# Enterprise Agentic AI: Security Debt and Adoption

**Podcast:** The AI Native Dev - from Copilot today to AI Native Software Development tomorrow
**Published:** 2026-10-20

## Transcript

Someone said, Mintos basically was a margin call on your technical debt.
And last week I was with a, you know, like a hundred plus CISOs in New York and people are now starting because of this like, you know, real notion that there is an autonomous attacker out there.
Lots of attacks have happened.
Speed has increased.
Security has not kept up.
We've seen 10x increase year over year on the backlog.
And for every issue that is being fixed, eight new issues are being created.
The AI Native Dev is a podcast for developers and engineering leads at the cutting edge of AI and agentic coding.
Join your hosts, Guy Pajani, and me, Simon Maple, every week as we chat with the most exciting voices in AI and tackle the biggest questions facing developers today.
This is the AI Native Dev.
Yesterday, you were writing code.
Today, you're prompting agents.
Tomorrow, you'll be running a software factory.
Agentic coding is moving fast enough to give anyone whiplash.
This June, AI DevCon London sold out.
Hundreds of developers, engineering leads and VPs packed in to hear speakers from Anthropic, OpenAI, Netlify and GitHub cut through the hype and get to what actually works.
This November, we're bringing it back to New York.
Bigger, bolder and full of people actually building the agentic future.
Three days of real talks, real tools, real answers, whether you're directing the agents, building the loops themselves, leading the teams or setting the strategy.
As a podcast listener, you can get 15% off your ticket using promo code POD15.
We have so much planned and we can't wait to have you join us in New York.
Hello, everyone.
Welcome back to the AI Native Dev.
I'm Guy Pajarni, and we're here in the Snyk AI Security Summit, or the Snyk-backed AI Security Summit, with Manoj Nair, who is heading product innovation marketing.
I forget now who used the title, but kind of key product leader in Snyk.
Manoj, thanks for joining the podcast.
Thanks for having me, Guy.
A really fun event here today.
Various companies.
various stages.
But I figured what we should talk about today, mostly also relevant to the kind of AI Native Dev audience, is to talk about the enterprise and kind of the state of AI in the enterprise and agent adoption.
Because I feel, you know, oftentimes in this podcast and in general, maybe like the hype of the era, you know, we get drawn and we dig into just sort of like this incredible futures on it.
And enterprises have certain Burdens, a lot of urgency to move, but certain sort of burdens that prevent them from doing it.
And I think Snyk is in a really, really good kind of a point of view on it, working with some very moderns.
So I guess just to kick it off, what is it that you'd say is the current state of enterprise adoptions as you're sort of seeing it?
And then we'll dig a little bit into why are...
like the ones that are behind what's holding them back and the ones that are ahead how are they getting there yeah it's a really good question first of all thanks for having me here and thanks for being a sponsor of AI Security Summit.
So it's become a really good collection of people talking about security and AI.
A year ago, no one was really cared.
Now that seems to be the biggest topic.
So it's been a really good turnout and good to be here.
I find, just as a bit of a side note, like when I founded Snyk many, many years ago, I debated whether to come back to security because I was saying on how...
Like you go to a security event and you come back and you kind of want to cry in a corner, you know, like curl up in a corner and cry as it's just like the world is doomed.
You know, there's so much problem.
And, you know, you're going to like a DevOps conference and it's all like singing Kumbaya and the web is amazing and we can kind of build these great things on it.
And so I think like in the world of AI, it's just this sort of odd combination of both.
It's like you have these conversations about these incredible things you do in building and in security.
all these things that AI unlocks.
And there's definitely a lot of doom.
There's definitely a lot of like the world is collapsing on us, agentic attackers, what can we do on it?
So it's just sort of an interesting...
I'll start there.
I hope we had the healthy dose of optimism too from all the speakers.
A lot of both.
I liked how an enterprise customer recently classified it.
And I'll give you a little bit going back to the first question.
AI is definitely an attacker now.
AI is also a new threat surface.
And then we had Satya Nadella talking about it recently.
AI is an insider and an agent.
The fourth thing, actually, is the interesting part in all this.
AI is also a defender.
We can unpack that.
But if you take those first three things, I think from an enterprise perspective, you think about using AI versus using agents.
And are you just using or are you building?
So we classify it, like think about this like a two by two, like, you know, use AI, building with AI, use agents, building with agents.
And so categories of companies that I would say are almost every 100% is using AI.
Yeah.
You know, Gemini.
Yeah.
Let's assume that's now pretty much the standard.
