# AI Security Shift and Agent Economy

**Podcast:** No Priors: Artificial Intelligence | Technology | Startups
**Published:** 2026-10-23

## Transcript

AI has become the tool that's causing this kind of security apocalypse.
It is also the tool that can help us to solve it faster as well.
It went from how to get everyone just to using AI.
Now all of a sudden, everyone's racing to figure out what AI security means.
I've heard serious technical people say things like, air gap, everything important.
And we're like, not going to be able to trust the internet for a while.
And we just assume all the critical infrastructure and government services fall down at some point.
Is that your expectation for what happens?
Dane, I'm so excited to do this with you.
Yeah, thank you.
Thanks for coming here too.
I'm sure I'm not the first person to make this joke, but your last name, Connect, that's pretty good for the Cloudflare value prop.
Yeah, yeah.
There's been some jokes about renaming the show next year.
So with everything that Cloudflare is doing, what are your top few priorities as CTO right now?
Well, I mean, this past year, it feels like 10 years compacted into one.
So those priorities are...
constantly shifting but you know it all goes back to our mission of helping build a better internet and uh that really hasn't changed over the last 15 years uh where we want to make sure that uh the internet's secure uh that everyone has access to uh be able to uh get their content online easily and uh scale it up uh and uh just you know over the arc of uh the ai um changes in the past year you know it went from you know how to get everyone just using ai how do you make it easy for them to deploy and their agents deploy To like most technical transitions, security is kind of an afterthought.
And now all of a sudden, everyone's racing to figure out what AI security means.
And it means things for different sides of view it kind of differently.
You know, one side is, you know, as a company is how do you keep your data safe from AI leaking the data out?
But it's also how do you keep people from getting in as well too?
And, you know, over the last, I would say three to six months, just the number of vulnerabilities that are being reported in CDEs has just gone up exponentially.
Previously on the Internet, we would see these log4j moments or these shell shock or type of incidents maybe once a year.
It would be all hands on deck internally at Cloudflare to make sure how we protect not just our enterprise customers, but also all of our free customers because we view it as a public good and making sure that the Internet stays safe.
These things are now happening weekly.
Not all of them are publicly reported on, but there are things that are as serious as the log4j type things, but just happening at a greater frequency.
I expect that through the rest of this year and into next year, by the next 18 months, majority of Teams time is going to be spent on security.
I think there's a stat that was put up earlier today that during one of our keynotes, where it was showing that I think over 50% of engineering time is going to be spent on security.
And I don't think that will last forever.
I think that will be a short transition.
At some point, the AI will have surveyed majority of the code and found most of the bugs or found most of the shortcuts.
You know, there's one that's kind of coming out today and has been started to be blogged about and tweeted about where one of the keys on the Internet is that protects all TLS and WebPKI, which just secures all your connections, was secured by the number four.
Literally, they basically used, you know about cryptography.
It's all about randomness, right?
That's why CloudFare has our lava lamps is so that you can get good randomness.
And when a key out there is they use the seed, they use the initial thing to kind of create it with a single number four, it's going to be reverse engineered.
And AI can just do all these things that doesn't sleep.
It's not like the one engineer you had that was red teaming things.
Last week, I think OpenAI found the seeds for the NIST curves that were back in 2000 that were released.
These things are just moving so fast and the bar is going up and the models are just getting so good at cybersecurity.
Mythos was just kind of the tip of the iceberg there.
Since then, it's not just been the The model's getting better.
It's the harnesses.
It's how people know how to, how humans know how to use them and use those frontier models in order to find those exploits.
Given your, you know, visibility, what do you know about the humans behind, you know, these attacks and harnessing these models and taking the volume of vulnerability discovery up so quickly?
Like, are they, you know...
nation-state actors?
Are they script kiddies?
Like, what can you say about how the attacker landscape has changed?
Well, I actually think for some of these, some of these large vulnerabilities that have come out more recently, actually, haven't been nation-states.
They've been, you know, high school kids even that are...
We're going to call them agent kiddies now.
