Snyk Ltd

But you don't have to be a domain expert in the project to be able to be useful to a project in a security sense.

Yeah, I mean, if you think about it, there are tools out there that people use that are specialty tools that you'd run on a project like Snyk or, I don't know, there's a variety of them.

I'm sure you could list a whole bunch that you would run at the end of that that are... different than, say, you know, linting and other things like that.

And so I can imagine that that skill set being distilled somewhat into somebody's role and thinking about it is specific, but more applicable to other projects than maybe this one specific project that somebody has learned, you know, the ins and outs of.

Hello and welcome to another episode of the AI Native Dev.

This time we are recording this live from San Francisco at the AI Security Summit run by Snyk and also the AI Engineering Group.

Here we have a wonderful panel and we're going to be talking all about Agent Baseline.

So this is going to be a fun session.

So how do I adopt agents? How do I build agents? How do I control what those agents can do across the board? How do I make my developers and my business users successful as possible with agents today and into tomorrow?

Awesome.

And finally, but by no means least, we have Marcelo Sousa from Snyk.

Tell us a little bit about yourself, Marcelo.

It's a reference architecture for production agents, deploying them and operating them.

And this was created by Keycard, Docker, Snyk, and then a few other companies as well have contributed.

It's totally vendor neutral, but we got as many people as we could from the community involved to create just a practical roadmap for what are the six outcomes we thought teams should work towards when building production agents.

And we called out, you should be able to discover what's running.

TESOL is the most ambitious tool here.

Founded by Guy Poggiarni, who built Snyk, it aims past spec first at spec is source.

The specification is what you edit, and the code regenerates from it.

How Tessel handles specs Each source file gets a paired spec file, and the two stay in sync.

They had to patch a record-breaking 1,413 vulnerabilities in a single month.

And according to enterprise application data from Snyk, eight new software bugs are currently being introduced into codebases for every single one that gets fixed.

So for every hole we patch, we are digging eight new ones.

Yeah, pretty much.

Eight, then there's trust, which is worse.

Snyk's toxic skills scan in February looked at about four thousand skills from ClawHub and Skills.sh. Thirteen point four percent had a critical issue.

About thirty-seven percent had some kind of flaw.

And Coy Security found about twelve percent of ClawHub skills were malicious.

You know, I don't necessarily think you have to sacrifice the money for the sake of your values.

You know, as the CEO of Snyk, I tried to, yes, we had a culture based on performance.

You go, we want to do well, like we want everybody to do well, but that you don't have to sacrifice the culture of the company to do that.

You know, we still want to care about the environment.