Advancing AI-Native DevSecOps with Jyoti Bansal

This is Textron tv. Hey everyone. Welcome back here to Techstrong tv.

You know, my next guest is, it's been my pleasure to have him on the show. com, and he's been on with us ever since then through AppDynamics Harness traceable, everything else he does, he always comes on and nice enough to talk with us about it. My friend, Jody Bonsal, Hey you.

How are you? Hey, always great to have, uh, to be on here. You know, we are DevOps, uh, pros, uh, you know, for a long, long time and passion.

Absolutely. I've, Alliance is great to always judge Longer than we probably care to admit. I think it's been probably like 11, maybe 12 years already.

Man, that's a long, long time. Forever in the tech industry. Jodi, of course, you know, harness has become a, well, it was a unicorn years ago already, but Harness is one of the, you know, foundational players in the CICD place space.

And, you know, it in many ways represented a sort of a next gen CICD one. I remember interviewing you when you first told me about the idea for Harness that you said, Hey, I looked at CICD and I said there had to be a better way. There had to be a better way.

And, and it's proven out over the years, harnesses has been great, traceable for those who maybe are not as familiar on our audience today. Traceable was a, a second company. You, you started and you were CEO of, and you know, it, it started with some basic, basic, you know, security tracing, but looked into API security and as the market's developed, adopted a lot of AI type of technology.

Of course, the big news in it, it's, it's, you know, it's not today News. It's probably a month or more old, is you've combined harness and traceable, which the good news is it's one less hat for you to wear, right? You don't have to be CEOs of two different companies.

Um, Yeah. So, you know, people ask me like, how's it going? And I say like, you know, the two CEOs get along well, so that's easy Yeah.

For the first time in history, right. To see that, that, that's a good take on it. But, you know, beyond eliminating A-A-C-E-O role, what, talk to us about the strategic drivers for, for combining these companies.

Yeah, So our thesis at Harness, you know, we are known as, uh, CICD to begin with, but our thesis at Harness always was let's remove all the toil from software delivery. And, you know, I define software delivery as everything that happens after coding, you know, develop a side code and what happens after that? You know, you have to build your code, you know, just mostly ci, you have to do a lot of testing.

You have to do the deployments. Uh, you know, and deployments require like, you know, uh, governance and approvals and infrastructure provisioning. Uh, so you have infrastructure is code get involved.

You need to do resiliency testing. You need to do stress testing. You need to do, uh, you know, security testing, and then things go into production.

You have to verify production, roll back, all the stuff that's like, you know, before you code going to a developer rights code and the code going to production. There's entire process. And, you know, if you estimate across the industry, you know, uh, people say that's about 40 to 50% of the engineering time across an engineering organization goes into that, that process, the software delivery process.

So if you're looking at like 40 million software developers in the world, the cost of software developers is at least a hundred thousand US dollars. So you're looking at like $40 million of software engineering cost, and about 40, 50% of that is the software delivery process. That's like, you know, one and a half to trillion dollars of the software engineering cost.

So at Harness, I started with that mission, like, can we simplify that? Like why do we, and you know, that's where you have DevOps, DevOps all kind of things, you know, come in the tool chain in there. Like, can we really create a platform to simplify that entire software delivery process is fully automated.

Intelligent pipelines, they do all the stuff, you know, from building, testing, deploying, they have cost management, security, governance, compliance, every aspect of it, right? And, you know, uh, that was, that's, and at Harness, we started with the CD as our first, uh, product, and then we'd been expanding our platform. We 15 products in the platform to do all a spec of software delivery there, and including bringing the security and governance practices in the software delivery pipeline.

And we're starting to see more and more of the customer demand, like our customers, like say a Citibank will with like 20,000 developers, you need to go and deploy in production on, on demand, you know, you need security and governance and compliance to work, you know, for that. So all of that has to be built inside the pipelines in a fully automated kind of way, right? I started traceable as a separate company year after AppDynamics, uh, primarily to bring instrumentation observability for app, for security, for application security.

When I was at AppDynamics, people were, ask me all this all the time that you have this great observability technology, you can instrument and watch everything that's happening, and you're using it for performance monitoring and troubleshooting. Can we use it for security monitoring and troubleshooting and stopping the attackers? And that, that those conversations or the genesis of like, you know, why we started traceable.

