对话 Cloudflare CTO Dane Knecht：让智能体 Web 的安全能力惠及更多人

Brief Description

Sarah Guo and Cloudflare CTO Dane Knecht discuss security as AI agents change the web. Their conversation covers vulnerability discovery, secure development, content monetization, internal AI tools, token budgets and the role of interns and curiosity in organizational change.

Table of Contents

• Trailer
• Cloudflare CTO Top Priorities
• Today’s Attacker Landscape
• State of Internet Infrastructure
• Shift Towards Security Spend
• Road to Better Software and Internet Security
• Building Secure Production Software
• Reducing Surface Area
• Near Future of the Web
• Monetization and Signals
• Success for Content Creators
• Workplace OS and Use Cases
• Restructuring for AI-First
• Token Budgeting
• Cloudflare’s Intern Strategy
• Importance of Curiosity
• Attacking the Legacy Software Security Problem
• Engineering Team Prioritization
• Open vs. Closed Models
• Democratizing Security for Everyone
• Conclusion

Trailer

AI has become the tool that's causing this kind of security apocalypse is also the tool that can help us to solve it faster as well. It went from how to get everyone to using AI. Now all of a sudden everyone's racing to figure out what AI security means.

I've heard serious technical people say things like air gap everything important and we're like not going to be able to trust the internet for a while and we just assume all the critical infrastructure and government services fall down at some point. Is that your expectation for what happens? Dane, I'm so excited to do this with you.

Yeah, thank you. Thanks for coming here, too.

I'm sure I'm not the first person to make this joke, but your last name connect. That's pretty good for the Cloudflare value prop.

Yeah. Yeah. there's been some jokes about renaming the show next year.

Cloudflare CTO Top Priorities

So,

so with everything that CloudFare is doing, what are your top few priorities as CTR right now? Well, I mean, this past year, it feels like 10 years compacted into one. so those priorities are, constantly shifting, but, you know, it all goes back to our mission of helping build a better internet. And, that really hasn't changed over the last 15 years. where we want to make sure that, the internet's secure, that everyone has access to, be able to, get their content online easily and, scale it up.

and just you know over the arc of the AI changes in the past year you know it went from you know how do you get everyone just to using AI how do you make it easy for them to deploy and their agents to deploy to like most technical transitions security is kind of an afterthought and now all of a sudden everyone's racing to figure out what AI security means and it means things are you know different sides view it kind of differently you know one side is you know as a as a company is how do you keep your data safe from AI leaking the data out but it's also how do you keep people from getting in as well too and you know over the last I would say 3 to 6 months just the number of vulnerabilities that are getting reported in CDES has just gone up exponentially.

you know, previously on the internet, we would see these log forj moments or these shell shock or type of incidents maybe once a year and it would be all hands- on deck internally at Cloudflare to make sure how we protect not just you know our enterprise customers but also all of our free customers because we you know view it as a kind of a public good and making sure that the internet stays safe. to these things are now happening weekly. not all of them are publicly reported on but there are things that you know are as serious as the like the log for J type things but just happening at a greater frequency you know and I expect that you know through the rest of this year and in the next year by the next 18 months majority of teams time is going to be spent on security you know you I think there was a stat that was put up earlier today that during one of our keynotes where it was showing that I think over 50% of engineering time is going to be start to be spent on the security and I don't think that will last forever.

I think that will be a short transition you know at some point the AI will have surveyed majority of the code and found most of the bugs or found most of the shortcuts. you know, there's a one that's kind of coming out today and has been started to be blogged about and tweeted about where one of the keys on the internet is that protects all TLS and webk webpki which secures all your connections was secured by the number four literally the basically used if you know about cryptography I mean It's all about randomness, right? you know that's why software has our lava lamps is so that you can get good randomness. and when a key out there is they use the seed they use the initial thing to kind of create it with a single number four is going to be reverse engineered.

you know and AI can just do all these things you know it doesn't sleep. It's not like the one engineer you had that was red teaming things. you know last week I think OpenAI found the seeds for the NIS the NIS curves that were back in 2000 that were released.