Yeah, that are just...
spending their time, you know, like they used to do, kind of capture the flag security contest.
They're pointing their agents at an area and doing that.
You know, there's also, you know, and there's just financial reward for them.
There's bug bounties that they get paid out of sizable amounts.
But it's given the tools that honestly the nation states have had in some forms for much longer, either through agents or just through, you know, sure number of people that were working on the problems, given it to the masses.
This is the first time in 15 years I've heard serious technical people say things like, well, we should just like air gap everything important.
And we're like, you know, not going to be able to trust the internet for a while.
And we just assume all the critical infrastructure and government services fall down at some point.
Is that your expectation for what happens?
Humans, we are pretty adaptable and we can move fast when we need to.
And, you know, I've seen the industry kind of partnered together.
When things like this happen, people that you usually think of competitors are no longer competitors.
We're just literally protecting critical infrastructure, as you said.
And I think when those kind of critical moments happen, people will rise to that challenge.
So I'm a little less doomsday.
I do think that a lot of the things that we've done over the past five to 10 years, moving away from a kind of a castle moat infrastructure for security.
to moving to more of a zero trust does put a lot of companies in a better position where, you know, you're not saying this office is completely air gapped.
You're saying, you know, these devices, these flows are secured in a different way and everything's going to be tightened.
What is it going to take for organizations to do what you're describing?
Like 50% of engineers do not work on security right now.
I had a.
Greg Brockman from OpenAI on the No Priors podcast last week.
And he said that he thought in 2027, people are going to spend as much money on tokens for security as engineering.
Like you're saying, very related idea.
What is going to drive that shift?
Just emergency, right?
So you're going to move forward all your security spend over the next 18 months.
both from the red team side, which is more the offensive, trying to actively try to exploit things, as well as the defensive side, how you prepare things.
But I don't think that's going to last forever.
I see a world in like 18 months where new software productivity goes way up because all those resources are back focused on that.
But there's definitely the same in this period.
where security is on everybody's mind.
What are some of the key elements of getting to a better place in terms of overall software and internet security?
I think people discover, of course, that there are libraries and services everyone uses that had vulnerabilities that took effort to discover and now do not.
And I think we'll hit some of those.
What else is important there?
Because part of the concern that I have is the rate of software production is also going up a great deal.
Right.
So to some degree, we got to go like patch everything that we have already made and then keep up and get ahead of the pace of delivery.
Yeah.
Also, I mean, for one, we're right now we're patching 70 years of software out there.
So it is just catch up.
And then on a go forward basis, I think the software development lifecycle, the agent development lifecycle is going to need to change.
And luckily, the same way that we can use security right now for Red King and things like that, it'll just be built into the process every step of the way.
And I think software will just get more secure over time.
What have you learned about building secure production software internally?
already that you think people can learn from?
Like, what does that mean?
Like shift left and like, can we, and there are many theories of how to do this, including, you know, broader use of formal verification, using agents for security in the development process.
Like what do you think is going to create better software from first delivery?
I can go back to first principles of there is you want to reduce your attack surface area.
the easiest thing you can do is to give less places for there to be vulnerabilities.
So looking at all your software and saying, how can I simplify this?
How can I reduce the footprint, the code?
And then beyond that, things like formal verification and I think things that are safer programming languages and things that are built into the runtimes that make everything safer and come.
But I think it just starts with And AI, at least, the early AI is very verbose, likes to create complexity.
So AI, in a sense of what we've been dealing with, has actually not been kind of helping build a more secure stuff right now, but I think it will get there.
And I think that's where humans still come in and human judgment comes in and making sure that we design the software in a way that it can stand on its own securely.
That was actually going to be my reaction when you say we want to reduce the surface area.
I'm like, oh, yes, of course, in principle.
And that's not the natural inclination of today's models.
Right.
And like, you know, I asked him to do something and I'm like, well, like with one tenth of complexity.
Please try again.
Is that the role of engineering and security engineering today?
Is that something that's going to be solved at the model level?
The way that humans did before agents, it needs to be solved kind of at all levels.
You need to train the engineers that are writing the code, the product engineers.
