Nico Popp welcome to the Noise 2 Signal podcast.
Thank you, Mehul Thank you for having me.
Nico, you have been a technology executive for over thirty years. You've been at all kinds of
yeah, like make make me feel younger now, that's just good.
but yeah, Nico, you have been a technology executive for 30 years. Most recently you were the chief product test officer at Tenable and now you are an investor or an operating partner at Cross Point Capital Partners. So you've had an interesting career in the sense that you've seen all the legally legacy players play at their game. And then you also you've also had this opportunity now with by putting on the investor hat to see all what all the new companies are doing, especially with AI.
And one of the reasons I wanted to have you on the pod is your writeup post Black Hat caught my attention and you wrote something along the lines dead men walking everywhere. and which I which I vehemently agree with the point of view that you had. So I wanted to have you on the pod and dive detail dive deeper into what you were thinking and get started there. So let's let's start there, Anico. You went to Black Hat, you had an amazing experience, you came back thinking all these companies are dead.
What happened?
Well, you know, I I first of all, you know, we are in a an amazing period. I really think it's a complete renaissance time. I don't know I don't know if people understand how profound the transformation that we are living, how profound it is. You I I I feel like there's the people in the middle, you have entropic and open eye, and then you have people like us to think about agent and then people using Chat GPT, and then there's the rest of the world that has no idea.
that you know everything is about to change socially, economically, technologically, morally, so really really amazing time. So
But the the problem, Nico, is they think they know. That is the problem. The people, the rest of the they they think they know. They think
No, I I I you know I believe me, I I travel to France all the time. They they they don't you know, very few people are enlightened to to see there are profound changes coming. You know, it you know what? I'll give you an interesting story I heard. You know, like in Belgium, they have exam for becoming a doctor. So it's the first year exam is really stringent, really hard. And I think it was like twelve percent only succeeded. This year
48% succeeded. Do you know why? Because people were hiding earbuds and they had their phone in their trousers and chat GPT answering the question, which means the way we test people, students, is gone. It's gone. Homework is gone. So, you know, only you know oral testing. So you gotta rethink the whole educational system. I think people are starting to think, you know.
Why?
Enlightened people are seeing the issue. But no, I I think the wave and and Blackhead was exactly like this. I felt, you know, people are dubbing, you know, legacy, you know. By the way, every company today is now officially a legacy company. Right? You you know, I I tell all the company advisors, you're a legacy company.
But if you if you if if you talk to them, they call themselves cells AI native or they're AI enabled. If you talk to them, they think they are they are AI yeah.
It's marketing. It's marketing. And this is why I wrote the post because you know putting a layer of AI, of search, explainability, you know, on top, or even sometime agentic, on top of your product is not is not, you know, AI native. And that's why I wrote the blog. I think people do not understand it's the architecture of what we are building as software has fundamentally changed. And I use
You know that that three layer approach, right? You know, when you when I was building application, you know, especially in security, we had typically sensors and sensors create data that we store in a database. And then we have a query layer and you know some kind of console, but basically we have human on top, right? So database, query, human. And if you think about the new architecture, we still have sensors, they still need to c collect the data. But the data now is about
Context, context graph. It's about data for the AI layer. And so the graph is really helps the data be more token efficient, better at reasoning. So we have context and then we have reasoning, right? Not query. We have reasoning, that's the agency layer. Right? And then and then that's the model, sorry. And then on top we have the agent. We don't have the human anymore. And so if you're not reinventing your software stack,
Yeah.
You are not in and building on top of what you have. You're not AI native. And I can promise you, there is a company, a startup, somewhere in the world, right? That is basically reef rebuilding your business around that newer architecture. And so it's a little bit like I think we talk about the the cloud disrupted the on-prem software stack across all the all the verticals. We're we're gonna see exactly the same thing.
But you know, Nico, they would argue that we are replacing humans with agents, so we have an agentic layer on top of it and it does the same querying to get the job done. And but what you're arguing is this is a completely different sh this is
No, no, they still have a console, they still feed console is the right place. They think, you know, calling API is gonna be, you know, adding API is gonna be enough, right? You know, a lot of the reasoning is gonna be spent thinking about what API to call and then versus structuring the data in a way. And by the way, they're still not learning, they're still not capturing a genetic trail. We'll talk about the moat, right? For if you're doing AI native. It's about the data, the context, and the continuous learning. So this
Concepts are not even there, right?
And do you think like this is this transformation is a very lengthy and drawn out process or is this something that is quick? If you mean for example, if you have customers, if you have data, can you put agents on top of it and get going? Or do you have to like completely reimagine the way the entire processing of the data happens?
Yeah, so you know, pardon my French, but shit, it's happening so quickly. Right? I mean, can you imagine, Lina? I you know, I just had breakfast with my, you know, my ex boss. He was a he was my boss at Next, and he's been, you know, he's basically he built a macOS, right? He was running Apple Engine for many years. And he's the best programmer I've ever known. He's the guy, you know, who would disappear for a week and write the foundation classes. He was the only guy who could touch my luck.
At Apple and Next. He told me I haven't written a line of code in the last six months. I have a lot of pull requests, but I haven't written a single line of code, right? And I all I do is review the APIs now. That's the best programmer in the world telling you this thing. So you can see that was not true nine months ago, right? You all started with the latest in January and all these things. So it's crazy. The act the the the speed of change is
I've never lived through something like that.
But if you re if you if you read the media narrative, it seems like we are at the verge of SASP polic SASPO collapse. Like it all the SAS is going away. All us all that is going away. all the cybersecurity sh companies are dead. Asenthropic is going to take take over the world and you know, there will be five companies and you'll be happy.
Right? So do you buy that philosophy or do you have a completely different philosophy? Given and and I agree with your friend in the sense that I've also not I've I I've also not written code. I've re reviewed a lot of code in I mean I've probably written more code in my entire in the last one year than I've written in my entire life. and but and it is much more productive code, more spending more time reviewing and critiquing the code rather than writing the code.
No, I I I I do think there's gonna be not a SAS pocalypse, but a SAS Renaissance. Now, the new office may not be the old one, right? It's like you know, it's basically that agentic architecture we we just discuss in in two minutes, will still be delivered as a service, right? And I don't see entr you know, look, entropic
What does that mean?
