Why Security Always Failed and What Finally Changes That - with Justin Somaini 的完整文字稿

comfortable acknowledging. And a lot of that is a result of a couple of different problems, two problems. The first one is we are we have a labor problem, is we're never gonna be able to hire enough people, even with unlimited money. to be able to review all code before releases, for example, in an agile CI CD pipeline. We're never going to be able to catch all people doing you know human behavior issues, you know. And so there's always that problem. second to that, as an industry, we haven't really achieved the ability of a shared accountability model with the rest of the business units, engineering, IT, or otherwise. And incorporate our processes in those functions transparently. but instead we have this, you know, this labor cast over to those teams, which is create which creates friction naturally. Even in the best of situations, it's a smile with friction, you know. and so we there's a lot of issues, but today is really. The first time that I think that we have achieved an opportunity to dramatically lessen the unnecessarily unnecessary human labor in those processes with a semantic model. Now it's early days. As we all very well know, it's been out for a couple of years, but generally getting the integrity down and understanding it and adopting it is still early. But back of a napkin, if you look at 95, 90 to 95% of the workloads security teams do. It is pattern matching, you know. you know, we're building the same model T4 over and over again. that that is incredibly exciting, not only to just finally highly automate those things that humans do, but don't necessarily derive a lot of joy from. but also we can meet the scale of how the needs and demands of what the business is. And so we can review every cut line of code going into production. We can do all of those kind of things that we've had to kind of pull back on because they've been heavily laborious. and so for me, that's incredibly exciting. And there's a lot of things that go into that on what it could mean on our ability to advance the mission. an objective incapability of what we're what we're all trying to do. Aaron Mog: Yeah, I a hundred percent am with you on that. I I'm kind of in a similar space, maybe a little bit more cynical some days, but you know, the ability for us to scale what matters with AI is amazing. And just not just AI, but all this tech we have available to us Justin Somaini: Mm-hmm. Yeah. Aaron Mog: is like pretty cool. you know, I always worry about like are we letting sort of money and hype make that not a reality, right? Cause obviously that's a big force on industry right now. And You know, the the business in itself is moving so fast, right? Everybody's scared of getting fired if they're not doing AI fast enough. You know, somebody's valuations and money being spent are like, I don't know who's gonna pay for all this, but it seems astronomical. So like there's a little bit of fear of like a crash, but like, you know, we've crashed before and it created out of those ashes rose a bunch of really great security companies. You know, think about the Web10 crash, you know, resulted in a lot of great companies. The OA crash resulted a lot of great companies, like. You know, and and then these big changes, you know, from endpoint A B to E D R or whatever it is, like the these things create incredible opportunities and chances to win. the the the side that you've been doing, I guess for a while now on more of the investor side, like how do you wade through the bullshit? I guess like how are you like, I mean, obviously you have a lot of experience to rely on, but Justin Somaini: Right. Yeah. Yeah. Aaron Mog: like there's more snake oil salesmen in security than there have ever been. There's more people in security who don't care about the mission than there have ever been. Like how do you sort of separate the wheat from the chaff in that way? Justin Somaini: Yeah, I mean, I am not gonna break new analytical insights here, you know, but I do Aaron Mog: Mm, sure. Justin Somaini: think that the time that I spent in venture and as a traveler in venture, you you kind of pick up how really good investors do just that. And the first thing I used to God, I think it was on a podcast at Black Hat like couple of years ago, and there was a couple of investors around the Table and then there was me. And they said, what what is the biggest thing that you analyze? And they say, founders, founders, founders, founders. And I'm like, it's gotta be the product. What is the problem that you're trying to solve? How are you solving it? And I said, You know, I'll give you a token. You know, I will tell you maybe 20% on the founders, but 80% it's gonna be on the product. Within 12 months, man, my ship turned around so fast. It was not even funny. I was like, I came back and talked to some of them and I said, All right, maybe it's like 70% founders when they were saying 90, 95. Aaron Mog: Mm. Right. Justin Somaini: So what does that mean? when you look at the efficacy of building a company to take feedback, to go out and hunt, you know, for those customers, there's a lot in that C to A stage before you're really building out that go-to-market team that's really on the founders. And so the ability to Synthesize the problem, understand the problem, communicate out the problem to get potential buyers on the same page, even if it's like the first 10 customers in that C to A kind of range, is really on the founders. And if you're a first-time founder and you've never done that before, you've got a massive educational hurdle. For any founder, I've generally seen sales is a challenge, marketing is a challenge. Aaron Mog: Yeah. Justin Somaini: but If you've been there and you've done that, you've learned that, hey, that was really hard. I'm gonna hire my product marketing person on day one, not wait until you know. So there's these things that you learn. So that profile of simply are you a first-time or second-time founder? is a very

