Bản chép lời đầy đủ của Secure Vibe Coding and the 99%

IT, software engineering, development, cybersecurity is uh evolving. 00:04:07.280 --> 00:04:12.080 And speaking of evolving, like I was looking into the everyone's familiar with lovable, I think most people are. 00:04:12.159 --> 00:04:20.079 Uh and I know you guys had a massive like uh Series C announcement recently, uh insane valuation, incredible growth in terms of revenue and ARR, things like that. 00:04:20.160 --> 00:04:27.360 Uh and I read that the team I think is is you know expanding from you know uh several hundred folks to hundreds of more by the end of the year. 00:04:27.439 --> 00:04:44.639 And I was thinking like from the CISO's perspective, like you know, before we get into lovable, the platform and the you know kind of vibe coding and all that, uh, how do you think about that in it as a CISO internally in the enterprise of like, you know, you guys are getting ready to onboard hundreds of more employees and staff, and you know, that comes with an incredible amount of you know security concerns and considerations as well. 00:04:45.040 --> 00:04:47.600 When I joined, we were around 40 people, right? 00:04:47.759 --> 00:04:51.920 Now we are like we have 400 laptops in MGM system. 00:04:52.000 --> 00:04:53.839 That's like that's the real count of things. 00:04:54.000 --> 00:05:02.000 So that includes contractors, that includes uh different types of workers, but again, like we're dealing with 400 entities and we are not stopping our growth. 00:05:02.160 --> 00:05:13.680 So I will not tell you the end goal targets for like hiring and growth, uh, or at least like open head counts, but we are we are expanding massively and you know within the year to grow almost 10x, right? 00:05:13.839 --> 00:05:16.399 Not like this is this is the 10x uh company. 00:05:16.639 --> 00:05:20.480 The famous 10x engineer is already a reality, people building with AI. 00:05:20.639 --> 00:05:26.879 Now we are a 10x company that you know you join it in one state one year after it's 10x uh from its previous state. 00:05:27.040 --> 00:05:32.959 And I think we actually we've been like two or three different companies on that way because you join like early stage startup, right? 00:05:33.199 --> 00:05:37.920 Then suddenly you end up in like 100 people company, and that's I think where things start to break. 00:05:38.079 --> 00:05:49.519 And I think this is like like there are some milestones to every company, and I think as a CISO we should always like acknowledge that you know, we don't do our work in some kind of vacuum or like a theoretical space, right? 00:05:49.600 --> 00:05:55.600 It's always practical, it's always who are we protecting, uh, what we're protecting, what we're protecting against. 00:05:55.759 --> 00:06:05.920 And when you're like 40, 40 people company, you have different types of adversaries compared to you know 400 and having all this massive announcement being on like all these front pages and so on. 00:06:06.079 --> 00:06:10.000 So overall, it's

been a very um very wild ride. 00:06:10.160 --> 00:06:16.639 I think what helped a lot is, of course, one is understanding where the business is going, and we've seen the numbers, right? 00:06:16.720 --> 00:06:18.800 We've seen the numbers before anyone else. 00:06:18.959 --> 00:06:25.199 We could project that you know, if we don't mess up, we will be in a year, we will be 10x company, right? 00:06:25.279 --> 00:06:28.319 So that was that's that's crazy, but it's also expected. 00:06:28.480 --> 00:06:36.399 So as a CISO, you just need to build your company, so build your security program to cater for probably 15x company, right? 00:06:36.480 --> 00:06:41.920 If you expect to be 10x, if you like add extra on top for extra resilience, then you'll be fine. 00:06:42.079 --> 00:06:43.600 Uh, did we succeed at that? 00:06:43.759 --> 00:06:48.000 I think at some points, yes, at some points, you know, I wish we did things differently. 00:06:48.160 --> 00:06:52.639 Uh, but I think one uh one area where we grew more than 10x is hiring. 00:06:52.720 --> 00:06:58.720 So we went from one person to like I think with all the offers sent out, we have like 25-ish now. 00:06:58.879 --> 00:07:00.800 So we grew almost like 25x. 00:07:00.879 --> 00:07:05.600 And I felt like at different stages of the growth, you know, the growth doesn't go linearly, right? 00:07:05.759 --> 00:07:15.519 Let's say there is a sales motion, there is a new office opening, let's say in the US or in Europe, then you immediately get like plus 50 people suddenly, and then then things start to break, right? 00:07:15.759 --> 00:07:34.319 So I did feel at some uh uh at the feeling at some point in time uh where you know I felt like you know we're at our capacity or like we are so overutilized that no weekend work, no like you know, 24-7 work, or like AI agents cannot help, and we kind of start falling behind. 00:07:34.480 --> 00:07:37.600 And I think you know that's uh that's where two things need to happen. 00:07:37.680 --> 00:07:43.040 You need to still invest in hiring because you know humans drive agents so far, not vice versa. 00:07:43.120 --> 00:07:46.480 Uh so you need good, you need great people in the place. 00:07:46.800 --> 00:07:55.120 Um, and then another thing is of course, you need you need to reinvent yourself, you need to reinvent your team, you need to understand how you work with things, right? 00:07:55.199 --> 00:08:01.839 If you have too many requests around certain areas, right let's figure out what the technology can help us with. 00:08:02.000 --> 00:08:12.959 And AI has been a great helper in that, kind of kind of trying to solve old problems, like new problems for us, old problems for others, probably, um, so that we don't we don't break. 00:08:13.120 --> 00:08:16.560 And again, like necessity is the greatest driver of innovation. 00:08:16.720 --> 00:08:23.519 So I think we've been able to innovate internally around like you know, doing security reviews, uh running IT with very slim team. 00:08:23.600 --> 00:08:47.120 We had one person running our IT for almost a year, for instance, and you know, just trying to break the old stereotypes, like you don't need a team of 50 IAM experts to do certain things, but you do need key people in the key areas that know how to do their job really, really well and also are open to the same notion of okay, we are here all we are all beginners, right? 00:08:47.200 --> 00:08:51.440 We're all experts, but also we are beginners at this AI stage security. 00:08:51.679 --> 00:09:04.559 So let's let's be open, let's not kind of let's not bring our old biases into the workspace, into the solution space, and let's try, you know, some of the solutions they can be extremely simple with AI and they they just drive a lot of value. 00:09:04.799 --> 00:09:07.360 So yeah, we just need to discover them and magic happens. 00:09:07.679 --> 00:09:08.639 Yeah, I love that framing. 00:09:08.720 --> 00:09:14.559 And uh so I was digging into some of your previous interviews and and public, you know, uh discussions you've done and things like that. 00:09:14.720 --> 00:09:21.759 And you had uh a conversation, I believe, earlier this year with the team at Wiz, I think it was, uh, where you used this phrase uh soft guardrails. 00:09:22.000 --> 00:09:27.759 And you you made an argument basically that hard blocks, you know, just create friction that AI existed workflows route around. 00:09:27.919 --> 00:09:33.200 And when I read that, you know, uh it's funny you mentioned DevOps and reinventing ourselves and then learning new ways. 00:09:33.279 --> 00:09:35.279 Uh, because like there's a there's two kind of framings. 00:09:35.440 --> 00:09:42.320 One is soft boundaries or soft guardrails versus like hard boundaries with agents in terms of what they can or can't do in an environment and things like that. 00:09:42.480 --> 00:09:49.840 But I also I thought of, in the sense of DevOps and DevSecOps and things that I've worked on, like like probably similar to you in CSD and all these kind of things. 00:09:50.000 --> 00:09:56.639 When we do implement uh you know these hard blocks within development workflows and things like that, as you said, we just get worked around. 00:09:56.720 --> 00:10:01.200 Uh developers go around us, it proliferates shadow usage, they don't engage us. 00:10:01.279 --> 00:10:04.320 Uh it's like we're almost to our own detriment in terms of security. 00:10:04.480 --> 00:10:15.279 I'm curious like how you were thinking about that phrase when you used it, and then also how you try to, you know, how you try to implement it at levelable, like what uh deserves a hard block versus what you know is a soft, a soft guardrail, for example. 00:10:15.600 --> 00:10:18.799 Yeah, that's uh that's a million-dollar question, right? 00:10:19.039 --> 00:10:29.039 So I think it's uh the the the best the best solutions or the best kind of answers because it's it all depends on what problem are we solving,