So we've been to like a lot of their existing kind of enterprise tools.
It's just sort of, it's there.
And then you got, you know, building with AI.
So you have the co-pilot era and.
It was so interesting.
Maybe sitting 18 months ago, we thought it was game over on AI coding as co-pilot.
But there's still a healthy percentage of the enterprise customers because they were early to co-pilot.
They were Microsoft and GitHub customers.
So that natural gravity was there.
But that was easier because of the connection, I feel, for a lot of enterprises.
So 50-60% of the enterprise probably is...
kind of, you know, in that some kind of AI, you know, assistant mode.
Right.
Auto-completing and sort of sidebar chats.
Sidebar, like, yeah.
So humans very much orchestrating.
And so then enters the agentic, you know, building with agents.
And that's where I think, like, it's usually the cursor, you know, clawed unlock that happened.
That's not still a factory, but it's, you know, getting to a point where...
okay, the agents are doing work.
I can shut down my laptop and go away.
And there's a risk aspect in all this.
That's where the attack surface, AI as an attack surface, really exploded over the last six months with skills and MCP servers and all that.
And then the last one is like building agents.
So you're like actually, and I am modifying that last category a little bit.
I think maybe part of our conversation is.
you are shipping production agents, whether for internal use or external use.
So you're not just using agents.
But I also think those people are increasingly the ones that are, you could probably say that's also where the software factory is coming to life too the most.
As they're building enterprise.
That last category, right?
And so I would say there's a lot of people shipping agents now.
We are just releasing the state of agentic AI in the enterprise, volume three.
I never thought we would do one of these reports three times in a year.
It's so rampant.
It changes so quickly.
It's changing quite a bit.
First time we did it was January.
Surprise, surprise, OpenAI was number one in terms of models being used for building.
By the second report, Entropic really closed the gap.
And this third one, we are really focusing on the agents, not just models being used.
Like what are the harnesses?
What are the agents?
and we're starting to see like this is interesting term of reach of the risk right so you could use you know we see lots of different models open models have become much more prevalent than than even six months ago but there's a lot you know a lot more agents in there too in the path so let me uh echo back a little bit and just like drill into a few things before we go further so the first thing you're saying is there's actually still a fair bit of that sort of co-pilot style sort of self uh kind of uh development uh and organizations we actually see this a lot at tesla as well And I think it's almost like the inaction versus the action or it's a little bit of the feel-good appeal of like, yeah, yeah, of course we're sort of building with AI.
And it's interesting because I feel like with Cursor's cloud agents, there was sort of a lot of this conversation.
Like in some of the kind of more frontier development sort of teams, not frontier models, the Cursor cloud agents are convenient, but they weren't necessarily like seen as sort of something novel.
But I think what they cracked pretty well is actually this like, fit and convenience into Indeed, these sort of enterprises just sort of smooth their journey into that path.
And that's the twos to the threes that I think about, like a lot of customers transitioning, you know, from being just using AI as a co-pilot to using, you know, doing more agentic development.
transition was easier because of...
With that sort of cursor cloud agents.
So as they move into that, so maybe let's drill into that and then we'll sort of go a bit into these others that are billing agents and into the attack surface.
I guess what has been, what do the companies need to overcome, right?
Or like, what is it that helps them make that leap, whether it's from a security or risk or compliance or maybe even cultural reason?
to be able to go from I'm just co-piloting to I am now kind of agentic, developing agentically.
Honestly, the number one propellant of that, I feel, is leadership and culture more than anything else.
We have stories of, you know, like some of the largest financial institutes in the world where the CEO and leadership team are actually using agents on a weekend and they come and talk about it.
And so it becomes a...
The pace of change of these enterprises are so slow typically.
But when it is the top-down person saying, no, you are going to be more productive doing agent development, that makes timelines.
Think about 50,000 cloud code agents getting rolled out in an enterprise.
That would be a year-long project.
We were notified in May that it's going to be by August.
That sounds like an aggressive timeline.
And then end of May, I got a call saying, no, it's being pulled in to July 10th.
So top-down pressure really works.
And then there's pressure.
This is obviously security concerns, right?
And so when you have this conflict between, then what happens is it goes to the CTO versus the CISO.
So the CTO is the proponent for the change.
And we are seeing a lot more of the power of shifting the culture that goes from CEO to CTO.
CISOs, unlike in the cloud era, that they were slow to get to it, they don't want to be left behind.
And we can unpack that too separately.
But they don't want to be left.
Some of them are even driving it because of the agentic attacker, which we'll get back to.