These guys will try to walk up the stack in very attractive segment like you know, CRM, you know, human reactions ERP system, right? But
It's not the model that's gonna make the difference. It is it's it's the business data. So there is equal opportunity for the incumbent to reinvent themselves, right? Or legacy or new startups to come in and build that agentic SaaS layer on top of the the business data. As long as, you know, and they and and and create durable IP.
Right. This is why open source model, you know, open weight models are so important because you will be able to create durable IP, you'd be able to, you know, record you know the trajectories of the agent, you're gonna be able to do continuous learning and build models that are specialized that don't have to be basically you know the frontier model. So I think there's a lot of room for competition to actually reinvent the SAS stack. Doesn't have to be the frontier model, and it's a huge
Huge opportunity. Even the legacy player, you know, an enlightened sense Salesforce may be able to reinvent itself or buy the number one competitor, right? to to adjust. So I I think the stack is being reinvented, right? It's not going away, it's just being reinvented. new players can can come in, and that's that's very, you know, that's kind of a in terms of organism, right? There's a kind of a replenishment reinvention that's that's very lively, that's very good.
So what?
So w one thing w one thing I've recently seen is some of these existing legacy players are now tapping into the frontier models. we just I recently read an announcement from Tenable that Tenable is integrated with Mythos or Fable Fi or something on those lines. Do you think that is a that do you think that is like a long term good strategy or the s the strategy should be to own the model, own the
It's a huge mistake. It's a huge blender, right? They should, you know, when you do that, you do not build durable IP. Right. I think the you know the what you need to do is build your own IP. And I think this is where open s why open source and open weight model are so important, because you build your agency layer, from there you build, you know, the traces in the reasoning that works that didn't work, right?
Yeah.
you use that for enforcement learning, you build your own model. Now you have durable IP. I actually wanna my next blog will be about like, you know, the three pillars you know, I need something more sexy than pillars, you know.
Well, you have to you you have to call it musketeers or something. No, you cannot be called
Yeah, the three musketeers of you know durable innovation in AI, right? To to to create a moat. That agentic architecture, two, capturing the traces, the trajectories, because that's gonna be the data, right? You become a system of record. Three, use that system of record to build durable, you know, your own model around the task. If you do these three things, you know, I w I wanna invest into you. And and by the way, you have a moat, you have a long term, you have a long term horizon.
Building on the frontier model, everybody can do that, right? So I think right now it's more marketing than anything else. They're doing that. A lot of people are doing that for marketing, but they are gonna realize, you know, they need they need their their you know their own IP.
Yeah, because they because they
Yeah. Outsourcing your reasoning layer to an and frontier model is always is always risky. it is not not a good place to be in. so let's
Although I don't think they're gonna walk up on tenable. I don't think you know Anthropic will look at these markets, they're too small, right? People will say, you know, I think they will do application security because you know, code generation, right, is so there'll be no bug in code, right? Because you can say, fix this. There'll be no vulnerability because they'll be extremely good at that. So I think AppSec is a very is definitely a place where they have ambition. But everything else, I don't think the models will care. They'll be more interested in providing the model.
the the CPU to sustain but the you know, cyber I don't think goes away and gets subsumed by the entropy of the world. It's not interesting. Too small as a market.
And you know, let's talk about let's talk about motes. Let's talk about the mod you discussed, you know, the how to build motes in the age of AI. you you briefly referenced the three musketeers. how do you think like companies, especially those that are starting new or those are have been in business for a long period of time, should think about building modes in the age of AI?
A fragmented.
Yeah, and I think they're like you you you can see there are waves, you know. a lot of startups that started four years ago, by the way, are kind of relatively in trouble because they they almost started too early and now you you know you you you wouldn't want to start now or a year ago, right? That's kind of a you know, that's really shitty for investors that put money four or five years ago. They're also legacy, not only legacy, right? It it's crazy.
Especially if you started with the rag architecture. If you started with the rag it's
my god, yeah, like like rag. Rag Rug doesn't exist anymore. Who's talking about a rag? Or maybe a rag on memory, right? On context. It's like rag was the big thing, vector database, and it's like but it's good. The model will just call. Yeah, yeah, and the model f will figure it out. We'll rag itself.
Back to databases was a big thing, yes. And and it was this, it is in my recollection of the early rag architecture, it was just spitting out stupidity. It was just spitting out random stupidity that sounded like good. That sounded good. And you know, it looked good. You you dig deeper into it, it is just crap.
That's the Glen, right? Glenn was the big the big right guy, you know. We you know, we got a a search index on on the right data and then land, boom, bait when agentic, MCP, you know, the model will just figure it out. You know, the context window are so big, you know, they'll figure out what matters better than you. so crazy.
Agree. So yeah, so let's get back out of the topic of modes. Like how do you think then how do you how do you think organizations should think about building modes in the age of yeah?
yeah, yeah.
So take an example, because I I gave you the three more Agentique Soc, right? Crowded space. And you know, you know how many Agentix Socks startup I you know I I see every week?
Very clear.
I need one every week. There is one new there is especially from the the f factory in Middle East. There is like a new new well funded startup that comes up every week.
Exactly. So number one, you know, uhgentics are a bit more complicated. Let's say if already if you build it on the sim, I already don't want to talk to you because the seam, right? How long does it take to ingest the logs? Hours. And then you know, run the detection on the logs. You know, half of them are broken anyway, right? They break all the time. So agentic attacker, second minutes, right?
So you're like, forget it, real time. Real time is the answer. So if you're building on the logs, right, the seam is already is already gone. Why is did Cisco buy Splunk? I mean, there might be an economic reason, but it's like talk about like being, you know, like one one one game too late, right? It's like you know, like, but anyway, so first elimination, we're building on the
I mean, we have to we have to talk about Cisco acquisition. That should be a separate section in in this podcast. So we'll get to that later. Because they also bought
There's a history. Look, the the Cisco executive team is better. I mean the product guys are actually better, but there's a whole history of like I don't know how you say and I'm looking for French words, but screw up. So so all right, so back to the moat, right? So the first thing I'll say, do you have a true agentic architecture? Right? Show me your reasoning loop, you know, your React loop, you know, what do you have, you know, the critique, all these things.