right? 00:10:29.440 --> 00:10:36.000 If our developers are moving too fast or too slow, or are we breaking production with our AI agents, right? 00:10:36.080 --> 00:10:37.840 Those are different types of problems to solve. 00:10:38.000 --> 00:10:41.759 Of course, there is some sort of general AI adoption uh problem. 00:10:42.000 --> 00:10:56.399 With AI adoption, I mean let's say you're an enterprise, you've heard a lot about uh how great AI is, you have friends who had managed to build 10x, 20x companies, all great, but now you you need to bring AI into your workspace and workplace. 00:10:56.559 --> 00:10:57.759 Uh, how do you do that, right? 00:10:57.840 --> 00:11:02.879 You need inventory, you need visibility, you need some kind of guardrails, you need to start somewhere. 00:11:03.120 --> 00:11:13.600 Um, so again, like I think my first uh intuitive uh uh approach to this would be just clearly define what are we solving and for whom with the AI, right? 00:11:13.759 --> 00:11:24.399 And I think a lot of this you know token maxing discussions and general, like the AI adoption driven by fear of missing out, FOMO, um, is just wrong from that perspective, right? 00:11:24.559 --> 00:11:29.279 It's not about who uses AI more, it's more like what value do you get out of it. 00:11:29.440 --> 00:11:33.360 And like when looking at you know internal usage of AI at Lovable, right? 00:11:33.440 --> 00:11:34.720 I could see like numbers. 00:11:34.960 --> 00:11:48.399 Some people spend, I don't know, tens of thousands of dollars of to worth of tokens every every month, and some spend just thousands or hundreds, and sometimes you know, like you know, those are all great people, right? 00:11:48.559 --> 00:11:52.000 And there's all great contributors, it's just such different ways of work. 00:11:52.159 --> 00:11:59.759 So, but again, I think AI just emphasizes the need for solved guardrails because previously we lived in a very deterministic world, right? 00:12:00.000 --> 00:12:03.440 So you had static analysis, it was called static for a reason. 00:12:03.600 --> 00:12:04.399 There are rules. 00:12:04.559 --> 00:12:06.960 If something falls outside of the rules, it's not found. 00:12:07.120 --> 00:12:09.919 If the rules find it, you know, there is some pattern matching. 00:12:10.080 --> 00:12:15.279 That was, you know, we can argue whether it worked really well or not, but it was very deterministic, right? 00:12:15.360 --> 00:12:17.279 It's the same result all over again. 00:12:17.440 --> 00:12:20.080 Um, so that was the age of hardware guy rails, right? 00:12:20.159 --> 00:12:32.399 You cannot have an adaptive kind of policy that says, well, I can look at your intention and your job description and at what you're trying to achieve, and probably this is not what you want to do, right? 00:12:32.639 --> 00:12:34.399 This is how humans think, right? 00:12:34.639 --> 00:12:46.799 Let's say you have an intern, and then you you kind of like onboard them into the system or into the your work or their line of work, and then you just sit with them, and then you tell them, okay, probably here you can use it differently, right? 00:12:46.879 --> 00:12:49.360 And that's where uh they become efficient. 00:12:49.519 --> 00:12:52.399 So I could see the soft guard as being something like that. 00:12:52.480 --> 00:13:13.440 So literally like babysitting your your intern, uh, where if there is some sort of AI, LLM judge in place, if there is enough context to understand for what kind of again, what are we achieving, what is the person role, what is the person working towards, or what are we expecting them to work toward work towards, or their agent, right? 00:13:13.600 --> 00:13:15.600 That could be also applicable to their agent. 00:13:15.679 --> 00:13:20.480 Um, then it's easier to identify what are we what should should we allow. 00:13:20.639 --> 00:13:27.440 And the list of allowed things, it's kind of endless in a way, because there are so many different ways to solve a problem. 00:13:27.679 --> 00:13:40.320 And we don't want to limit creativity, especially you know, at places like Lovable, where everything that's built is built because of creativity, like those numbers, serious C, we don't care about them like honestly, that much. 00:13:40.399 --> 00:13:41.759 It's not like the end goal, right? 00:13:41.840 --> 00:13:50.320 The end goal is empowering 99% to be able to build anything, and for that, for uh in reinventing that for understanding how we can get there, it requires a lot of creativity. 00:13:50.399 --> 00:14:05.600 So if I just put hard guy rails saying, okay, no, no, nothing that's you know, outside of this 100 rules, uh, we'll just miss out on a lot of speed, we'll miss out on a lot of opportunities, and great things just will not just happen, you know. 00:14:05.679 --> 00:14:08.960 They they will just, you know, we will not even know they didn't happen. 00:14:09.039 --> 00:14:20.159 We will just see, okay, our quality of you know product, uh or like at least like our numbers, you know, in terms of customer satisfaction and product adoption, they not the same as as before. 00:14:20.320 --> 00:14:27.840 And one of the reasons could be that you know we put too many guardrails, we slow down the creativity, the execution speed too much, right? 00:14:28.080 --> 00:14:33.919 Again, we are all in the security domain, so we all think there is another part to this equation, right? 00:14:34.000 --> 00:14:35.519 We how much risk do we accept? 00:14:35.679 --> 00:14:45.039 And this is, I think, where um where the soft guardrail concept works nicely with um business risk approach. 00:14:45.200 --> 00:14:47.759 So, as a business, you have your goals. 00:14:48.000 --> 00:14:51.039 Like, our goal is clear, we want to enable 99%. 00:14:51.440 --> 00:14:52.320 How do we do it? 00:14:52.480 --> 00:14:53.679 That's secret, of course. 00:14:53.840 --> 00:15:02.639 We won't share like our internal roadmaps and

everything, but still you can draw the line from there to your risks, like risks in your risk registry. 00:15:02.720 --> 00:15:08.960 And from there, you can identify what are the threats coming out of people running AI, right? 00:15:09.200 --> 00:15:21.279 You can understand that because of you know, like kind of how those business goals can be endangered by people running AI without any guardrails, and then you can be like, okay, what what kind of behaviors do we want to promote? 00:15:21.440 --> 00:15:24.000 And you build soft guardrails around them. 00:15:24.159 --> 00:15:32.559 So, and I know I spoke to some uh founder yesterday in the space who are doing something like that, you know, with uh with the guardrails. 00:15:32.879 --> 00:15:34.960 Um, you can build it yourself. 00:15:35.039 --> 00:15:59.360 Um, it just you know, clod uh or um cursor or lovable, you know, with there are always these hooks, there are always ways to understand what's uh what AI is doing or prevent uh next command from executing, you can always send that data to uh to your CM, to your intelligent systems, you put LM judge on top of it, and you provide a lot of context, and then you identify behavioral policies. 00:15:59.440 --> 00:16:08.720 But I do I do have the strong conviction that uh most of the guardrails will be soft guardrails very soon, but we still need hard uh guardrails as well. 00:16:08.879 --> 00:16:16.240 Because as we've seen uh with Hug and Face incident, with other incidents where I agents just they very they're super creative, right? 00:16:16.320 --> 00:16:26.480 So we take human creativity and we multiply it by agent creativity, and sometimes those things, you know, this is where like agent doesn't have good enough judgment to not do something. 00:16:26.639 --> 00:16:32.480 And we need to understand that that would be a great hard guardrail, meaning that this should never happen. 00:16:32.559 --> 00:16:52.000 But again, if we think about that picture with business goals, risks, threats, controls, you know, the whole business risk management uh approach, what should never happen is already coded, codified, and coded somehow into your business risk approach, if it's done correctly, if it's done deeply enough. 00:16:52.159 --> 00:16:53.600 So this is what we were trying to do. 00:16:53.679 --> 00:17:02.720 We're trying to understand like given where we are going, what should AI never be able to do in order for us not to uh fail at where we are going? 00:17:02.879 --> 00:17:09.279 And some of those things would be never escape sandbox, and um, and how do how would AI escape sandbox? 00:17:09.359 --> 00:17:15.119 And there's like you need, of course, to do a lot of work with your security team, with your IT teams to understand those services. 00:17:15.440 --> 00:17:21.119 But I think again, like thinking about trust, which trust boundaries should never be crossed and iterating from there. 00:17:21.200 --> 00:17:29.599 So that would be absolutely like,