So then it becomes like, what are the biggest known security risks?
And it really breaks down to, in coding at least, what do agents do?
They produce, there's an output.
And in the process of producing, the output could be insecure.
You know, the code might be bad, they might use bad dependencies.
No different than devs, but just faster.
Then there's, you know, the environment.
Again, there's a new supply chain.
So you started Sneak and, you know, it was like the dependency supply chain risk was a big concern.
The new ones, you know, like skills and MCP servers of the new NPM of these agents.
So those are, you know, there's toxic flows, there's toxic skills, like, you know, three lines of English can be malware.
What is the intent of the skill?
And then finally, the behavioral risk, right?
So like the Pocket OS moment was like a big moment for a lot of CISOs, even though it was a safety thing.
Do you want to remind us of the incident there?
And this is, you know, Pocket OS is this company that's building a rental car, you know, management portal and software.
And I think the headline story of this was the agent was overly permissioned and deleted the production database and, you know, Rails API backend or something.
And the copy.
And it was one where the famous line I remember there was, you know, when introspective, the agent said, oops, that was bad.
I should not have done it.
So this oops, it was bad.
I shouldn't have done it became like a big headline.
Like, okay, what are all the ways that...
What is really a safety concern became a CISO concern very quickly, right?
Safety, security.
But it really comes down to like those three things, like the output, the behavior, the supply chain.
And I think the best CISOs and organizations involved are like looking for a cutting edge solution, whether they build or buy or some combination to overcome that and move the ball forward.
Right.
So I feel, again, kind of sort of repeating a little bit, right?
So we have these enterprises, they're sort of moving to Agenic.
They have to overcome kind of these concerns.
I guess kind of paraphrasing a little bit, like would they generate secure code?
So like this notion of secure the output, there's definitely like a whole period of like, you know, these agents are producing insecure code.
We had all these stats on it.
It wasn't even wrong at the time, except, you know, I think models have gotten better.
But it's true that also you generate volumes of it.
You have to secure the output.
And we'll get to agentic attackers in a second on sort of that driver of urgency.
Then you have the sort of supply chain element.
It's interesting because like skills and MCPs are there, but there's also this whole world of like of tricking.
the agents to actually just download malware.
They're sort of falling for the same type of mistake.
So I don't know if that's sort of the first bucket or the second.
Yeah, kind of blurs the line.
I forget what type of squatting they kind of called that.
Slop squatting.
Slop squatting, yeah.
Sort of creating, you know, just like making up dependencies and then going off to download them.
And then you have this notion of behavior.
So more sort of securing.
the environment would start veering a little bit into like enterprise security land on it.
So we'll come back.
So we have to overcome these three concerns.
And I guess also echoing like a lot of that is the top down pressure to just happen.
One thing that is...
that I sort of see when I talk to like, you know, the big banks or others is that, you know, when, again, for most people listening, they think about running an agent, they assume a bunch of permissions for that agent.
So like it is running agentically, surely it has access to the internet.
Surely it has, you know, like some ability to do things.
And I see like a lot of organizations that are like the banks, they're embracing it.
They'll tell you everybody's using Cloud Code or whatever it is, but they are running those agents.
in a very confined kind of setup, right?
Like they can use intelligence, but they don't really have a lot, as much information access.
I guess, is that what you're seeing as well?
And do you have a view?
Like, is that, like, I guess, how do you feel about sort of the sort of security functionality tradeoff?
It's like, are these agents almost as effective, even though they are kind of locked down?
Is it losing 80% of the value?
I think it's an extension of the AI as a co-pilot era.
So these are agents.
They're not co-pilot.
They're not doing autocomplete.
They are taking, let's say, tasks and going and being able to achieve it.
So they can do that.
I think it will prevent them from being real factories.
And so now you see all kinds of...
The most common enterprise solution for an agentic coding is they'll use something like skills scanning and MCP scanning from us.
They'll have a secure sandbox, you know, Docker or something else.
They will look at either creating permissions and separate identities for the agents or the more sophisticated ones are exploring a lot of, you know, more dynamic authorization, you know, ephemeral authorization on the fly.
I think that's an unsolved problem with a lot of POCs going on there.
So at a minimum, just everyone is a teammate.
They have their own identity and they're locked out of the internet.
In fact, like, you know, how do I let my agent securely browse the internet but not the open internet has become another thing.
And so I think that's that next phase that they're starting to curate the internet.
And there's companies that are agentic, you know.
search tailored for agents that are now taking off and saying, hey, we could do that part where you don't expose anything that you don't want your agent to have, but it has most of it.