material thing. The second one is, you know, they VCs spend so much time doing background. On the founders before they invest in them, you know, five, 10, 15 referrals outside of what the founders have said. It it reminds me of going through a clearance process, you know, when they go through and do it. But it's so critically important to know the person and the background and expertise and capabilities. because generally speaking, the product and the problem use case. Has a high probability of changing in the first couple Aaron Mog: Mm-hmm. Justin Somaini: of years, you know. So, you know, what you're investing in is really the people and their ability to go through the journey and end up in a successful outcome. And so, so that is the first thing. And how do you interview somebody? When you see that CEO and you're talking with them, what I look for is is that a salesperson or is it a product engineer trying to fake it as a salesperson? And the reason why is. That CEO is going to have to be out there selling all day, every day. And if they can't do it, it's going to be a challenge. the the second thing, you know, I'm being a practitioner, you know, I I I look at the problem space. Well, I I I love DRM. I don't know if I'm gonna invest in any DRM companies. You Aaron Mog: Right. Probably not. Yeah. Justin Somaini: know, so so having said that, is is this a a a cornerstone problem, a need to have or a nice to have, maybe is a better way of saying it. so that's another one. and then the competitors, you know, is this a wave that's already out there and we're kind of catching up and you've got those natural mark go to market hurdles? Or hey, are you right at the cusp and going out? And we see that now with agentic AI security solutions and security solutions leveraging AI, you know, what is a use case? And then you get into the tech. You know, is it FUD or or is it tangible? Is it real or is it like no, that's you you don't understand the problem nor do you understand the technology. that's generally rare, but it it does happen every now and then. Aaron Mog: It's it's so interesting to hear you talk about the especially the people side of it because you know, as a CISO, like as a buyer, you have a certain mindset, which is like, I have a problem, help me fix it, right? Like, or or whatever your particular lens is. And then you talk about transition to investing, and you're like, the people matter. And like it's funny to watch founders, especially go through this transition. So it's I I spent a lot of my time with like founders of startups, and the things you did to raise money. Are very disconnected from the things you do to make money, right? Like nobody gives a shit you had a run around, right? That you raised money. Nobody. Like they they act like we care and they're like, we raised a hundred million or two hundred million or forty million. And yeah, maybe it's a news story for a day, but like a CISO doesn't care. And like the personal story, like, I mean, and no offense to anybody, but like I have heard the Israeli military story 200 times at this point, but more than that, hundreds and hundreds of times. And Justin Somaini: yeah. Yeah. Aaron Mog: Great. Like I I appreciate the fact they're very good what they do. But like, what's the next sentence? Like, how do you solve a problem Justin Somaini: Yeah. Aaron Mog: that affects me? So it is funny to watch sort of you say that about BC because it's like like your thesis on the sales Justin Somaini: Well. Aaron Mog: side is right. Like I have a problem. You have a solution. Yeah, the people are making it matter, but like at the end of the day, a crap product's a crap product. Doesn't matter if Kevin Mandia built it. If it sucks, it sucks. Right. not that his does. I'm Justin Somaini: Well you I mean your your point Aaron Mog: just saying like brand name. Justin Somaini: your point is exactly on because it's fascinating when you watch those the maturity of the messaging or the the sales messaging because in the beginning days they're selling to that seed VC. That first slide is their background. It's not the problem, it's not the product. It's okay, here's us, here's our background, here's our bona fides, whatever it is. And so when they are talking to design partners, which is, hey, we're still in stealth and we need our, you know, five design partners to kind of figure out our our our comp product. they're still using that same VC pitch where, hey, this is us. And you see that disconnected. So my guidance, you know, my advice is like, okay, just drop that first slide, start with a problem, and then start with a solution. Two slides, make it very simple, Aaron Mog: W yeah. Justin Somaini: and then do a Yeah, the other problem that generally happens is they haven't worked the problem or the product, you know, down. And so it becomes like a 15 minute conversation on what is the problem that they're trying to solve or how they're solving it. And it was like, you've already lost me. You know, if you d if you can't nail it in that elevator pitch in the beginning and then go into explode a lot more. I question if you really know it yourself, you know, in a lot of ways. Aaron Mog: Yeah. Justin Somaini: And it's a messaging, it's a refinement, but you're absolutely right. And it's hey, who's your audience? And and tailor the conversation for that. Aaron Mog: When you were, you know, doing investing in in VC and and, you know, I'm sure you just do some of it. So I I sort of look at first especially first time founders as like teenagers. Like you can't tell anything. They they know. They're like so sure they know what they're doing. And then they like you said about pivoting, even pivoting is like really just them not knowing what they're doing. Like that's really what a pivot is. It's like, I'm gonna create this thing, and you're like, Nobody wants your dead cat, stop walking around town with it. And then they'll pivot Justin Somaini: Yeah.

