14.000 --> 00:20:17.519 And it's a sliding scale in every country where it's slightly different. 00:20:17.519 --> 00:20:28.000 But AI is going to force us to have a bigger conversation about this more consistently because the ground's shifting beneath our feet right now really quickly. 00:20:28.400 --> 00:20:29.920 Is anybody having those conversations? 00:20:29.920 --> 00:20:32.319 This is the first conversation I'm having about it. 00:20:33.279 --> 00:20:44.240 Well, I I I I go back to, you know, when I wrote uh Gaudi and I wrote the original article, we were thinking about it in this very micro context of like all of our meetings are suddenly becoming recorded. 00:20:44.240 --> 00:20:52.880 And as you said, it's the first few times you roll into a meeting and you pop open the uh the video recording conf stuff and you realize you're being recorded. 00:20:52.880 --> 00:20:58.240 For like a second there, you're like, uh Should I say something? 00:20:58.240 --> 00:20:59.440 Should I say something? 00:20:59.440 --> 00:21:00.400 Should I block it? 00:21:00.400 --> 00:21:01.519 Should I be opposed to it? 00:21:01.519 --> 00:21:03.200 What's the what how should I feel about this? 00:21:03.200 --> 00:21:05.920 And then five minutes later you forget and you're just doing your meeting, right? 00:21:05.920 --> 00:21:08.799 And then you get the meeting notes and you're like, oh, this was useful. 00:21:08.799 --> 00:21:17.119 Oh, and then you're like, oh, I'm glad that it didn't capture those for that five-minute chat at the beginning where we were talking about my weekend and how hungover I was, or whatever it was. 00:21:17.119 --> 00:21:17.920 You know what I mean? 00:21:17.920 --> 00:21:26.799 Like, there's a lot of us just kind of like flipping through it really fast and accepting the new normal because it's incremental. 00:21:26.799 --> 00:21:34.880 And it's but it's gonna keep being incremental until it's massive in in terms of the amount of change that's happened. 00:21:34.880 --> 00:21:43.519 In the corporate context, it's easy for the CEO and everyone to see like this is like increasing our productivity and our throughput as an organization. 00:21:43.519 --> 00:21:44.480 We got to do this. 00:21:44.480 --> 00:21:48.640 If we don't if if our competitors are doing it and we're not, then we're gonna lose. 00:21:48.640 --> 00:21:53.359 And so, like everything tilts towards adoption of these things. 00:21:53.359 --> 00:21:59.680 Uh and um, you know, in the personal wearables, I think we're a little bit behind the you. 00:21:59.680 --> 00:22:09.440 You know, the effective corporate wearables, if we call these meeting note takers wearables to a certain extent, we got a ways to go on the on the non-business side. 00:22:09.440 --> 00:22:12.079 But lots of people are embracing and using these technologies. 00:22:12.079

--> 00:22:18.480 And you know, a lot of these cars that are around us, think about how many cameras are on a Tesla that are recording us all the time. 00:22:18.480 --> 00:22:28.240 How frequently does Tesla get subpoenaed by law enforcement for a crime that happened within a a a distance of a Tesla, even though the Tesla had nothing to do with the crime. 00:22:28.240 --> 00:22:33.519 Uh, you know, storekeepers with their cameras are getting subpoenaed all the time. 00:22:33.519 --> 00:22:37.359 Like a lot of of our life around us is being recorded already. 00:22:37.359 --> 00:22:45.279 You know, the ring doorbells, the nest doorbells, lots of data is starting to accumulate around us. 00:22:45.279 --> 00:22:47.440 Uh, and it's it's not slowing down. 00:22:47.440 --> 00:22:48.880 So it's kind of scary. 00:22:48.880 --> 00:22:51.920 And it and it just means that we have to be intentional about it. 00:22:51.920 --> 00:22:54.160 And that's what was the the core point. 00:22:54.160 --> 00:22:58.319 Like, we didn't set out to write like the uniform policy for all companies. 