Veracode

He led a lot of the engineering team at Snyk through the hyper-growth period.

We've got team from Snyk, from Veracode, from... whole bunch of other companies uh and they're built in this space for a long time and they have built amazing technology but then when we go to market a lot of stuff can go wrong i mean competitors enter spaces incumbents start marketing a certain thing you put foot wrong in a meeting and you say something which was stupid and then you impact a relationship in a negative way i mean all these things happen all the time i will tell you a funny story for us was um We actually were deployed, the guys that led our Series A, I think slightly before they actually invested in us.

And the guy who invested, James Wise, he's the partner that led it at Borderton.

The security lead at Borderton all of a sudden could see that James was doing some stuff with agents that was not sanctioned.

A working feature and a safe feature are different things.

Veracode tested Merethin 100 language models on 80 coding tasks.

The models produced functional code but introduced security vulnerabilities in 45% of cases.

Java was the worst, with failure rates above 70%, and models failed to defend against cross-site scripting in 86% of relevant cases.

HelpNet SecuritiesCoverage summarizes the details.

The finding worth remembering.

Veracode found that larger models did not perform meaningfully better than smaller ones, which points to a systemic issue rather than something scale will fix.

The AI will happily write a login system.

Now layer in the security picture.

Veracode's 2026 GenAI Code Security Report found that across their test battery, about 44% of AI code generation tasks introduced a risky security vulnerability.

The average pass rate across tested models was 56%, barely moved from the year before.

And Georgia Tech's VIBE Security Radar project recorded a near six-fold increase in CVEs attributable to AI coding tools in just two months, from six in January 2026 to 35 by March.

I'm betting that the Vogons will destroy the earth, but you're not going to pay me for three days? Okay, whatever.

In Veracode's 2026 Gen AI Security Report, they found AI coding security improved, but still fails 38% of security tests.

Now, that doesn't mean that it's 38% insecure, just that 38% of the code failed some security test or the other.

And I mean, where did AI learn to code anyway, right? Did it come up with it on its own? No, it didn't.

He scaled Iron Mountain from $1.8 billion to $3.2 billion in revenue.

He led Veracode through a $614 million acquisition by CI Technologies, and before that, grew a SaaS business that he ran to the point where Iron Mountain just had to buy it.

From Cisco to the boardroom of BitSight and Fairwinds, Bob has spent decades at the intersection of cybersecurity, cloud, and transformation, and he has the scar tissue to prove it.

Psychology grad who became a technology leader and now one

Well, the hardest part about starting in as a CEO, if you're coming into an existing company, is that everybody's trying to nudge you to what they think should happen at the company.

And you have to draw your own conclusions so that you're, essentially being misled, not in a malevolent way, but, you know, if you're the CMO, you have a position on this is where the company should be.

I remember my first day at Veracode, this fine person said, you know, we're a channel-led organization.

And I was like, well, how does the channel make money on us? And it was like, well, that person's on vacation.

Wait until you see what vibe coded software from non-programmers does to get to the goal.

Veracode's 2026 report tested more than 100 models and found that with no security guidance, AI generated code fails security testing nearly 44% of the time.

And that number is virtually unchanged from last year, even though almost all of that code runs just fine.

It runs.

Oh, sure.

I mean, we just saw Proofpoint agree to buy the data security company Veracode for $6.3 billion.

Which is huge.

Right.