Aaron Mog: and sometimes they figure out. Most of the time they Justin Somaini: Yeah. Aaron Mog: don't. But did it make you crazy they wouldn't listen to you? Cause like for me, I advise them, but like I I'm not a famous CISO. I don't necessarily have that background. I'm sort of like this, I believe in this cinematic. But like, did you find that it took them a while to listen? Like a couple of mistakes? Justin Somaini: I I d I didn't get yeah, I didn't get that problem a lot. all of the founders in my experience were eager to solicit and very open to receive the critical feedback. You know, obviously YL is Israeli source, you know, of founders. and legend and lore is Israeli culture is very, you know. Cr self-critical, you know, give me that critical feedback. And so maybe that was part of it. But it's really around the personality. What do they do after that? so you get got the feedback. Are you in analysis paralysis, or do you just dismiss it? Or do you take that and say, Hey, I want to bounce that same feedback off of four other people? usually you have more than one board member, you know, usually you have trusted advisors, you have your own network. You know, really solicit that one voice. And do I have a consensus? Does it resonate? I mean, there's things that I have said in hindsight, I'm like, yeah, I'd I I I'm gonna pull that back. I was wrong. You know, new data Aaron Mog: Mm-hmm. Sure. Yeah. Justin Somaini: came in, you know, hey, we're gonna we're gonna switch gears. And so I think that not just taking one person's word on it is really important. was it frustrating when? I've given feedback and I'm thinking about one particular case and this was a while ago. Yes, it was very, very painful. because because I'm an operator, you know, I just wanna Aaron Mog: Yeah, 'cause you know, right? Yeah. Justin Somaini: I just wanna jump in and help out. And that persona doesn't lend itself to being the wise man on the on the mountain just passively, you know, kind of participating. Aaron Mog: Right. Justin Somaini: I'm an active participant. And so I think that was more me than it was them. but yeah, it was you you do see that in the VC world. Operators go VC and then they go back operational because that is, you know, that's that's a muscle memory that where they where they enjoy. They enjoy Aaron Mog: Yeah. Justin Somaini: getting their hands in it, right? Aaron Mog: It's it's tough to sit in the backseat and give directions when you know the right way to go and they're driving and you gotta let them figure it out. And like Justin Somaini: Yeah, that's right. Aaron Mog: a lot like teenagers where it's like you've gotta let them learn. And you know, the second and third and fourth and fifth time founders need way less of that. But I also feel like sometimes they're worse. Like sometimes cause they it worked once, they think they know the formula. And I I think this is really noticeable in AI because you know. Two years ago, like RSA 20, 23, 24,

whatever it was, 23, like there was something like three or four thousand vendors present in San Francisco, almost none of which were talking about AI. And then all of a sudden AI became the story. And like, well, I thought you knew the future. Like you were all telling me you knew what was gonna happen. And now you're all left for dead because there's this new cast of characters in AI security. And they're raising obscene amounts of money, right? Like hundreds of millions of dollars to your. What felt like a big $12 million round. So I'm sure you have investments and friends that like got stuck in that generational transition, you know, where they were doing something, cloud security, which is sort of a I don't know if it's a dead market, but it's definitely not receiving a lot of attention. What are you telling them? Like, are you like pivot or keep going or like where where do you land there? Justin Somaini: yeah, I mean there's I mean let's one, there's a a bit of history I think on the on the founder and VC side that I think is really important. When you look at the the twenty nineteen vintage funds. yeah, well, I mean their words, not mine. yeah. Aaron Mog: Right. That's a great vintage is a great term. Yeah. Right. I just like it. Yeah. Justin Somaini: Well, actually I was told if I've in it for more than twelve months, I can't say it's them and not me. It's like Aaron Mog: Okay. Fair. Justin Somaini: But, anyways, you had so much money going into startups with valuations increasing more than what was average norm. We didn't have a proportional amount of exits. And so at this point, which is roughly seven years later, where you start getting those exits to the LPs, we've got a lot of zombies out there, a lot of companies. moving forward, which should have gotten bought out, MA or closed. And so those returns going into the LPs hasn't been there. And that's really, really important as the next fund in this AI space, you know, the timing, it's not an AI fund, but you know, that the timing of where money is going into, we have yet again huge explosion in valuations. but the LPs for those funds saying, hey, I'm going to raise a new fund, that Cash liquidity is just not there in a lot of ways for those new funds to come. So, one as a backdrop, we have a very big question in the VC world of how many funds are gonna explode. Not because of AI, just because of this backlog of lack of liquidity from the 2019, 2020 kind of era. And so the second question we have is. We do have some astronomical valuations. now that would be fine if the MA space moved proportionally, but in the MA space is roughly in the 100 to 600 million range, you know, of of companies getting acquired. The Wizzes of the World, billion and plus, I think is maybe one a year. So it is such an out if that it is such Aaron Mog: Right. If that, yeah. Yeah. Justin Somaini: an outlier. but everybody thinks that their company is the next whiz, 32 billion, 16 billion, whatever it is. So they are willing to take on that money early to get those large valuations. Say, hey, I raised a hundred at an A round, and so my valuation is maybe you know, 600 million, a billion already, already putting yourself at MA. So you're at the A round, you might have maybe a million in revenue if that, and you're already saying you're gonna go IPO. That's insane. That that's insane. The the the inverse problem, and this is why it's really important, because the valuations are so high, and we've seen this so many times, the large funds, you know, the the sequoias of the world, et cetera, are being forced to swim downstream to seed, so they can put a check in. To get money out of valuation, because they can't make money on a B round or C round because they're not going to get their three to five multiple because valuations are already so high at that point. So Aaron Mog: Yeah. Yeah. Justin Somaini: they're having to come down and compete at the seed round, which is only creating more of a problem why these seed and A rounds are getting so large in volume. And so eventually it's gonna explode. We've seen this problem before and everything goes back. the question is when and if. So your question again i monologue sorry Aaron Mog: Okay. Justin Somaini: so so to your question my advice my advice is you know you know when you're greedy pigs get slaughtered and and so i i get it you gotta have money to be competitive but you need to find a healthy point of what you're really committing to there was a seed company came preemptive a round no customers A hundred plus million in as in A round valuation. And I'm just like, I just I why? It just it just why? It doesn't make any Aaron Mog: Seems like a Justin Somaini: sense. Aaron Mog: it's like being born with like a weight around her neck. Like the Justin Somaini: That's exactly right. Yeah. Aaron Mog: like so I don't I'm not an investor, I'm a a go-to-market person. I know how hard it is to get a hundred million dollar of AR. I know how, especially in cyber, it's so hard. And it's Justin Somaini: Yeah. Yeah. Yeah. Aaron Mog: like we're a seed company and we're a unicorn. I'm like, okay, okay. But you're gonna need to get to a hundred million plus really fast, right? And you know, Waze obviously that like a year, like some of these companies can't do it fast, but like to your point, that's the absolute outlier. Like most of the time it's a grind, it's a knife fight for twenty-five thousand dollar deals. And like doing that with this IOU of a of a couple billion dollars is really hard. Again, maybe they'll pull it off. Some of the guys doing this, you know, I look at that, I'm like, I'd give you know, Lou 100 million dollars. I'd give Kevin a hundred million dollars. Like these guys are badasses. But some of these guys Justin Somaini: Yeah, like Aaron Mog: have like, okay, you've never done it. That's and not that they can't do it. It's just a big you're starting the race like with really behind the starting line.