00:22:58.319 --> 00:23:01.440 What we were trying to do is just get everybody to pay attention to what's happening. 00:23:01.440 --> 00:23:04.240 And that was the point of the talk, too. 00:23:04.240 --> 00:23:20.799 Uh, you know, when I did the talk at unprompted, I probably spent like a third of the talk at the beginning and end just trying to like zoom out and say, like, no-takers is is our first opportunity to exercise our brain around risk and and and culture. 00:23:20.799 --> 00:23:25.680 But like, this is a much bigger conversation that we need to be having over the next couple of years. 00:23:26.880 --> 00:23:29.279 AI kind of got dumped on security, I feel like. 00:23:29.279 --> 00:23:29.920 I'm not sure. 00:23:29.920 --> 00:23:31.359 Would you would you agree on that? 00:23:31.359 --> 00:23:40.480 That AI sort of has fallen in the hands or the responsibility of security leaders, or how's that look for you? 00:23:40.960 --> 00:23:46.160 Yeah, I would say two years ago, CISOs were in the AI is not my problem. 00:23:46.160 --> 00:23:51.359 Uh, and that it's done a it's been a 180 degree swing in 2026. 00:23:51.359 --> 00:23:53.279 And it was fairly predictable. 00:23:53.279 --> 00:23:58.400 I was telling everybody this that, you know, security leaders should be owning AI risk. 00:23:58.400 --> 00:24:01.359 Uh, like look at it from a CEO standpoint. 00:24:01.359 --> 00:24:07.440 Yeah, if I'm a CEO of a company, I need somebody who's driving innovation, so I've got a CTO and a CIO. 00:24:07.440 --> 00:24:14.160 I've I need somebody who's driving revenue, so I've got my business leaders, my chief revenue officer, my salespeople. 00:24:14.160 --> 00:24:18.319 I need people who are like keeping track of what's working and not. 00:24:18.319 --> 00:24:21.279 And that's HR and finance and legal. 00:24:21.279 --> 00:24:26.559 Uh, you know, and legal and finance also are responsible for

managing sites of risk. 00:24:26.559 --> 00:24:32.160 But like the typical business in 2026 has a lot more technical risk than ever before. 00:24:32.160 --> 00:24:36.960 Like one of the biggest risks for companies is uh a ransomware takedown. 00:24:36.960 --> 00:24:42.160 Look what happened to Jaguar Land Rover last year, Marks and Spencer or Kupang. 00:24:42.160 --> 00:24:57.440 There's so many of these companies that have been hit by ransomware, and the operational impact is that their factories shut down, their supply chain uh went out of business, uh, their customers were left unable to get their cars repaired or even buy a car. 00:24:57.440 --> 00:25:02.079 And so security has become much more important, cybersecurity. 00:25:02.079 --> 00:25:05.200 And then you look at all this AI transformation stuff. 00:25:05.200 --> 00:25:10.160 The CEO doesn't want to hire another technical risk leader to manage AI risk. 00:25:10.160 --> 00:25:12.640 So they're turning to the CISO because that's been their job. 00:25:12.640 --> 00:25:16.000 Your job is to make sure that all the technology doesn't destroy us. 00:25:16.000 --> 00:25:23.839 Like it's it shouldn't be like, I need to hire someone who makes sure that the AI technology doesn't destroy us is different from cybersecurity. 00:25:23.839 --> 00:25:27.680 It's not that different in the in the eyes of the board and the CEO. 00:25:27.680 --> 00:25:29.359 It's a form of technical risk. 00:25:29.359 --> 00:25:32.240 I want one person, one neck to choke. 00:25:32.240 --> 00:25:34.640 And so that's become the security leader. 00:25:34.640 --> 00:25:51.440 The interesting twist, I think, that we didn't anticipate as much is that CEOs are also turning to the CISOs and the security leaders to help drive the innovative change in AI, because a lot more security leaders also own IT than did a decade ago. 00:25:51.440 --> 00:26:04.799 That is 100% a trend that we see in Silicon Valley is that young companies, like when I go in and build help build security, I'm typically building IT as well, and it's all sitting under a technical security person. 