The security teams still need to be involved in making sure that they're getting checks and balances, second set of eyes on things.
You need to build in processes.
We've gone to...
defining things a lot more internally on how we build a Cloudflare, writing down our principles.
We have a document called the Codex, which is kind of like a buildup of a lot of RFCs that the teams have built for it.
Here's how you build secure software Cloudflare.
Here's how you build available software Cloudflare.
Here's our best practices.
And then it kind of gets boiled up into some 10 commandments that the agents know how to follow and use in every part of the review process that can help enforce those things.
So, you know, you have agents out there that are just riding a lot of the slop and then you have deeper down the factory, you have people that are doing the performance runs and the security runs and just like how the company operated before you need those adversarial reviews.
When you zoom out a little bit and just look at overall traffic on the Internet and how much of it has become agent driven over the last year.
I think it's outpaced most people's expectations.
What has updated in your worldview of like what the web a year from now looks like, either from an economic model perspective or a security or requisite infrastructure perspective?
Yeah, I mean, I kind of think of it as we're in the messy middle right now where humans and agents are riding the same rails on the Internet, where, you know, agents are trying to parse a human web.
when that's just, you know, when it's just inefficient, you know, and was designed for humans that could do things at different speeds, you know, going to a website and be able to read and, you know, see the ads and participate in the full economic model versus an agent that now can go to a thousand web pages in the same period of time, which is great.
It's just you need to find a new economic model to support that.
Do we get parallel webs?
Is there like a human web and a machine web?
Like everybody's trying to do, what's it called?
AEO now?
Yeah.
I mean, yes, I think we do.
I think we find ways to deliver the content and meet agents and humans where they are, as opposed to trying to meet them in the same place.
And right now there's like translation layers.
You know, there's a lot of companies that like, you know, help you, you know, an agent view a web page.
These are just all extra burning of tokens for things that probably don't need to be need to happen.
The website usually knows what data and we've had things like this.
We've had APIs, ways that computers talk to each other for years.
It's just API has only covered a small fraction of the information on the Internet and agents have a thirst to understand everything.
And so they're going out and trying to explore the human Internet.
And we need to make it easier for them.
We need to make it less costly for the site owners and we need to find a way for them to get compensated.
You know, I think it's in a world where you can get very simple, you know, most like a content website, like a sub stack, they know what their CPM is for how much money they should be making on ads for that site.
And so if an agent's reading the site, I think there is a world where you get to the point where an agent can decide whether or not they want to read the content and then they can decide if they want to pay the CPM rate.
And that's where you need to then get new payment rails for the internet that can do millions of transactions a second for all these little micropayments.
All these things that we've been talking about for years, micropayments always are two years away.
I think agents will actually push that forward and actually see a world where actually there is a new economic model for content creators.
Who do you think the players are?
What are the variations of that infrastructure?
I think obviously Cloudflare has an important role to play here, but the rise of personal agents like Instinct and Muse have also made this an immediate question from a transactional perspective.
I don't think everyone knows on the other side what that business outcome is going to look like.
Everyone's been through these transformations where the internet, they thought was going to kill Main Street.
It didn't kill Main Street.
The small businesses are still thriving.
But there were people that were displaced, and so there's always some skepticism there.
And so there's some natural inclination to just block them out.
You saw Amazon just say, no personal shopping there from an agent.
I mean, I think these are all people that are, you know, that messy middle where they're trying to figure out what that path forward is and trying to keep some of the negotiation leverage there.
I think we will get to a place where Muse and Dots and all those personal agents will be able to accomplish tasks seamlessly as you as a human could do even easier.
But I don't know if the technology is quite caught up to that yet and the business models either.
Is there anything you're personally excited about on the roadmap or just from a technical exploration perspective on the Cloudflare front that you feel like is going to enable this ecosystem in the future?
Well, I mean, absolutely.
On the content side, we've released a conference monetization gateway.
where we make it easy for people to put their sites behind us and take microtransactions for their content.
Including providing wallets for agents to use and a stablecoin that's going to be able to help facilitate that transaction as well.
