Securing Code at AI Scale

Hey everyone. Welcome back here to techstrong TV. Every time I interview this gentleman, we have the same discussion.

He lives maybe a half hour from our offices here, and we never seem to get together to do this in person. But next time, I promise you we are. But let me introduce you to my friend, Manoj Nair.

Is it Nair or Neer? I always mess this up. Manoj Nair.

Nair. Who's the CTO over at Snyk, and Manoj, welcome back to techstrong TV. It's great to have you on.

Yep, and I promise next time in person, Alan. It's really good to be back here. All right.

I'm going to hold you to it, man. Manoj, being CTO at a company like Snyk is an accomplishment in and of itself. It's also a huge responsibility.

But give people an idea of your background and how you came to be CTO here. Yeah. I can't exactly tell you the shape of how this comes, Alan.

Like everything else, you go and run to the biggest place that you can make an impact, and that's my career, right? And you learn from your mistakes. So I'm an engineer by trade.

Mm-hmm. Operating system guy, accidental product manager. I was one of those, build it and they'll come.

No one came. Mm-hmm. And that sucks, so- ...

let me figure out a use case for this beautiful thing we built. I became a security guy that ended up at RSA, learned a lot about security, went through nation state attacks, and it's like, okay, compliance and security are not the same, right? So fast-forward, entrepreneur.

I've run scale systems. I've done a lot of transformative growth, like how do I go to a place that has really been legacy and completely transformed them? So that was my last job after I exited my startup.

And so Snyk for me is almost a culmination of all of those life lessons, and it just was meant to be, as they say, right? And so here's an engineer who kind of didn't like their security tools but ended up being in security, who learned security and compliance are not the same. Where else would you be other than Snyk?

So my career in the last four years has been leading product, leading R&D, leading all things AI, and now coming back to bringing all of that together where we have gone from being just dev security, how do you enable devs to build securely, to really having agents as first-class citizens. And it's agents, it's the transformed dev. Obviously, the transformation is not common everywhere.

But how do you take them on that journey? How do you take enterprises on this journey? And there are new security challenges, and I feel like our customers live in this AI fog.

So it is an amazing time to be able to do what we do and the kind of impact we make. That is what really is amazing. No, I agree with you.

Yeah. We're living in historic times, and what's possible now. Yes.

A lot of my friends, because I'm also entrepreneurial, I've done multiple startups myself. A lot of my friends who are also startup entrepreneurs, I think the feeling is you could build anything today. Mm.

Yeah. Right? We could build anything.

Yep. And you don't need a gazillion dollars and- Mm-hmm ... benches of people either.

Yeah. Right? You could literally build out anything pretty quickly, but it makes for interesting times.

But of course, the internet being the internet, Manoj, this is why we can't have nice things because there's a dark side to that building anything. Yeah. And there's a dark side to that power of that AI gives us with this.

Mm-hmm. And that's kind of what keeps us up at night a little bit. Yeah.

In security, I think one of the biggest things that's come up most recently is the whole Mythos glass swing kind of thing. For me, I look at it maybe through a different lens. For me, I look at it through Gene Kim's Phoenix Project or the book "The Goal" before, that Phoenix Project's kind of based on, which is all about theories of constraints and bottlenecks.

It used to be that the bottleneck in security was we would find so many vulnerabilities, right? Human pen testing and everything else. You found vulnerabilities, and quite frankly, even at that level, we probably found more vulnerabilities than we were able to fix in a reasonable amount of time or remediate in a reasonable amount of time.

But now with things like Mythos and AI native pen testing- Mm ... someone's moved the cheese. It's no longer the bottleneck of how many vulnerabilities do I find?

Quite the contrary. It's what am I supposed to do with all these vulnerabilities? And I know that as a CTO and at a company like Snyk- Yeah ...

look, this is front and center. Very much so. " Exactly.

Mike Tyson. And I feel like this is the world that our customers are living in. There were very robust programs.

Yes, there's always something new in security, and then it's like boom right now. What do I do? Nothing that I depended on is anymore true So how can you find ground and how can you find stability?

And the hits keep coming. And even the good news is a hit. Like a CEO- Yeah ...

there was this story in Forbes about as soon as Fable five came out, the CEO said, "Oh, no, not again. " And so that's how people feel like. I think on the specific point you made, I like Jason Clinton's quote, from he's deputy CISO of Anthropic, and we just did a partnership release with them.

And I think he says exactly what you and I are talking about here. In AI security, detection was never the bottleneck. And so pairing Claude's capabilities with Snyk, enterprises can turn high-fidelity findings into action inside the workflow where software is built.