Today’s Attacker Landscape

so just you know these things are just moving so fast and the bar is going up and the models are just getting so good at you know cyber security you know midas was just kind of the tip of the iceberg there where you know and since then it's not just been the models getting better it's harnesses it's how people know how to how humans know how to use them and use those frontier models in order to find those exploits

given your you know visibility What do you know about the humans behind, you know, these attacks and harnessing these models and taking the volume of vulnerability discovery up so quickly? Like are they, you know, nation state actors? Are they script kitties?

Like what can you say about how the how the attacker landscape has changed? well, I actually think for some of these some of these larger vulnerabilities that have come out more recently actually haven't been nation states. They've been you know, high school kids even that are we're going to call them agent kitties now.

Yeah. Yeah. That are that are just spending their time, you know, like they used to do kind of capture the flag security contest. they're pointing their agents at a an area and doing that. you know, there's also, you know, and there's financial award for them. whether it's buck bounties that they get paid out you know sizable amounts. but it's it's given the tools that honestly the nation states have had in some forms for much longer either through agents or just through you know sheer number of people that were working on the problems given it to the masses.

State of Internet Infrastructure

This is the first time in 15 years I've heard serious technical people say things like, "Well, we should just like air gap everything important and we're like, you know, not going to be able to trust the internet for a while and we just assume all the critical infrastructure and government services fall down at some point." is that your expectation or what happens?

Humans we are pretty adaptable and we can move fast when we need to. and you know I've seen the industry kind of partner together when things like this happen. people that you usually think of competitors are no longer competitors. We're just literally protecting critical infrastructure as you said. and I think when those kind of critical moments happen people and will rise to that challenge. so I'm a little less doomsday. I do think that a lot of the things that we've done over the past, you know, 5 to 10 years, moving away from a kind of a castle remote infrastructure for security to moving to more of a zero trust, does put a lot of companies in a better position where you know, you're not saying this office is completely airgapped.

You're saying, you know, these devices, the these flows are secured in a different way. and everything's going to be tightened.

Shift Towards Security Spend

What is it going to take for organizations to do what you're describing? Like 50% of engineers do not work on security right now. I had Greg Brockman from OpenAI on the No Priors podcast last week and he said that he thought in 2027 people were going to spend as much money on tokens for security as engineering.

Like you're saying very related idea. what is going to drive that shift?

There's emergency, right? So, you're going to move forward all your security spend over the next 18 months both from the red team side which is more the offensive trying to actively try to exploit things as well as the defensive side how you prepare things. but I don't think that's going to be last forever.

Road to Better Software and Internet Security

you know I see a world in like 18 months where you know new software productivity goes way up because you know all those resources are back focused on that but there's definitely this period where security is needs to be on everybody's mind

what do you what are some of the key elements of getting to you know a better place in terms of overall software and internet security I think people discover of course like that there are libraries and services everyone uses use that had vulnerabilities that took effort to discover and now do not and I think we'll hit some of those what else is important there because part of the concern that I have is the rate of software production is also going up a great deal right so to some degree we got to go like patch everything that we have already made and then keep up and get ahead of the pace of delivery

yeah well so I mean for one we're right now we're are patching 70 years of software out there. So some of it is just catchup. and then on a go forward basis you know I think this you know the software development life cycle the agent development life cycle is going to need to change and you know luckily this the same way that we can use security right now for red team and things like that it'll just be built into the process every step of the way and I think you know software will just get more secure over time.

Building Secure Production Software

What have you learned about building secure production software internally already that you think people can learn from? Like what does that mean? Like shift left and like can we there are there are many theories of how to do this including you know broader use of formal verification using agents for security in the development process like what do you think is going to create better software from first delivery?

I kind of go back to first principles there is you want to reduce your attack surface area. The easiest thing you can do is to give less places for there to be vulnerabilities. So you know looking at all your software and saying how can I simplify this?

how can I reduce this you know the footprint the code and then you know beyond that I mean things like formal verification like and I think things that you know safer programming languages and things that kind of built into the runtimes that make everything safer will come but you know I think it just starts with and you know AI at least you know for the early AI is very verbose it likes to create complexity so you know AI in a sense of what we've been dealing with has actually not been kind of helping build a more secure stuff right now. But I think we'll get there. And I think the you know that's where humans still come in and human judgment comes in and making sure that we design the software in a way that can stand on you know its own securely.

that was actually going to be my reaction when you say we want to reduce the surface area. I'm like, "Oh, yes, of course, in principle." And that's not the natural inclination of today's models, right? And like, you know, I ask you to do something and I'm like, "Well, like with onetenth the complexity, please try again." is that the role of engineering and security engineering today?