for instance, your product uh can have a very powerful CLI that allows very kind of admin level operation. 00:17:29.680 --> 00:17:36.079 So, what happens if you let your agent um run that CLI as a with developer credentials? 00:17:36.240 --> 00:17:37.440 Probably nothing good, right? 00:17:37.519 --> 00:17:47.759 So maybe some good hard guardrail is limiting destructive commands from CLI or entire C like kind of not letting AI to use CLI entirely, right? 00:17:48.000 --> 00:18:04.000 That would be a good example, and then rely on on soft guardrails for more kind of open-ended behavioralistic uh matching of what people should do versus what they shouldn't do to achieve those goals that you also make those guardrails aware of. 00:18:04.160 --> 00:18:06.160 So yeah, that's uh a lot to unpack there. 00:18:06.240 --> 00:18:10.480 You used a phrase that I wanted to kind of um double double down on or kind of go a little deeper on. 00:18:10.559 --> 00:18:12.319 You talked about uh empowering the 99%. 00:18:12.799 --> 00:18:18.240 Um and we've heard this you know uh talked about a lot lately with like uh low-code, no code, citizen development. 00:18:18.400 --> 00:18:22.319 Um, you know, I feel like we've democrated everyone could be a builder, like these kind of phrases, right? 00:18:22.480 --> 00:18:25.119 Uh with AI and development tools. 00:18:25.279 --> 00:18:30.480 You know, and and I I feel like we've democratized development, but we haven't necessarily democratized uh security, right? 00:18:30.559 --> 00:18:38.319 Because it's a specialized domain and you know, it it's not widespread in the sense that everyone can just pick up a tool and do it like you can with you know, kind of creating code in natural language now. 00:18:38.400 --> 00:18:51.200 Um and lovable is in this unique situation where um you have internal security considerations and things like you talked about of scaling the team and the pr in the program and and things like that, but you're also like a platform provider for the community for that for that 99%. 00:18:51.920 --> 00:18:57.359 Um and it reminds me of like the shared responsibility model of the days have passed, uh, you know, in the cloud days, right? 00:18:57.440 --> 00:19:00.319 Uh but it's this new paradigm for AI driven development. 00:19:00.480 --> 00:19:19.759 Um, you know, how do you think of that that shared responsibility model between like, you know, lovable as a platform in terms of your security uh configurations, requirements, you know, baselines, et cetera, and then what is left to the the community, the 99%, who many of whom uh aren't developers by nature or aren't definitely not security practitioners by nature. 00:19:19.839 --> 00:19:20.799 Like, how do you think of that? 00:19:21.200 --> 00:19:24.720 I think about it every day, you know, not joking even. 00:19:24.799 --> 00:19:30.160 And what's interesting, I had this opportunity to see it evolving, right? 00:19:30.240 --> 00:19:42.720 So when I joined, when we were like very limited as a development team, as a security team, we we were trying to understand how can we empower 99%, because that has been the goal from the beginning. 00:19:42.960 --> 00:19:49.119 So when the product was driven by one person, when Anton just and Fabian were starting to create it, right? 00:19:49.200 --> 00:19:51.920 Two people got together, it was the goal back then. 00:19:52.160 --> 00:20:01.599 So at the beginning, we were like, okay, we provide people tools, we provide good tools, we provide good primitives, and people will figure it out, right? 00:20:01.759 --> 00:20:09.680 We tell them there is a security bug in your project, here is a nice button, click here to fix it, and then AI tries to fix it, right? 00:20:10.079 --> 00:20:18.000 What we learned is that uh very low percentage of people took advantage of that opportunity. 00:20:18.319 --> 00:20:20.400 Um, and there were like many reasons to that. 00:20:20.480 --> 00:20:22.720 We ran uh various researches on that. 00:20:22.880 --> 00:20:28.559 Uh one was that people were just um scared to break something that works, right? 00:20:28.880 --> 00:20:32.720 Another was that they were unsure what this all this is all about. 00:20:32.880 --> 00:20:36.480 Kind of, oh, security is scary, security is complicated. 00:20:36.720 --> 00:20:46.400 So for people, it was you know, it wasn't the most obvious thing, and uh they they what we were providing them, they not necessarily use those opportunities. 00:20:46.480 --> 00:20:58.319 So we realize that going kind of to to really empower 99%, we need to be even more responsible for um for the outcomes, right? 00:20:58.480 --> 00:21:04.160 It's not about saying like putting a stamp on the app saying this app is unhackable, right? 00:21:04.240 --> 00:21:05.200 That's impossible. 00:21:05.279 --> 00:21:11.039 We know all that on the secure system is one that is disconnected from any network, put in the Faraday cage, we're not going there. 00:21:11.279 --> 00:21:16.240 Um, but again, like we provide tools, but then there is an extra step to it. 00:21:16.480 --> 00:21:24.880 And um I think it uh kind of the the whole approach evolved around um the kind of the final destination of this. 00:21:25.039 --> 00:21:32.160 Where are we all going with how the would security on a platform like Lovable would look like, let's say in 12 months, right? 00:21:32.240 --> 00:21:44.000 And I have the strongest conviction that um everything um every security like security should be solved as a class of problems on lovable apps. 00:21:44.160 --> 00:21:44.559 Why? 00:21:44.799 --> 00:21:53.519 Because A, we have opinionated stack, meaning that you know we we know where the issues are coming from, we know the tech stack very well. 00:21:53.599 --> 00:22:00.720 Uh AI is very um much um optimized to create certain types of apps, certain Primitives, right? 00:22:00.799 --> 00:22:04.799 So we can provide it with a lot of secure building blocks, which we do

today. 00:22:05.200 --> 00:22:07.599 Then we own, as you say, the full loop. 00:22:07.759 --> 00:22:15.039 So code generation, then we own a deployment, we own runtime, we own the full cycle of application. 00:22:15.599 --> 00:22:19.279 And this means that we can inject security at all levels. 00:22:19.519 --> 00:22:20.880 And we did this experiment. 00:22:20.960 --> 00:22:30.400 We in June this year we released a toggle in the uh in the settings um saying auto-fix security issues, right? 00:22:30.880 --> 00:22:49.759 This is our first step towards that grand vision of security being commoditized or like kind of um taking out like the builders should not worry about it too much, meaning that the platform should do their best to solve it for them, right? 00:22:49.920 --> 00:22:52.000 However, how do we solve it, right? 00:22:52.240 --> 00:22:56.000 The biggest uh value is in asking right questions. 00:22:56.079 --> 00:23:02.160 So it should ask the builder like we we took care of all the um obvious bugs automatically. 00:23:02.319 --> 00:23:04.880 Now there are a few things we want to clarify with you. 00:23:05.119 --> 00:23:07.920 Do you need this table to be private or public, right? 00:23:08.000 --> 00:23:09.200 What are you building, right? 00:23:09.279 --> 00:23:10.400 Let's let's talk about that. 00:23:10.480 --> 00:23:16.559 And based on that, uh the EI can make pretty good decisions about the security model of the application. 00:23:16.720 --> 00:23:22.240 So uh so essentially what we did, we shipped like there is uh behind the scenes, and like you can also find it in the UI. 00:23:22.400 --> 00:23:26.559 There is this every application when being scanned, uh, we build a security model of it. 00:23:26.640 --> 00:23:28.319 So essentially it's a threat model, right? 00:23:28.480 --> 00:23:31.599 Um, so what is important, what can go wrong, and so on. 00:23:31.759 --> 00:23:43.759 Um, and then based on that, we iterate, and then uh when scanners that we also keep developing find issues, if the toggle auto-fix toggle is on, um just issues are being taken care of. 00:23:43.839 --> 00:23:54.079 And since we own the full loop of development, uh we can, if if something breaks, the agent can spot it and fix it uh before user notices, right? 00:23:54.319 --> 00:24:09.359 So essentially we can arrive at self-securing, self-healing software that that you know pipe dream of many because we are in the lucky spot to have all control of all the layers, and we we also put that, you know. 00:24:09.680 --> 00:24:12.640 I think we could have stopped earlier, right, in this journey. 00:24:12.799 --> 00:24:18.079 We could say we could have said, you know, developers, like builders need to learn security. 00:24:18.240 --> 00:24:21.599 Here is the book, here is Madocs, go learn or something. 00:24:21.759 --> 00:24:25.359 Ask your AI agent to fix like secure it for you, right? 00:24:25.519 --> 00:24:28.880 But again, like I think there is some more like societal responsibility. 