00:26:04.799 --> 00:26:12.960 Many of the IT leaders and modern companies grew up in security rather than IT and have responsible responsibility for both now. 00:26:12.960 --> 00:26:24.160 Uh traditional larger companies still have that CIO, but they've been getting squeezed uh and their roles have gotten narrower with, you know, the SaaS and cloud infrastructure. 00:26:24.160 --> 00:26:29.119 So those um CIOs have smaller organizations and less budget for innovation. 00:26:29.119 --> 00:26:39.759 Uh and yet in 2026, the biggest pressure on every company is to integrate AI and evolve how your workforce uses technology to be, you know, effective. 00:26:39.759 --> 00:26:43.839 So a lot happening right now and a lot of pressure on CISOs. 00:26:44.400 --> 00:26:47.039 You make me realize come to a lot of realizations today. 00:26:47.039 --> 00:26:50.480 We've always been, I

mean, I've only been security for like 10 years. 00:26:50.480 --> 00:26:53.759 But when I started in security, it was like, yeah, nobody listens to us. 00:26:53.759 --> 00:26:56.160 We deserve more power or more influence. 00:26:56.160 --> 00:27:02.880 And boom, I did I just realized now one of my clients, the, you know, my the CISO now became the CTO. 00:27:02.880 --> 00:27:23.839 Uh I guess my question to you now is having been through what you've been through, how do you, for those that aren't comfortable with taking that responsibility and that risk, like how should a CISO handle their new job responsibility that they weren't that they aren't aware that they have or haven't been given or paid for? 00:27:24.799 --> 00:27:30.160 Yeah, I I think that uh it's a huge opportunity and we have to rise up to it. 00:27:30.160 --> 00:27:43.119 This is uh you're right, it's what we've always been asking for is to get a seat at the table and to be able to have influence in the direction that the whole organization goes. 00:27:43.119 --> 00:27:45.440 So this is our this is our chance. 00:27:45.440 --> 00:27:46.799 We have to step up. 00:27:46.799 --> 00:27:49.839 And if we do, the rewards are will be there. 00:27:49.839 --> 00:27:52.720 If we don't, someone else is gonna step up. 00:27:52.720 --> 00:28:00.960 Uh it's just a it companies need people, governments need people who are gonna step up and and and take responsibility in the space. 00:28:00.960 --> 00:28:08.000 And if the if our best people don't do it, then blessed good people are gonna do do it, and that's not gonna be good for anybody. 00:28:08.000 --> 00:28:12.400 Because, you know, there's always somebody who's willing to take the role, even if they're not qualified. 00:28:12.400 --> 00:28:22.640 And I'd rather have the people who have the experience uh and the judgment uh have the confidence to take the role and and believe in themselves. 00:28:23.440 --> 00:28:28.000 What are you talking to CISOs all the time in your in your through a company? 00:28:28.000 --> 00:28:29.279 What are they asking me of you? 00:28:29.279 --> 00:28:32.480 Is it more personal or more technical, the the questions you're being asked? 00:28:33.279 --> 00:28:34.240 It's both. 00:28:34.240 --> 00:28:42.319 Um it's both, you know, when I first started, we would I would get together with other CISOs and they'd be like, I don't get to present to the board. 00:28:42.319 --> 00:28:43.920 I never even talk to my CFO. 00:28:43.920 --> 00:28:50.799 I I'm buried under the CIO, and I just get a budget that's not good enough, and nobody asks me my opinion. 00:28:50.799 --> 00:28:52.720 Like that world's long gone. 00:28:52.720 --> 00:29:00.799 Now you see um the Treasury Department called the CEOs of all the biggest banks to Washington, D.C. 00:29:00.799 --> 00:29:02.720 two or three weeks ago. 00:29:02.720 --> 00:29:05.599 And why were they called to DC? 00:29:05.599 --> 00:29:08.000 To talk about cybersecurity. 00:29:08.000 -->