Reducing Surface Area

Is that something that's going to be solved to the model level?

The way that humans did before, agents, it needs to be solved kind of at all levels. You need to train the engineers that are writing the code, the product engineers. you need to the security teams still need to be involved in making sure that they're getting a you know checks and balances, second set of eyes on things. You need to build in processes. we've gone to defining things a lot more internally on how we build at Cloudflare. writing down our principles. we have a document called the codeex which is kind of like you know build up a lot of RFC's that the teams have built for here's how you build secure software cloud. here's how you build available software at Cloudflare.

Here's our best practices and then it kind of gets boiled up into some ten commandments that the agents know how to follow and use at every part of the review process that can help enforce those things.

So, you know, you have agents out there that are, you know, just riding a lot of the slop and then you have deeper down in the factory, you have people that are, you know, doing the performance runs and the secure security runs. And just like how the company operated before, I think you need those adversarial reviews.

Near Future of the Web

when you zoom out a little bit and just look at overall traffic on the internet and how much of it has become agent-driven over the last year. I think it's outpaced most people's expectations. What has updated in your worldview of like what the web a year from now looks like either from an economic model perspective or a security or requisite infrastructure perspective?

Yeah. I mean, I kind of think of it as we're in the messy middle right now where humans and agents are, riding the same rails, on the internet, where, you know, agents are trying to, parse a human web, when that's just, you know, one is just inefficient. you know, and, was designed for humans that could do things at different speeds. you know going to a website and be able to read and you know see the ads and participate in the more the econ full economic model versus an agent that now can go to a thousand web pages in the same period of time which is which is which is great. It's just you need to find a new economic model to support that.

Can we get parallel webs? Is there like a human web and a machine web like everybody's trying to do what is it called AEO now?

Yeah. I mean yes I think we do I think I think we find ways to deliver the content and meet and meet agents and humans where they are as opposed to trying to meet them in the same place. and right now there's like translation layers. You know there's a lot of companies that like you know help you know an agent view a web page. these are just all extra you know burning of tokens for things that probably don't need to be need to happen. you know, the website usually knows what data and you know, we've had things like this called, you know, we've had APIs, you know, ways that computers talk to each other for years. it just, you know, APIs only covered a small fraction of the information on the internet. and agents, have a thirst to, you know, understand everything.

and so they're going out and trying to explore the human internet. and, you know, we need to make it, easier for them. we need to make it you know less costly for the site owners and we need to find a way for them to get compensated you know you know I think I think it's in a world where it can get very simple you know you know most like a content website like a substack that you know they know what their CPM is for how much money they should be making on ads u for that site and so if an agent's reading that site I think there is a world where you get to the point where an agent can decide whether or not they want to read the content and then they can decide if they want to pay the CPM rate, right?

And you know that's where you need to then get new payment rails for the internet that can do you know millions of transactions a second for these all these little microp payments all these things that we've been talking about for years you know u microp payments you know always are two years two years away and you know I think agents will actually push that forward and actually I think we will see a world where actually there is a new economic model for content creators. what who do you think the players are or what are the variations of that infrastructure right like I think obviously Cloudflare has an important role to play here but the rise of personal agents like Instinct and Muse have also made this like an immediate question from a transactional perspective

I don't think everyone knows on the you know on the other side what the business outcome is going to look like you know everyone's been through these transformations where the internet you know it was going to kill Main Street it didn't kill Main Street there you small business are still thriving. but you know there were people that were displaced and so there's always kind of some skepticism there and so you know there's some natural inclination to like just block them out right you know you saw Amazon just say no personal no personal shopping there from an agent. I mean I think these are all people that are you know this that messy metal where they're trying to figure out what that path forward is and trying to keep some of their you know negotiation leverage there.

