Secure Code Warrior CTO Matias Madou on Empowering Developers with AI-Driven Security Tools

Hey everyone. Welcome back to Text Drunk tv. I'm so glad to have this person.

Usually I see them around RSA or Blackout or one of those, but I haven't. So we've got him here on Textron tv. Let me say hello, please to Ma Marias Madoo.

Marius is the Chief Technology Officer. He's a director as well as co-founder of one of my favorite companies, secure Code Warrior. How are you, my friend?

How's it going? I'm really good. Thank you so much for having me.

Always a pleasure. Where are you in the world today? I'm in breweries, Belgium.

Excellent. What am I? It's a great city.

Great area. Um, so Mattias, why don't you give people a little sense of your background, how you came to found Code Secure Code Warrior, and a little bit about Secure Code Warrior. Sounds good.

So I'm a technologist. Um, I started my career at Gen University here in Belgium, where I pursued a PhD in application security. Um, I was working with static Analysis solutions, and 20 plus years ago, there was only one company that was trying to do something very interesting with static analysis, and that company was called Fortify.

So I started my career 20 years ago at at Fortify because I, I joined them, I finished up my PhD, I moved to the us and I joined them when they were still, uh, a tiny startup. Um, I've spent seven years at Fortify, um, finding problems in code and saying she at that time, throwing it over the wall to developers and running away as fast as we could. So my philosophy was like, Hey, can we do something for the developers?

Can we help the developers? Can we make sure that developers can create secure code from the start? And that's why we started Secure Code Warrior.

Our vision, our mission is to get those damn security people off the developers back. That's our, that's our goal. In the beginning, I think we were a training company.

We were trying to provide content to developers. I remember hands on content. Yep.

Hands on content, making sure they knew how to code securely. Um, these days we call ourself developer risk management, developer risk management. So we wanna make sure that organizations can control risk, that can potentially be introduced into the code.

So we wanna make sure that the, the CISO has the means to make sure that developers really have the tools and the knowledge to create secure code. That's our philosophy. Um, so ultimately, um, I think the philosophy should be only secure.

Developers can check in code into repository. You know, only secure developers, only upskill developers should be able to check in code into a repository. And that's how, how we move forward with Secure Code Warrior.

Love it. And I love, you know, I, so look, I've, I've been following Secure Code Warrior now, I don't know, six years, seven years. Is that about right?

I think so, yeah. We've, we've spoken quite often. Yeah.

And I have, I've seen the metamorphosis from sort of a training company to more of a, a product led or a engagement as well, consulting and everything else. And it, and it's been a great, a great journey. You've also collected some amazing talent at Absolutely.

Code Warrior over the years. Um, but of course, AI is kind of changing all the rules now, right? True.

So all of a sudden It got easier for developers to kind of build security in because security via AI is being built into the IDE. It's being built in, you know, the rise of platform engineering. Seven years ago, we didn't talk about platform engineering, but the idea of building a platform that has guardrails in place mm-hmm.

Gives these developers, we don't ask the developer to have to build their own platform to develop on. Right? They, they're given a platform that hopefully has some security and so forth built into it.

But AI is, is certainly changing this secure Code Warrior being who you are, meaning the company, not just you. Um, you guys are taking advantage of this use, using it, leveraging it to try to make the mission better. You recently came out with, uh, some security rules that are in GitHub that developers now can use.

Well, why am I telling the story? This is your story. Tell us.

Sure, Absolutely. So with Secure Code Warrior, we're, we're embracing the new world that we live in, the new world where developers are going to use AI to create codes. Um, so our philosophy is that, um, developers will be replaced, and not with ai, but they will be replaced by developers that are using ai.

So we need to make sure that we give every means and tool to the developer to create the best secure code that they can potentially create. So that's our philosophy. So as Secure Code Warrior, we wanna make sure, um, we guide the developer in writing secure code with AI these days.

And we do that in, in different flavors. So in our platform, we have these new type of challenges where, well, it's, it's like more of a role play. Um, you, if, if you, by the way, if you ask AI a question, if you're a developer and you ask AI a question, you do not get a text answer.

You get a diff between the original code and what the AI solution is suggesting. So then the question is, do you accept that? Do you believe the AI solution?

Do you approve essentially, um, the diff and are you going to commit that code into the repository? Um, and that's our new type of challenges in the platform. So in the platform, we do some role playing, like, Hey, you've asked this to the AI solution, it's proposing this piece of code.

Is it, is it secure? And if they say, no, the AI solution is gonna help you a little bit and say, Hey, well, did you think about this? Do you know about SQL injection?

Do you know about, um, uh, uh, cross side scripting? Like, and it's trying to explain, you know, how to think about these things and how to create secure code and how to work with an AI solution. So that's in our platform.

But then at the same time, we also saw that if you give a couple more hints, you know, a couple more ideas to an AI solution, it's actually producing better code. If you say to an AI solution, well always use parameterized queries. It's gonna essentially avoid creating SQL injection, or it tries to avoid making SQL injection.