We're also doing things with OpenAI, a project called Signals, where we're making it easier for agents to actually discover content instead of having to crawl the entire internet and continually go back to pages.
We're making it easier for them to know what's new content and actually kind of more proactively do that.
So, you know, it's a win for the AI labs as well as a win for the site owners not having to get constantly crawled and pay for that infrastructure.
So, you know, there's a whole set of kind of new laws on the internet that I think I'm really excited to see all those kind of grow to see, you know, the X402 from when Stripe came out with it, I loved it because it went back to the 402 HTTP code, which was Tim Bernsley created 20 plus years ago, 30 plus years ago for payments.
So like, you kind of always knew that you needed a better payments rail on the internet, but we haven't been able to kind of figure it out.
And I think agents will lead us to that as well.
When you think about these initial products that you've released, like, is there, what would success for a content creator or somebody who ostensibly had a website on the internet that they were monetizing with ads before?
Like, what's the killer success case you guys need to see or show the world where it just becomes like a default to do this?
Well, I mean, I think we're, instead of them paying us, we're paying them, right?
You know, where it's covering their infrastructure costs.
providing money that supports their livelihood.
You know, we can actually increase the number of content creators out there, which, you know, the last generation of the internet has done very well, like with YouTube and TikTok and X.
We can actually make it exponentially larger.
And when you look at the workspace OS.
like release and ecosystem work that you guys have been doing.
What is, what are you hoping are the like biggest use cases of it coming up?
Transition a little to a release called Cloudflare OS.
Cloudflare OS is our internal platform for how our employees use AI every day where we, you know, and it actually goes back to security routes where, you know, we were very worried about customer data, internal data leaking out.
And we want to make sure that our employees could use all the new AI tools and models, but have a way to safely deploy them internally to understand how that data is being used and flowing and have good governance over that.
In addition, the reason I call Cloud4OS is we started to realize that as we have more and more agents, we need to be able to teach them what we call Cloud4 special.
how we build a Cloudflare.
For humans, we did that through Cloudflare University and the onboarding process and meeting your colleagues and working with them.
But we needed to work really to find that and document that for agents.
And so Cloudflare OS is the platform where our employees can build anything that they want in a secure way without having security.
It's not something that they have to think about.
The BR that's trying to create a call list, they don't have to worry about security.
It's just built in there for them.
But they also know that it's being done in a way that is consistent with the themes and values of how software works.
And why release?
I think of this as like somewhat different from the other products that Cloudflare offers today in that it is not infrastructure.
It's like an end user facing product for managing AI use within the organization.
Like why release it?
Or do you think of it as a departure?
Yeah, I mean, For one, it's kind of a reference architecture, really.
Over the past 10 years, we've built our developer platform where we started with just a simple serverless compute primitive, and now over 100 different developer platform tools from storage to databases to durable objects.
We wanted to show how you can build it completely on Cloudflare and how we build things internally.
give people the option to fork in and build their own version of their own company OS on top of it.
And what is a way in which it is helping your people and your organization that you think is like clear success?
It's actually used more by our go-to-market teams and our G&A teams than it is even used by our engineering teams.
You know, it's, you know, giving them a very fast, you know, early on, I thought, you know, we saw training was the biggest gap for people using AI.
And when you just kind of point them at a chat interface or another by putting tool, it's too much of a blank slate for them.
And so, you know, this is a platform that's designed, you know, you design everything for it for how your business works and you immediately can go there and, you know, get access to all the data that they need.
They can get guided and taken through.
where they quickly realize, oh, this is not trying to replace me.
This is trying to make me better at my job.
And that's been really exciting to see just all the different ways people at the company have done that.
A lot of the, how this conference got put together, the marketing team built hundreds of internal tools where previously they would have to go out and work with different agencies, but the speed that they can move with a smaller team now is just amazing.
Assuming this is a continuation of, you know, starting in May, you guys did this restructuring to be an like a sort of AI first organization.
What else reflecting on, you know, the last number of months has worked or not work that you would recommend to others?