Versus some of these guys that are doing, you know, smaller rounds, still great money. Like I had Ed Bellis on the phone, he raised 25 mil for Empirical. Like, like perfect. Like you're Justin Somaini: Yeah. Aaron Mog: gonna like you know he's had an amazing exit. You know he's gonna kill it. Like, yes, let me write a check. So, like, you know, there is a balance there. do you have stuff Justin Somaini: Yeah. I mean the Aaron Mog: that you are looking at, you know, again, like even in your out of your own money or whatever it may be? Is there a sector or a space, obviously just generic AI, but like that you think Justin Somaini: Hm. Yeah. Yeah. Aaron Mog: in cyber is like, yeah, that's where I think we're gonna go? Like, or that's what I think's really Justin Somaini: Yeah, I Aaron Mog: cool. Justin Somaini: that that's a great question. I there's need to have and nice to have's. And Aaron Mog: Mm-hmm. Justin Somaini: so the first one from a buyer's point is is this a tuck in to another product? And everything is what is the valuation that you're investing so you can see a return. The other one is is this actually solving a problem or is this a problem looking for, you know, a nail looking for a hammer, you know, or a hammer looking for a nail? I don't know. Yeah, well that's the Aaron Mog: Right. With lots of those. I got ya. Yep. Justin Somaini: And so a couple of spaces like the other one, and I've always had this thought when you know Palo Alto came out and checkpoint is what is the time delay between these innovation waves within a sector? You know, firewalls, for example. we we see like endpoint right now, where the crowd strike, the sentinel ones, etc. That seven years, you know, kind of rubric or kind of milestone that I have. As well as past its due. I think it's really healthy for a lot of new companies to come in and coming in with an AI approach. I don't think AI is the label. It's kind of like, well, we never called products a relational database solution. You know, it's like, well, they all have them, but Aaron Mog: Right. Right. Right. Justin Somaini: it's it's a tool to make the overarching solution better. And having that within endpoint. For example, I I think Glow just came out. great team, great product. they're listening, I'd love them to have the podcast. I think it's gonna be great. you know, so that endpoint space is really and there's a couple other players there, but they're the one that just came out that I was thinking about. I had a couple of other companies in the SOC. Every there's a lot of sock solutions, but really Aaron Mog: wow. Yeah. Justin Somaini: but there's only like four, three that Aaron Mog: Hmm. Justin Somaini: you really should look at, you know. Aaron Mog: Right. Justin Somaini: and we can get into how do you differentiate between those if you want, but there's some really good ones that are, you know, have legs to kind of go the distance that I'm really excited in. I would say generally almost all you know, problems I think can be better to delabor the overarching problems. We see that in DLP, we see that in Maybe not the GRC space, that's my personal love, which is odd. But yeah, I mean there's then there's interesting ones. There was a couple of companies that like going back to the endpoint where the legacy providers are not looking at non-binary code, and we have a lot of compromises in that space, and so A couple of companies, startups took on the okay, we're going to analyze non-com compiled code and for risk issues, et cetera. I think one got bought up, but but interesting kind of flushing out of the solution set. I don't think it's maybe a standalone endpoint. It should be included in a overarching one. So we don't have multiple agents. I do think the DLP ones are important because I love DLP, but we need a better analytical capability to kind of reduce false positives and everything else. AppSec, well, the open source project, Kosi is there. I talked with Omar Santos from Cisco and he kind of brought that up and dug into it. But how do you create that secure harness? How do you create the security layer? Yeah, you get into agentics and a whole bunch of other stuff. But I I think that's a a a big thing everybody's focused on that I'm really excited about as well. But yeah, we'll see what the actual architecture looks like, you know, three, four years from now. Aaron Mog: Yeah, it's funny because we're recording this and this should be out right before Black Hat of this year, right? So 2026. I'm overall pretty underwhelmed by a lot of the products that are coming out right now because I I I just fundamentally look at like the retread of some of this stuff is like I in my career I've never seen more failed projects than DLP. Like that's the project I've seen fail the most across twenty six years of doing security because I'll take. Justin Somaini: Why did why did it fail for you? why why do you what was your your gripe with it? Gripe, Aaron Mog: Te Justin Somaini: concerns, you know. Aaron Mog: I remember I was at a very large company once. So they're yeah, we've had the OP on for two years and we've never looked at it. Because we know if we open it up, it all becomes our problem. And and we're not business process consultants. We're security guys. Right. These Justin Somaini: Yeah. Yeah. Aaron Mog: are not threats for the most part. These are broken business processes. And nobody ever owned that. Right. Nobody ever had the capability to go out and advise these organizations on how to this is exactly what's replaying an AI, right? Your CFO. Just uploaded next quarter's financial projections into Claude and there's nothing you can do about it. Nothing. Justin Somaini: Mm. Aaron Mog: Don't even bother. Like they're not going to listen to you. AI is doing what it's going to do. You have zero hope of fixing that particular problem from a you did wrong, don't do it perspective. Your only option is to create an approved channel that they

