Application security

I guess the important one here will be, you know, the on-call, the pager, people are confused about that.

We'll get to that, but you touched on a really important point when you said, well, you respond to incidents, you analyze the tickets, do that, but then you're like, well, sometimes you also do something like software security, which is AppSec, analyzing vulnerabilities in source code.

That is funny because I'm literally editing a video that I'm making for YouTube about AppSec engineering, application security, it's like a roadmap and I talk a lot about that.

And what people don't realize that you touched on is job titles are misleading.

You can have a title of cybersecurity analyst and you do a whole bunch of tasks.

You pivoted, right?

So we started off, and that's where our roots come from, in the AppSec space.

AppSec with AI has completely changed.

And two things are happening that, again, are wonderful for us, for me, which is, you know, mythos and post-mythos security.

And we touched on that a little bit about the exploitation window collapse and what do you do.

But when we look at even things like Opus 4.6, 4.7, 4.8, and now 5.0 as just the sort of benchmark that I think a lot of people use for vulnerability discovery today, capabilities for vulnerability discovery are definitely increasing.

A year ago, if you were to ask me that question, and while I was at Trail of Bits leading the AIML and AppSec team, it was around like a 10% true positive rate, 10 to 20%, right? Like that felt like maybe where we were going to peak because a lot of the research indicated that it was a memorization thing that was producing higher true positive rates for vulnerability discovery.

True positive rates, they've increased a ton over the last year in terms of what you can actually find with AI to produce real exploitable vulnerabilities and improve it.

Patching, not so much.

We've, we've gone through this many times.

We, you know, we did white hat security together, and at some point we pushed AppSec so high that the adversary shifted and they went to ransomware.

You know, they, they shifted tactics.

I did SentinelOne and helped them, and helped them out.

Yeah, in the layman terms, it's a vulnerability management.

So what happens is anytime when you are doing the security, whether it is physical security or software security, infrastructure security, there's a whole bunch of scanning you do right i may have a scanner or a pen testing and things like that and i'll do and i'll have let's say thousand ten thousand a million vulnerabilities are there For every AppSec engineer, there is 200, 300, 400 developers.

So that ratio is very skewed.

So you cannot fix all the million vulnerabilities or 100,000 vulnerabilities.

But now that we have agentic harnesses and these components are going to act on the behaviors and the intents that we give them, it's really important to like, hey, what's in your harness? So, yeah, I think that'll be a big one.

I don't know if this is really adding a control, but it's a reminder that we've been focusing on the identity aspects, or maybe the IAM aspects, if you will, but this is as much an AppSec thing, really, in its feel as it is about identity, and we don't want to forget the controls coming from that world.

You mentioned supply chain management.

Those are relevant here.