Is there anything else that you see that's missing? If you were trying to envision a software factory reference architecture, what do those components look like?

Yeah, so it's an awesome question.

Firstly, I'd say, I think there's kind of a split right now on people that are talking about, you know, this kind of stuff I'm saying, like you have a review agent and then some people are, you know, but it's non-deterministic, like it can make mistakes.

And my counterpoint to that is like, we've had people, people make mistakes too.

Like if we theoretically had, you know, a thousand security engineers and they could do all of this stuff, they're still going to make mistakes.

So I think the, like, it makes mistakes doesn't hold water to, you know, it's compared to people that also did it.

Now, the software factory thing, I think, is super interesting.

What is one thing you're looking forward to from the industry or forward thinking? What does AI security need next?

Yeah.

Yeah.

Well, and like that's the reason that like least privilege is important, right? Like if every If every developer was actually a security person, first of all, we'd never get anything done.

But secondly, you could give them more permissions.

You wouldn't have to worry so much about least privilege all the time.

But anyway, we don't live in that world.

So I would say developers weren't megatrusted in the first place, not because they're bad people.

When we think now about this new landscape of static analysis or banded cell tooling, what still applies and what doesn't?