00:29:14.400 If you're the CEO of a bank, are you gonna show up and say, I don't even know who my CISO is. 00:29:14.400 --> 00:29:15.279 I've never met them. 00:29:15.279 --> 00:29:22.480 You're gonna show up and you will have you're gonna have your CISO on speed dial because you're you need to be fully briefed for that meeting. 00:29:22.480 --> 00:29:33.759 You need to come across as having your act together and that this so, like, uh it's funny, a couple of years ago I wrote uh an article kind of like as a retrospective on my case. 00:29:33.759 --> 00:29:35.759 I said the CEO is next. 00:29:35.759 --> 00:29:41.440 Because I was talking about how regulatory scrutiny is moving from the CISO to the CEO and the board. 00:29:41.440 --> 00:29:44.559 It's happened. 00:29:44.559 --> 00:29:51.599 CEOs are the one, you know, when when United Healthcare had their situation, it was the CEO who got yelled at before Congress, not the CISO. 00:29:51.599 --> 00:29:58.079 Uh when Treasury called the the large banks, they didn't ask for the CISOs, they asked for the CEOs. 00:29:58.079 --> 00:30:13.039 The expectation is that the CEO has a trusted conciliary for security, that they are working closely with them, making sure that they're supported and resourced, and the CEO is calibrating risk against all the other risks to the company. 00:30:13.039 --> 00:30:16.480 So it's a it's just a fundamentally different world in 2026. 00:30:16.480 --> 00:30:21.599 And it's uh and I think it's a great time to be in security because of that. 00:30:22.480 --> 00:30:29.359 I know a guy who has uh contributed to that new world we live in where the CISOs aren't getting yelled at anymore, it's a CEO. 00:30:29.359 --> 00:30:31.519 Uh I'm looking at him right now. 00:30:31.519 --> 00:30:34.480 So thank you for taking that one on the chin for all the CISOs out there. 00:30:34.480 --> 00:30:36.559 Uh one last question for you. 00:30:36.559 --> 00:30:46.240 Since I and you're a part of all these really cool startups that are revolutionalizing a part of the security stack using new AI technologies. 00:30:46.240 --> 00:30:53.039 Is there any area of the portfolio that you think AI is especially outperforming that anybody listening should go take a look at? 00:30:53.039 --> 00:30:56.319 I know that you're working with like AppSec and a bunch of different areas. 00:30:56.720 --> 00:30:57.359 Yeah. 00:30:57.359 --> 00:31:07.440 I it's one of the questions I uh ask every security leader when I'm working with them is are you f are you changing who you're hiring uh in 2026? 00:31:07.440 --> 00:31:13.119 Have you changed the job descriptions for your roles in 2026 because of AI? 00:31:13.119 --> 00:31:24.160 And in 2025, the answer was mostly no, I'm still hiring, you know, I'm I'm hiring detection engineers, I'm hiring AppSec engineers, I'm hiring compliance people. 00:31:24.160 --> 00:31:26.400 In 2026, the answer is changing. 00:31:26.400 --> 00:31:30.880 I'm hiring I'm hiring people who are really good using AI. 00:31:30.880 --> 00:31:34.160 I'm rethinking we're everyone's a builder now. 00:31:34.160 --> 00:31:36.079 I heard that on my last meeting. 00:31:36.079 --> 00:31:38.960 Everyone, you know, that was a security leader. 00:31:38.960 --> 00:31:41.119 So everyone is a builder now. 00:31:41.119 --> 00:31:44.880 Uh because and AppSec is a really great example. 00:31:44.880 --> 00:31:57.200 Like if we step back and and if I said to you or you said to me, what job has fundamentally changed more because of AI than any other job, I would say software engineer. 00:31:57.200 --> 00:32:06.720 Like so far, software engineer's job in 2026 is is more different than it was in 2023 than any other job because of AI, right? 00:32:06.720 --> 00:32:20.400 A lot of jobs like we're 20% better, we're using these like very cut still kind of primitive AI tools, we're we're experimenting with agentic solutions, but coding is so far ahead. 