should be using that has some kind of constraint around it. That's it. That's Justin Somaini: Yeah. Aaron Mog: you're like in my opinion, good luck. Even inside of like government, but sure as hell inside of Porch 500's like good luck. And so, you know, I look at this and go, you know, the the I I hate the idea of taking AI and applying it to the same thing we've been doing for 25 years. I get it because it sells and it makes sense, but like, shouldn't we rethink some of these things? So, like I was I was just talking to somebody else who's like a hardcore abstract person. I'm like, what the hell happened to WAF? Like, where did that go? Like, where what happened to the idea of stopping these attacks? Justin Somaini: It's still there. Aaron Mog: Before they hit code base. Justin Somaini: Yeah. Aaron Mog: When was the last time you saw somebody write a WAP check out of EC? Like 15 years ago, right? And so I just look at that and go, like, okay, so the reason we like even zero trust, I'll use that as an example. Zero trust never worked, never worked. I've I've pitched it forever. I've I've sold versions of it. But at the end of the day, anything built on static rules breaks and you end up building so many obsections that exceptions it doesn't work, right? Like, that CFO. Can't have access to this because you allow it and then it just turns into Swiss cheese. But part of that is we can apply AI to these rules, right? So if I'm thinking about you know that type of process, I'm going, okay, you try to log into this app. You don't normally do that. You can have AI ask them, hey man, why are you doing this? Like you don't normally do this. Why are you doing this? Little chat window. Yeah, I'm working on this business project, blah, blah, blah. Click. Yeah. Okay, cool. Like it's a just a decision engine. That's stuff we can never do with firewall rules and allow tables and all this kind of stuff. I don't hear anybody talking about that. All I hear Justin Somaini: Well see but see. Aaron Mog: about is the same old shit that we've been trying to sell for ten years and it just bores me. Justin Somaini: So I I I I think it's really, really important. maybe two things. when we say AI, one we're talking about tran generally, we're talking about transformers, semantic models. I mean, there's a lot of different algos out there, you know, similarity, you know, blah, blah, blah. Librarian, dynamic librarians, whatever. the whole intent should be To solve the labor problem of that the security team has. It really, really should. So the question would go: let's use DLP as an example in my mind. all right, let's assume we have exact data matching on social security numbers for our employees, and we're finding so let's just for the sake of argument assume that false positive isn't there. But tax season rolls around. Now the security team is inundated with all of these people sending out their so you know tax forms with social security numbers on them. It's a labor problem. So now we're and so the security team would go, crap. well, we know what it is. It's not our problem, just ignore it. You know, it's you know not a false positive, but it's not material. So we'll just kind of I don't want to say look the other way, but effectively. What the semantic model should do. Is ease the workload process problem to delabor what should be done but couldn't be done because of the labor constraint. So to your point, wow, we see this. Send a Slack message. Hey, Bob, you send out your tax forms, clear text over email, which means that it's stored on 50 million systems all over the internet. You should use an encrypted capability that we already approved. Yeah. Like a drop box or a box, or maybe I don't know, whatever Aaron Mog: Whatever. Yeah. Justin Somaini: solution that there. So the thoughtfulness of what it's really there for, I think is a really important question to say, what is AI? Now, if somebody says, I've got DLP with AI, you're you should be like, Well, what is what does it do? What is the value that it brings? Aaron Mog: Explain that to me. Yeah. Justin Somaini: Explain that to me should be the real question. What would be better is if those companies would say, Of course we have AI on our product like a lot of other tools, but we leverage it to do X. You know, we're this Aaron Mog: Right. Justin Somaini: is what it's doing. This is the outcome that you should expect. That labor problem, Justin, that you had, you don't really need to deal with it as much because we can integrate with Slack and kind of have that conversation with the employee to figure out if it's real and kind of educate them. and I I don't think that's there. And I'm sure there is a lot of companies that have Slap AI and I've seen them Slap AI on a logo, but I do think there are some really thoughtful implementations of it. How do you find them and not the others? Maybe that's a fair question. Yeah. Aaron Mog: Yeah, and I think like all markets, it'll shake itself out and some stuff will make its way into the big guys, and then some startups will have really creative answers. And I guess, like for me, the idea of of you know, reinventing things in this new paradigm of like this amazing decision engine. Like if you think about it, just if you and I were sitting next to a CFO all day, like that was our job, just sitting next to him in a chair and watching what they're doing, they would probably never get hacked, like almost for sure, right? Don't do that. Don't click on that. That's stupid. Justin Somaini: Yeah, that's right. Aaron Mog: That's not where you file your chat. That's not a real wire transfer request. Like we would instinctively know what is stupid and what is smart. Right. Justin Somaini: Yeah. Aaron Mog: And it's never been static. It's always been intent and feel and intuition. And I think for the first time we have models that are somewhat capable. I'm not saying they're capable of that. Obviously, Justin Somaini: Yeah.

