Manoj Nair: Snyk Unveils Evo – The First Agentic Security Orchestration System for AI-Native Apps

Hey everyone. Welcome back here to Techstrong tv. Let me introduce you.

We will reintroduce you to my next guest. We've spoken before. It's my friend Manoj Menino is the Chief Innovation Officer over at sny.

It's always good to have our friends at Snyk on the show. Manoj, how have you been? Good.

A, it's good to be back. It's always nice to have you on, you know, Minosh, I love the title Chief Innovation Officer 'cause it can cover a lot of sins, but it covers a lot of exciting, interesting things as well. But people out there saying, how does one become a Chief Innovation Officer?

Are you an innovation major in college? I mean, were you an assistant chief Innovation officer? Give, give people a little insight to how you wounded up with this title in this role here at Snyk Minosh.

This is awesome. Uh, I am an engineer by training, you know, old operating system Colonel guy who became an accidental product manager. Uh, and then, you know, it's like built a, built a hammer looking for a nail.

I was like, this is not the way to do it. Uh, and that's how I ended up in security. So I ended up, uh, running product and engineering for RSA, built our entire security portfolio.

Then I accidentally really understood what security is by going through a nation state attack and then saying, oh, that's not, you know, security. So, um, my, my, all my life's lesson is like, run to the biggest problem. You can make an impact.

Um, you know, I went and started a company and learned everything that they don't tell you. So there's no entrepreneur school either. And then, yeah, I know everything took, took that to an exit, was thinking what to do next and all these lessons together was why I came to snyk.

You know, I feel like SNY is such a different take on cybersecurity, like fixed problems at the point of creation. And, uh, I came to make Snyk, uh, what I thought would was the potential to be a generational company and now with that original dev security mission. And so I was the chief product officer for a few years, first two, um, three and a half years into snyk.

So CPO and then, you know, the AI wave was coming and we didn't think this is what will happen. We said, we have a bunch of other folks who look like me. They're former founders.

We either acquired or hired, and we basically put together a band of pirates. And, uh, that's how even the thing we're gonna talk about, Evo comes out of that group. So this is really about, I love it, you know, thinking about what is the next wave and how do you go about really creating the conditions for a startup?

And oh, we're no longer a startup at Snyk, right? So we're a pre IPO company of a certain size, 4,700 customers. How do you innovate fast and faster than those nimble startups working with the biggest companies in the world?

So that is, you know, these, these roles don't really have a description that's well known and, uh, each company does it different. But that's, that's what I'm doing now. Love it.

That was great. Monosh. Thank you.

You know, you mentioned snyk. com 12 years ago. And the reason I did though is because I really love, I'm a security guy myself.

I've been a security guy for 30 years. I thought DevOps gave us a chance to do security better. Mm-hmm.

So I was all about DevSecOps, you know, sneak burst on the scene. I'm going to guess what, about eight or nine years ago. 10.

10 years ago. Just 10 years ago. Yep.

And to me it was one of the first companies, let's call it DevSecOps native. Mm-hmm. Right?

Yep. It was native DevSecOps it right from the get go. It said, Hey, we're gonna, we're gonna help make security better.

And what, I don't even know, we called it the software supply chain at that point, but we're gonna help make security better pre-deployment, we're gonna shift left, we're gonna work with developers. Mm-hmm. And, and so to me, the sneak mission was always just a, you know, it was my mission too.

Mm-hmm. It was my passion. Yeah.

We've seen shift left change. We've seen so much change in, you know, with the advent of AI and agentic AI and generat of AI and ML ops and platform engineering and GI ops and Cloud native mm-hmm. All of these macros and some, some much bigger than others Yeah.

Than, you know, working on how we write and deploy code Yeah. Software, our app, our eight, our applications. And now, you know, you, you, you, you can't stand still.

You know what they say, if you're not moving forward, you're dying. Right? Yep.

Sneaks moving forward here in a big way mm-hmm. Around AI with, you mentioned evo. Yeah.

Tell us, tell us all about it. Well, you know, just a little bit on what you were talking about, like Sure. The core concept, as you said, is very simple, right?

Can I give engineers context Right. At the point of creation, but software engineers are not taught, you know, security. And this is the only engineering profession where it's all about innovation.

It's not about safety. So there's the root of, you know, like you don't have a security problem. We had, uh, Tara Algamal the father of, uh, on stage last week at the AI Security Summit.

I know Tara. I love them. Mm-hmm.

And, and so, you know, uh, another R-S-A-L-M, but you know, we didn't overlap there. Uh, TAR goes, we don't have a security problem. We really have a quality problem.

And that's the, Well, Jen Easterly said this too. Same thing. Yeah.

Former head of cisa. Yeah. Yeah.

And we don't have, we have a software quality problem And this is what the root of sneakers is. So now you'd fast forward, as you said, to the age of ai, it's not just the dev, the agents and the LMS have learned all the same bad habits. 'cause they learn from our bad HA code.