Yeah.
You
Yeah.
What what's your strategy on the agentic loop, right? Multi-agent, all these things. I want to see a real agentic architecture. It's not a mode. I think that gets easier and easier. But at least it's architecture architecturally sound from a product standpoint. And by the guys who started five years ago, they don't have that, right? They have they use playbooks, they things of that nature. They're already obsolete. Two, do you understand every time you deploy, you sell your product?
Do you have a mechanism to get better for your product to have to build an unfair advantage? That's the are you capturing, you know, what you're doing, what's working, what's not working? It's called the agentic trajectories, the reasoning, right, the evidence that you collected, right? You want to build that knowledge of what's working in the customer environment. You know, what makes what's a good triage, what's a bad triage, what's a good investigation, what's a bad investigation.
Which context did you use, right? All that data, all these agentic trajectories, that's gold, right? You want to build that context. You want to reuse that context. You know, if if an agent solved the problem quickly, you want to reuse that knowledge. That just runtime. And then come the third, so that's context is is the first mode, right? It's the what people call the context graph. It's basically the reasoning lay, you know, it's the data to reason, but also the history, the traces that you reuse to think better.
But that's nothing. The bigger mode is once you have captured these trajectories, can you use them? Are you able? Do you have the skill set, the talent to actually train your own model? Are you building your own model based on these trajectories to do, you know, if you just capture the traces, you're you're building monkeys, right? Monkeys who can repeat what worked. But that's just a monkey. What you want to do is build an expert, right? When you you hire
A guy you expect it to be much better five years down the road. So you want your agent become expert. How do you build expertise is called is reinforcement learning. And so can you use these trajectories to actually, you know, you know, RL your model and be a real expected. So I'm looking for these three patterns, right? In addition to be not building on top of the sim. Sorry, Cisco. I'm looking for these three patterns. That's just an example, but you can apply that to
Sure.
Agentic DLP, you know, agentic VM, you know, agentic you know, any insecurity, agentic EDR, right? EDR is gonna be reinvented with that architecture.
I mean the I have a follow-up question on this, but I want to touch upon one thing. So one thing that I'm seeing increasingly is every existing category, an agent tick has been added in front of it. Do you think that is the that is the real end category, or do you think there is an all-encompassing new category that comes in to account for these things? Because I'm hearing the same thing in an agent tick CTEM, agent tick VM, Agent Tick ESOC, Agent Tick EDR. And it feels like it's the same legacy category with an agent tick.
a prefix to it. Do you think that is like is that the process of figuring out people no no one really knows where this is going to land. So they just call it agent for the time being?
Yeah, I think it's legacy adding adding AI, right, into their platform and and and marketing it as AI. Back to the are you building it with the three musketeers? Right. I think the third problem is the go to market in cyber is increasingly going to towards platform. I think, you know, enterprises, CISOs are tired to basically manage multiple vendors. I think, you know,
If Nikesh did something brilliant, you know, that term of platformization, right? The the bundle, the suite reinvented, the level of integration then can be discussed. I I think there's a real problem in security where the you know, like CTEM, for example, I think will end up in the Agentic SOC. It's more context for the Agentic SOC. So I think there's there's two mechanisms operating. One is a technology mechanism, which is what we just discussed, the three musketeers, it needs to operate.
Second, there is a natural consolidation of the market. We saw it in cloud security with CNAP. I think we're gonna see the technology transformation of AI, which also makes makes building product much easier, is also gonna accelerate the the platformization element where customers will demand more capable is. I think AI security is a good example where right from the get-go, a lot of CSOs say, yeah, I just don't want buy this.
you know, VM for AI, I want to buy the entire platform that looks at my code, you know, look at the exposure and then build a gateway, the runtime gatrail, right? So I think there's this that dual evolution of AI native and platformization. And that's that's a lot of so some market will disappear, right? CTEM in particular, I don't think will be standalone because of the platformization. But you also have to look at the mousketeers underneath. Do are people building it
And
With the must the three musketeers in mind, or not?
It it's do you s it's so do you think so in terms of the modes you talked about the context being the good mode, right? so w the way you one you one could read that is one is you have to have data mode, like you have enough data that you can you know you can collect all that. Yeah. Yeah. So do you think then the the agentic layer has to be owned as well, or can that part of the architecture outsource, or do the organizations also have to own the agentic layer?
Determode, datumode and self learning mode.
so I I think the harness, the orchestration layer, gets commoditized, right? There's you know, because I think it's a little bit like you know, and probably the LLM will you know the vendors will try to to move into that layer. So I I think orchestration is not a moat, right? But you
Mm.
need to sit at the orchestration layer whether you're trying to do governance or where you're or you're trying to capture the data, right? The the trajectories. So you need you need this this integration. So it's not a mode in the in the long run, but it's a mean to an end. It's a mean to capture the data. And then from the data the you know the the continuous the continuous
You're right, because if you d if you don't r if you don't own the agent tech layer, you may not get the thinking traces as well. So if you don't get the thinking traces, then you might r risk losing all the all the advantages of using the open source models.
Yeah, but you know, at the same time, all the you know, if you look at you know, even like all the orchestration layers now give you hooks and APIs to basically you know, especially the one we want to sell into an enterprise like Anthropic, are gonna give you a hook and then you can use this hook to basically capture the reasoning, capture the interaction, the action. So I think they're they're getting open by default because the enterprise will say, Look, I need it for governance and observability.
Mm.
So you need to give me the hook or I won't you know, you won't enter my enterprise.
Yeah. Nico, let's switch to the next topic that I had in mind for you, which is vulnerability operations. one of the most epic write ups they did. I think it was a three part write up, which
Yeah, you didn't see the musketeers, so I had to go to the samurais.
and you the write-up was seven summarizes of one ops. so I want to understand what is one ops from your point of view and how is it changing? And then the second follow-up I had to that is you also mentioned you also mentioned it is merging with secups. So I'll start there. So what is one ops and how is it changing? And then how is it converging into secups?