Which, by the way, has been our entire existence. Yeah. The one change here, as I said, is the speed.

And now it's not just devs, it's devs and agents. So how do you do that has been a big part of what we are focused on. Absolutely.

And you're right, it always has been the focus at Snyk. Yeah. I tell people this when I talk to them.

I think the issue is what I call AI scale. We've got to move our platforms, our processes to work at AI scale. And there's two pieces of that AI scale.

One is the speed, the velocity. The other is the sheer numbers. Yes.

Because if you had X amount of vulnerabilities that you were working on before, you're now working on 10X or 100X. Yes. And they're coming faster.

So, those are twin- Mm-hmm ... flywheels that are driving this. And so we need to make our whole platform has to be able to work on that scale.

Yeah. So how is Snyk adjusting to that scale, Manoj? Yeah.

I think, really thinking about it from two bookends, when you talk to our customers, some of them have access to Mythos, some don't. 5 Cyber. And there's this realization that models now are able to, with context, find things that were, yes, previously you could find them, but it required expert human pen testers, and now the models are becoming pretty good at that, which basically makes it easier to find these things at scale.

But on a scary side, that also means that it's not just the frontier labs who are careful. It's these innovations, within three months, they end up being in open models. So anyone who's smart enough to know how to build a harness with even not very sophisticated model, is able to chain these low vulnerabilities and start finding sniper shot attacks.

By the way, these have happened. All three frontier labs have said this has happened with their models. They're not able to stop it.

Plus, the open models are becoming powerful. 5 Cyber, how can I get ahead of it? Can I attack myself?

Can I build that harness? Can I be an adversarial tester and not have to wait for pen testers probably doing it once a quarter, like most companies, they do their high priority apps. As they say, it's like the 15 days that you test, and the other 350 days you're open because you're not testing.

It has to be continuous because software is changing continuously. And so that's one where we have, yes, and some of our customers are sophisticated, some of the largest organizations in the world. They can get access to the model.

They're smart guys. They can build harnesses. And what we're doing is saying, Snyk has something very unique in these environments.

We know all their vulnerabilities, from code to open source to container. Our ability to use these models, and by the way, we have access to on-guardrail models by being trusted partners to these labs. Our ability to combine that knowledge, that data in a sophisticated way allows us to have been much more noisy.

Much less noisy, very sharp. Mm-hmm. Sniper shot.

And so the problem with the models are if you just throw them at this, they're very noisy. I just heard this morning, 30% false positive rate from Mythos at Palo Alto Networks. Palo Alto Networks, one of the largest security companies in the world, smart guys, obviously they know how to use it.

So that's one of the big focus, where it's like continuous offensive security in your fingertips that is very sharp and very focused at giving you constant ability to poke into your environment like an adversary with frontier labs or open models are going to be able to do today. So very, very accurate, continuous, and you basically have a pen tester running in your code pipelines. Great.

Look, I agree with everything you're saying. I write about it and talk about this every single day, Manoj, and that is a key piece of it. Here's the thing that scares-- And I'm in security 25 plus years, so I know where I'm coming from here.

5 security type functionality, and they're not going to be as honorable as Anthropic or OpenAI. Yes. They're not going to work necessarily with stand-up companies like Snyk.

Mm-hmm. You know what I mean? They're going to be more down and dirty, and it's going to be more of a Wild West, and God help us.

Right? Yeah. What do you say to your customers out there who say, "Manoj, I appreciate what you guys are doing.

" Yeah. I think that firstly, make sure that you get ahead of it by testing yourselves. And the second is there's this whole contextual risk prioritization approach for security that's long become-- This is the best laid plans.

Mm-hmm. "Well, let's fix the criticals. " Well, now you have an attacker who never sleeps, so they are chaining these low-priority things to attack environments.

It's proven. It's seen. And so how do you remediate?

Don't live in this vulnerability debt backlog. Just don't. Right?

And so how do you do that? It's very hard because applications break when you change them. And so the other part of this that we're very focused on is really driving remediation, which by the way, has also always been a focus for us.

We had fixed PRs in open source, was our first original innovation. Like, "Oh, wow, who's this company? " And so we went from there.

Recently, what we have done is we have brought that fixed capability into agents. Everyone's using agentic coding assistance. So we have built skills that use our context, and we have also built our own small language models that do the Snyk agent fix.

Right? So we're able to fix right as the code's being built and say, "Hey, this is insecure. " And then how do you not allow the debt to keep coming?

So we say, why just stop at fixing after the code's produced? What if I give the agent the context so that the code's never insecure? So that was Snyk Studio.

So we're now saying you can secure at inception most of the things you can. You have a safety guardrail that is an agent that can fix. And so you have to stop this incoming spigot of vulnerabilities.