And so it's no surprise. So I think that, you know, we launched the AI trust platform in, in, uh, may of last year or this year, and it's moved so fast. You know, time time's a very different, uh, horizon at this point.

Like it is, you know, warp speed. So may feels like last year, but it was just May of this year. And it was us positioning all the things we do now directly into the context of that AI driven development.

And we started also talking about securing AI native apps, right? The software, the vault as market, I think it was Mark Andries who said it, and then AI is eating software. But if you think about AI driven development, what we have done at that launch, and since then, is all the context that we were giving devs, it was superpower was it was super fast and accurate.

Devs might choose to ignore that agents don't. And so here's that little secret that we, you know, we call it secured inception, I believed. And now the proof is there.

We know that AI driven code can be more secure than human, uh, driven code if you are providing security context to the point of inception. So this whole notion of context engineering and, and that we did partnerships, we now support everyone from copilot to cognition who owns both Devon and Windsurf and Cursor Cloud code, open ai, like all of these, every major, there's about 15 or so of these. And, uh, there are AI driven development, and then there's AI agent AI development.

So that, that was going on since May rapid set of innovation iteration. Now we have hundreds of customers who are using that. And the second part that I said was now something we were slowly cooking with design partners, which is great.

My AI driven development is secure, by the way. That's not true for most of the world. It's just for these hundreds of SNY customers.

But we now know how to do that. We now know how to do secure inception, and no one should adopt a coding assistant if you don't do that. Like everything else, even in the ID is too late.

But the world's still doing static analysis and everything in the CI stage. So there is no, like, there could end up being a, a more important time for the DevSecOps Foundation. And then on that foundation is secure AI driven development.

Uh, EVO comes as the next phase. And what, what we saw there is, as you are building agen AI native apps, this is your customer experience agent, uh, who decides to give a car for $1 because it got prompt injected. Uh, it's the, I've seen in my, uh, Twitter feed, someone goes to United Airlines and tells the agent, the Gentech app not to, you know, follow the instruction.

So these kinds of things started, you know, how people started understanding that this surface is different. This is software that doesn't follow rules of software. This is some call it, you know, this is probabilistic versus deterministic software, non non-determinism stochastic methods.

What it means is the same inputs could result in different behavior and different outputs. Everything is the same. But it, you know, you do this with chat GPT, you can ask it the same thing five times.

It'll give you five different answers sometimes. And so that non-determinism is the magic of gen ai. That's not gonna go away.

You can make it go away, but then the magic goes away. So you want the magic, you have to deal with this. Security is all about rules based.

It assumes software is rules based. So most of security is rules based. And so it is not about just, you know, defeating prompt injection.

It's not about defeating just, you know, oh, how do we figure out how to not allow, uh, you know, toxic flows to happen. We saw that the surface was moving so fast that the leading companies that we partnered with had this new role, created an AI security engineer. It's, uh, somebody understands LMS and ML operations and, and really thinking about how do I secure this very vast and very fast moving surface?

And that's what EVO then was born as the tooling saying, this engineer is like a person who's sitting on the cockpit of a Gen five fighter jet is gonna have so much data coming at them. They're gonna need to have tooling that allows them to be that elite fighter pilot. And that's really the heart of e evo.

You know, I basically use the URA loop principles, observe, orient, you know, de detect and then act. And all of that is how, you know, we brought Evo really, you know, how do you have this new defender, have the best tooling to deal with non-determinism and, and very wide surface and very fast moving surface. And, and that's, it's very different.

Other domains have built ENT security, orchestrators security didn't have one. One now, and now now we have evo. But you, you mentioned something that the tail admin knows there that I think is important and worth noting.

Mm-hmm. Are we, I don't think anyone wants a world of dozens, hundreds of different secure, not just security, but agentic ai mm-hmm. Systems, though that's probably where we're headed, right.

We're gonna, we're all, even personally, we're gonna have a fleet of agents that Yes. That, that do stuff for us. I think the orchestration is the key and their ability to talk to each other, not to do duplicate duplicative work and, and be like, uh, you know, more, more efficient mm-hmm.

Is the key. You know, last January, if I would've told you MCP service is gonna be the defacto standard in six months. Yeah.

Well, it's about nine or 10 months. But it's, it is the defacto standard for all of these agents to work. Yeah.

Many companies want to be the agent manager. Mm-hmm. Right.

Big companies. Salesforce, uh, yeah. Uh, uh, uh, what's their names?

Uh, the, uh, service metric, not service metric. ServiceNow. Yep.

ServiceNow. Yeah. Um, you know, SAP, everybody wants them, man, be your agent manager.

But is that realistic? Do you talk trust ServiceNow to be the, the agent manager for my AI security agents, for instance? Yeah.

In the development process. How do you see EVO fitting into this? Yep.

You know, it's a bit of a crowded world, right? Yeah. I, you know, it's a, it's a really good, our belief is that you need special purpose agents.