Yeah. I think vulnops is the evolution of vulnerability management when the attacker becomes agentic. And when the attacker becomes agentic, it means really three things. The attacker has scale, right? Look at the hugging face and open eye, 1200 agents in CAUT collaborating, right? To to hack hugging face to
See if they can steal the verifier code. So you have scale. Everybody has the net army. The Chinese net army is now available to anybody who can run a bunch of agents. Two is speed, right? The ability to find how to exploit your environment, right? you know, when you have 1200 agents running in parallel and then thinking faster than human is unprecedented.
And sharing and then sharing their thinking on a message board so that all of them coordinated.
All right, yeah, you're gonna look for identity vulnerability, you're gonna look for misconfiguration, I'm gonna look for you know RC vulnerable, I mean all that happening part. So scale speed. Third and then third is sophistication. This model, especially the Chinese one, have learned how to exploit EDR, right? Or circumvent EDR. They know all the attack techniques there. So they're not your you know your your your traditional you know script kitty, right? They're like
Expert hackers, red teaming. There are 1200 of them and they're moving at the speed of light. So once you have that, what does vulnerability management become? Because one of you know what I learned from my tenable days was vulnerability management had become a compliance game. You know, I'm gonna scan. If I'm good, I'm gonna scan every day. I'm gonna get a list of all. You know, all the vendors are gonna tell you, I have a better way to prioritize.
Customer doesn't give it their own. I'm gonna fix compliance, critical and high. I'm gonna fix the critical and high within three months because that's called compliance. Everything else doesn't matter. Here's the problem the age attacker agent will find a medium or low vulnerability that creates an attack path to your conjugal, and that's what he will explain. Or he will find zero days, right? That we'll just publish, or you will find on the on the on its own that's something else. So
Volnops is what VM must become when the attacker is agentic, that is move at the speed of light, you know, an army you know fighting you, and then basically with a high sophistication. That's really what Vulnaps is was was about.
I would I would caveat that to say at the speed of compute. I mean they're only they're they're only restricted by the the amount of compute. and and and the way you framed the discussion was in the context of seven samurais. And typically when I see these frameworks, they're typically put in the concept of a stages or a life cycle.
yeah, electrons go at a speed, you know, transistor, you know, speed of light, nothing goes faster than the speed of light.
But you s you decided to have it as seven samurais. Why seven samurais to describe one knobs? What what was your thinking there?
Yeah, I'm trying not to be boring. So you know, if you if I've learned something, you know, I I were in my early my my first job was at Next. I was working for Steve Job. And if I've learned something from Steve, the world belongs to storytellers. If you want to be listened to, if you want to be read, you know, don't give people like a lot of technical mumbo jumbo. Tell them a story. So if you've
Your title is the seventh samurai of Volumes. People say, What the heck? What is that? They're intrigued. They will want to read. They will want to learn. So you have to be you have to be telling story. Again, the you know, even in the age of AI, I bet you know, this is why AI is so dangerous, right? You can't tell story that resonate with you because he knows you better than anybody else, better than your spouse, be better than your children.
Yeah, crafting crafting narratives and telling a good story is an underappreciated superpower. If you can do that really well at scale, I feel like the best at this game is Jensen Huang. Incredible storyteller in terms of the story of Nvidia and
Yeah. Very deep, but very deep, but able to tell you a very simple story while you understand the depth. By the way, the real reason you want to tell a story, it is way more fun to tell to write a story than write about. So forget about, you know, do you want to work or do you want to enjoy yourself? You want to enjoy yourself, turn everything into a story. But you're right, Jason Wang is is really amazing, you know, i in terms of the depth that he has and the ability to simplify, you know, the
Very simple.
Yeah. Exactly.
And
So that everybody in the audience can understand what he's saying. It's brilliant.
And you could you could also say that about Elon Musk, you know, I want to take humanity to the to multiplanetary, but his goal is startling. Like if you if you look deeper into his his his real motives, it's like startling getting starling to move. But the story he has always told is like, you know, I want to take humans to i make it interstellar or something. People buy into it and now you realize well
Yeah, all the car. no, I'm not making electric car, right? I'm making, you know, robotic taxis, right? It's like like and you know the the the post is always moving with these people. But it felt like it was planned all along, you know, that's that's brilliance, you know. I knew it all along.
Yeah.
That is the brilliant. That is the brilliance of storytelling. Is you don't see the story until until it unfolds in front of you. So let's let's unfold your story, the seven samurais. the way I understood it is in is there are seven characters from your point of view. Let's dive deeper into each of those characters.
Yeah, help me because I don't even know if I remember the seventh samurai in it.
The first the first character that I have is shift left. the the the first one is shift left. Yeah. Basically moving as far as possible in the SD SDLC lifecycle to find vulnerabilities early on than than later on. So maybe dive deeper into
That's what I remember. Yeah.
Yeah, that's that's obvious, right? I mean, if you own the code, which is, you know, a big if, because you're still using a lot of code from third party, right? And and open source. But even open source you can upgrade. so yeah, I mean it it's it's obvious, right? So you know, I I really put it in there because I didn't want the pandit to say, no, you know, vulnerability should be, you know, safe, safe by secure by design. Sure. So I I let's get the first samurai out of the way. It's the most
An interesting one. Sure. Fix the fix the bugs before they exist. Big big idea. Move to the next male.
The thing the the thing the so the the shift left is obvious to me and it makes super obvious, especially if you own the code or you're in the open you're using open source software, the thing where it gets muddy for me is the commercial off the shelf software. so that's where I don't know where you know what to do about it. What is what do you think in
Bingo bingo bingo.
You you know, there's a story that I heard that you know, Mythos was released to the big banks of the world, the City, Bank of America, JPMC, and they use Mythos and they target their network appliances, you know, their their firewall, their VPN, their load balancer. And they had an shit moment, right? Houston, we have a problem. They are critical vulnerabilities, we were not aware.
in or basically is in our network compliance. The ones that don't get changed, don't get patched, that have weird operating system, that are fairly opaque. If entropic, so I think they went to the government and said, if you let these guys release their model, we're gonna have a serious problem on our hands because our friends in Asia are gonna go after us. So you gotta you gotta put the kibash on that thing. And that's what happened.
So I believe, as you said, the bigger problem is the code that you're not write, especially the code which is embedded in hardware that is hard to fix, hard to change, hard to replace, right? Because all these unmanaged, you know, appliances. And so that problem doesn't go away. And so what what do you do, right? And remember, like if you look on the on the dark web, on the on the black market for vulnerabilities.