I think we will get to a place where muse and dots and all those personal agents will be able to accomplish tasks seamlessly as you as a human could do even easier. But I don't know if the technolog is quite caught up to that yet and the business models either.

Monetization and Signals

Is there anything you're personally excited about on the road map or just from a technical exploration perspective on the cloudflare front that you like feel like is going to enable this ecosystem in the future? well yeah I mean absolutely on the content side you know we've released u a conference monetization gateway where we make it easy for people to put their sites behind us and take microtransactions for their content. we including providing a wallets for agents to use and a stable coin that's going to be able to help kind of facilitate that transaction as well. you know, we're also doing things with OpenAI, a project called Signals where we're making it easier for agents to actually discover content instead of having to crawl the entire internet and continually go back to pages. are making it easier for them to know what's new content and actually kind of more proactively do that.

So, you know, it's a it's a win for the AI labs as well as a win for the site owners not having to get constantly crawled and pay for that infrastructure. so, you know, there's a whole set of kind of new laws in the internet that I think really excited to see those kind of grow to see you know the you know X42 from when Stripe came out with it. loved it because it went back to the 402 HTTP code which was you know Tim Burns leak created you know 20 plus years ago or 30 plus years ago for payments. So like you know we kind of always knew that you needed a payments a better payments rail on the internet but we haven't been able to you know kind of figure it out and I think agents will lead us to that as well. when you think about these ## Success for Content Creators

initial products that you've released, like is there what would success for a content creator or somebody who ostensibly had a website on the internet that they were monetizing with ads before? Like what's the what's the killer success case you guys need to see or show the world where it just becomes like a default to do this?

well, I mean, I think we're instead of them paying us, we're paying them, right? you know where it's it's covering their infrastructure costs. It's providing money that supports their livelihood. you know, you know, we can actually increase the number of content creators out there which you know the last generation of the internet has done very well like with YouTube and Tik Tok and XA I think we can actually make it even exponentially larger.

Workplace OS and Use Cases

And when you look at the workspace OS like release and ecosystem work that you guys have been doing, what is what are you hoping are the like biggest use cases of it coming up?

This is kind of transitioning a little to a we released something called Cloudflare OS. and Cloudflare OS was is our internal platform for how our employees use AI every day. where we you know and it actually goes back to security roots where you know we were very worried about customer data internal data leaking out and we wanted to make sure that our employees could you know use all the new AI tools and models but have a way to safely deploy them internally to understand how that data is being used and flowing and have you know kind of good governance o over that. in addition the reason my company called Cloud for OS is we started to realize that you know as we had more and more agents you know we needed to be able to teach them what made Cloudflare special how we built a cloudflare you know and for humans we did that through Cloudare University and the onboarding process and you know meeting your colleagues and working with them.

but we needed to kind of more clearly define that and document that for agents and so Cloud OS is both the platform where our employees can build anything that they want. in a secure way without having to you know security it's not something that they have to think about. you know the BR that's trying to create a call list they don't have to worry about security is just built in there for them but they also know that it's being done in a way that is consistent with the themes and values of how cloud works

and why release I think of this as like somewhat different from the other products that cloudfire offers today in that it is not infrastructure it's like an enduserfacing product for managing AI use within the organization like Why release it or do you think of it as a departure?

Yeah, I mean for one it was it's kind of a reference architecture really. it's you know we over the past 10 years we've built some our developer platform where we started with just a simple serverless compute primitive and now you know over a 100 different developer platform tools from storage to databases to durable objects. we wanted to show someone show how you can build it completely on Cloudflare. and how we build things internally and kind of give people the option to you know fork it and build their own version of their own company OS on top of

and what is a way in which it is helping your people and your organization that you think is like clear success?

it's actually used more by our go to market teams and our GNA teams. than it is even used by our engineering teams. you know it's you know giving them a very fast you know early on I thought you know we saw training was the biggest gap for people using AI and when you just kind of point them at a chat interface or another byputting tool it's too much a blank slate for them and so you know this is a platform that's design you know you design everything for it for how your business works and you they immediately can go there and you get access to all the data that they need. they can get guided and taken through where they quickly realize, oh, this is not, you know, trying to replace me. This is trying to make me better at my job.

and that's been really exciting to see just all the different ways people at the company have done that. you know, a lot of the how this the conference got put together. the marketing team I mean built hundreds of internal tools where previously you know they would have they would have to go out and work with different agencies but they can you know the speed that they can move with a smaller team now it's just amazing.