Yeah, I think so. Aaron Mog: there's a bunch of bridges cost, like how much those tokens are going to cost. Do you really need to watch everything? There's all these like problems with it. But I I would love to see some of these, you know, some of the other day, like, why the hell doesn't Claude know it's me? Like Claude knows everything about me. Like there was a I think I was just talking about this. There's an onion headline that came out that said, Americans are now spending 80% of their time entering six digit codes from their phone. Like, and that's how I felt about security at that moment. I'm like, that's all we're Justin Somaini: Yeah. Aaron Mog: doing now is just gears of code. And I'm like, Claude should know that it's me. Like It's me. Like I they know everything about me. I should be able to hold my phone, say, Hey, Claude, and it goes what do you want to do? Like, and I know it seems kind of futuristic, but I feel like that's in our grasp right now. Like to do those sorts of things. and it doesn't really feel like that's happening in security as much as it is, let me help developers code better. I'm like, Yeah, all right. Like I get it, but Justin Somaini: Yeah, well, I mean, I I think the change, I mean, what we when we look at the impact of AI on the market, general market, and then impact of AI on security. one security historically has been a laggard in adoption of technologies versus a leader as an industry, right? Aaron Mog: Yeah. Yep. Justin Somaini: Some some segments are are Well ahead like tech, et cetera, well ahead than others. but if we look at SaaS, you know, and the adoption of SaaS, it took seven to ten years for, you know, a lot of mainstream companies to even start programs. and so as a result of that, those use cases, those requirements, those I want, I want, I want kind of features haven't really come out. What I would say is we are starting to see some really interesting internal development and capabilities. So large companies using AI security teams on solving some of their challenges. And we did this at Unity before I left. Was how do we create a because we had a a Slack chat bot to help employees? They could ask any questions. We would rotate, somebody was always on the chat, you know, sort of thing. But we took all of our JIRA tickets, our docs, everything, and kind of put it into a model. Those are very early days. So it would be a a smarter chatbot. it was it was great. not as much because of the delaboring, but we told employees, hey, y y you don't you can ask anything and not feel shame because you're t you Aaron Mog: Yeah. Yeah. Justin Somaini: you could have that vulnerability of do I need passwords? You know, whatever silly question or embarrassing question that they want, and they can get an answer and get that guidance. I thought was amazing. anyway. Yeah. Yeah, absolutely. Aaron Mog: It's like AI therapist, but for security. Cause people are using AI as therapists right now, right? Like please talk to me about this embarrassing thing. Justin Somaini: Well, I did that myself. I I my pet project, one of my pet projects, I gave my run local models and I gave 20 years of email, all of my text, you know, everything about me. And then I said, build a persona mapping, psychological persona mapping of me, you know, relating to who I deal with, etc. And then because I was like, I'm getting really tired of you saying, Claude, that I'm amazing and all my stupid ideas are genius, and like, that's not true. It's not true at all. Aaron Mog: Yeah. Not true at all, yeah. Yeah. Justin Somaini: And I said, build out the personality that best works with me. Because one, who am I? And then two, what is the best personality that works with me? And it was that data driven, factual, snarky, maybe somewhat unhealthy, aggressive sometimes, you know. Aaron Mog: Mm-hmm. Justin Somaini: And it was just you were you're able to do things, but it wasn't the first thing I went to. But now I feel a lot more trusting because I set up that persona of the AI to be more data centric, to be more accurate, to be self critical in a lot of ways. anyways, yeah. Aaron Mog: No, that's it's a huge problem with AI is the the sycophantic nature of like every idea Justin Somaini: Yeah. Aaron Mog: you have is fantastic. But you know, you mentioned something there which is interesting too, which is like you kind of side channeled like I used a local model because it had knew everything about you. Like I also think we're gonna go through this massive shift to local models. Like we have to. This costs too much. Yeah, Justin Somaini: it's happening now. Yeah. Aaron Mog: like the tokens cost too much. I mean, there's massive value in Justin Somaini: Mm-hmm. Aaron Mog: frontier model stuff and the Using Mythos and like I I get it, but the cost is so high versus like these run. So I actually think there'll be a whole new generation of AI architects inside these shops that are building the engines of these companies because the there's no chance that two competitors use the same AI. I don't believe it. I just don't think that's where we end up, right? Like you're not gonna have like I don't know if you saw there was a article about Kirkland Ellis here in Chicago. Big law firm spent $500 million to build their own AI. Because they realize if everybody's using Harvey, we're never gonna win a damn case. Like everybody's getting the same advice. And it's like that doesn't work for us because we have to have, even if it's maybe not as good, it's different. Like it's based on what we think. And so like I do think there'll be a whole generation of that, which I'm really excited about securing. Cause I think when you know, cause like you were joking about like adoption. Like I remember sitting in CISO's offices of banks and be like, We're never going cloud. It'll never happen. And I'm like, Justin Somaini: Yeah. Aaron Mog: okay. And then five years later they got fired. The AWS architects come in