Yeah, I mean, so, you know, the restructuring was hard, you know, saying goodbye to some of my colleagues.
It was the first time CloudForever did it.
We had always been very careful not to over hire.
This was for different reasons.
This is because we saw the way AI was transforming some teams and how they work.
We thought of it as like a factory floor where you needed to actually rebuild, rethink how things happen.
There were some processes or some, the way a product manager would send an email forward to customers and involve three teams.
It involved a team where you went to BI to go get a cohort of the people that you wanted to send an email to.
You went to the marketing team to help you design the email and get the voice right.
You went to the marketing operations team to get the email out.
You're never going to be able to actually redesign that process unless you make some hard changes and force people to rethink, well, what actually is the right way to do that?
It might not involve those three teams at all might just involve a new way of doing things.
So what came out of that was a tool where a product manager now goes in and describes the cohort.
They write an email, it rewrites it in CloudFare's voice, it sends it to their manager and the manager can click approve if they like it and it goes out.
We didn't go from three teams getting faster at doing that.
We went to one tool that can kind of let a product.
product manager now have a superpower they didn't have before.
When you think of all of the different workflows and tasks within an organization that's got about 5,000 people like Cloudflare, how do you decide who the owner is of rethinking that process?
And was it bottoms up from one of those teams in this case?
Is it an organizational leader?
When you have so many of these things that could change to be faster and make more sense, as you described.
Yeah, I mean, Cloudflare has always had a thousand more things.
that we could ever do, whether it was products and features or things like this.
And so we always look for people that are going to take initiative and ownership.
And so it doesn't really matter if you're ordering it one to 100 and try and prioritize it.
Any one of those 100 things are probably safe if someone's passionate about it.
So we kind of gave people at the end of last year the tools and started seeing how they were experimenting.
And people quickly kind of...
broke out in different cohorts of people that were really leaning in and, you know, just naturally doing those things and taking ownership of them.
So, you know, I think it was very bottoms up from the how we're going to do those things.
It's been a major topic of conversation for organizations as to how they should think about token budgeting.
Right.
Like, you know, what's.
a reasonable amount to spend?
How do I think about this versus human capital?
Who should get tokens even within our organization?
Like, what is your philosophy on this now?
It's definitely changed.
You know, and each model kind of makes you rethink it as the cost dynamics change.
But, you know, in general, you know, I think it's kind of silly that we're actually asking humans to decide which model to do each task.
Like it should be intelligently routed.
Yeah, exactly.
Humans just aren't going to ever be good at that, right?
But early on, you do it kind of brute force and you get people to experiment and you say, hey, well, let's try for the planning part.
Let's use the top frontier models for that.
And then once the plan's written out and agreed upon and iterated on, then potentially some more of the open source models.
can go do that and then you go back and you have one of the frontier models do the reviews and the red teaming and things like that.
Now, all that today is fairly manual.
But I think as we start to learn and experiment, I think people will become intelligent.
And over time, there'll be more governance on that.
Cloudflare has been in a place where largely we let people use the models and tools that...
they see fit for the job.
We don't have a token leaderboard.
We don't encourage it.
We encourage people to focus on the output.
They're not graded on if they used it, they're graded on what they've shipped and what they've built.
But then we do have some kind of, we found like just kind of like giving people notices.
Like if you happen to use $300 a day.
They'll just get an email, right?
Like it says, hey, did you know?
And because most of the time people didn't realize they were doing it.
And they're like, oh, huh.
And then I think if it gets to like 500, it goes to your manager.
If it goes to a thousand, it goes to a VP in a day.
But it's, you know, those things rarely happen.
And usually it's people are actually happy to get those notices.
Where do you think you are in your overall evolution of like take things just for the current level of capabilities of models, assume no new development of?
you know, rethinking the way different things at Cloudflare are done from go-to-market to engineering to be...
Oh, I think we're still so early.
You know, Cloudflare did something, you know, two years ago, we had about 200 interns.
And what we saw was those interns were, you know, really the first, you know, fully kind of AI native, you know, where you took AI away from them.
I don't think they would be able to work.
Oh, no.
Is that good?