So I think what is missing there a little bit is security is always thinking about all the layers and the risks, but it goes back to what are you trying to enable that organization to do and that agent to do.
And I think it's just time to unpack it.
So let's allow it to take, but let's close as many doors as possible using a little bit of yesterday's model versus tomorrow's model.
So that's where I feel like that's the step between the three and the four that is a pretty big unlock required before they can go off and do that.
And that's what they don't get if they run in such a...
Yeah, kind of more open.
Yeah, and I think it's interesting because I feel on one hand it is a real limitation.
On the other hand, this is an era in which the best thing you can do is just get going.
So if the way to get going is to run agents without internet access, fine, do that.
There's probably enough value in that anyway for you to continue.
And then alongside that, you have to think about how do I start enabling.
So I guess...
There's a compliance aspect to here.
Like a lot of these organizations feel like there's a compliance reason for a human approver at the end.
Yeah.
I talked to some companies who have already gone and changed their job descriptions or their contractual agreement saying, hey, it doesn't matter if you're using AI or not, you own the output and you're responsible and all those controls in place.
And I think that's fascinating too, because that is a barrier.
And I've started challenging, what is the actual law that says this?
What is the compliance?
What is the regulation?
Or is this just how we interpret things?
Yeah, I think it's a little bit like insurance.
It's like self-driving cars are running along for self-driving car while self-driving causes an accident.
who's to blame and i feel you know in in the in the context of a self-driving car typically the same company owns the entire stack you know you are kind of running along and you're building it but in the case of you know it's a uh it's a production or like a product change that has happened uh it's it's sort of a bit of an evolution right if you don't have a name to attribute to it there's an accountability problem so you need the organization i think to more broadly decide the changes of a certain type or to a certain application or such, the company is willing to take responsibility.
So, you know, they're sort of stomaching the risk in favor of...
the change.
And then you need to convince the auditors that that's the case.
This is so fascinating.
We had a customer summit yesterday.
We did a poll of who's responsible in the organization.
Is it the dev?
Is it the business?
Is it the organization?
It was fascinating.
The more AI native organizations were further along.
They said it is a shared organizational risk.
We decided we will back this risk.
Right.
For the benefits.
And I think that is probably one of the hardest things for that next leap.
Right.
For people to like go off.
And there's a lot of agents being built and shipped too.
So there's that risk assessment happening on both fronts in software development and in the software that is powering their business.
Right.
It's different sets of risks.
Here there was a human involved.
Yeah.
what can i do you had someone to fire if a thing was problematic you could uh there were heads to sort of roll right right in this case it was already like your shipping apps the business was responsible quote unquote the business you had product security you had appsec you had all these functions so i think they this is why i feel like we see a lot more agentic apps in production than true agent government Software development.
And it's, you know, like you think about it, like it's like, well, how's that possible?
It should be a sequential journey.
No, it's like people are leaping forward there because the organizational notion of risk was already established.
And we have to move from that individual risk to organizational risk and software development.
Yeah.
I'd also say that the agentic, like as you talk about building agents to be sort of an evolution of using agents, I think the sort of the caveat to that will be.
that building agents is a specific team.
So in those 50,000 developers you have, maybe 100, maybe 1,000 are building agents.
But changing the 49,000 is really hard.
It's like a big endeavor.
And so it's actually easier to get a team to be...
forerunners than it is to sort of get an entire organization to sort of level it up.
I guess we've seen this with DevSecOps as well.
You'd always have the sort of the forerunning teams that sort of set the North Star for the organization and that deal with all of this, you know, compliance and getting the auditor so you can't get everybody.
And then you have the rest that you need to like gradually move them up the ramp, you know, as they build out.
Yeah, and this risk management, I mean, I was just hearing my talk at AISS, you know, talking about how there's, There's this interesting inversion of control or sort of inversion of responsibilities that is happening in which security needs to build more automation and fix more issues on it.
And engineers, if they want to manage that risk, have to build security controls.
And for security, you don't, I guess you do blame security engineers and such, but you don't expect.
sort of security people to inspect everything to say if it's an attack.
You know, you expect them to build automated controls that inspect to see whether something was an anomaly or not.
So to an extent, we probably need to get to that spot.
Yeah, I think that, you know, it's fascinating you're bringing this notion up.
I think it's a good segue into a little bit of that autonomous attacker.
Yeah.
I just, for the first time...
in my software engineering career or even like, you know, in security or outside security, start hearing the notion of trade-off between operational risk and security risk.