The one that sold for the most money, because you know, nation states were there is like, I want VPN. Give me remote RCE on VPN. my god. That is that is real money, right?
That is the tr that is the that is the true crown jewel. If you really want to break into it, the sonic walls of the world, the Fortinets of the world, those are like the prized as soon as the vulnerability gets out, Sisa Cav is on on on on top of it. As soon as those come out.
There's a control. Yeah.
Yeah. So you can shift left as much as you want on that thing, that's not gonna solve the problem. So we gotta shift right. Right? That's actually most of the samurais are shifting right.
But do you
But do you think then you just point the models and brute force your way into them? Like as if you're an organization you just point the latest, greatest, like you know, whatever it is, Fable five, fable six and just point it at your appliances, remove all the guardrails and just go at it? Do you let you let
Well look, I'm gonna have an investor moment. You know, we know at Crosspoint we have a company that we really we really love. It's called Reversing Lab. And they are superpowers, they are able to decompose binaries and tell you, you know, what's in there, what artifact composes your binary, and then of course once you know that, you know what critical overall. Yeah, so there's there's commercial solution to that, but there's zero doubt in my mind that Mythos and this model can do that decomposition as well.
Mm.
Even the even the commercial software. So you can they can look at the commercial
and then or or learn it right so so you know I'm a nation state I got a nice frontier model I buy a few Fortinet appliances and I'm having a ball on the weekend and then on Monday you know I have zero days you know I probably don't even do any work I put like foot into my agentic loop and come back on Monday morning and I've got ten zero days.
Super.
I have a zero day.
Come back.
the next samurai that you had on the list is the continuous scanning samurai. Continuously discover. So it's very pertinent to what you just said. Continuously set your agent on the loop on the weekend.
Which by the way, most people already do this scan every day, right? They put Nessus or you know, or they have CrowdStrike and they just scan their machine every day. so I think it's p we still shift left and continue scanning. You know, they're kind of the obvious samurai. It's I gym. You know, it's like you should have done that a long time ago anyway. There's nothing specific to AI, right? There's something you should have done. You should be doing all right.
Do you think the traditional scanners are commoditized? The
yeah. Duh, duh, yeah, yeah. I think that's yeah.
And d as a result of it, do you see an advent of AI native scanners coming online that can reason on the job? Like, you know, for example, you run the ran you run the scan on the weekend. You run the scan on the weekend. And it is like
Yeah, or exactly. And then or validate or find the attack path, right? I think that's where red teaming and VM. There was always a well, people even like red teaming because it could be disruptive. So they wanted the scanner to be passive. So there's a role for scanner to be passive. but you know, I look at Tenable, right? We were every time there was a vulnerability, you had to create a setup, you had to create a plug. I mean, you knew that. Create a plugin.
Yes.
It's an agent running a night doing the whole thing for itself. So I think let's put it that way. Scanning scanners be are definitely commodity. You're not gonna build a sus you know a sustaining business on scanning alone because it's obviously very easy to create a scanner.
I do think I th I I mean I do think, you know, I've wor worked on some of these cannabis in the world at well both at Tennibal and and Collis and my sense is they are very static and they're dumb in the sense that they don't think for themselves. They can only do what they have been told to do, either through a plug
You mean they lack context?
Well, they I mean the whatever they the way I think about their there are rules encoded in them. Those are the only things they do. And that's that's the end of it. There is no additional thinking. It is almost like somebody said this this is like a filing cabinet. You don't they have just dumb drawers, they collect the data and they store it. They can't think and reason on the top of it. And I think the superpower, I think the superpower in the age of AI is to reason as your scan. We found a port, what is this port doing? And then query query that service. Is this a web service? What what web services there? Let me qu go deeper.
And doing on the job scanning and going deep deep deeper into the service and then trying to exploit it is the real is the real game.
First principle, right? First musketeer, the scanner is gonna become agentic. Exactly what you said. You'll have a reasoning layer, which he doesn't have today. Second second principle, platformization. Right? You know, I think EDR vendor have heard the quality, the tenable of the world, because I already have an agent that has EDR protect you, my agent can do scanning. So that's where also you you're saying I think the the market consolidation, the platformization in in cybersecurity. It's hard to believe
Yeah.
VM like CTEM, you know, think of CTEM as universal VM, remains standalone for that reason.
the next samurai that you had is the is the validation samurai. And this is something I vehemently agree with you, is that the things that will ma because my sense is the number of vulnerabilities will continue to exponentially explode over a period of time with all these new models coming up, new models having new capabilities, new vulnerabilities coming up. So patching everything is not possible. The only things you really need to worry about are the things that are
vulnerable, reachable and exploitable. Like you know, do you like those that is the real validation you need to do and you to close those gaps before the attackers or the agentic attackers can
That that's the big trend by the way. You know that joke about prioritization and you know Cisco buying Kenna and like totally irrelevant, especially now because prioritization now is essentially a function of your infrastructure. Right? It doesn't matter. A critical for the world is not a critical for you. It might be a medium vulnerability that unlocks the path to the customer database with all, you know, your customer information. And so validation is the new prioritization.
Right. It it is, you know, and but it's like, you know, you cannot go to Zahra, buy the cloth, you have to basically design your own clothes. So it's become it's custom made.
And I mean you I think you can also apply the you can also apply the static non thinking approach to prioritization as well, because this is most of these tools are prioritized based on a score. You know, the your score is nine or ten and it doesn't take into account it doesn't take into account the compensating control of the context of the organization. Right. Right. They they don't have the firewalls or the configuration changes, or maybe they have like a Cloudflare running in front of it. So you can
that's the other dimension. That's the other dimension.
I think it's a another summary, but you you're right on the money. Even Wheeze, right? The the infamous Wheez graph, right? Doesn't have the control. That doesn't have the so they tell you, that volume is a workload is exposed to the internet and has a VM that has a admin, right? well, they don't tell you. I have cross-strike that basically make the exploit, you know, impossible. Yeah, it's like, okay, great. So you're wasting my time, right? You're missing a dimension. So you're like you're you're totally missing.