Actually, I think it is.
I think they know how to use the tools better than us.
It's just like you took Google away from me over the last 10 years.
Like, how would I learn anything?
That's where they reached to first.
And we actually saw the managers that had interns from that summer actually adopt AI faster.
So then this past summer, this past year, we decided we were going to hire 1,000 interns.
So that's, you know, for a 5,000 person company.
Yes.
Wow.
Yeah.
Over the course of the year.
Yeah.
And it's just been amazing because, you know, one, just the number of ideas that come from the interns.
So, you know, that's something that, you know, with AI lets people experiment faster.
And so having more ideas, getting more people in there, but also just seeing the way that they use AI, like, you know, they need to fill out a form.
They reach for AI.
And I still find myself, you know, there's so many things where I'm like, oh, wait, I've just been doing this manually still.
And then I'm like, yeah, wait, I should be using AI.
And I don't think that that's a natural for most of us yet.
And I think that will take time.
And so, yeah, I think we're still very early in our AI journey.
I love it, though.
The mass intern strategy.
I run a very small partnership.
And we always have a, you know, an intern or two floating around a team of about a dozen for, you know, ideas and intern energy and all that.
But we just converted one of our, you know, in college interns to full time and Jed and had him drop out and everything.
And I think that you're right where maybe like the dial should be turned up on the amount of DNA that is really, really native to these tools.
Yeah, I think it's great for them as well, too.
You see these schools like Waterloo and Northeastern with these co-op programs.
And from what we've seen is people that get that type of real work experience are some of our best employees many years in and go on to do great things.
It is interesting or encouraging, though, that instead of it being like, hey, here's a master plan, we're going to map out.
every department and sub department at Cloudflare and be like, share the key workflows.
We're going to try to re-engineer the workflows.
It is instead a strategy of like, assume people are rational about their tokens if given information about their usage, hire a bunch of interns and assume high agency people we have here are going to go like, you know, shift those workflows to something more intelligent over time.
And then brute force and just try things.
You know, early on, we had an email alias called agents at Cloudflare.
where we, this is back in January of this year, where we just told people to, you know, be curious, can I use AI for this?
You know, email in your jobs to be done.
And that email would, this would reply back to the skill file.
And for a while, people thought it was actually, you know, thought it was all AI and automated.
It was actually a bunch of interns that were, you know, helping people write skill files.
But that let us kind of get to see, you know, in a way that's not going out and like, you know, hiring a consulting firm to come out and like catalog every single thing to be done is, you know, people that are recognizing, hey, this seems harder than it needs to be.
I wonder if an agent can help me here.
Is there anything else about the last year that's changed beyond the intern level, like your hiring philosophy?
What you look for and people to bring on?
Well, I mean.
One of the biggest things we always look for is curiosity.
And so, you know, if people aren't using AI at home in their personal life and all that, I mean, that's a pretty big red flag.
Like, just how can you not be embracing AI if you have, you know, a level of curiosity out there?
So, you know, I think just double down on some of those kind of key characteristics of, you know, drive and curiosity and empathy.
So even better for this next set of people.
Well, I mean, I am a alpha user of all products and technology forever.
So but I think the answer is like fear and skepticism.
Right.
And so I guess implicit in this claim about like curiosity, including an experimentation with with frontier tools is like that needs to.
That needs to be a core principle for people who work at Flair.
Yeah, I mean, a lot of things we're doing, we're not, you know, we're inventing new ways of doing things.
I mean, the scale that we operate at for the number of sites behind us and the amount of free services we give away, it's just not possible with off-the-shelf technology.
So you need people that can come in and literally invent new things.
And that starts with curiosity.
I have a couple of questions for you to, to close out and mainly about security both and how to do that in a new way, both at Cloudflare and then how you think it's going to work in the broader ecosystem.
What do you think is the process by which if half the engineering team is going to go work on security and just like fix 70 years of vulnerability?
How do you attack that problem?
internally, assuming that not all software is perfect, even amazing production, internet scale software.
And then, yeah, we'll talk about the ecosystem.