It's always been operational risk.
And last week I was with, you know, like 100 plus CISOs in New York and people are now starting because of this, like, you know, real notion that there is an autonomous attacker out there.
Lots of attacks have happened.
They can automate finding these chained exploits and vulnerabilities using lower, things that basically have been our backlog.
Someone said, Mintos basically was a margin call on your technical debt.
And so now how do you erase that security technical debt?
And the only way to do it is to make that trade-off, saying, I am okay accepting this because I will automate fixing this issue.
And maybe that is that culture change that changes, that lost, you know, the stragglers that we see, because you have to do that en masse.
You can't do that in pockets.
You can't just have security engineers doing that.
And I actually think that could be an unlock, right?
Like a silver lining here is as organizations, as more organizations start asking their security folks and their businesses, like, hey, we need to make this trade because it's more important that we fix all that.
That starts changing the culture.
And sometimes a crisis is what you need to change the culture of tip forward.
So I love that.
And I've actually really felt this in the conversations here with sort of different CISOs, this sort of appreciation.
And, you know, to be clear, this is like some of these are banks or like very large, like Fortune 100 organizations.
sort of very sort of security-minded organizations, but also very sort of ops and uptime-minded organizations.
Like, they don't really tolerate sort of.
And you really see, you know, kind of explicit statements.
It's like, I think we are near, you know, some are already at, few are already at, but many are saying that they are near the point where we're saying I would...
I would just accept an outage.
Now, I want to minimize the risk of an outage, which I got to say from the Tesla lens, that's good.
You know, that's a part of what we do.
Good code review.
And so we build those out.
And so we'll kind of help you maintain that quality.
But it is interesting to say, OK, you just go all the way to the patch.
And this was very much like my conversation with Caleb.
Sima as well is very much around it.
But again, he's in the cutting edge.
So I almost expect to sort of hear that from him.
And I feel what's really interesting is to hear, CISOs of very large companies saying this is the conversation.
And someone yesterday told me that I feel like, you know, for the first time, I feel like I can go into the CEO's office and say, we need to shut down all development as we just invest in building and kind of covering the sort of technical debt and building this past.
And it would be a viable conversation.
It's pretty strong statements.
Yeah, I think it is.
To your point also, this is why I feel like this could be that urgent crisis trigger for a big change that needs to happen.
And the second part, I think generally, I feel like software engineers, we get trained on innovation and building, not on safety and security.
And so as a result, what are we good at?
We're good at fixing our application if it breaks.
Because we understand the business logic, we understand the app, we understand the operational part.
There's platform engineering teams, you know, who have, you know, like DevOps to SRV to platform engineering.
You have a lot more of this, you know, automation and scaffolding there on the operational side.
I think, like, if I were to say two things, one is security teams, how to, like, push that, you know, and especially product security.
Yeah.
To get that level of scaffolding for that security, you know, auto PR and merges.
And we are trying to help there.
The second part is, assume that we will be good at fixing the operational issues faster than security.
What else could you do to get ready if you feel like you're going to take more operational risk?
And maybe that is part of that impetus to go to a true software factory in some sense.
Hey everyone, hope you're enjoying the episode so far.
Our team is working really hard behind the scenes to bring you the best guests so we can have the most informative conversations about agentic development.
whether that's talking about the latest tools, the most efficient workflows, or defining best practices.
But for whatever reason, many of you have yet to subscribe to the channel.
If you're enjoying the podcast and want us to continue to bring you the very best content, please do us a favor and hit that subscribe button.
It really does make a difference and lets us continue to improve the quality of our guests and build an even better product for you.
All right, back to the episode.
So let's talk a little bit about the use of security in agentic development or the sort of world of software defense factories and sort of building those.
Maybe I'll kind of tee this up a little bit, right?
When we talk about...
security in the agent era and the sort of software factory era.
We end up talking about it.
This is sort of true in Tesla and true in Snyk.
So this is actually like a good overlap area for it, which is we talk about this sort of division of securing the product and securing the factory.
And so in the securing the product side, very much about automation of securing the products is a lot of what we've just discussed on it.
bringing in the vulnerability patching and other security controls into it.
And the security factory is around a bunch of agent protection and these problems you mentioned before.
So maybe within that context, how do you feel, I know at Snyk moved into this agentic app set, set of products on it from the scan.
You want to say a little bit about how do you think about securing the product side of it from Snyk and the new lens?
And how has that maybe changed your views of How did we see it before?
I would say, you know, traditional AppSec, which Snake, you know, thanks to you.