You still need to do code review. You know, there's House Nations, there's, there's mistakes that an AI solution can make. But that's what we've released, um, last week.

So what we've released is those very simple generic rules that essentially whisper in the AI solution. Like, Hey, always create secure code, but it, it's a little bit more than that. You know, we make sure that we whisper in the AI solutions here, how to produce that code.

Um, so it's essentially very silly that they not always create secure code by themself, but it, it's kind of normal. They're trained on, on random stuff. So quite often they do not know what to produce.

But so what we've released is a very lightweight set of rules that can be added to your, um, cursor to your regular IDE, um, whatever IDE you're using with an AI solution connected to it. You can embed those very simple rules. You can extend those rules, and it is gonna produce better meaning more secure code.

By the way, it's only focused on security. We're, we're a security company is only focused on security, is not focused on quality or optimizing for whatever. No security.

I have a question on that. Absolutely. I would love to hear, I am sure that the security, it helps making you know that the, that what it does in helping you develop more secure code works.

Mm-hmm. But are we destined to live in a world where the developer's gonna have a security focused ai, a speed focused ai, an optimized of focused ai, uh, an AWS optimized versus a Google Cloud versus Azure, uh, uh, you know, I'm needed to work with Salesforce. It's the same problem I have with Agentic ai.

Are we, are we destined for a world where I'm gonna have to deal with dozens of agents with five or six different ais working in my IDE? 'cause it's gonna drive me as a developer, it would drive me crazy, right? Um, maybe so I, I think for maybe, but for the foreseeable future, I think it's a reality.

I think more and more specialized AI solutions will come into play, um, solutions that help you with fixing code, um, solutions that help you with generating ideas. And if, and some of them are, we actually did a piece of research and we saw that, uh, certain models are better in certain languages than other models. Um, so today, yes.

Um, five years from now, I don't know. I hope it's, it's not the case because as you said, it's gonna be, it's gonna be hard to, to live with. And, but today it will live in a reality where there's a lot of specialized solutions.

And, um, I think it's our goal as secure Code Warrior, making sure that people are informed what they can use, how they should use it, and how they can produce the best result. And today, yes, it's a complex problem. Absolutely.

It absolutely is. I got business kind of question to ask you. Sure.

It's in GitHub. Am I assuming it's free and open? Yep.

It's free and open to use. Um, ev anyone can extend the rule pack. Um, right now we're, we're not allowing new check-ins from, from people outside of Secure Code Warrior.

But, so yes, it's free to use, you do not have to be a Secure Code Warrior customer to use the rule pack, uh, but uh, to do, to use the rules. But you can simply download it, you can optimize them, you can change them, you can do whatever with them. Uh, we would love to hear the feedback.

We would love to hear how it goes. Uh, but yes, um, we thought, you know, for us, it's, it's the first step. So we say like, Hey, you know what?

Let's, let's do something back for the community and let's figure out who has an interest, who wants to work on something like that. And it's the first step. It's a lightweight rule pack that we just released for free, and we would love to hear the feedback.

I Love it. You can get it on GitHub. Do you, you wouldn't happen to know the GitHub address URL off the top of your head, do you?

Uh, not off the top of my head, but I can actually look and Wow. So it's got, it's called GI git com. I'm cheating.

I'm absolutely cheating. com/secure code warrior slash ai dash security dash rules. Got it.

So that's where people can download, um, the rule pack. You could probably get to it off of this, the, uh, the, uh, secure Code Warrior website too. Can Oh, absolutely, absolutely.

And, and what's the website? com. I love it.

This is a great resource for our developers, our DevOps people out there. Check it out. Even for our security people out there, you need, you got, they, you need to be on top of this stuff so you know what to expect and what's available, how you can help the developers in your organization develop more secure code.

Yeah, And it's, it's all text based, so I, I think it, it applies to a lot of, uh, other areas as well. So, um, uh, optimizing to get the, so essentially what we're doing is, is we're, we're helping the AI produce the best results, like it's prompt engineering, but on a continuous basis. So all we're doing is trying to make sure that we get the best results out of the AI solution.

And I think that's what we all want in every field. So what we've done is just a very specific one for developers and to write secure codes. I love it, Mathias.

I, I don't, I don't ever say your name as good as you can. It's just my New York accent. I apologize.

But, uh, maus is how it is. It, it is. Maus.

Thank you so much for coming on text on tv. It's been too long, my friend. Come back soon.

Keep us posted. I'm sure there's a lot more going on with Secure Code Warrior. You guys always have a lot going on.

Will you be a black hat this year? I will be. So, um, would love if people we're there, wanna catch up, we're Oh yeah.

If you're there, let's catch up. If people wanna catch up, send me an email or LinkedIn and I'm happy to go for a coffee. We're doing live video.

I expect to see you there. Sounds good. I'll, I'll take you up on that one.

We'll reach out. Sounds good. Maus maus, Madu, chief Technology Officer, co-founder, secure Code Warrior here on Tech Drunk tv.

We'll take a break. We'll be right back.