Episode 330 - w/ Jeevan Singh - Vulnerability Jail

You're right.

Developers are, I mean, not only are they asked to ship more and more and more, but we talked about this ahead of time where they might be constrained as well on things like token usage.

So it's like use AI to build things faster.

Also don't use it too much AI though, because it costs money and that's bad.

We want the things we don't want to spend the money.

So I have one question about all this.

That's very, I feel very, very important and critical.

How much work do you put in? Let me set this up.

Love

it.

Yeah.

If you're going to be called on the carpet and you have to remediate something, that something better be worth calling people on the carpet and making them do things.

How do you do a good job of getting high quality, highly synthesized and correctly prioritized vulnerabilities i feel like that's a huge critical part part of this yeah

yeah there's a bunch of critical parts so also the ownership model um making sure that we are a high response security team as well so um yeah we've always done a pretty good job like i my goal has always been two to three percent false positives at most because you want to have the trust of the engineering team um so and i'm not saying we get it right all the time um we do definitely get it wrong and we we solicit feedback from engineering we we prefer when they provide us feedback and say i disagree um we have a much better conversation when it comes to with respect to that um so yeah it is i love that yeah they do trust us um we are not We don't want to be heavy handed.

At the end of the day, engineering is also driving the business and generating a lot of profit for the, or a lot of revenues for the company.

So we definitely want to work with them with respect to that.

But like, we also want to make sure that they are aware that there are consequences as well.

So with respect to the ownership model, we are a monolith.

We have strong service team catalogs within our monolith.

If something goes wrong, it's easy for us to quickly change the team and make sure that the right team is jailed instead of the wrong team.

And we are very, very high response.

Fortunately for us, we have a large sizable team in India, but also a large sizable team in North America as well.

So we have good coverage across the board.

So if someone's asking or saying, hey, there's something wrong with this, we need you to We'll look at it.

We'll quickly jump in, unblock folks, and then move forward.