It's a little bit funny to sort of ask you about Snake.
Yeah, yeah.
But you're actually a lot more in the detail of it.
I'm just like a boring board member at this point.
If you go back to why you did it, it was to change the traditional AppSec era.
I remember our first conversation, the auditor, the gatekeeper trying to do, essentially became a CYA.
And if you think about what they were trying to optimize for was that scarcity of human bandwidth.
I can have only that much bandwidth to fix issues.
So I'm going to like, and then you do it late.
So you just like, you know, piling up these issues so you can fix fewer issues.
We feel, I feel over the last 11 years, have been able to shift that in to the dev loops.
We're here.
We're obviously successful.
Almost 5,000 customers starting with the biggest in every category.
There has been progress, but I don't think we moved the toil.
We moved it to a point where if you really did a good job, you can enforce the ID and the PR.
I think that breaks at the pace of a true agentic software factory.
And so one of the notions there is could you, what are you doing?
You're providing security context automation and learning to the dev.
What if you provided that to the agent?
Can you shift it into the agentic loop itself?
And Guy, you brought this example of packages, right?
Like there's bad, you know, unhealthy packages that are more susceptible to risk.
There's ones with vulnerabilities and now there's, you know, with zero days, there's a lot of malicious packages.
Yeah.
And so if you could block that right at the point where the agent is making a choice to provide the agent like, you know, this one is a QR code scanning package that has never been updated for 10 years and this has been updated yesterday.
And as long as the one updated yesterday doesn't have malware, that's probably a much better choice.
So if I can provide that context in the loop right before you get the output, the best part.
And so what else could we do there is what we started thinking.
And it's in prevention part.
And prevention, I feel, can be a lot more effective than even in shift left with the devs.
So shifting into the dev context is one thing that has changed with, oh, if there's agents producing code, actually good news.
They're better at following instructions.
Mostly.
You have to keep an eye on whether they're doing it or they're getting overloaded.
Too much context, too much cognitive.
But it's more about the effective.
There's no reluctance because there's no agenda.
The agent is just...
It's just a technology problem you have to solve on how to do it effectively.
Speed is another thing.
You do have to be very fast.
You can't just put a model in there that's going to take a long time crunching.
It's a great way of taking some of our deterministic tools and technologies and Intel and global context.
So that's something that we're seeing really good progress.
There's about 1,500-plus enterprise customers who adopted this notion of a sneak studio, which is where we are feeding our context to the agent.
Right, yeah.
And I love that sort of phrasing of it of, we've been providing context and tooling to developers, now we provide the context and tooling to the agent as a new coder, right?
Like it's sort of a new entity that is now producing the code.
Exactly.
So that's step one.
The second step is interesting because everyone has a backlog.
I have a backlog.
I don't know about you.
You probably erased your backlog.
Well, at Tesla, we're fortunate in the remediation.
It's also a factory on it.
So the backlog did actually get addressed.
But it's the goodwill or the good fortune of a new company that is agentic from the get-go.
So if you have any history, you have a backlog.
You got there one way or the other.
Right now with autonomous attacker, that became the biggest problem.
Prevention is good, but what do I do with my backlog?
And there's really stark numbers there because speed has increased, security has not kept up.
We've seen a 10x increase year over year on the backlog.
And for every issue that is being fixed, eight new issues are being created.
So that's not acceptable.
And yes, prevention can help if you really do that at that point.
But I have a huge growing backlog.
So this is probably the most promising use of like an agent to do that remediation.
We've been slowly building towards that.
We release skills for cursor cloud codecs and there's organizations like Labelbox.
and relay networks, you know, case studies, we got to backlog zero just using the skills.
Why?
The skills were more security context for your coding agent to use to safely get rid of your security debt.
Then we released a lot of customers said, well, we have places where we don't have, you know, an actual coding agent.
It's, you know, I just need to go do a bad job.
Can we get a remediation agent?
So we did that.
It was a little bit of bring your own model.
We learned a lot there.
We were a lot more efficient than just using, you know, we have a benchmark called Wall and Bump.
You know, my team's gotten really creative in these benchmark namings.
So V-U-L-N-Bump.com, you can go see the results.
But it's, you know, really good to see that, okay, we get a 90% merge success rate using us plus cloud versus 60% just with cloud.
And it's 61% more token efficient.
So that was effectively the value of a harness, right?
Because you're sort of building something that is attuned for it.
It's not just context and guidance.
It is an actual kind of a built for purpose.
Built for purpose.