Yeah, I mean, I think largely, you know, we're, you know, today we have one red team.
I think by the end of the, you know, the end of the year, next year, we will probably have four or five red teams.
So, you know, break people out into groups that are actually, you know, being more adversarial and actually like going out and actively trying to find vulnerabilities.
Why is that the approach when instead of like, oh, we're finally going to get like our patching systems right?
Our processes right?
I mean, processes and those things can always be better.
We have a volume process.
We have a patching process.
Are they perfect?
No.
But, you know, the best way I found for those sorts of things to get better is to out of crisis kind of comes.
That's how you get those things fixed.
When the volumes get too big for the engineering team to just do them using their normal processes, engineers are inherently lazy in a good way.
They will automate away those things as they need to, as they realize that there's no other way to do that.
I think the focus needs to be on the discovery side.
People will do the right thing and figure out how to patch it in a scalable way over time.
Do you express a philosophy on just prioritization of this versus like shipping new features?
Because I guess my understanding of it's not as if we didn't have a backlog of like vulnerabilities and every large piece of software to go fix.
It was just like whether or not that was a priority for engineering teams previously as one common state.
I mean, I think you need to figure out how to do both.
You know, it might come at the expense of cost optimization or other things.
But I mean, companies, if you're not shipping, you're dying.
That's how we think about it.
So it's not going to freeze in order to do this.
Oh, no, absolutely not.
You need to be able to continue building and shipping new things.
But you need to be able to make sure that you're doing it securely and patching and fixing bugs.
And I think if we do it right, we'll actually be able to...
do them both faster with AI.
While AI has become the tool that's causing this kind of security apocalypse, a lone apocalypse to happen, it is also the tool that can help us solve it faster as well.
Right.
So it's on both sides of it.
Where do you fall in this debate of the role, like good and bad, of open and closed models on the cyber front?
Right.
Because the argument, the broad argument is, well, having defensive and offensive cyber capabilities, you know, they're parallel in the same model, despite safety and guardrails being built into them.
And so you can't have open defensive models without them also being offensive.
And the argument sort of that were the concern around only having security capabilities in.
a set of frontier closed models as well.
How are you going to release them?
And you can't possibly get them out to the distributed set of actors that need to defend.
Like, what do you think?
Or did I characterize that correctly?
Yeah, I mean, I think over time, it all has to be open because everyone's going to get access to it anyways.
And, you know, that's how open source tends to work.
Yes.
The bad guys, the bad guys are going to find a way to get it.
So all you are is and the.
you know, the top companies will have a way of getting it as well.
So you're just excluding a mass population that just doesn't have the access that probably needs it.
And then so final question, just because Cloudflare, very mission oriented, does carry the weight of some, you know, internet resilience on its back.
What about all of the people who can't afford to have four red teams or like never had a red team to begin with that run important systems?
How do they how do they protect themselves?
So, you know, I would say put your sites behind Cloudflare, put your infrastructure behind Cloudflare, build on Cloudflare.
You know, when these major vulnerabilities come out, like the React one last year, we don't just give it to our paid customers who have like the advanced firewall and WAF capabilities.
We give it to everyone.
We view those kind of things as part of the utility that we offer.
And, you know, we want to provide that just like, you know, we want to provide performance for everyone.
You know, before Cloudflare started, you know, there were probably 3,000 sites in the world that had a large-scale CDN to cache their stuff at the edge.
You know, now there's hundreds of millions of sites that do.
So, you know, Cloudflare has always viewed our goal as providing, democratizing the security and performance for everyone.
Awesome.
Thanks so much for doing this, Dane.
And you guys heard it first.
We have the agent kitties and the vonk-pocalypse.
Am I pronouncing that right?
Yeah.
Yeah.
But it's resolvable.
All right.
Thanks so much, guys.
Thanks.
Find us on Twitter at NoPriorsPod.
Subscribe to our YouTube channel if you want to see our faces.
Follow the show on Apple Podcasts, Spotify, or wherever you listen.
That way you get a new episode every week.
And sign up for emails or find transcripts for every episode at no-priors.com.