and it's all clapped. So, like, you know, the only constant is change in this shit. so it just I cause interesting you brought some of this up because you started a podcast and I think very interestingly called it trust issues, right? Which I think is it's very funny for somebody who's in venture capital and investing in all that because like, you know, it's sort of like you build a thick skin from being burned over the years. but I guess like kind of. close like closing the loop on on the AI part, but like more on the on the you part of like podcasting and things like that. Like why trust issues and why are you doing it? I would love to sort of as somebody else who Justin Somaini: Yeah. Aaron Mog: just started a podcast, I'd love to hear about. Justin Somaini: well I mean I I well I I keep saying I'm I'm not gonna monologue and yet I do. I I I I love I love our industry. I mean and I I doing it for 30 some odd years, you take a little bit of personal I wouldn't say ownership, but you know, it's it's something that I I I believe in our mission, I believe in our objective. I love the openness in the community. I love the real problems that we solve. Anyways. And so engaging with others is really fun with me. other CISOs, vendors, et cetera. and I I thought about doing a podcast for a long time, but there's so many, so many, but there's a a really good, helpful security podcast out there. And I didn't have an idea of a voice, a message, a conversation that was different. Right. And so going through the VC world, one of the things that came out, two things. One was, every CISO I talked to about, hey, you know, portfolio companies, whatever, it was okay, listen, Justin, there's like a thousand of these startups out there, and I can't make heads or tails what's what. And I would respond and be like, I can help with that. I mean, I I can show you how to analyze these companies to figure out which ones have a higher probability of success than others. Nothing's guaranteed, but there's some rules of the road. So that was one arc. The second one is every seed or every company, you know, they're trying to get in front of buyers. At the seed stage where we were investing, you know, that early adopter group is pretty small. It's rarely the Fortune 500s, it's 3,000 to 7,000 employees, you know Quick budget cycles, and you have to have a person that is really interested in being a design partner in an early stage. And so that group of people is pretty small. And so what do you do? You reach out to them, let's have a dinner. you know, yet another vendor dinner where you're struggling to get 15 people around the seat. you can't really talk about the product anyway. So the vendor is going, I'm spending $20,000 and to build a relationship. And everybody else is like, I'm here because Bob's here and Bob's my friend, not because of the vendor. I was like, there's gotta be a better way to do this. Aaron Mog: Mm-hmm. Justin Somaini: And so I wanted a I felt that there

was a content-driven opportunity of how if I can select and do my own analysis and select those companies, you know, and I do every month I go through the 1500 seed A and B security companies, Aaron Mog: So many compos. Justin Somaini: but I get it down to 50 or 70. And I said, Those are the ones I want to come on. And it's very simple. It's hey, who are you? What's your journey? And talk about the product. If you want to do a demo, great. But it's just it's just that's it. It's just talk about the problem openly. And if you're not interested in early stage companies, you don't have to listen. It's amazing. It no stress. Yeah. Aaron Mog: Yeah, no, it's one of those things about modern content. Just put it out there and lick it up off the stoop or not. Like, you know, it's one of these Justin Somaini: Yeah. Aaron Mog: things, like even doing this is like I I'm sure a million people would rather listen to like threat of the day, you know, let's talk about hugging face or whatever the thing is. Great. Like, there's so many people Justin Somaini: Yeah. Yep. Aaron Mog: doing that that are awesome at it. Go listen to them. We're doing live, you know, there's a lot of people delving into like live stuff where they're talking about it in real time in chat, like they're Twitch streamers, but for security. Amazing. Like I first of all, I don't have the energy for that. But also, like I I I think slow content is more my style where it's like I want to have a conversation. but yeah, I was I was listening to some of your your your episodes and some of them are friends of mine and people that I know. I was like, this is like a like a like a Gartner session without all the bullshit. Like it's like you're actually like he's getting into Justin Somaini: I don't think. Aaron Mog: it in some way without I don't have to wade through a bunch of hype. so I I think it's great to have you in that role. Like I I think more people should be. supportive of startups. I I think in general we're all benefiting from it in some capacity. So I I think like all good CISOs have at least some innovation budget, at least some ideation of like, you're on my radar. Maybe you're not ready for your size or scope yet. But like I kind of been nurturing that, Justin Somaini: Yeah. Well, there it's I I've always felt this was my analysis and and talking to you know other CISOs is there are areas of my product space where I don't need innovation. I don't need an innovative firewall. Not not today, maybe maybe five years. I just don't need it. Aaron Mog: Block the traffic, right? Yeah. Mm. Justin Somaini: Then there's okay, I can go to Checkpoint, I can go to Palo Alto, I can get a firewall, that's great. Then there's a whole set of problems. That I need something different, whatever that is. Then you go through, are we gonna buy or build? And some of those, depending upon your market, you you're gonna have to build it because it's so unique and so bespoke. You know, Meta does this and a lot,

but other ones, you just don't know what's out there. And instead of reaching out to all the VCs that are investing and being inundated with now VCs trying to sell you, how do you how do you get access to? Hey, what are the five identity AI enabled security companies that are coming out? And I don't want to be bothered, I just want to listen. And it was Aaron Mog: Right. Justin Somaini: like such an easy value fit that that was what it is. And and actually it's turned out to a bunch of CISOs now say, Hey, you know, here's here's my projects for the year. here's the ones I'm really interested in innovative ideas. What what do you got on your list? And I'll s I'll send them my Excel sheet and have see for themselves. Aaron Mog: We got to we gotta turn you into AI, man. We need like a just an AI that I could go ask these questions to. Cause I'm doing I do a lot of like market analysis. I'm like, who's doing this? And then you know, you go through this whole process and you know, I think in general the most interesting stuff's right below pay for play. Like I know who's in the magic eight, nine magic quadrants. Great. I know who they all are. But like that next cheer down of like they're real, they have customers. But like I if you go ask AI, it just spits back Gartner to you, basically. Like So if you are interested in building an AI of you, I'm in. I'm I'll I would recommend it to everybody. so you know, in that kind of vein, you know, I was just