And where it's taking advantage of the global context is like things like breakability.
Like we see across, you know, millions of repos and upgrades of dependencies, which particular, you know, upgrade path is going to, for this application, be the safest one to do.
So you've got to...
network effect data starting to come to play.
We now just today released a cloud remediation agent so you can kind of do a broader campaign across all of your vulnerabilities and we're incorporating a model and a harness and all that in there.
The step that is before that, you do want to use frontier intelligence for detection too, which you have a deterministic engine, it's finding things.
Frontier intelligence is finding other things that you can find only with context.
So our first application is we kind of use that for triage so you can reduce the number of real issues.
This is the, so just sort of, I guess, give a view of it.
This is kind of an understanding.
Previously, this was, I found a vulnerability.
Here's information about this vulnerability.
And then these skills and all that are really about engaging better with an agent where the agents...
kind of role is maybe to understand a little bit the application and analyze it and all that and here with this information there's a little bit of guidance of sequences like verify the fix before you do that the remediation engine kicks in this is the sort of last part is a lot more about kind of the broader application context of it like understanding yeah fine you told me about whatever like none lack of input sanitization in the spot on it but what does that mean for my actual application does it mean there's some exploitable path yeah and then they use the threat model use the pull like you know what business logic is understood.
So you can be a lot more effective at saying like, these are the real things.
Like, this is not prioritization.
I feel like this is like truly deleting stuff that doesn't matter.
Right.
And then focus on the things that matter.
And then, you know, like essentially are able to do a batch mode remediation of things.
So we're finding great results with that internally ourselves.
You know, we put it at like a hundred plus repos that we have.
subset of our full thing and 93% merge success rate.
Learned a lot.
What about tests?
People that have good tests have a good job of fully merging.
You then start going to the point where you're like, okay, I need to almost do a PR agent, I think we have talked about this, or a critic of that PR that was opened by the machine to say, how good was that?
Is this going to be successful?
I think the final step there is like automatically, like if I can build enough confidence with the human in the loop that this is working well, then there's more likely by policy they're going to say, okay, this class of issues, you can automatically.
This autonomy.
So, so I think, thanks for that.
And I feel like this sort of last bit is really where it starts touching the factory on it.
And I feel like the reason AppSec existed is that it, or like exists today, is that it carries these sort of two competences in the world, right?
Which is like in the organization.
One is the sort of the knowledge of what is secure and insecure, you know, what like what is correct behavior from like what an attacker might exploit.
And the second is like, how does that application behave and what will break it?
And I think agents are just raw intelligence.
And so to an extent, you can feed in information from both of those and the opportunity of blending the two together.
But if you want to get autonomous merging of it.
that's the part in which you need to get the engineering to manage risk.
And maybe that's like software factory line versus if you want to understand which of these risks even merit the tokens, and which really should maybe a conveying of what's the other side in that risk equation to the factory.
That's a lot of this sort of like agentic appsec and sort of fitting that in.
Yeah, I think that's a good way to think about the separation.
And this goes back to what we were talking about, the trade-off of operational risk and security risk.
That's a perfect place where this comes to life, where the factory with the engineers who are driving the intent and orchestrating it, if we have this kind of agent for doing the AppSec, know how to incorporate that into the whole factory process so that it's going to be a lot more effective.
We're bringing that global context, we're bringing the automation, we're bringing the security understanding, but bringing it in a way that can be leveraged by other higher order agents in that factory.
Almost like the security fabric for that factory.
Yeah.
So I feel we're kind of running out of time a bit here.
So we talked a lot about...
just sort of in general, a kind of enterprise adoption, you know, and sort of being hindered a bit by that sort of risk and sort of controlling it in the future.
We talked a bit about some of the current pains around embracing the factory, malicious skills, malicious MCP servers, behavioral kind of containment, and then how kind of the agentic appsec kind of evolution is able to secure the product side, right?
Going from starting from delivering that type of context and information to the agent versus the...
human to dedicated harnesses around remediation.
And if the first one was more in prevention, you know, the second is more in remediation to much more of like full loops that try to collaborate with hopefully an agentic functionality on the other side that is able to remediate things.
I'm curious, maybe as a closing question, as you look at these enterprises that are today running agents in like a more...
contained fashion.
They don't kind of provide, you know, internet access or others.
And as the factory, like I think today the products are such an easy target for agents that they're sort of pursuing mostly those.