Restructuring for AI-First

Assuming this is a continuation of you know starting in May you guys did this restructuring to be an like sort of AI first organization what else reflecting on you know the last number of months has worked or not worked that you would recommend to others? Yeah, I mean so you know that the restructuring was hard you know saying goodbye to some of our colleagues was the first time cloud for ever did it. you know we had always been very careful not to overhire and but this was for different reasons. this is because we saw the way AI was transforming some teams and how they work. and you know we kind of thought of it as like a factory floor where you needed to re actually rebuild rethink how things happen. you know the there were some processes or some you know the way a product manager would send an email for to customers. It involved three teams.

You know it involved a team where you know you went to BI to go get a cohort of the people that you wanted to send an email to.

You went to the marketing team to help you design the email and get the voice right. you went to the marketing operations team to get the email out. where you know it you're never going to be able to actually redesign that process unless you kind of kind of make some hard changes and force people to kind of rethink well what actually is the right way to do that. and it might not involve those three teams at all. It might just involve a new way of doing things and you know so what came out of that was a tool where a product manager now goes in and describes the cohort. they write an email it rewrites it in CloudFare's voice. it sends it to their manager and the manager can click approve if they like it and it goes out. where you know we didn't go from three teams getting faster at doing that.

We went to you know one tool that can kind of let a product manager now have a superpower that they didn't have before. When you think of all of the different workflows and tasks within an organization that's got about 5,000 people like Cloud Players, like how do you decide who the owner is of rethinking that process? And like was it bottoms up from one of those teams in this case?

Like is it an organizational leader? Like when you have so many of these things that could change to be faster and make more sense as you described. Yeah, I mean Cloud For has always had a thousand more things that we could we could ever do, whether it was, you know, products and features or things like this.

And so, we always look for people that, are going to take initiative and ownership.

and so, you know, it doesn't really matter if you're ordering it, you know, one to 100 and try and prioritize it. Any one of those hundred things, are probably safe if someone's passionate about it. So, you know, we kind of gave people at the beginning of last year the tools and started seeing how they were experimenting and you know, people quickly kind of broke out into different cohorts of people that were really leaning in and you know, just naturally doing those things and taking ownership of them. so, you know, I think it was very bottoms up from the how we're going to do those things.

Token Budgeting

it's been a major topic of conversation for organizations as to how they should think about token budgeting right like you know what's a reasonable amount to spend how do I think about this versus human capital who should get tokens even within our organization like what is your philosophy on this now

it's definitely changed you know each model kind of makes you re rethink it as the cost dynamics change but you know in general you know, I think it's kind of silly that we're actually asking humans to decide which model to do each task. like it should be intelligently routed.

Exactly. Like humans just aren't aren't going to ever be good at that, right? Like you know but you know early on you do it kind of brute force and you know people you get people to experiment and you say hey well you know let's try for the planning part let's use the you know the top frontier models for that. and then you know once the plan's written out and agreed upon and iterated on then you know potentially some more of the open source models can go do that and then you go back and you have a one of the frontier models do the reviews and the red teaming and things like that. now all that today is you know fairly manual. but I think you know as we start to learn and experiment I think people will become intelligent and you know and you know over time there'll be more governance on that you know coughware has been in a place where you know largely we've let people use the models and tools that they see fit for the job.

you know we don't have we don't have a token leaderboard. we don't encourage it. encourage people to focus on the output. the you know they're not graded on, you know, if they used it, they're graded on, you know, what they've shipped and what they've built. but then u you know, we do have some kind of we found like just kind of like giving people notices like, you know, if you happen to use $300 a day, they just get an email, right? Like says, "Hey, did you know?" And because most of the time people didn't realize they were doing it

and they're like, "Oh, huh." and then I think if it gets to like 500, it goes to your manager. If it goes to a thousand, it goes to a VP in a day. But it's it's you know, it those things rarely happen and usually it's it's it's people are actually happy to get those notices.