Impossible. Impossible.
The compensate why are we spending all that money on compensating control if they're not part of the security graph?
And we and I see this building control all the time is when I you know when we run a scan from the outside in, we find very few vulnerabilities in in some of the organizations that we're testing. But as soon as the whitelist are scanner IP, we see a lot of we see a lot of findings. And the the the point I want to make is, you know, if you have really good compensating controls, having vulnerabilities is okay. It's not the end of the world. So if you have a really good cyber hygiene, really good compensating control.
I use your time for patching. And in fact, it's one of the samurai, right? Because you may be missing the control. Let's put it in there. Or you may not have the right policy, the right configuration for the control, for the WAF to take care of that vulnerability. Let's update the control. And then now you have more time to go patching, right? Because we're even agentic patching will take time. So I think the control are totally neglected.
defense for vulnerabilities in today's world, except for the zero days, right? The zero day people, you know, set cops actually look at it and then okay, you know, they know it might be coming to them. They they're gonna go fix it.
Yeah.
the you know, right on cue, the the next samurai you have is prioritization. this is this is a fun topic for both you and me. And prioritization has been if you think about if you think about the evolution of vulnerability management, it has
yeah.
That's right.
yeah, I mixed my things up. Validation was like making sure you w the vulnerable is exploitable. Yep, yep, yep, yep, yep.
Exactly. But pri but if you think about if you think about the evolution of vulnerability management, you know, before there was there there pro previously there was vulnerability assessment, then it became management, then it became risk-based vulnerability management, and now it has now it has become continuous threat exposure management. So it's the same story, but but the the goal has always been the goal has always been to prioritize correctly. So vendors came up with scores, vendors came up with threat intel.
That's right.
Yeah.
all these different things and in Kenna was the leader in risk-based prioritization. You know, they take they they invented they invented the category and they eventually they eventually got bought by Cisco.
They invented the concept, right, of politics.
So I want to start I want to start the discussion there. what was your when when when Kenna when Cisco was Cisco bought Kenna, what did you think of
I I I scratch my hair and I say, you know, did you buy the right company? Did you because, you know.
To me, privatization was relatively easy to imitate. And it is basically something you have to monetize on top of VN, which is already hard to monetize. So I was scratching my head and say, if you want to be in the VM business, why don't you buy a VM? And so to the point where I think you and I were thinking they must have bought the wrong company for a few billion. I don't know. Remember the past track?
Yeah.
They did they they didn't buy the scanner, which is the most important part.
Yeah, I forgot. I forgot there was a scattering VM. There was like and you know, I think at that time
And probably these people are no longer at Cisco, so we can talk about it. You know, it's kind of the lunatic running the asylum. And the Clay had no idea what cyber security was about. Because spending that kind of money on something that is really truly commodi co you know, commodity and and not buying the conjure, you buy Nessus. It's still the best scanner in the world, right? You know, I always say Qualys is the best at management. And actually you heard it from JPMC. Qualis best management, best management API, tenable best scanner.
Yeah. True.
Still all true today. But why would not you buy one of the scanners? There were three. I mean it's not that complicated. There were three companies with scanners and you bought you bought the the fourth one, which is strange.
But I still don't get like
No, but I mean I I I and I this is something that has struggled me for forever. Service now recently bought Armis and apparently for the CTEM or the VM exposure and they've sp spent a lot of money.
I think the Cisco people may have moved to service now.
We should not say that okay. Okay, well you like it. You like mine, so people
my god. so yeah, so I don't get it. I don't get if you want to play the VM market, buy the one of the best ones. There are only three ones and they're all up for sale. Or at least I think they're they're they're all
Yeah yeah exactly. And I mean and these are high price tags, right? And and and and and nobody w wants to buy Qualys, nobody wants to buy Rapid Seven or Tenable right now. bummer. You know, but yeah, I I was surprised I wa as well with Aramis. I was thinking the same thing and I think reminded me of Kenna as well. I I they do have a scanner. I think Aramis has a scanner, right? They have an open they they took an open source scanner and built.
What do you think is the future?
No, but going back to your point, you buy the best scanner. You don't buy the the you don't buy a lane scanner. If you want to buy if you if you're willing to spend eight, nine billion dollars on something, you might you bet you might as well get the best scanner that is that is out there and with and best scanner and best customers as well. I think they have like forty or fifty thousand customers.
Yeah, or you you Yeah, well they should have asked Chat GPT whether it was a good idea or not.
But I think the more I think about it, there is there is high likelihood that the Cisco people move to Service Town and then they put that much like that is much likely possible.
We're gonna repeat what we did with Kenna. We're gonna do that service now.
Huh. What is
At least it's at least it's a good story. It's probably not true, but it's a good story.
It is a good story. what do you think is the f future? You know, we we briefly touched on this. Where does pra prioritization go? Does this does this you know, obviously the new category is CTEM for RBBM, the new category CTEM, and now I hear I've heard preemptive CTEM. There is a new category that is emerging that is preemptive preemptive exposure management. So
Yeah, yeah. You're gonna disarm the vulnerable. I mean, in a sense, it's the new privatization. What are the most exploitable, right? The validation vulnerabilities that would create the most damage, right? The the customer database compromise the the attack path. So in a sense, adaptive system or sorry, or preemptive, it's either adaptive or preemptive.
It be preemptive. Pre empty. Preemptive C Ton.
cyber and marketing sorry AI native AI native preemptive and anyway it's the new politicizing right can because the real politicization now is not in the absolute whether Von is easy to exploit it is can I exploit it in your environment the samurai the validation samurai and does it lead to a major breach because that exploitation leads to
Yes.
creates an attack path, has a blast reduce to a conjugal, and therefore is very costly to enterprise. That's the new prioritization. And that's very specific to your environment. It's not an absolute. You cannot say that vault comes with that prioritization coefficient. It depends, right? It's contextual, right? And now it you only become preemptive by the way, if you do more than VM, right? Because once you're prioritize, you have to go fix it. Right. So if you fix it, then it's preemptive.
So that's part of that vulnerable. We're gonna have to go further to the right. We gotta fix this this vone once they're prioritized.