00:32:20.400 --> 00:32:25.440 Like the software engineer role at most companies has changed a lot. 00:32:25.440 --> 00:32:30.880 And so if you're the security team that's doing application security, what have you seen in 2026? 00:32:30.880 --> 00:32:44.960 You've seen that the volume of code that engineering is cranking out has gone up by like it hasn't doubled, it hasn't tripled, it's gone from like 250,000 lines of code to 2.5 million lines of code in a month. 00:32:44.960 --> 00:32:49.039 That's that's how significant the the volume change has been. 00:32:49.039 --> 00:32:54.960 And it's not like engineering has hired 10 times more people, they're just like cranking out 10 times more code. 00:32:54.960 --> 00:32:57.759 So how does the security team deal with that? 00:32:57.759 --> 00:33:12.319 The old kind of like, all right, we're gonna do our scanners, we're gonna do some manual code review, we're gonna like try and do some threat modeling, we're gonna hire some pen testers and we'll rely on bug bounty to find the rest. 00:33:12.319 --> 00:33:18.160 Like every every part of that is being stressed and reimagined right now. 00:33:18.160 --> 00:33:33.839 And like I'm on the board of an app sec company, and it feels like uh what customers want from an app security tool is uncertain in 2026. 00:33:33.839 --> 00:33:35.920 Like everything's evolving there. 00:33:35.920 --> 00:33:41.359 Uh what are the frontier model companies that are building these AI coding solutions? 00:33:41.359 --> 00:33:45.680 What are they gonna kind of like suck into their uh kind of solution? 00:33:45.680 --> 00:33:50.319 What's gonna be left for AppSec companies and AppSec teams to do? 00:33:50.319 --> 00:33:52.000 It's not it's not clear yet. 00:33:52.000 --> 00:33:58.240 Whereas the coding tools have gotten really good at coding, they haven't gotten really good at vulnerability remediation yet. 00:33:58.240 --> 00:34:05.440 And in fact, we're finding more vulnerabilities than ever, but the we're not getting any more efficient at fixing

them yet. 00:34:05.440 --> 00:34:18.000 And so every security team is like throwing a lot, like pulling a lot of resources off of other things and putting them in vulnerabil vulnerable remediation in 2026, but it's still too manual. 00:34:18.000 --> 00:34:26.320 Uh and it's still on unclear like what you should what stack you should have for your app sec team in 2027. 00:34:27.360 --> 00:34:29.519 Have you met anybody that's done anything novel there? 00:34:29.840 --> 00:34:30.079 Yeah. 00:34:30.079 --> 00:34:38.639 I most of the companies that are doing it well are investing in building kind of harnesses, I think is the terminology everyone's using right now. 00:34:38.639 --> 00:34:47.519 But think of it as basically the the structure around the model to make the model effective in your environment. 00:34:47.519 --> 00:34:49.679 Uh that's part one. 00:34:49.679 --> 00:34:54.079 Part two is building out kind of like some sense of internal context. 00:34:54.079 --> 00:35:02.159 Like looking at code in the abstract after it's written, you're not going to identify all the most important vulnerabilities. 00:35:02.159 --> 00:35:07.840 It's only in the context of like the infrastructure and the environment that you really come to understand. 00:35:07.840 --> 00:35:10.719 Like it's one thing to identify there's a vulnerability. 00:35:10.719 --> 00:35:14.320 It's another thing to understand where where the fix should be applied. 00:35:14.320 --> 00:35:20.960 Should it be applied right down, you know, right there in the code right there, or is this something that should be fixed as a systemic level? 00:35:20.960 --> 00:35:31.440 That's where the app sec engineers, you know, with experience are adding a lot of value and that we're gonna have to continue to see that like people aren't stopping hiring app sec engineers. 00:35:31.440 --> 00:35:32.000 It's the opposite. 