Cloudflare’s Intern Strategy

Where do you think you are in your overall evolution of like take things just for the current level of capabilities of models assume no new development of you know rethinking the way different things at cloudflare are done from go to market to engineering to be

oh I think still so early you know comfort did something you know two years ago we had about 200 interns and what we saw was those interns I think were you know really the first you know fully kind of AI native you know where that if you took AI away from them I don't think they would be able to work and is that good

I actually I think it is I think they know how to use the tools better than us it's just like you took Google away from me you know over the last 10 years you know like you know how would I learn anything right like that's just that's where they reached to first and we actually saw the managers that had interns that from that summer actually adopt AI faster so then this past summer this past year we decided we're going to hire a thousand interns.

So that's you know for 5,000 person company.

Yes. Wow.

Yeah. over the course of the year still

Yeah. And it's just been amazing because you know one just the number of ideas that come from the interns you know that's something that you know with AI less people experiment faster and so having more ideas to get more people in there but also just seeing the way that they use AI like you know they need to fill out a form they reach for AI and I still find myself you know there are so many things where I'm like oh wait I've just been doing this manually still And then I'm like, "Yeah, oh wait, actually I should be using AI." And I don't think that's a natural for most of us yet. and I think that will that will take time. And so yeah, I think we're still very early in our AI journey.

I love it though. The mass intern strategy. I run a very small partnership and we always have a you know an intern or two floating around a team of about a dozen for you know ideas and intern energy and all that but we just converted one of our you know in college interns to full-time and Jed and had him drop out and everything and I think that you're right where maybe like the dial should be turned up on the amount of DNA that is really native to these tools.

Yeah, I think it's great for them as well, too. You see these schools like Waterlue and Nor Eastern like with these co-op programs and you know, from what we've seen is people that get that type of real work experience just you know are some of our best employees many years in and go on to do you know great things.

It is interesting or encouraging though that in instead of it being like hey here's a master plan where we're going to map out every department and sub department at cloudflare and be like here are the key workflows we're going to try to re-engineer the workflows. It is instead a strategy of like assume people are rational about their tokens if given information about their usage hire a bunch of interns and assume high agency people we have here are going to go like

you know shift those workflows to something more intelligent over time.

Yeah. and then and then brute force and just try things. You know, early on we had an email alias called agents at Cloudflare where we this back in January of last of this year where we just told people to you know you curious can I use AI for this you know email in your jobs to be done you know and that email would this would reply back to the skill file. and for a while people thought it was actually you know thought it was all AI and automated. It was actually a bunch of interns that were you know helping people write scale files. but that let us kind of get to see you know in a way that's not going out and like you know hiring a consulting firm to come out and like catalog every single thing to be done.

It's you know people that are recognizing hey this seems harder than it needs to be.

I wonder if an agent can help me here.

Importance of Curiosity

Is there anything else about the last year that's changed beyond the intern level like your hiring philosophy and what you look for in people to bring on?

well I mean one of the biggest things we've always looked for is curiosity and so you know if people aren't using AI at home in their personal life and all that I mean that's a pretty big red flag like I mean just how can you not be embracing AI if you have you know a level of curiosity out there. So you know I think just double downing ding down on some of those kind of key characteristics of you know drive and curiosity and empathy play even better for this next set of people.

well I'm I mean I am a alpha user of all products and technology forever. So but I think the answer is like fear and skepticism, right? and so I guess implicit in this claim about like curiosity including in experimentation with frontier tools is like that needs to that needs to be a core principle for people who work at Flare.

Yeah. I mean I mean a lot of things we're doing we're not you know we're inventing new ways of doing things. I mean the scale that we operate at for the number of sites behind us and the amount of free services we give away it's just not possible with off-the-shelf technology so you need people that can come in and literally invent new things and that I mean that starts with curiosity.

I have a couple questions for you to close out and so mainly about security both and how to do that in a new way both at Cloudflare and then how you think it's going to work in the in the broader ecosystem.