And by the way, it's 2 to 10x more across our customer base of thousands in the last year. So vulnerabilities are going up because AI, unfortunately, is producing a lot of the code and a lot of the vulnerabilities. The research has shown 50% more.

So with this technique, you're saying, "No, no, no, we will actually flip the bit on this. " And then the last part is I have millions of vulnerabilities. I don't have enough compute in this country, Manoj, that I can fix all these, and that's a real pain for customers.

So that last most important thing we did now is how do I remediate at scale using agents? So we build a remediation agent, and we've had public case studies. We had LabelBox went from two years of technical debt to two weeks erased.

Now, who's LabelBox? They're supplying the frontier labs with labeling, so they have to be very secure in their supply chain. Relay networks, right?

Us plus Claude and us plus Codex. So we're now building an ability to leverage Snyk with your agents to completely start erasing your technical debt. And so that's the bookend.

Find as sharp with the best models like an attacker would, and then fix agentically so you're not sitting with this thing that we have all sat on for too long, which is, "Oh, I got a vulnerability debt. " You're not going to be okay. That's our strategy for our customers.

I love it. We were talking off camera, and so now we are going at AI scale at the next bottleneck, which is this remediation, the bottleneck. Now, Manoj, let me play devil's advocate.

As I said, I've been in security a long time. I remember back when I was selling vulnerability management tools at one of the companies I co-founded. And one of our partners was a-- I don't know if you would remember this.

One of our partners was a company called Citadel. They had a product called Hercules. Mm-hmm.

At the time, we were big DoD suppliers- Mm-hmm ... for NAC and so forth. And Citadel had the contract with DISA.

And they were doing automated remediation- Mm-hmm ... back then, 15, 20 years ago. It never caught on because people were afraid.

Yep. Is it going to break something? Mm-hmm.

Is by fixing this vulnerability, going to break something that's maybe more critical than what I'm fixing? Yes. How do you overcome-- And you talk, it may be irrational fears, right?

Yeah. But it's a trust issue, I think, more than anything, maybe. How do you overcome that piece of it?

Funnily, now I 100% agree with you, right? It's not the first time, as I said, even we have tried this. There's a few things that are fundamentally different.

So one of them is now with agents. The agents are producing the code, and you're okay with that, but you're not okay with an agentic fix. So it's become a lot more acceptable, I think.

So as you said, part of it is irrational. " Humans are not touching most of it. There are companies where 80, 90, 100% of code is being produced by agents, right?

So now to go and say, as a security guy, I'm going to use the same techniques you're using to produce code. We're arming the security engineers to become AI security engineers and be the 10X at driving these fixes in safe ways. So what is the safety part here, right?

Why are people afraid? Well, the application might break. So we introduce something like breakability.

How likely is this upgrade to break your build? And we have that intelligence now. No one else does.

So we're supplying the agent that kind of reachable. Do you really want to fix this? Because if it's not even in a code path that got out of the package, just because it's there, why do it?

Right. And so it's this combination, it's much more mentally acceptable for most organizations that this is happening anyhow in production, so it should happen in fixing, but then doing it carefully with these intelligent signals. Our actual stats on this, and this is early days, right?

" That was low 70s, right? Mm-hmm. So we're improving that merge rate.

We're improving the fix rate. More specifically, we're providing unique security context, and that's now, I think, become something that people say, "Yes, we really need this" because in the last part, Alan, let's say an application breaks because of a security fix. It's actually very easy to go remediate that.

And what is not easy is to get attacked and then deal with a breach. And those are all the changing conditions which I feel are really positive in today's world. Absolutely.

Manoj, I wish we had more time, but I got people in the waiting room for our next one. Note, when you come up here, I'll just clear out a couple of hours, and we'll just talk, and then we could divide it into as many sessions as we'd like. But I could talk to you about this stuff all day.

For now, though, for people who want to get more information about how Snyk helps with AI native pen testing, and maybe as important or more important, how Snyk can help with AI remediation- Yeah ... io. io, right.

Yeah. I remember. But once I'm there, is there a path I should follow?

Is there people I should reach out to? You mentioned the blog. How can our folks, our audience, stay on top here?

io. You'll find Jen is on the site, and she will help you guide whatever you want. So just ask your question.

I love it. All right, Manoj, next time in person. No if, ands, or buts.

Yes? 100%. We're going to make it happen.

All right. I enjoyed the conversation, Alan. Have a great evening.

As always, my friend. Bye. You be well.

Take care of yourself. " We've got a lot more coming up. It's a busy day.

io. Go check it out. The game is changing here.

Don't get caught. "