But as agents target factories more and sort of target that agent manipulation more, how, like, what do you think if you kind of, I don't know even what time might just sort of offer really in sort of factories, but I guess what do you envision as the future of sort of enterprise agentic automation, like what type of controls do they need to have to be able to trust these agents from a security lens?
I think we understand the breakage risk, but from operating those agents securely, what type of control do they need to, I don't know if the right word is let go, right?
Or like trust enough that they would run them with broad responsibility?
Yeah, I think the biggest, You know, like you talked about like the three aspects, the output, the supply chain and the behavior.
There's obviously the, I think about it like the infrastructure layer and the application layer, typical security way of thinking.
I think of the infrastructure layer, like, you know, sandboxing and all those controls will become more mainstream.
You kind of need to like curtail your blast radius, but it doesn't do anything at the application layer.
It's just protecting your local network and machine in that sense.
So it's great.
You know, do it.
I think the two biggest things I feel that are kind of fledgling technology capabilities, but not yet fully solved in a robust enterprise forward way is the identity stack for sure.
Like, you know, what do you really do with these agents and the identity?
And eventually, I think that part is interesting because it connects back into the...
you know the the origin source and you know going back to like who created this yeah okay the the intent like you're the agent is coming and asking me to do a thing yeah like what is it trying to do like what is it trying to uh what is the real that it's asking me for permission to the system you know for right and then like solving that on the fly and understanding the intent you know and then deciding how much permission am i going to give that at the moment So I think that will get solved, but that's one that I think is not, that needs to get solved for more, more trust.
And then the second one is the behavioral part.
Like let's even take the internet disconnected thing, right?
Part of it is like, what do, what does this agent pull from the internet?
And the internet is a scary place with a lot of, but you know, you talked about slop squatting, right?
Like people, these agents are hallucinating a package name.
There's a little bit of interesting predictability in the hallucinations.
So the packages or malware is being put in those drop points.
Those are the kinds of risks.
So could you, on the fly, really figure out, based on the memory and the history, what in this particular action, what could the potential behavior be?
And not block it, because that's old school security.
And it's like, what do you do to steer the agent back into the, like, you know, okay.
Yeah, that's not something you should use.
Steer it back on the rails.
And I think those are the two big things I feel like truly unlocks it for the enterprise.
Everything else is, you know, like I said, the future is here, but it's not an evenly dispersed moment.
A lot of things, it's awareness is missing.
Yeah, there's really good supply chain scanning capabilities from us, a few others, good sandboxing, good way to test the output.
I think that's an awareness gap.
This is really a not yet fully solved properly gap.
To get ahead.
Yeah, I like that.
And like I really love, like you call it, you talked about infrastructure and application layer.
And I increasingly think about these as like security and safety.
Sort of imperfect split, which is containment security as in like I told you to be in the sandbox, stay, you know, like don't kind of go over there.
And then safety is interesting because it comes back to maybe like the future of AppSec, which is like.
If you think about a skill and it's behaving in a certain way, understanding whether that behavior is correct or not depends on understanding what is the skill and what does it do.
And so a lot of that intent analysis, a lot of maybe like the skill definition, those are around sort of the bound, like they need to combine an understanding of.
the business understanding of what is it that it's trying to do and the sort of security understanding and kind of comes back to, well, this is kind of what we do in AppSec.
And I think maybe the last, you just touched on it, it might be the hardest of everything we've probably not discussed, but maybe it's the next time.
Businesses have never been really good.
Like I built a data classification taxonomy product like 20 years ago.
And no one knew how to put the rules in for that because, well, the security guys or the admins don't know the business and the business doesn't understand how to do it.
I think agents can actually help bridge that.
But that's a critical bridge.
Like, how do I unlock something that is in the organizational brain of the business?
Because that is required to then solve this last part.
Yeah, yeah.
And defining what you want and what good looks like, sort of the thing that we as humans avoid like a plague.
And, you know, I guess from the Tesla lens perspective, we often think about this as like, these are skills, like, you know, that is where you codify it.
That's not to say, how do you kind of extract that?
Yes, how do you extract that?
Yeah.
Cool.
Well, Manoj, this was a great conversation.
Thanks for taking the time over here.
Awesome to be on, you know, your podcast.
And thanks, everybody, for tuning in.
And I hope you join us for the next one.
The AI Native Dev is brought to you by Tesla.
the package manager for skills and context.
Your hosts are Guy Pajani and me, Simon Maple.
Our producer is Tom Dowler.
The AI Native Dev is not just a podcast, it's a community, and we host monthly meetups at the Tesla offices in central London.
Visit tesla.io forward slash community to learn more, and I hope to see you there.