Let's let, let's go after building and rethinking a next generation of application security. Uh, paradigm mean application security has been this kind of old school vs. And all kind of things that are like very removed from the application coders itself.

Uh, and, you know, traceable got very successful building out, like, you know, uh, we found a lot of, uh, excitement around protecting the APIs, you know, tracking the APIs, testing the APIs. The APIs are the foundation of any modern application these days. What we started to see over the next last few years is the convergence of the DevOps and, and app security, uh, personas in a very, very significant way.

You know, I, I would go into a meeting like, you know, my harness sales team will set up a customer meeting and the customer will say, it's one hour meeting. Can I, can we save the last 10 minutes for con talk to talk about traceable, uh, you know, and I go to a traceable meeting, and that the customer will say, can, can we, let's talk about harness as well, the last 10 minutes. We use both or we want to use both.

Um, because they go, because it's, it's my team that does both, that I'm responsible for DevOps, you know, and deli software delivery. And I'm also responsible for making sure everything is secure. And you know, that the secure software deli and development practices are happening.

And you know what, what we saw the need is like now is the right time to bring them together because the world really needs a platform for that. Like, there is no way you can do two DevOps without mission security in the DevOps processes. But two, DevOps isn't like, you know, that everything is fully automated.

You know, like what we talk about, like in a DevOps world, automate everything. All the checks and controls and balances are in there. You know, everything is like a developers can ship on demand.

Like, you know, you write code and the code goes through, have something and it goes to production. But if the application security is not taken care of in the process, you really can't ship to production. And the second thing that we see with the evolution of DevOps is the production data has to cycle back in, into the pre-production, uh, lifecycle completely.

Like, you know, how you, how you test things, how you build things. And that's really why we, you know, uh, that's the, the sta the strategic, uh, reason why the two companies and the two platforms come together. And now if you look at it like, you know, it's the first DevOps platform that has two application security from like runtime protection of wf, you know, your API protection, your bot protection, you know, full, you know, API, you know, das dynamic application security testing, you know, web das, uh, you know, AI security, all the aspects of, uh, security are completely baked in, into your, into the DevOps process.

So that's definitely one part. The second part of your question was AI native. When we talk about, like in one thing, you know, everyone talks about ai.

And, uh, I always like to, to remind people like that the harness was launched in 2018. This was not, you know, and I, the interview, we did the tele interview there. At that time, the headline was, harness brings artificial intelligence to continuous delivery.

This was 2018, not when JG PT came out in 2023. And so we have been at the forefront for ai, for DevOps, you know, pre lms, uh, you know, uh, for, you know, verifying for deployment is going to break something. How to intelligently run tests, how to optimize your costs, all kind of things.

You've been building AI models, you know, and now with, with LLMs and genetic ai, you know, the, like, the real power in in the DevOps DevSecOps world is the agent tech, uh, uh, work that you can do. Because now you can have AI do things for you, like can create pipelines, can troubleshoot a deployment, can make sure can fix a security vulnerability, can, can like, uh, can, uh, debug when a secure venue do a security incident. All kind of things that, you know, agent AI can do.

Uh, so, and Harness has been at the forefront of it. Traceable has been all about bringing AI and, and, and, you know, neural net analyze the API data. But what we realized was AI is only as strong as the data, right?

So now you have so much potential to build a agent ai, and, and that's what we are building, uh, agen AI for almost all use cases. So Harness has the, the strongest data of how applications are built, everything that's happens, like in about how people are building applications, how they're testing it, what they, the problems are, we have all the data Traceable has all the data on how applications are consumed because everything is consumed through, through an API. So now, if we bring the two sources, two pieces of data together, how apps are built and how apps are consumed, the potential for agent tech AI that we can, that we can continue to build is massively, massively high.

So what, what, what, what, what, you know, you'll see from Harness, and we've already been launching in, we are launching almost like one AI agent every couple of months. You know, we have AI agent for, for DevOps that we launched to last year. AI agents for QA that can automatically do all your, you know, generate all your end to end tests, uh, uh, AI agent for finops for optimizing and cloud costs, AI agent for fixing security, vulner for doing feature experimentation.

And all of this come from this data of like how apps are built and how apps are consumed through APIs. I love it. You know, it's great Jody.

It's Jody. In some ways it's getting back to your roots without dynamics even. 'cause you're looking, you're taking observability data post-deployment, right?