00:35:32.000 --> 00:35:39.920 AppSec engineering roles are uh becoming even harder to fill, and the people who are good at that are getting paid more than ever. 00:35:39.920 --> 00:35:44.000 So there are definite things that organizations can do. 00:35:44.000 --> 00:35:52.400 Like that, you know, Cloudflare came out with a blog post earlier this week that a lot of people thought was interesting because it talked about essentially how they built the harness for Mitos. 00:35:52.400 --> 00:35:57.920 Uh that's exactly the type of thing that lots of companies should have been doing and should be doing. 00:35:57.920 --> 00:36:04.000 And I I saw somebody else just took Cloudflare's blog post and threw it in Claude and said, build me what Cloudflare has. 00:36:04.000 --> 00:36:15.360 I don't know that you're gonna get there with with that, but uh you that's the direction that people should be thinking, you know, instead of just waiting for for someone else to solve the problem for them. 00:36:16.800 --> 00:36:21.920 Do you have any other closing thoughts that you'd like to leave whoever's listening to

this with? 00:36:22.800 --> 00:36:23.199 Yeah. 00:36:23.199 --> 00:36:29.039 I I I think if you you could take this conversation and you could be like, wow, this is a scary place. 00:36:29.039 --> 00:36:37.280 2026, AI is disrupting everything that's happening in in the business world, and you could be like discouraged by that. 00:36:37.280 --> 00:36:42.079 Or you could listen to the conversation and then think, wow, this is a great opportunity. 00:36:42.079 --> 00:36:48.159 You know, AI uh is is opening up opportunities for a lot of us to do things that we haven't done before. 00:36:48.159 --> 00:36:52.559 Like, like that person said to me this morning, um, my whole team is builders now. 00:36:52.559 --> 00:36:57.840 Security people didn't get to think of themselves as builders before, but being a builder is is is fun. 00:36:57.840 --> 00:36:58.960 It's exciting. 00:36:58.960 --> 00:37:08.480 Uh, you know, oftentimes the security team is culturally not aligned with the rest of the company because the rest of the company is building something and the rest of the company gets excited when they ship a product. 00:37:08.480 --> 00:37:14.800 Security team feels like unrecognized, uh, disconnected from like the business success. 00:37:14.800 --> 00:37:33.599 Uh, this is our chance to be part of the team that's building for the company uh and to reframe where we sit uh in in a way that's positive and that will get us more resources and more support and ultimately more secure products that can you know distribute out to the world, which is what we that's why we get up every day. 00:37:33.599 --> 00:37:38.960 So uh I think in 2026, we can't get discouraged by the pace of change. 00:37:38.960 --> 00:37:50.719 We should get excited, we should be embracing it, we should find our curiosity, uh, and we should be uh setting aside time every week to explore and experiment and to grow and not just do work. 00:37:52.159 --> 00:37:53.440 Man, it's Friday. 00:37:53.440 --> 00:37:55.679 It's the first day of summer out here in London. 00:37:55.679 --> 00:38:00.480 I just had a podcast for Joe Sullivan and ended on a lovely, great, happy note. 00:38:00.480 --> 00:38:08.000 Thank you so much for your time today and for everything you do for your Ukraine, everything you do for the security community and everything you've done for CISOs out there. 00:38:08.000 --> 00:38:11.679 Thank you so much, Joe, and take care of yourself and have a lovely weekend. 00:38:11.679 --> 00:38:12.480 You too. 00:38:12.480 --> 00:38:13.760 Thanks for having me on. 00:38:13.760 --> 00:38:14.880 Thanks. 00:38:15.920 --> 00:38:17.760 Well, that's all for today, folks. 00:38:17.760 --> 00:38:20.480 Thank you for tuning in to the mnemonic security podcast. 00:38:20.480 --> 00:38:29.920 If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us a mail to podcastnemonic.no. 00:38:29.920 --> 00:38:31.679 Thank you for listening. 00:38:31.679 --> 00:38:33.360 We'll see you next time.