00:24:29.039 --> 00:24:35.839 So if we give people a tool, tool with so much power, with that comes quite some responsibility. 00:24:36.000 --> 00:24:45.200 So essentially, um, we're looking into solving security in these apps as a thing of its own, right? 00:24:45.359 --> 00:24:51.039 So ideally, there should be no security tab whatsoever in the app, and at least no security scan. 00:24:51.119 --> 00:25:02.240 Because if if if something is can can be found, then AI should be able to immediately fix it, and then the code generated should be as secure as possible from default, from from the get-go, and so on. 00:25:02.400 --> 00:25:20.079 So essentially, the people will be just presented with questions and business questions about their app, they will answer them, and then if we do it right, that the expectation of a person who's building and the result of the build by AI will be the same, right? 00:25:20.160 --> 00:25:22.000 And that's that's the end goal. 00:25:22.079 --> 00:25:31.200 Of course, it's hard to get there, and uh we're spending a lot of a lot of cycles thinking hard about it, but at least that's our conviction that it is possible. 00:25:31.519 --> 00:25:40.240 And as AI and LLMs uh improve, um, we get closer and closer there to improvement also of our harnesses and technology. 00:25:40.400 --> 00:25:41.599 Uh, but it's it is possible. 00:25:42.000 --> 00:25:44.799 Yeah, you said uh several things that really uh resonate with me. 00:25:44.880 --> 00:25:59.680 It's like what you're describing to me uh sounds like one, like leveraging your opportunity as a platform provider to make a systemic impact of security across the ecosystem by things like secure defaults and and making it, as you said, it's almost invisible to the user in many ways. 00:25:59.839 --> 00:26:03.680 Like good security it it rather than being a friction point, it should be almost invisible to the user. 00:26:03.839 --> 00:26:07.599 They don't necessarily it's abstracted from them, at least to the extent that it's possible, right? 00:26:07.759 --> 00:26:26.000 And then the things you were describing, like it really felt like secure by default, secure by design, things that have been championed by like Google and uh um Syssa under Ken Easterly, like these kind of concepts of uh software vendors and platform providers, you know, kind of making it uh invisible to the user and doing the right thing from the onset in terms of design and default configurations and things like that. 00:26:26.160 --> 00:26:40.319 But you also said something I want to ask a little bit about too is um, you know, obviously as a platform provider and what you all do with lovable, you sit a little bit closer to the model layer than maybe some of the you know users in the community, especially non-technical users who don't call kind of follow this so much. 00:26:40.480 --> 00:27:00.480 Um and there's been uh a lot of research on on this from AppSec vendors, from uh academia, you

know, those kind of things that show that when it comes to the code that the models generate, it's still pretty mixed in terms like it's its quality and and capability and functionality has has seen great improvements, but security has kind of stayed somewhat relatively flat. 00:27:00.559 --> 00:27:02.000 And of course, it's a lot of reasons for that. 00:27:02.079 --> 00:27:05.680 It's trending on vast open source data sets that have vulnerabilities and flaws in it. 00:27:05.839 --> 00:27:13.359 Uh maybe the user didn't ask for the right thing in the right way with security context as part of the request to the agent or the you know development tools. 00:27:13.519 --> 00:27:27.359 Um, do you think we'll see a place where the models get so good that it's producing, you know, uh overwhelmingly secure code by default, and or you guys are able to do some of what you said, which is you know, you're kind of fixing it on the fly for the user, so they don't even need to necessarily worry about it. 00:27:27.519 --> 00:27:32.000 How do you think about like like models uh producing secure code kind of implicitly on their own? 00:27:32.400 --> 00:27:33.119 It is possible. 00:27:33.279 --> 00:27:34.480 That's that's my answer, right? 00:27:34.640 --> 00:27:35.279 It will be possible. 00:27:35.359 --> 00:27:38.319 We will see the day where the benchmarks will improve. 00:27:38.480 --> 00:27:52.640 I don't think we'll see 100%, you know, uh, or unless the, you know, it will be kind of the models will uh reward hack the benchmarks and they will know what exact code to produce to get scored, like very, very high scores, which they will absolutely do. 00:27:52.799 --> 00:28:04.240 Um, but in the kind of in the world where we add humans uh creativity to the mix, so we don't know what the human will build, how they will do it, but we know for sure that they will be creative. 00:28:04.400 --> 00:28:12.480 Um, I think um defense in depth is one of my favorite concepts, and this is exactly what we should um strive to build here. 00:28:12.640 --> 00:28:18.000 So essentially we have like at the center we have LLM, and LLM should generate reasonably secure code, right? 00:28:18.240 --> 00:28:27.680 Um, then we have uh the harness, uh we have security scanners, we have different tooling, and we have this loop between the user and the agent. 00:28:27.839 --> 00:28:33.359 So all of that together, it's absolutely possible to achieve secure software, right? 00:28:33.599 --> 00:28:36.319 So of course, like model models can improve. 00:28:36.400 --> 00:28:42.720 Like I feel like if if we're if the models stop developing today, if there's no more improvements, that's it. 00:28:43.119 --> 00:28:43.599 That's it. 00:28:43.839 --> 00:28:47.279 Big ceiling, nothing, nothing gets better, only worse. 00:28:47.440 --> 00:28:54.319 Um, I think we we could still achieve it, but it would be like quite a lot of engineering and fine-tuning and doing specific things. 00:28:54.480 --> 00:29:00.720 Um, but again, like I do I do still think that models have got some some improvement in them, maybe quite a lot. 00:29:01.039 --> 00:29:06.640 So that will that will help to make that core of that onion of defense and depth onion pretty strong. 00:29:06.720 --> 00:29:11.599 So whatever comes out is already secure to a large extent, very large extent. 00:29:11.680 --> 00:29:19.440 But still, I wouldn't I wouldn't uh rely on it as an only security layer in like our like offering, right? 00:29:19.680 --> 00:29:33.279 So with the scanners and the automation and everything that else that we offer, including specific kind of fine-tunes or uh harnesses or um knowledge files for different types of issues, uh we can we can get pretty pretty far. 00:29:33.440 --> 00:29:37.920 And again, but I think the the last missing bit is that auto improvement loop, right? 00:29:38.000 --> 00:29:59.440 Where we finally make the agent to understand what human wants from them and understand how to get there securely and actually look at the all the existing findings so far, generations, uh well, starting from call generation to what the scanners found, and just take it into account and improve, get better, get good at security. 00:29:59.599 --> 00:30:00.559 So that is that is possible. 00:30:00.640 --> 00:30:08.720 But again, there needs to be that part and the dialogue between the creator, the builder, and the agent when some things are unclear. 00:30:08.799 --> 00:30:09.599 Aaron Powell Yeah, well said. 00:30:09.759 --> 00:30:14.400 I think uh you know it's it's funny how a lot has changed, of course, in AI and akintic AI and things like that. 00:30:14.480 --> 00:30:27.279 But fundamental concepts like defense and depth and things you just talked about are still alive and well and will always be alive and well, uh, you know, regardless of the technological changes, like those fundamental concepts or primitives, as you call them earlier, I think are gonna uh persist no matter what. 00:30:27.599 --> 00:30:44.319 And as I said, I dug in some of your uh previous interviews and things you've said, and I hope I'm not misquoting you here, but like what you all do, this capability you provide of that that you know development for the 99%, um, it's amazing, but of course it has some implications for CISOs of organizations uh that find teams internally using these things. 00:30:44.559 --> 00:30:53.920 Like say that, you know, you you've you've said that uh every uh employee vibe coding an app is effectively a new vendor, and that whole departments may start to look like uh mini vendors that you need governance for. 00:30:54.079 --> 00:31:02.079 Uh for a CISO that's listening and discovered you know 40 new internal apps and marketing team spun up with Lovable uh last quarter, for example, like you know, what do they do about that? 00:31:02.160 --> 00:31:07.680 How do they kind of govern and and and secure that uh democratized uh capability within their enterprise?