Do you think
So in terms of in terms of collecting in terms of collecting the context, do you think the the the the players should build their own context, build their own sensors to collect all this context or th should they rely on the existing products and vendors to collect the collect the context?
That's what CTEM does. CTEM takes the API either from the from the tenable of the world or from the crowd-strike, from the you know, the the NDR, you know, the flows, right? Like like in the cloud, right? In the cloud, it's basically you can get all the all the data. you combine the this asset infrastructure, right? The infrastructure information about the different assets.
and then you combine it with the vulnerability scan that gives you what software is running, what vulnerability, what misconfiguration, all these things. And so you c you know, a lot of the CTEM player were actually same thing. They don't have a scanner, they just import, right, from from different vendors.
Then put it.
I get it. the next samurai was the agentic agentic patching. And I don't think like patching is difficult, but it's like deploying the patch and validating that the patch successfully deployed is is the difficult part. That's the reason I think most organizations don't deploy these patches. If it was as easy as running a command, like you know, like I've seen very high adoption rates for yum updates. So if you just want to run a yum update, you know, they don't have any problem with it.
Yeah.
We'll still have to put.
Yeah, exactly. it's like, I fixed it. Here's a pull request. Push it. I mean, that was pre high, right? So the difference now is AI can run, generate the test. They're gonna generate all the patching tests to see if it's still compatible for your environment. Yeah.
Thank you for doing.
Your dog your dog is dog is barking.
Yeah, I know. let's pause. Zina.
Stop it.
Can't put her outside with
Mm-hmm.
Sorry Mill, I knew it would happen.
Ha ha ha ha.
I don't know what to do with her because they are the garners are here outside. Stays in
Okay. So I mean we can continue recording. That's fine. I'll take this out. I've taken a mark off out. Yeah. so let's restart. so Nico, the next the next samurai that you had is agentick patching. one of the most difficult things is not the patching itself, but making sure that the patch deployed successfully and didn't break things. That's the reason you know, egen the patching is always the slow part of the business.
Yeah, where we have to interrupt again.
Agents is touching.
Yeah. Yeah.
How do you how do you think that goes on in this with with the seventh samurai framework?
I I think it's all that validation of the patch that can get automated, right? You know, you can have an agent that creates the synthetic environment, roll the patch, generate the test, the compatibility test, rerun the test, right? It's very similar to code generation, right? Code generation got better because the the model was able to generate the test, right? very effectively. and so I think you see the same phenomenon with a genetic patching.
Yeah.
Mm.
And I think I think this is the same concept that you can apply to testing because when you are deploying these patches, all you really want is to reason whether the the patch deployed successfully. Historically humans have to do it and they had to check all these applications and web pages, everything is in a database is up. You can actually encode all that reasoning into the agent tech layer. maybe have a bunch of tags for dev assets versus production assets deployed on the dev assets and you know, we have seen some success, but it's not as easy at this.
But that may be the that may be the path out of you know
And again, the agent's gonna learn, capture the trails, record the the path, right, the traces, and then learn from what was successful patching before. And so your agent become an expert at your environment and knows where what type of software, what time of configuration configuration changes are necessary, right? That's kind of that tribal knowledge that the agent will build over time, if done properly.
And then and then if you cannot patch some things, the next samurai is the most relevant samurai, which is which you turbid as adaptive remediation, but I feel like this is more like adaptive mitigation where you just you just control the
Yeah, yeah, I had the wrong term. I had the wrong term. It's really about mitigation. It's virtual patching, it's what we talk about. You can basically deploy, redeploy, update. You EDR, your power, your wife, you can create a policy to basically make the vulnerability non exploitable. And you know, I'm not saying you're not gonna patch over time, but at least you're buying time. As you said, you're disarming. It's really disarming the vulnerability for exploit.
Yeah.
The WAFs, the the you know, the WAFs, the EDRs. Yeah, you basically go there.
And again, if you look back to the few vulnerabilities that are gonna create a catastrophic breach if they're not fixed, that's the most immediate response. And that's typically, by the way, this is where vulnerps move to SACOPS, right? Because you know, vulnerability management people do not touch controls. SACOPS touches control. So, you know, back to the platformization, you know, VM won't be a standalone market anymore, CTEM won't be standalone.
Right. CTEM was interesting up to there, and now you're getting into the space of SecOps. The the the last samurais are all runtime, real time, SECOPs oriented.
And is and that's the and the last and that's the last samurai you had, which is the agent tech federated SOC. it the it in AI continuously hunts zero day exploits, detects, contains, and orchestrates a response as one management converges with SecOps. I think that's what you I think I think this is very point on. This is very spot on. I think this is where the this would be the good final stage for this category, where this is something that is happening twenty four seven.
Até o jogo.
That's the ultimate convergence, right? We started on the left with AppSec, fix your code. We got into core VRM and then CTEM for basically better prioritization. I need to find the attack path and all these things. And then now we got into reprogramming the controls. And then the last smile is I can't patch. I know I have a critical vone that can exp create a catastrophic breach. I cannot patch it fast enough. Too complicated. maybe there's no patch.
My control, I cannot put a control there, I cannot guarantee the control will be able to stop the exploitation. All I can do is detection response. I need to basically at least be able to detect that that vulner is being exploited. So I can, you know, I can go fix it, you know, create a network, a micro segmentation on the fly with Illumio or something else, or just just go take that machine off the network, you know, because I know it's under exploitation and then clean it. So
That's actually now you're in SECOPS. You're in the SOC, right? Of course, now the SOC is gone. It's no longer the same, you become the Agentic SOC. Now you have you have that full convergence. What tells me is kings of the castle in cybersecurity are secops, not the VM guys. The VM guys now report to the endpoint guys, the endpoint guys report to secops. So this is where I think the the agentic socks can absorb VONOPS.
And the whole CTEM and VM market. That's the to me, that's the opportunity. Vice versa. If you're a terrible qualist and maybe a rapid seven, you can see that the C market is gonna get commoditized. So you have an opportunity to go after the C market with the Gen TikTok and then do the Von Dap configuration. Anyway, now I'm big becoming boring, but as a whole, I think SACOPS.
Absorb the entire VONOP chain, including and when I say sec ops I the Agency SOC. And then basically absorb the VONOPS and that means the VM and the CTM market. But that means there's strategic opportunity for people on the left, VM guys, because a lot of the you know, if you bought Splunk, right?