Like the, one of the things you need to do is to constrain their scope of thinking, reasoning perception on learning so that they're not, you know, having all these behavioral issues that can happen. But you also need domain specific orchestrators, not one orchestrator to rule it all. Something that's very good at orchestrating software to open life cycles.

And I've seen that and we use those. That's magical. Something that, you know, I also run marketing at Snyk.

There's some amazing things in the marketing stack that is different from a really, like, almost think about, you know, maybe analogies help. I'm a big, um, Marvel Defenders fan. If you have a Avengers and, uh, you have, uh, you know, the shield and there's a Nick Fury and it's, you know, you need somebody who is knowing how to know powers of these heroes and experts to, you know, in an orchestrated way.

And so that's what you need. And that's our belief that there's probably not gonna be a lot of agent security orchestrators, but there are gonna be different like customer experience, CRM, you know, uh, workflows for enterprise. Those, they're specialized orchestrators.

We are built the first specialized security one. And that's why we made it open. It was not just meant to orchestrate, you know, because we also released four or five specialized agents along with Evo, but it'll also work with their other agents that others will conceive.

And this is partly why we had the summit last week. We brought, some are competitive to some of the agents we built. We brought industry leaders or building agent systems and agent security tools.

We think orchestrators will be few and building one that is open and going to invite others to also be part of that. Look, I gotta give you extra points for the Marvel reference. That was good use of Avengers.

I, I give you, I give you a couple extra points on that. Thank you. Good stuff.

Um, so look, people are watching this Evo actually came out o over a week ago now. Mm-hmm. And, um, if you don't mind, we only have a few moments left.

Yep. Tell people how they can engage with Evo, how they can, you know, try it out, test it out, take it for a spin. io or also since it's, it was born out of my labs team, we are very public with our labs research.

io and both sites will lead you to a few things we're making available to everyone. First step is you need to understand what's going on, right? That observe phase.

So in this case, you know, there's the AI bill of materials and you talked about MCP, we were surprised in highly regulated environments. The developers were building in MCP servers into the code, and so were their CSOs. It's very hard to detect these things.

It's not like a network connection to the internet from a cloud service that you can say, oh, I figured it out. No, it's in your code. So you need deep understanding of code so you can try out our AI bomb.

That'll really put a light on everything that you have. Agents, tools, uh, and, and MCP servers, all of that are in your code. And then that awareness and observe is where you start.

It's real time observability and what's happening inside your code. And then you go into, you know, how do you put policy, the orientation. I don't want deep seeq remove, do I have deep seeq?

Well remove it right? Then. It's a question of how do I, so all of that they can try out from those sites.

There's another risk that is very new to this environment that was never talked about in DevSecOps before, which is the tool chain itself. These agent IDE platforms like Cursor and others are being attacked so that you start with the dev who's using those tools, compromise their dev environment with poison MCP servers and these toxic flows, and then use that as a way to insert vulnerabilities into the code. So there's MCP scan is another tool we introduced.

You can run it as a dialer in your endpoint and see if you have any, you know, people are downloading all kinds of MCP servers to connect to their tools. They're powerful, but some of them are actually very bad. So see if you have any toxic flows in your MCP servers on your endpoint tools.

And then lastly, we just lost that was both of these have been available once we updated them last week to be orchestrated by evo. And then the red teaming agent is new that came out last week. We can try that out too.

And that's available to anyone. If you're not a sneak customer, you can still try the MCP scan. It's open sourced if you, if you wanna try the others, you just have to sign up for a free, you know, it's a free unlimited trial.

And then if you really wanna be a design partner in Nivo, there's a form there that you can say, uh, look, we, we are being very picky with who we engage at this stage. And, uh, we have about 40 to 50 of these design partners, but we're bringing in very well qualified. If we feel like you are going to find value and add value, then that's a design partner and then we'll open it up further.

So express your interest and we'll, we'll bring you into the full EVO funnel. Excellent. Good stuff.

Windows. It was great having you back here on Techstrong tv. Don't be a stranger.

Are you gonna be a cube con maybe in a couple weeks, or, uh, No. Nah. I think my next show is Reinvent, but we do have the AI Security Summit Sydney version happening between now and reinvent.

So if any of your listeners are Not in Sydney, oh, I'd love, I'd love to. Well, we, we actually do have a decent following in Australia. Yeah.

Sydney's one of my favorite cities in the world too. I love it. So, you know, hey, maybe you need Techstrong to broadcast live there.

You wanna fly us out to Sydney? There you go. There You go.

Well, we're always down for Sydney, but we will be, we'll be at Reinvent doing live video too. Great. So maybe I'll see you there.

I'll See you there. And then, uh, yeah, shout out to anyone who's in Sydney. com and November 17th, you're gonna have some great conversations from leading company who have adopted Love it.

Agen ai securely. Love it. Great.

Er, chief Innovation Officer at Snyk here on Dextro tv. We're gonna take a break. We'll be back with more in a second.