00:31:08.079 --> 00:31:10.799 Um yeah, there is uh there is an answer to that. 00:31:10.880 --> 00:31:19.920 And uh I think it's a combination of uh platform capabilities, of uh good governance, and the guardrails we um can establish for them. 00:31:20.079 --> 00:31:27.119 Because um I I made another point recently that you know um if like technology is out there, right? 00:31:27.200 --> 00:31:31.359 The the genie is out of the box of out of the lamp, things are happening. 00:31:31.519 --> 00:31:39.519 So what we see a lot, or like a lot of customers come to us saying, like, you know, we've seen people using Lovable uh under the hood, right? 00:31:39.599 --> 00:31:43.279 So we got tired of it, it's impossible to stop, or like other tools, right? 00:31:43.359 --> 00:31:50.160 They can use the same way they can use any AI tool from their personal account, for they can use it on their phone, they can see that work. 00:31:50.240 --> 00:32:02.000 Okay, work does not allow using it, you know, in on their work computer, but they can do something on the phone, like take like you know, make a photo of the screen and then put it in uh Claude or Chat GPT or lovable, like build me a thing around it. 00:32:02.160 --> 00:32:04.559 And the intentions are mostly good, right? 00:32:04.640 --> 00:32:13.039 People are not are not malicious or malign, and they they want to solve problems, they want to be creative, they want to build something. 00:32:13.279 --> 00:32:17.599 So a lot of enterprises realizing well, we don't have other choice. 00:32:17.759 --> 00:32:25.119 We need to provide the technology to people we work with in a controlled manner, and it's all about what uh the platform offers, right? 00:32:25.200 --> 00:32:28.720 And then we've uh we spun up uh we spun up a pretty big team now. 00:32:28.880 --> 00:32:32.880 We were joking like half of the lobable has been working on enterprise security features now. 00:32:32.960 --> 00:32:52.559 Uh but the idea is that uh we looked at everything that people need to uh use AI securely for building websites, uh you know, slide decks, anything you can imagine um internally in the organizations and potentially publishing it on the internet if they want to go there, right? 00:32:52.720 --> 00:33:00.640 And everything like the core to the approach has been kind of the gradual maturation of people and their AI usage, right? 00:33:00.720 --> 00:33:12.640 So you start with people just trying it out by default, everything super private, like you know, in Google Docs, when you create a document, no one sees it, you can write anything you want, even your IT admin will not be able to see it. 00:33:12.880 --> 00:33:16.000 Then you can publish it, you can publish it to your org. 00:33:16.240 --> 00:33:19.039 So, again, pretty limited surface. 00:33:19.279 --> 00:33:24.000 Um people can interact with it if you published it, right? 00:33:24.400 --> 00:33:29.200 You need to be mindful of that, but it becomes kind of an internal information or internal tool. 00:33:29.359 --> 00:33:35.839 And then, of course, you can, if your organization allows it, and that's another kind of governance control that uh is possible to set. 00:33:35.920 --> 00:33:39.359 Uh, if your organization allows it, you can publish it externally on the internet. 00:33:39.519 --> 00:33:42.480 Many don't, many just uh want to play it safe. 00:33:42.640 --> 00:33:47.279 Let's say all the apps should be internal apps, um, which is their choice, right? 00:33:47.359 --> 00:33:56.640 In turn, like at Lowable, we do not have that limitation, but we of course uh we also shipped a lot of um functionality to monitor everything that's been published, right? 00:33:56.720 --> 00:34:15.039 Everything that's been built, um, and spot anything that should not be on the internet, anything that, let's say, we have things like PII scanner, we have things like security scanner, uh, and the combination of being on the internet with uh sensitive PII in it and security vulnerabilities, that's a bad combination, right? 00:34:15.280 --> 00:34:21.360 So we we can prevent uh prevent publishing with vulnerabilities, we can prevent publishing with PII. 00:34:21.519 --> 00:34:27.280 So you see, there's lots of controls, lots of like layers again in this defense and depth and this governance model. 00:34:27.440 --> 00:34:30.000 Uh and I think we just we just need to trust it. 00:34:30.079 --> 00:34:44.400 And we need to trust the combination of or like the total of uh an employee who's trying to do their job well, the AI as a technology that is helping them, and the platform that making sure it happens in the controlled manner. 00:34:44.639 --> 00:34:53.840 And yeah, I mean we are we are doing again, like we've spoke to great uh number of uh CISOs and CIOs about the same topic. 00:34:54.000 --> 00:35:05.039 And all they all they want is pretty much a certain number of controls, and we um we already get in much fewer requests uh than earlier, so it seems like things are working. 00:35:05.199 --> 00:35:17.679 Um and yeah, but I also could uh could summarize it as you know, everyone wants minimal attack surface, everyone wants secure by design, by default code, everyone wants uh minimal blast radius. 00:35:17.760 --> 00:35:27.039 So if you know if this thing explodes, no one else could like no one is hurt, uh, and everyone's wants uh everyone wants a good visibility into what's happening. 00:35:27.360 --> 00:35:34.159 So audit logs, uh application logs, uh, some sort of monitoring and uh alerting on top of that. 00:35:34.320 --> 00:35:47.119 And you know, that's that's it it's a pretty simple formula on the Kai level, but you know it's uh it gets uh tricky as we get to the detail into the details, but again, for every organization, the the answer is a bit different. 00:35:47.280 --> 00:35:49.519 But I think uh those were the main uh rules to follow. 00:35:49.920 --> 00:35:53.519 Yeah, it's a good framing in the sense that uh it's it's

simple, but not necessarily easy. 00:35:53.599 --> 00:35:57.440 The devil's in the details in terms of implementation and execution and things like that. 00:35:57.599 --> 00:36:05.440 Um the speaking of controls, the last couple of questions I wanted to ask you um are a little bit in the vein of uh you know regulation, governance, risk, and compliance. 00:36:05.519 --> 00:36:07.119 One's internal, one's external. 00:36:07.280 --> 00:36:08.800 I'll start with the internal one. 00:36:08.880 --> 00:36:13.039 Um you all have some uh again, you're building out your security team and capabilities pretty quickly. 00:36:13.119 --> 00:36:30.719 Uh you have some folks in my network who I think have joined your team and I think uh seen you and and others speak about uh a concept of uh GRC engineering, which is you know taking governance, risk, and compliance from maybe a paper-based, uh, you know, cumbersome, tedious activity that's not really technical to moving it to more of a engineering discipline. 00:36:30.880 --> 00:36:37.760 Um, you know, how do you think of that concept of GRC engineering in terms of uh how you build that internally at your at your organization at Lovable? 00:36:38.000 --> 00:36:42.880 Like how do how do you guys approach uh governance, risk, and compliance from like maybe from an engineering uh perspective? 00:36:43.280 --> 00:36:43.519 Okay. 00:36:43.679 --> 00:36:46.320 Uh let me take 10 steps back. 00:36:46.480 --> 00:36:53.119 I know it will be a massive detour, but this was something that I've been thinking super hard um for the past week. 00:36:53.440 --> 00:36:58.159 Well, not week, I mean months, but actually putting it in writing and just publishing the blog. 00:36:58.400 --> 00:37:02.320 But my biggest kind of, you know, why are we doing why we why would we exist? 00:37:02.400 --> 00:37:03.679 Why security teams need it? 00:37:03.760 --> 00:37:09.280 Because there are certain threats, there are certain risks out there that can endanger the organizational success, right? 00:37:09.360 --> 00:37:10.639 That's that's our goal, right? 00:37:10.800 --> 00:37:15.760 Not to be in the podcast or like, you know, like build something cool, no one cares, right? 00:37:15.840 --> 00:37:18.719 Like what we really are here, we're like risk reducers. 00:37:18.800 --> 00:37:20.400 Uh, and we need to get it right. 00:37:20.480 --> 00:37:28.960 We need to make sure we do not take too much unacceptable risk, we need to make sure we do um, yeah, we we integrate with how organization works and so on and so forth. 00:37:29.119 --> 00:37:41.199 But now here is a curveball coming our way very quick, or more like asteroids uh um coming at Earth, and now we have to like scramble and shoot it to the down before it hits us, right? 00:37:41.360 --> 00:37:44.079 The asteroid is the AI-powered attackers. 00:37:44.159 --> 00:37:47.440 Um AI-powered attackers are out there to get us all. 00:37:47.599 --> 00:38:09.119 Um, you know, you don't need to be some