Attacking the Legacy Software Security Problem

what do you think is the like process by which if half the engineering team is going to go work on security and just like fix 70 years of vulnerability how do you attack that problem internally assuming that not all software is perfect even amazing production internet scale software and then you know we'll talk about the ecosystem

yeah I mean I think largely you know we're you know today we have one red team I think by the end of the you know the end of the year next year we will probably have four or five red teams so you know break people out into groups that are actually you know being more adversarial and actually like going out and actively trying to find vulnerabilities. why is that the approach when instead of like oh we're finally going to get like our patching systems right our processes right? I

mean processes and those things could always be better. we have a ven process we have a patching process.

are they perfect? No. but you know the best way I found for those sorts of things to get better is to out of out of crisis kind of comes that has that's that's how you get those things fixed. you know when the volumes get too big for the engineering team to just do them on using their normal processes you know you know engineers are inherently lazy in a good way and so they will they will automate away those things as they as they as they need to as they kind of realize that there's no other way to do that so you know you know I think the focus needs to be on the discovery side and you know people will do the right thing and figure out how to patch it in a scalable way over time. Do you express a philosophy on just prioritization of this versus like shipping new features?

Engineering Team Prioritization

because I guess my understanding of it's it's not as if we didn't have a backlog of like vulnerabilities in every large piece of software to go fix. It was just like whether or not that was a priority for engineering teams previously as one common state. I

I mean I think you need to figure out how to do both. you know it might come at the expense of cost optimization or other things but I mean companies if you're not shipping you're dying is how we think about it. So it's not going to be freeze in order to do this.

Oh no absolutely not. You know you need to you need to be able to continue building and shipping new things. but you need to be able to make sure that you're doing it, you know, securely and patching and fixing bugs and I think if we do it right, we actually be able to do them both faster with AI. I mean, while AI has become the tool that's causing this kind of the security apocalypse to happen, it is also the tool that can help us solve it faster as well, right?

So, so, so it's on both sides of it.

Open vs. Closed Models

Oh, where do you fall in this debate of the role like good and bad of open and closed models on the cyber front? Right. because the argument the broad argument is well having defensive and offensive cyber vulner cyber capabilities you know they're parallel in the same model despite safety and guardrails being built into them. And so you can't have open defensive models without them also being offensive.

And then the argument sort of or the concern around only having security capabilities in a set of frontier closed models is well how are you going to release them and you can't possibly get them out to the distributed set of actors that need to defend like what do you think or did I characterize that correctly?

Yeah. I mean I think over time it all has to be open because everyone's going to get access to it anyways and you know

that's how open source tends to work. Yes. the bad guys the bad guys are going to find a way to get it. so all you are and the you know the top companies will have a way of getting it as well. So I think you're you're just excluding a mass population that just doesn't have the access that probably needs it.

Mhm.

Democratizing Security for Everyone

And then so final question just because you know Cloudflare very missionoriented does carry the weight of some you know internet resilience on its back. What about all of the people who can't afford to have four red teams or like never had a red team to begin with that run important systems like how do they how do they protect themselves? Also you know I would say put your sites behind Cloudflare, put your infrastruure behind Cloudflare, build on Cloudflare. you know when these major vulnerabilities come out like the React one last year we don't just give it to our paid customers who have like the advanced firewall and WFT capabilities we give it to everyone.

We view those kind of things as a part of the utility that we offer and you know what it provides. that just like you know we want to provide performance for everyone. You know before cloud first started you know there were probably 3,000 sites in the world that had a large scale CDN to cach their stuff at the edge.

You know now there's hundreds of millions of sites that do so you know copper's always viewed our goal as providing democratizing the security and performance for everyone.

Conclusion

Awesome. Thanks so much for doing this Dane and you guys heard it first. we have the agent kitties and the vulp vul apocalypse. Am I pronouncing that right?

Yeah.

Yeah. but it's resolvable. All right. Thanks so much, guys.

Thanks.

Find us on Twitter at No Prior Pod. Subscribe to our YouTube channel if you want to see our faces. Follow the show on Apple Podcasts, Spotify, or wherever you listen.

That way, you get a new episode every week. And sign up for emails or find transcripts for every episode at no-briers.com.