Feeding back, feeding that back into the machine, reiterating, reiterating, making better. Mm-hmm. That's an amazing thing.

I got a question on the agent AI stuff, and this is something that we've spoken about here at techstrong a lot. Are we gonna live in a world where I'm gonna have 25, 35 different agents, each one does one thing. I got one that does.

So let's say I'm a developer, I'm a DevOps person, and I got harness I'm using, and I said, okay, I gotta use my QA agent, I gotta use my, my deployment agent. I gotta use the security agent. I got like, how many agents or too many agents, or do you think we'll have sort of call 'em, let's call 'em super agents, right?

That do multiple things where, how? Because I mean, and that's just harness. What about all the other tools we we have and things I do?

How many agents can one person deal with? How, what do you think? Yeah, that's a, that's that's, that's a great question.

You know, it's, it, think of agent as the, as a, as the new ui. So let's say if you are a dev developer or DevOps engineer, you know, you're using different ui, some UI for your ci, some for cd, some for feature flagging, some for, you know, uh, finops, some for chaos engineering, something for your observability incident response. And because these are all different products or SaaS products, right?

And now agents become your new interface, like in how do you work with agents to do a do, do, do a lot, lot, a lot of the things. So it's like, you know, the, the advantage of having a platform like Harness is that all of these come together into one super agent. So when, when you are interacting the way, like, you know, if you're using all of these things of Harness, it comes together as one single UI is now it becomes one super agent.

So that's how, you know, you use the word super agent. That's how we think inside harness. We actually even call it a super agent.

Like, you know, these are, yeah, okay. These agents, they interact with each other and they, they become like, you know, one harness AI super agent, and that's what the, our use end users are interacting with. And you know, there's a lot of power of like, you know, the agents coming together and the data that they can share, you know, on how, how, how, how agents operate.

Uh, and you know, the approach that we have taken at harnesses that the, the for DevOps and software delivery platforms have to evolve and platforms have to emerge. Like it was still so disjointed for so long. And we were disjointed because people didn't build platforms of best of breed.

Like, so the industry had this debate of, you know, do I buy best of breed things for each of these? Or do I have platform like, you know, some platform, but the platform doesn't have best of breed stuff at, at, at, at harness. And, uh, now traceable the mind.

We have taken a very, very strong point of view from day one that we have to build a platform of best of breed that our cd best of breed, our ci best of breed, our feature, uh, flagging best of breed, our kiosk engineering best of breed, our a p security, our, you know, uh, security testing, all of them. And the way we do that is by not packaging them together. It's one product with all of these different product, you know, uh, modules inside it, but customers pick and choose and, you know, and we are accountable on is it best of breed or not.

So, you know, to me it's like, it's the, it's really the continuation of that. Like, you know, your best of breed products will have their agents with, you know, instead of their, their, their UIs in addition to their UIs. And you know, there'll be these platforms that will emerge as well, that will combine them into super agents.

Maybe some third party platforms can emerge as well, that can take, and there's a lot of different things and integrating them together into, into something as well. Like, you know, that, that might make sense too. Or maybe an orchestrator or something, right?

Yeah. Something like that. Jody, I I wanted to, uh, so first of all, I, I get it.

It's a great vision and I, I make makes a ton of sense. Here we are 30 plus days post the announcement of this merger. How are things going, right?

'cause any, look, I, I've done, I've done rollups, I've done a lot of things in my life. Mm-hmm. You know, you, you're dealing with two different cultures, even though it was one CEO on both, but two different cultures coming together, little chocolate, a little peanut butter.

How, how, how's it working? Yeah, it, it's, it's, uh, it's been working great. Uh, you know, the first 30 days I've been, uh, pretty, uh, um, exciting, uh, uh, you know, as I said, uh, you know, I'm, I'm CEO co-founder of both companies, so it's as close as possible in culture, um, uh, that could happen.

Uh, it's not a hundred percent the same. You know, companies evolve and they have different, you know, even if, if sure I'm one co-founder of both companies, the culture, the culture differences. So yes.

But it's, it's, we are, it's pretty easy on that front for, uh, you know, for us. So you, our employees, uh, are very excited, you know, the, as the employees merge together, you know, I personally talk to, you know, dozens of, dozens of customers. There's a lot of excitement around the vision of how it comes together with like, you know, uh, a true DevSecOps platform.