kind of guru to understand that, yeah, if you can tell AI um, well, hack or like like just just you know get uh some token from that system, and here's the system which is black box, the AI, unless it has like very good guardrails around it, their base model, it will go and try to invent all possible ways to get in, right? 00:38:09.440 --> 00:38:10.880 Then you can add a harness. 00:38:11.119 --> 00:38:17.119 Let's say you put LLM model and you have a good harness that is optimized for well, red teaming. 00:38:17.280 --> 00:38:18.400 What happens then, right? 00:38:18.480 --> 00:38:30.159 So without much skill, like you don't need to know how SSH works, you don't need to know like how you know, I don't know, binary reversing works, but you now have the superpowers. 00:38:30.239 --> 00:38:37.360 And let's say you have morals that allow you to attack other people's system for profit, right? 00:38:37.519 --> 00:38:42.559 For your own profit, for your own good, um, without asking people about that, right? 00:38:42.880 --> 00:38:49.920 Then what happens is just literally like everyone out there becomes a big threat to a company. 00:38:50.079 --> 00:39:03.440 So AI-powered attackers, uh, with improvement of the models, with democratization of access, with open models like recent Quen model can already run on their pretty powerful gaming laptop, but still it's doable, and you just run from there. 00:39:03.519 --> 00:39:09.840 And it has uh we already seen gel broken uh Quen before that has no guardrails, it has like no filter. 00:39:09.920 --> 00:39:12.000 There are some sometimes there are people like that, you know. 00:39:12.079 --> 00:39:15.599 Now there is a model with no filter whatsoever, uh, pretty scary. 00:39:15.760 --> 00:39:17.440 So it's all coming for all of us. 00:39:17.599 --> 00:39:25.760 And my main kind of uh realization from it was that the one thing that can save us is actually the good old defense and depth approach. 00:39:25.920 --> 00:39:29.920 But with the trick, because previously, how does the defense in depth work? 00:39:30.159 --> 00:39:32.159 And I I promise this will end up with compliance, right? 00:39:32.239 --> 00:39:33.519 There is a compliance in the end. 00:39:33.679 --> 00:39:35.679 So uh, how does defense and depth work, right? 00:39:35.760 --> 00:39:57.280 You have these layers, and a lot of organizations, like at least like from my experience and talking to my colleagues, it was about like, okay, we we have these controls, we have these tools in place, and we can kind of like slap a lot of controls on this layer, a lot of controls on this layer, and then like it would just slow down attackers so much that they will bulk down in the defenses, we will detect them, we will jack them, right? 00:39:57.440 --> 00:40:06.639 So, but overall, like the each layer's performance or quality or perfection of each layer has never been the end goal because we we felt it's enough, right? 00:40:06.719 --> 00:40:07.760 It's good enough. 00:40:07.920 --> 00:40:10.000 But now good enough has changed. 00:40:10.159 --> 00:40:21.280 So now good enough became whoa, that's a person that has never hacked before, now can provision the AI model that has all the hacking knowledge in the world, and it's relentless. 00:40:21.360 --> 00:40:23.440 It's just you know, hacking at the cost of electricity. 00:40:23.519 --> 00:40:26.639 That's essentially what we are looking at with advanced capabilities. 00:40:26.800 --> 00:40:30.559 So if there is a gap in that layer, it will find it. 00:40:30.719 --> 00:40:36.079 And then there is another layer, and if there is a gap in that layer, it will find it, and it will find it, and it will do it pretty quickly. 00:40:36.239 --> 00:40:39.440 So my realization was that okay, we need pretty good layers. 00:40:39.519 --> 00:40:44.320 We need to measure, we need better controls, more intentional, with better coverage. 00:40:44.480 --> 00:40:56.239 So essentially, what we need to build is that each layer should have close to like 99% or 95%, 97%, depends on like where you are, like who's your uh attacker, uh, control efficiency. 00:40:56.400 --> 00:41:02.960 Meaning that if you have MFA, if you have EDR running on your laptops, right, those need to be everywhere. 00:41:03.119 --> 00:41:09.440 You cannot just like run it on just core employees or contractors, but not that group, and so on, right? 00:41:09.519 --> 00:41:21.039 So we need to ensure that the controls really cover what they they should, that we know where the gaps are, and we have a plan to address it, or some kind of mitigating control. 00:41:21.360 --> 00:41:27.360 And we need to be able to ensure like you know measure and validate the efficiency of each layer. 00:41:27.599 --> 00:41:33.679 So, and by doing that, we would enhance the layers and we would make it harder again. 00:41:33.760 --> 00:41:44.880 It's all about uh kind of the the bulking down the attackers and the layers so that we can inject eject them um when we realize okay, somebody's somebody's out there for us at the machine speed. 00:41:45.119 --> 00:41:49.519 Um, so how do we measure the control like how do we measure the control efficiency? 00:41:49.760 --> 00:41:50.880 JRC, right? 00:41:50.960 --> 00:41:52.960 That's that's that's what I was going to. 00:41:53.039 --> 00:42:14.400 So I think this this uh change, like post Metos World, you name it, like there are different um different names to it, or like advanced adversarial AIs, GRC will GRC engineering will shine if if done right, because then you can programmatically understand your layers, you can build like this graph of like what is where. 00:42:14.639 --> 00:42:21.360 If you look at uh you know your compliance uh software model, like that it already has all the data, right? 00:42:21.440 --> 00:42:24.960 You have your risks, you have your vendors, you have your controls. 00:42:25.280 --> 00:42:37.519 If you can kind of put them all into that um model and

understand which layer uh is comprised of what controls and what is their efficiency, like in real life, and what is still missing. 00:42:37.679 --> 00:42:40.400 So look for threats that are not addressed, right? 00:42:40.559 --> 00:42:46.800 Risks that are accepted with too high risk score, and ask yourself is my layer actually uh holding? 00:42:46.960 --> 00:43:12.480 And ask your GRC engineering uh to build the the eval or like the the nice modern word for that, or KPI, the old old school word, uh but some validation score for each layer, and if you can get to the coverage saying, okay, my coverage is 80%, great, get it to 85, then get it to 90 next month, they get it to 99, right? 00:43:12.639 --> 00:43:14.960 And the the farther you go, the harder it gets. 00:43:15.119 --> 00:43:32.239 But overall, um, I think that's uh that's the GRC approach I see as uh helping uh companies because I think GRC has been associated a lot with kind of you know, you build a team, you put it in the dark corner of the office, they do their job, you forget about them because they do their job good, which is great. 00:43:32.400 --> 00:43:34.480 It means they're great, they do their job good. 00:43:34.639 --> 00:43:39.119 Well, but now GRC takes a bit, they're like, hello, we are here, we can help. 00:43:39.280 --> 00:43:42.800 Um, and they should help um kind of put it all together. 00:43:42.880 --> 00:43:46.480 And again, uh I started with this business risk model, right? 00:43:46.559 --> 00:43:48.639 This is where everything is rooted in. 00:43:48.800 --> 00:44:06.320 Um so if we start thinking about the business risks, uh then GRC is the obvious uh um obvious first class citizen in this ecosystem because it has understanding of Um, of risks, of compliance, pretty much efficiency of our controls around mitigating those risks. 