You're gonna be in a very difficult position to say I need to buy an Agentix sock because I don't need the logs. And all the same stuff can be on cheap storage.
Yeah.
So very interesting strategic implication. Sorry about my dog. it clearly agrees with my statement. SACOPS is gonna absorb this market.
Do w what do you think happens to like do you think if the agentic sock becomes a reality, do you think we'll need more security engineers on the team or less? Or do you see an explosion? Do you see an explosion of I mean I one one way you can think about this is there is an explosion of agents, the defensive I I guess the dog agrees with my my statement too, right? So
That's interesting.
Yeah. You'll be working in the adjusted stock. Look.
We should we call him an Agenic dog.
Yeah, yeah. that the robot the the dog robots definitely coming, less that expenses. so I my theory could be wrong is definitely the L1 layer goes away. I I think the it the the analysts moves up the ladder to more interesting job. I do think they also become developers in the sense that you know there will
Look at the Volume and create, you know, use the eye to generate this detection, right? The detection is a program. And they will also decide at what point does the agent do the response or goes to the human, right? A lot of these things, the response can have to be automated as well. And so they'll need to have governance policy on when do you bring the human in the loop, which has to be rare, right? Because you need to respond real time and fast.
Yeah.
And so they become they move to that layer of development governance policy, AI policy. In my opinion. But but so they the job don't go away, they evolve, they become more interesting, I think, more sophisticated. But I do a you know that layer one that probably were like the entry-level job, that that has to go away. Which is by the way, it's true in legal, in true development, it's true. You know, I tell people.
Yeah, has to go in, got it.
and that's actually the scary part, right? The if you look at the pyramid of the job, it's that bottom layer that's gonna be wiped out. Right? It's not the people with the expertise. you still give these people. So the threat is the entry level jobs are are going to to agents, period full stop. And that's most of the
I mean one way you can think about it, the one way you can think about this is at least this is some my personal experience is some of some what we have seen, at least in at Control, is that some of the entry junior engineers are much more productive with these models and these AI tools. So they operate like a senior engineer rather than a junior engineer because they've been paired with a very sophisticated tool. we obviously guide them. We give them we obviously guide them in the right direction so they can we the the output equ is equivalent to a senior engineer.
compared to my times at at previous companies where, you know, the productivity depended on a senior principal engineer. So we we see that as
Yeah, so you needed a hundred entry level, now you need ten senior which you get an entry level, which isn't you know, you you double team with cloud code and now it's there. Basically you only need ten of them.
Mehul (01:00:02.891) Yeah, you don't you don't need hundred them, you probably need ten, ten good with really good theoretical backgrounds. Nico, I wanted to get your quick hot takes on some topics and see how how this goes. Do you think one of the first questions I had for you was do you think we'll have user interfaces in the future or agents doing all the engagement with the tools?
Nico (01:00:05.542) Yeah.
Nico (01:00:29.798) Yeah, I had I had a post on UI. I think people, you know. I mean the analogy is simple. If the agent is like a worker, it's part of the workforce. I do not go to mail and ask to see your console and your UI mail, right? I interact with you on Slack, on email. So I think the new interface is and actually look at the these agentic interface, they look like WhatsApp. Right? So basically I think the new UI is the conversational, the communication UI, not the console.
And then the agent will create the UI on the fly. If he needs to ask you something or show you a chart or a dashboard and select some option, he will create the UI dynamically. So I think the the whole idea, and and by the way, this is where the legacy people they talk about like the big console, unified console, shh, wiped out. WhatsApp, Slack, right? Slack type interface. And by the way, that's great. You get the, you know, I want to see what my triage agents are doing. I joined the Slack channel. If you need to bring me in the loop.
Slack me, right? And ask me a question in Slack. So I think that's that conversational UI becomes the default UI.
Mehul (01:01:38.915) second question, Nika. Will AI platforms take over cybersecurity products or the cyber security products and cybersecurity platforms will take over and innovate with the open weight models?
Nico (01:01:52.103) Yeah, I I I think the latter. I think cyber is too fragmented and therefore too small for the the big guy, the big frontier model. They are gonna be way more you know, as I said, they will appsec is probably gonna be something they need to do anyway, right? But they will like EDR, foul, I mean everything by the way, everything with hardware, right? They're not gonna do that's not something they you know, they they're not gonna do foul.
Mehul (01:02:12.265) Okay.
Nico (01:02:20.998) Too fragmented, too small, better fish to fry. There are much bigger markets that can go after you know, look at the bigger SaaS, the Salesforce, the ERP, and go they'll go after that market. Much more interesting.
Mehul (01:02:36.107) Do you th do you think the C TEM players will stay independent in two to three years?
Nico (01:02:42.202) No, CTEM becomes context for the AI sock. We'll talk about it as part of all nuts.
Mehul (01:02:48.243) So who buys them? The Palo Alto's of the world or service knows of the world? Or some new player emerges?
Nico (01:02:56.092) I hope Cisco is now by them because I've still share all the tools. But we are
If the scan you know, I think there's two things either they get bad or they realize they can become agentic suck themselves. Because the agentic suck is disrupting the XDR, and they are not in XDR, right? It's disrupting the MDR. So they have an opportunity. The EDR guys all went into XDR, right? They're all, you know, they're all doing an XDR, if I'm right.
Is that because it's the federated Agentix SOC that will win? That's actually a big opportunity for the VM guys to actually move to the right now with a disruption. Or the guys on the right would either build it themselves or they'll buy, you know.
They say I don't need the scan, maybe I just need the context for the eye.
So, you know, all these count all these VM companies have been for sale for a while and none have been bought, so not even by P. So it'll be interesting to see how it plays. If I was at Tenable, I would definitely look at a Gent X.
Mehul (01:04:16.277) Nico, this has been a fascinating interview. I haven't laughed as much in any of my interviews as I've on the on this interview. So thank you for coming on the Noise to Signal podcast.
Nico (01:04:23.421) Not insightful, but you had a good time. Great. Thank you, Mayul. I had a good time. Thank you. Thank you. It was fun.
Mehul (01:04:29.15) I had a great time. I had a great time.