listening to a go to market podcast and somebody's talking about they did like a CISO survey of like how do they learn about products and how do they make decisions? And you know, in these surveys, CISOs always say things like, you know, education and content. And then they're always like, Yeah, we don't care about things like steak dinners, which is just bullshit because they do care, because they take them. But like in this new world of like just noise, like just incredible volume of just post and content and podcasts, all this kind of stuff. So if you're talking to one of these CEOs, maybe off mic, and they're like, How do I get anybody to give a shit about what I'm building? What are you telling them? Like, what's your advice to matter? Justin Somaini: It it's you know, honestly, it it is not it is the same thing is build rapidly Yeah. Build rapidly supportive existing customers and have those customers, they will naturally do the heavy lifting. that word of mouth is so much more powerful than anything else. You you have to do your electronic demand gen and you know, all of the other capabilities, of course, to kind of fill the funnel and drive it. But usually, especially in those early days, It's really about having those design partners and those customers and you just being incredibly almost inappropriately supportive of them in everything that they do. And that doesn't mean doing everything that they ask, because that might not be a good product Aaron Mog: Sure. Right. Justin Somaini: at the end of

the day. But you know, but you can do it so much better. For so for example, one of the things as a customer is so annoying is hey, we have I would love this feature. I would love this capability. And then you put a ticket in on some website and it goes off into the hole. Maybe you have a QBR meeting and somebody comes back and says, Yep, I acknowledge receipt of this feature. Some of these companies, these startups are like, no, no, no. We integrate, we create a Slack channel, you put it in there, we've got an agent that goes through and figures out the PRD for it. We rapidly develop within 48 hours that feature and deliver it to you so you can give us feedback on how to improve it. It's like to create that zealot, you know, that deeply passionate customer really driving into that kind of type of solution set, amazing. It's amazing. Aaron Mog: That's the superpower of being a startup is you're not Microsoft. You can move violently fast and solve problems fast. And and I do think that's an underlying utilized thing. And and you know, it's interesting because if you talk to like I'm I'm I'm big into like studying audience, right? Like I do more go to market and messaging and positioning and and building fans is what I call like you gotta have fans of what you're doing. And Justin Somaini: Yeah. Yeah. Aaron Mog: if you get outside of cyber and you talk to anybody who builds fans, comedians, musicians, Authors, it's such a grind. It's like one fan at a time. And if you talk to people who do that, they're like, you cannot believe the number of empty bars I've played to or the number of empty rooms I've told jokes to. And it's like, it's just this horrible grind. And and I Justin Somaini: Yeah. Aaron Mog: meet people and I'm like, and especially CEOs who raise the money and they're like, Why does anybody care? And I'm like, if it was easy, everybody would do it. If it was easy, Justin Somaini: That's true. Aaron Mog: everybody would have fans. We'd all play arenas. We'd all be Palo Alto. But you how many butts they had to kiss to become Palo Alto? It was hard. It it's so like I I do think like there's a to your point, there's sort of value in the grind of like being obsessive about the people you do get to serve and and I like and not expecting the world to come beat a path to your door. So I I I a hundred percent agree with that. And I I love that you're doing that pod. I encourage everybody to listen to it. It's really good. Really smart. I think mostly CEOs, right? On there for the most part. Justin Somaini: yeah, well, I mean, roughly 80% are you know seed and A stage founders. Then I have a a smattering of individuals to kind of flush out. I've had a couple of partners of VCs come on and give their perspective on where Aaron Mog: cool. Justin Somaini: we need. I've had a couple recruiters, exec recruiters come on as well. a couple of episodes that have not been released, talking about AI plus security, that intersection. said Omar Santos, who's the distinguished engineer over at Cisco. and then I had another one just with Ian Maholland from Salesforce, CISO is Salesforce, and then Jason Lish, CISO over at Cisco as well, to kind of get that practitioner perspective. Robert Nake, who was at the White House doing cyber policy. Aaron Mog: cool. Justin Somaini: And so it's just kind of flushing it out a little bit on some of the topics that you know, just Where do we need and where do we see innovation in the cyber industry? That's kind of the tagline. Aaron Mog: Very cool. I think it's at Someini Trust Issues on YouTube. I think everybody can follow you on LinkedIn, find you on LinkedIn, click follow, see your content, follow your podcast, follow their materials you put out. I'm sure you're open to CEOs and founders giving you some kind of pitch on what they're up to off camera to learn about Justin Somaini: Yeah. Aaron Mog: it. If you're spending time learning about all these spaces, I'm sure that's interesting. just man, I can't tell you. What a value that is to our industry. I think you've been valuable to our industry for a very long time. me too, as far as being around a long time, not as valuable, but just watching you over the years and and going like, he's the real deal. It's been really cool. so is there anything else that people can find you at? I'm assuming you're you know, other LinkedIn and the YouTube. Justin Somaini: Well, justin that justin at semani dot net is my email. LinkedIn is Aaron Mog: There you go. Justin Somaini: probably the easiest for everybody. And sometimes there's a bar outside of the Presidio that I go to a lot. So yeah. Aaron Mog: Awesome. so yeah, if you're looking for a a startup Sherpa, reach out to Justin, he'll tell you Justin Somaini: Ha ha ha. Aaron Mog: the path to success. thank you so much for taking the time to talk to me and and I'm a big fan. So keep at it. And if there's anything I can do to to help spread the word, let me know. But thanks so much. Justin Somaini: Well, I really appre I really appreciate that, Aaron. And thanks so much for having me on and really excited about what you're doing here as well. Aaron Mog: Awesome. Thanks, man. Justin Somaini: Thanks.