00:44:06.480 --> 00:44:21.760 So you already have all the ingredients on the table, but it's more like you need to intentionally build the controls that enhance every layer, measure every layer efficiency, and then make sure you have enough monitoring to spot this, you know, AI-powered attacks and prevent them. 00:44:22.000 --> 00:44:28.079 So that's that's my answer about GRC, where it's all heading and where it exists in our world. 00:44:28.559 --> 00:44:34.079 What I liked about the answer is uh you know, there's often been like this derogatory phrase where it's like compliance doesn't equal security. 00:44:34.159 --> 00:44:49.760 And like maybe that was the case in the past, but what you just described with PRC engineering or how you envision it, really it's like uh leveraging governance, risk, and compliance, uh not not not necessarily just for compliance, but show the efficiency and effectiveness of your security controls in near real time. 00:44:49.840 --> 00:44:58.559 Uh and then well, what better way to prove the value of security than to be able to do that and see how effective your controls are, you know, how what level of coverage you have, like you just talked about. 00:44:58.639 --> 00:45:15.599 Um so I think that that's the direction that that governance, risk, and compliance needs to move, not only to be uh better from the compliance perspective and things like that, uh to move, but to move it to more of an engineering discipline and tie it to the security engineering and activities of the organization too, and uh showing the effectiveness of your security investments and things that you're doing in the enterprise. 00:45:15.679 --> 00:45:17.119 Um so I like that answer a lot. 00:45:17.360 --> 00:45:35.440 Last question I wanted to ask you before we uh wrap up here is uh maybe tied to broader regulatory landscape, uh, you know, I know of course your organization has roots in uh uh the EU and things like that, um, but even here in the US and abroad and other nations, um, you know, there's a lot of evolution around regulations and and software security and cyber and so on. 00:45:35.599 --> 00:45:52.079 Um, you know, when you look at lovable, where you have this empowerment of the 99%, uh, when you have regulations coming for software vendors or software manufacturers, as they may be called, how do you see that playing out from the regulatory perspective when it could just be a citizen developer who created some app and put it out there? 00:45:52.159 --> 00:46:05.280 They're not necessarily a quote unquote software vendor or software manufacturer, but they did produce software and put it out into the world and maybe people touch it, or maybe it has uh an impact on someone's PII or PHI or you know, financial data or whatever. 00:46:05.440 --> 00:46:08.960 Um how do you see that playing out in a regulate regulatory sense? 00:46:09.039 --> 00:46:12.400 Uh now that everyone can maybe be a software manufacturer andor vendor. 00:46:12.800 --> 00:46:20.800 Yeah, I think it resonates very well with the responsibility of the platform over different aspects of creation cycle, right? 00:46:20.960 --> 00:46:28.559 So for instance, internally, uh we have we we we do have a trust and safety department, we have policies of what's allowed, what's not. 00:46:28.719 --> 00:46:35.440 So for instance, some projects like you can build a Microsoft login page look alike, but you can only publish it internally. 00:46:35.599 --> 00:46:35.760 Right? 00:46:35.920 --> 00:46:41.840 The moment if you decide to publish it externally, it may fail because of automated uh checks and so on. 00:46:41.920 --> 00:46:54.639 Uh but we we do not uh we try not to limit too much what you can do internally on your like on your you know in your small cave where you're experimenting, but the moment you put it into the bigger world, there are certain obligations. 00:46:54.800 --> 00:47:01.119 And our goal, our task is to make it very, very clear what what it entails, right? 00:47:01.199 --> 00:47:16.639 And we want to do it, it's not yet in the product entirely, but we do have that vision of telling people

early that you know you're building this thing, consider that certain um requirements will be put on you the moment you publish, right? 00:47:16.800 --> 00:47:20.000 So, for instance, uh we can uh take uh some regulated space, right? 00:47:20.239 --> 00:47:25.039 Healthcare data or um you know selling medical drugs. 00:47:25.199 --> 00:47:33.199 Um we've had some cases where we had to just take down um what people created because you know we need to see the evidence of a license for it. 00:47:33.280 --> 00:47:36.719 We need like now, you know, creation is easy, right? 00:47:36.800 --> 00:47:41.440 But before it starts earning money, we were like, okay, sorry, you can only build it internally. 00:47:41.599 --> 00:47:44.719 And that's the current uh there are some limitations. 00:47:44.800 --> 00:48:01.440 But again, we're looking to um to ease up the burden of regulations, and if we can ask those questions early enough, first of all, we can say, okay, if you want to build like a weapons, dark weapons marketplace, probably, you know, we're we're not friends, right? 00:48:02.079 --> 00:48:03.599 Please don't even try. 00:48:03.760 --> 00:48:11.679 Uh but then if if you have a license or you can apply for a license through us, um, or we can tell you where to apply it, right? 00:48:11.760 --> 00:48:23.920 That resonates very well with our narrative of like lovable being a co-founder, and that's one of the one of the pillars of the strategy, where it's like as a co-founder with some experience, we tell you that this will require a license, right? 00:48:24.000 --> 00:48:24.960 You can go and apply it. 00:48:25.039 --> 00:48:31.599 Here's the phone number, like here's a website, and people go apply, they get license, we do some sort of KYC on our end. 00:48:31.840 --> 00:48:33.519 Beautiful, everything works, right? 00:48:33.840 --> 00:48:35.119 That's one one side of it. 00:48:35.280 --> 00:48:38.159 Another is what is not dependent on us. 00:48:38.400 --> 00:48:45.360 So, you know, there is a Cyber Resilience Act, there is NIST2 in the EU, there is there is many like EU AI Act. 00:48:45.599 --> 00:48:53.360 Uh, so they all put certain like requirements, and sometimes you know, they're implicit, sometimes they're not very well known to creators. 00:48:53.599 --> 00:48:59.920 And uh what our goal is and always will be to make it known, right? 00:49:00.000 --> 00:49:07.519 So, again, understand what people are building, tell them this is these are the things you need to be aware of, and explain their responsibility. 00:49:07.599 --> 00:49:12.400 Because in the shared responsibility model, it's not only a platform that has responsibility, right? 00:49:12.480 --> 00:49:13.519 It's a creator as well. 00:49:13.679 --> 00:49:22.559 And the moment they start putting real people data into the into their um whatever they build, um, the moment they start to do certain uh actions, right? 00:49:22.960 --> 00:49:27.039 Things can change very quickly for for kind of what they need to comply with. 00:49:27.280 --> 00:49:57.840 So my advice has always been that you know it's uh um treating treating building process, not as a one-way street where you put put just requirements on the system saying build me this, uh, but also asking questions, being curious, being like, you know, like based on what you've built so far, what you see in my app, um based that I'm you know, I'm let's say in Germany, anything I should be aware of, any regulations, anything that I need to know and how to minimize that risk coming out of it. 00:49:57.920 --> 00:50:05.760 So for instance, like um uh you mentioned CRA Cyber Resilience Act earlier when we talked, uh it has very clear uh requirements, right? 00:50:05.920 --> 00:50:09.840 Some reporting requirements, uh software bills of materials, yada yada. 00:50:10.320 --> 00:50:14.159 So most of it technically we can provide as a platform, we already do it. 00:50:14.320 --> 00:50:21.679 Um but then like reporting, let's say if there is a security incident in your app, that's your responsibility. 