Uh, you know, especially when we look at like, you know, a large banks and financial services and, you know, companies that are, that are struggling to ship fast because of the security and governance and challenges. You know, they're very excited about, you know, how, how, how something like this can come together. Uh, you know, the, you know, traceable customer base.

Very excited. You know, we have been very clear that, uh, uh, you know, the, the core focus of, you know, bo uh, of, uh, of how traceable was building more and more deeper application security capabilities continue to remain. And we bring them together into the CICD DevOps cycle.

Same thing happens with the, our core CICD. And, uh, it all possible, you know, if in, in our, you know, many times when you merge to, to products or two companies, you know, people, people are like, you know, are we still going to keep building the, the independent capabilities or we going to, to put most of our energy on the integration, uh, of, of the two? And we look at like, you know, uh, both are, both are important and we have, we know we are, we have, have a very solid plan.

Our teams are working on how we can, we, you know, how how we can do, uh, do both, you know, of course there's advantage of the integrations. Uh, one thing that about, about harness model, and you and I have talked about it in the past, is this notion called startups within startups. Like everything is designed inside Harness as a startup.

So our, well, our CD is one startup. Our feature flags is one startup. Our CI is one startup, and now traceable and application security become a, a series of startups inside it.

So the entire machine, we know, like, you know, how to run independent multiple startups, you know, in one platform so we can continue to innovate. So, you know, it's, it, it fits right in so far so good. You know, teams are excited, customers are excited, you know, analysts, markets are excited.

So, you know, it's, uh, of course we have to bring the, you know, the vision into a reality reality as we, as we, as we integrate it all together, Execution, man. That's what it's always about, isn't it? Yep.

Look, we, we've been saying around here DevOps is DevSecOps for a long time. So really happy with that. I got one more question for you.

It's kind of outta left field. It has nothing to do with the products per se, but, you know, I remember reading, I think it was a, maybe a LinkedIn post or a video of you a couple months ago, and you said something along the lines that, you know, if you could do it all over again, you would not have sold AppDynamics when you did to Cisco. Might have continued to maybe take it you, 'cause you're on the verge of an IPO right then, right?

You were like ready to go out in a couple days and, you know, looking back, you felt as an entrepreneur you should have gone that way versus, you know, the left road versus the right road. Now sitting here with harness and traceable and with the success they're having, do you feel like this is your chance to get that right? Yeah, you know, that's, uh, I've talked about it publicly, uh, that at AppDynamics we sold the company a day before the IPO and you know, that's not what we, uh, uh, we are going to do again.

Uh, you know, it's uh, you know, it's, uh, interesting, uh, uh, data point, the harness and traceable now, you know, it's bigger than AppDynamics. Uh, when we sold the company at it, and, and the time of its IPO in terms of revenue, it's growing faster, you know, all, all it's, it has all the things. So it's like, you know, it's, uh, we are in that spot where AppDynamics was when you going IPO and we, we sold the company to Cisco.

Uh, and our upon, you know, I, when I look at where we are at Harness Traceable, uh, it feels like it's the beginning of the journey. Like, you know, that we, we are still just starting to solve these problems. You know, it's like we have no, we have probably done like, you know, a few percentage of the market share.

You know, we, the so many cus you know, we having a lot of success, but still, like, so much of this problem need to be solved. Uh, it's the, you know, whether it's the DevOps, DevSecOps, CICD, all of these problems are still unsolved. People are still struggling.

There's so much toil is still out there and I do think the next five years, 10 years or the great time because it's, uh, you know, AI will redefine it all. Uh, you know, it's, it's a great time to bring, bring in this platform. So we, we are in here for the long, long run, uh, and, and build a pla build a platform company, you know, the likes of like, you know, uh, ServiceNow's and you know how the platform companies are built To Solve these big problems.

I do things for DevSecOps. That's how that, that's how we want to build. Excellent.

com now too. Next time talk, we're gonna talk about that. Alright.

But for now, Jody, thank you so much for taking time. I appreciate it as always. Great, great talking to you.

Great. I love the insight, I love the story here. Continued success my friend.

I'll see you soon. Thank you. Alright, Thank you Ellen.

Jody Bonzo, CEO Co-Founder Harness here on Tech Drunk tv. We're gonna take a break. We'll be back.