Technically Speaking with Chris Wright
Oct 7, 2026 · 23 min · 9 segments
Every CTO and CSO faces a daunting reality: while engineering teams write clean, audited code, modern applications rely on thousands of open source dependencies they didn't write. When a critical…
Chris WrightHost
If you, if you go back in time, uh, scaling with people to do all of this work is a global scale problem.
Uh, and yet we need automation, we need tools, we need, uh, AI, LLMs to help us through th-this process of not just discovery, but remediation.
Um, I think a really interesting aspect here is we s-- you know, take, take an average enterprise, which is built of thousands of applications, each of which has thousands of dependencies.
So you get this sort of order of magnitude thing with that, that sandwich that you're describing being on the order of hundreds of thousands of, of different small language-specific modules.
Um, if you're trying to manage all of that as, as an enterprise and think about the change associated with all of that, I think that's by itself overwhelming, just the sheer volume.
In this Lightwell context, the versions that are being deployed into production are typically quite older than the versions that are being worked on actively in the upstream community.
I think part of the critical focus of Lightwell is patching those versions that are in production while sort of this parallel life of, of bringing it into the upstream, so we're making the overall, um, internet and open source sa- a safer place.
Yeah, I think looking at community releases where they're always focused on securing the most recent code, uh, is, is a fine goal for, for communities to work on.
But the code that is actually running in these production environments is, is-- can be much older.
Uh, in fact, the oldest vulnerability that we've discovered that is in production in a, in a customer's environment, uh, was a vulnerability found in two thousand and one.
And so, uh, uh, you know, at that point, you have to assume that whoever put that together has probably moved on to another job.
And that goes true for hun- the hundreds or thousands of applications that these customers are running.
And so a focus for us with Lightwell has really been on securing the content that they're actually running in their environment, and that's the last thing most customers wanna do, is completely upgrade some application that on its own is running just fine.
Um, but because the communities have moved forward and the technologies have moved forward, sometimes it can be weeks, months, maybe even years of work to fully upgrade that application.
Uh, and as a business, you wanna focus on, uh, the things that are-- that matter today.
And so by being able to focus just on the very surgical issues related to security, uh, it allows them to keep running application or upgrade it on their terms when they're ready to do it.
Um, this is that sort of peace of mind that Lightwell, I think, brings to the, the table.
If you, if you go back in time, uh, scaling with people to do all of this work is a global scale problem.
Uh, and yet we need automation, we need tools, we need, uh, AI, LLMs to help us through th-this process of not just discovery, but remediation.
Um, I think a really interesting aspect here is we s-- you know, take, take an average enterprise, which is built of thousands of applications, each of which has thousands of dependencies.
So you get this sort of order of magnitude thing with that, that sandwich that you're describing being on the order of hundreds of thousands of, of different small language-specific modules.
Um, if you're trying to manage all of that as, as an enterprise and think about the change associated with all of that, I think that's by itself overwhelming, just the sheer volume.
In this Lightwell context, the versions that are being deployed into production are typically quite older than the versions that are being worked on actively in the upstream community.
I think part of the critical focus of Lightwell is patching those versions that are in production while sort of this parallel life of, of bringing it into the upstream, so we're making the overall, um, internet and open source sa- a safer place.
Yeah, I think looking at community releases where they're always focused on securing the most recent code, uh, is, is a fine goal for, for communities to work on.
But the code that is actually running in these production environments is, is-- can be much older.
Uh, in fact, the oldest vulnerability that we've discovered that is in production in a, in a customer's environment, uh, was a vulnerability found in two thousand and one.
And so, uh, uh, you know, at that point, you have to assume that whoever put that together has probably moved on to another job.
And that goes true for hun- the hundreds or thousands of applications that these customers are running.
And so a focus for us with Lightwell has really been on securing the content that they're actually running in their environment, and that's the last thing most customers wanna do, is completely upgrade some application that on its own is running just fine.
Um, but because the communities have moved forward and the technologies have moved forward, sometimes it can be weeks, months, maybe even years of work to fully upgrade that application.
Uh, and as a business, you wanna focus on, uh, the things that are-- that matter today.
And so by being able to focus just on the very surgical issues related to security, uh, it allows them to keep running application or upgrade it on their terms when they're ready to do it.
Um, this is that sort of peace of mind that Lightwell, I think, brings to the, the table.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.