00:50:21.920 --> 00:50:34.800 So asking the agent to let you know what are your CRA responsibilities, or like what are the regulatory frameworks based on where you operate and what you build, it will tell you, okay, CRA might be a thing because you distribute software. 00:50:34.880 --> 00:50:40.159 Let's say you build like some app or agent and you ship it to someone else, so it applies, let's say so. 00:50:40.400 --> 00:50:48.000 And then we can um we can like the agent will tell you what what you need to do, and it's not super scary, it's not a crazy requirement. 00:50:48.239 --> 00:50:56.639 And I'm always trying to treat any regulations as some sort of you know improvement function, or like at least um they're there for a reason. 00:50:56.800 --> 00:50:58.559 So what are they trying to achieve? 00:50:58.719 --> 00:51:03.679 Okay, they're trying to mature the the creators of software, which is which is not a bad thing. 00:51:03.840 --> 00:51:11.119 Of course, we as a platform we provide some building blocks and uh ways for people to discover those requirements, and then we make it simpler. 00:51:11.360 --> 00:51:23.039 We don't we don't completely kind of do it for them uh because there's still their responsibility, but we can make it simpler to discover those requirements and to um to build um secure compliance software. 00:51:23.119 --> 00:51:29.280 And like recently we released uh for all the apps that want it, they can opt in to have their own trust center. 00:51:29.440 --> 00:51:37.760 So anything you build with us, you can build like a trust automatically deploy a trust center that showcases your compliance posture, right? 00:51:38.000 --> 00:51:45.039 And then that the that will be the biggest platform for making sure meeting those regulatory uh demands going forward. 00:51:45.199 --> 00:52:00.800 So this is where let's say you achieve CRA compliance uh just by yourself as the creator,

you can put it there as kind of the statement and make it more, you know, your your users will trust you more, especially, you know, because you you've done the job. 00:52:00.880 --> 00:52:13.519 Uh, and there is a place where kind of showcase it and do it automatically because most of those requirements they're just being um being automatically discovered and automatically uh generated based on the app and the data in the app. 00:52:13.679 --> 00:52:14.960 So it's it's a pretty cool concept. 00:52:15.039 --> 00:52:16.719 It's kind of like you know, automating compliance. 00:52:16.800 --> 00:52:28.559 Again, you you mentioned GRC engineering, that's exactly what it's doing, but for customer apps and simplifying that regulatory burden and regulatory uh overhead um that people may have. 00:52:28.960 --> 00:52:34.960 That's such a I I gotta be honest, that was a really amazing answer because I wasn't quite sure how you all approach that yet, you know. 00:52:35.119 --> 00:52:51.440 Um but it's uh it goes back to like again, making security easy to do or making it uh I want to say abstract from the user, because in this case you're explicitly informing them of requirements they have to meet or uh regulatory you know things that that may uh be applicable to them depending on the use case of their application and the data and so on. 00:52:51.519 --> 00:53:03.199 Uh but you're at least bringing those things to the forefront there to of their attention and then help enabling them or empowering them how to meet those requirements because I've done a lot of work in compliance like HIPAA, HITRUS, FedRAMP, TOC2, like NIST RMF, you name it. 00:53:03.280 --> 00:53:04.400 And it's like it's complex. 00:53:04.480 --> 00:53:12.480 Like there's entire cottage industries built around just each of these uh frameworks, you know, of of consultant agencies and and and auditors and assessors, et cetera. 00:53:12.559 --> 00:53:19.360 Um so it's really cool to hear you guys are doing that for the community and like helping them understand how to navigate that, how to meet it, making it easier to meet these requirements. 00:53:19.599 --> 00:53:29.679 It sounds like a win-win, both from the compliance perspective of meeting the regulation, the compliance requirements as a platform provider is in terms of meeting your responsibilities and then also uh helping the users do it too. 00:53:29.840 --> 00:53:31.679 So that was a that was a super cool answer. 00:53:31.760 --> 00:53:33.599 Uh I'd love to hear how you guys are approaching that. 00:53:33.760 --> 00:53:35.280 Um, but that takes us to the end of the interview. 00:53:35.360 --> 00:53:36.800 That's uh the questions I had for you today. 00:53:36.880 --> 00:53:42.559 I'm glad I finally got some time with you after chasing you down on LinkedIn for you know six months or so, however long it's been. 00:53:42.719 --> 00:53:45.280 But uh, you know, thank you so much for joining me today, Igor. 00:53:45.360 --> 00:53:46.400 I really love the conversation. 00:53:46.639 --> 00:53:47.760 Yeah, it's been my pleasure. 00:53:47.840 --> 00:53:50.239 Thanks for um interesting questions, really. 00:53:50.320 --> 00:53:56.639 And um, you know, I I think like if I can have like just a few more uh a few more things to say. 00:53:56.800 --> 00:54:10.880 Um I think like you know, overall like vibe coding, it has uh you know, it's a bit like an interesting space to be because you know there's a lot of expectations, there is a lot of like kind of baseline distrust, or can this be a thing? 00:54:11.119 --> 00:54:21.360 And I think as the community and like builders and the platforms in the in the space, we should all treat each other uh with respect and with understanding that you know we're all in the same boat, right? 00:54:21.440 --> 00:54:33.679 So if if tomorrow some of our competitors you know fail miserably, I'll tell you this, we will be impacted immediately because you know people will ask questions, oh, that happened to them, how do you sure you it doesn't happen to you? 00:54:33.760 --> 00:54:34.880 And vice versa, right? 00:54:35.039 --> 00:54:43.199 So overall, I think there is some job in the community of vibe coders and vibe coding platforms to um to support the end goals, right? 00:54:43.280 --> 00:54:54.079 We all want to democratize the creation, we want to put human first, we want the humans, like you know, people who had no idea that they were able to build such beautiful things, they will have that opportunity. 00:54:54.159 --> 00:55:00.400 So we just need to bring it to them and hear them out and you know, build a good build something that helps them. 00:55:00.639 --> 00:55:02.880 So I think that's our job, that's our mission. 00:55:03.039 --> 00:55:15.440 And we all should just like you know, kind of um huddle together and like just like you know, uh push towards that mission because you know I think if we do it well, uh the world will change for better, and that's all uh all that matters at the end of the day. 00:55:15.760 --> 00:55:16.960 Yeah, no argument from me on that. 00:55:17.039 --> 00:55:21.280 And it's funny, uh earlier I said like we had democratize development, but not democratize security. 00:55:21.440 --> 00:55:32.559 But as we went through this conversation, you laid out several examples of how you guys are trying to do exactly that, which is really cool to hear from someone with you know that many users, a global uh uh consumer base of customers leveraging the platform. 00:55:32.800 --> 00:55:36.239 So it's awesome, and I look forward to keeping uh keeping track of what you all do and what you all build. 00:55:36.559 --> 00:55:41.360 Yeah, I hope to speak uh you know um about very different things, let's say in a year or something. 00:55:41.599 --> 00:55:42.239 Yeah, I'm sure that's a good idea. 00:55:42.559 --> 00:55:48.480 We have an opportunity to like you know look back and be like, oh, that was so naive, or oh, that was such a great insight, right? 00:55:48.800 --> 00:55:48.880 Yeah. 00:55:49.440 --> 00:55:55.039 The space is moving so fast, so I have no doubt a year from now the conversation will look a lot different in a lot of different ways for sure. 00:55:55.280 --> 00:55:55.360 Yeah. 00:55:58.960 --> 00:55:59.119 Yeah. 00:55:59.280 --> 00:56:00.000 Thanks for having me. 00:56:00.239 --> 00:56:00.639 Take care. 00:56:00.880 --> 00:56:01.519 Have a good one.