Your Developers Are Letting AI Answer Your Security Findings

And you raise a good point about when building something from scratch, you really do have the opportunity to do it right from the very beginning.

And I think that's where we are with AI right now.

And my fear is we're going to miss the boat.

Like everything that we've learned and everything that we've known and talked about over the last 20 years since AppSec's been alive or around, we were constantly chasing the software development practices of the past.

And I'll go as far as to say we never actually caught up.

We never, I mean, people wanted to shift left, they wanted to shift right, they wanted to shift up, shift down.

We did all the shifts.

but we never actually caught up and made it in the end.

And so I feel like we're at this point right now with AI and things that are being built with AI, where if we set ourselves up, we could have a solid foundation for the next 10, 20, 30 years.

But if we miss it again and we let it go, We could be doing the same thing.

AppSec could be chasing AI for the next decade.

100% agree.

I mean, there's a big opportunity now with especially agent skills and processes and building software factories to embed security by design from the get-go, right? You're seeing a lot of security design review companies, including ours and many others that exist in the market that are starting to think about it.

And I think you can embed security from the moment an idea pops up.

or an agent starts to plan to embark on something.

Hey, let me go check this other service and see like, what do I need to do for my security standard? Or let me look at the skill and think about it.

And you can guardrail a lot of these agents and a lot of the secure development process.

But it's interesting because we have an opinion about this, that the problem with LLMs is they're kind of inhibiting human taste.

And I think security is taste.

It's a very tasteful exercise, actually, because there's a direct friction between the user experience and security, right? There's an inverse correlation.

The more security you need to make someone go through, the less of a pleasurable experience that is for the user.

Look at the TSA, right? No one wants to go through the TSA, but we all have to go through it.

And the more TSA makes it more scrutinous the less of a pleasure we'll experience it is to get to your terminal, right? And so I think that still has to have human tastes, right? Spitting up a new service, well, should we treat this as a zero trust service or not? That requires a level of intellect to know like, what is our risk standard and policies? And what do we really want to do here? And I fear that LLMs still don't have that taste unless they're instructed to think about it that way.

I don't know why you think about it, but that's my fears around the space in some way.

Yeah, and there's nothing enforceable at this point is also the challenge because you can inform the model, but you can't mandate the model to do something.

And you raise a good point about when building something from scratch, you really do have the opportunity to do it right from the very beginning.

And I think that's where we are with AI right now.

And my fear is we're going to miss the boat.

Like everything that we've learned and everything that we've known and talked about over the last 20 years since AppSec's been alive or around, we were constantly chasing the software development practices of the past.

And I'll go as far as to say we never actually caught up.

We never, I mean, people wanted to shift left, they wanted to shift right, they wanted to shift up, shift down.

We did all the shifts.

but we never actually caught up and made it in the end.

And so I feel like we're at this point right now with AI and things that are being built with AI, where if we set ourselves up, we could have a solid foundation for the next 10, 20, 30 years.

But if we miss it again and we let it go, We could be doing the same thing.

AppSec could be chasing AI for the next decade.

100% agree.

I mean, there's a big opportunity now with especially agent skills and processes and building software factories to embed security by design from the get-go, right? You're seeing a lot of security design review companies, including ours and many others that exist in the market that are starting to think about it.

And I think you can embed security from the moment an idea pops up.

or an agent starts to plan to embark on something.

Hey, let me go check this other service and see like, what do I need to do for my security standard? Or let me look at the skill and think about it.

And you can guardrail a lot of these agents and a lot of the secure development process.

But it's interesting because we have an opinion about this, that the problem with LLMs is they're kind of inhibiting human taste.

And I think security is taste.

It's a very tasteful exercise, actually, because there's a direct friction between the user experience and security, right? There's an inverse correlation.

The more security you need to make someone go through, the less of a pleasurable experience that is for the user.

Look at the TSA, right? No one wants to go through the TSA, but we all have to go through it.

And the more TSA makes it more scrutinous the less of a pleasure we'll experience it is to get to your terminal, right? And so I think that still has to have human tastes, right? Spitting up a new service, well, should we treat this as a zero trust service or not? That requires a level of intellect to know like, what is our risk standard and policies? And what do we really want to do here? And I fear that LLMs still don't have that taste unless they're instructed to think about it that way.

I don't know why you think about it, but that's my fears around the space in some way.

Yeah, and there's nothing enforceable at this point is also the challenge because you can inform the model, but you can't mandate the model to do something.