Spotlighting Opengrep with Endor Labs’ Varun Badhwar

Hey everyone, it's Alan Shimmel and welcome here to another Techstrong TV interview. Happy to back on our show, Varun Bois. Varun is the CEO and co-founder for Indoor Labs.

Varun, it's great to see you again. How's everything Alan? Everything's great, moving a thousand miles an hour, but that's what we love To do as, as are we all it seems, right?

Yes. Where have you been lately? Have you, you're at RSA or, Uh, we were at RSA, uh, luckily I came out free from RSA, so recovery was more, um, mental recovery and just, uh, uh, less, less of physical, uh, recovery.

You know, a lot of people that got sick as, as ends up being the case. But, uh, yeah, I, I did, I caught a nasty cold out there and I had to do with telehealth and ah, medicine up and everything else. But, um, it's what happens when you got 40,000 people in one area.

No, yet it's gonna happen. Yes. What, what'd you think of this year's show over all overrun?

Look, uh, Alan, every year there's a theme and everybody, every vendor's talking about that. It's no surprise this year was, uh, AI washing everywhere. Um, and, you know, I don't think it was surprising or shocking to anybody, but I think it was a great conference.

Uh, it's always great to have that many concentration of security folks within a one mile radius. And, you know, the conversations you have are, are deep and broad and, uh, you know, these, these are multi-year relationships that go a long way. Look for me, this was year number 23 at RSA.

Wow. It's a long, it's a lot of RSAs, man. I had a great time though.

Anyway. Hey, Varun, you, you've been, you know, I say 23 years at RSA give people a sense of your journey, not just at RSA, but you in security in general and stuff. Yeah, I've been in security for almost 20 years now.

Uh, you know, first four years were, as a practitioner in the last 16 have been building companies, uh, to solve problems that I saw firsthand. com. Took my learnings from there to build cloud security companies, uh, one of which was Red Lock, one of the creators of the cloud security posture management category, sold that to PA Alto Networks built Prisma Cloud, had a great one there.

And then in 2021, my team personally got hit by a number of software supply chain incidents, SolarWinds being one, code, cov being another one. And that kind of took me down a, a, a deep learning curve of, uh, how software is developed, or frankly, I shouldn't even call it, developed how software is assembled. Assembled.

And, you know, that took us down to creating Indoor labs, which has really been about revolutionizing application security in, in the software development lifecycle. Because the number one problem is the, the what I call the developer productivity tax on engineers. Engineers wanna ship code security tooling is always slowing them down.

And we've wanted to kind of break that barrier and solve it. Well, and happy to report that, you know, we're seeing tremendous success in doing that. Absolutely.

It is. com for 12, 13 years now. And, um, background in security, one, one of the things we've seen come is the rise of platform engineering, right?

To help developer, you know, developers shouldn't have to develop their own platform. And when it comes to security, every developer wants to have secure code, quality code, they need help, they need, you know, but they don't necessarily, the security tools for security people are not the tools that developers are looking for to stick with the Star Wars theme here, right? I mean, they, they want stuff that's more geared to them.

And, and, and it comes out, you know, and, and it works in the environments they work in. You guys over at Indoor Labs and, and we're gonna get into Indoor Labs as, I guess we'll weave it in as we speak here, but you guys recently announced a partnership with GitHub to make it easier for developers. Tell us about it.

Yeah, so we've been working for several years now with GitHub, and, and as you know, like GitHub is eight where 80% of the world's code lives. Um, and, and a lot of their focus has been how do you make security and native experience, just like you have bugs and issues, how does security just be an extension to that? So developers don't have to do unnatural things outside of their workflow and go to different security dashboards and A SPM dashboards and try to figure out what is important and how they fix things.

So the idea was for GitHub, if security can be a native experience to developers, things would get fixed a lot faster with very little pain. And we agree with that. And so with the philosophical alignment that the two companies had, we brought very complimentary technologies together.

GitHub has, uh, amazing capabilities for secrets detection and prevention of secrets in code. And then they have great first party code scanning tool in the code ql. All of these things are packaged and sold as GitHub Advanced Security.

But the key part that Indoor Labs brings into that conversation is software supply chain security. 80 to 90% of the code is not written by your developers as all of this open source code comes in. How do you vet it?

How do you vet all the models you're bringing in from hugging face and deploying ad hoc in your applications? So for us, all of this has been focused on how do we compliment each other with GitHub's powers on securing the first party code and end indoors kinda leading capabilities on finding and fixing problems and all of the open source code and now AI generated code, which we'll talk about also. 'cause as you know, you know, AI doesn't write novel code.

It's all written and trained on open source software. So it's just giving you more DURs open source software, which are either equally good or equally bad. Depends if you wanna look at glass half full, well, You know what they say crap in is crap out.

Right? And that's right. That's right.

It's only as you give it. Yeah. So we provide the guardrails and natively both of these products are integrated to give developers an experience, not just to find and report problems, but to actually bring the fixes to them.

And that Alan is a really fundamentally different approach that GitHub and Indoor Labs bring together to the market is where most of the application security testing tools just report problems. And then you send them by j tickets to your developers and it lives in a backlog for months and years. We're just bringing the fixes to them in their workflow, whether it's the copilot, whether it's any other ID they're using, whether it's in the pull request workflow, but it's completely native, the developers will never see a different security product experience outside of Got it.

Got it. So if they're using copilot, you know, it's funny, we did a thing at RSA we do every year, the dev, the DevSecOps Connect event Monday at Moscon Center. And we, we had an amazing panel.

We, it was a full day, but one of the panels we did had the CISO of, uh, open ai, CISO of philanthropic, the security tech lead for Llama and the CISO of Jfr, along with this woman, Sol Ro, who's written a lot of books on AI and former AWS and, and stuff like that. They said something that really resonated with me. The current state of AI is, it's not a pilot, it's a co-pilot, right?

We don't expect it to drive the plane. Well fly the plane. We expect it to help us fly the plane.

And to me, that's very much your mission for developers. You're not writing the code for them, you're not assembling the code for them. You are helping them do their code.

And, and that, you know, in my mind, that's the, that's the proper mission, right? That's the proper place for, for this AI kind of, uh, assistance. But how do you work within copilot, right?

Without stepping on each other or stuff like that? Yeah, it's a great question. So we essentially become a pair programmer inside of Cursor and Copilot and all of these other ideas.

So what's happening essentially is a developer is interacting with the, with these tools to produce software. And we are in there, uh, basically being the pair programmer that's bringing the security lens. Like imagine an enterprise.

If every developer of yours could have a security engineer sitting next to them working together, you just wouldn't have a lot of these problems as depth in the first place. That's what it works like. So developers asking copilot and Cursor to write some code, it gives some code and or is reviewing and inspecting that as it's coming in and saying, listen, what you produce has these problems.

Can you please rewrite it with these criteria? We basically have it rewrite and interact and a couple minutes later and or First Circuit copilot and your developer have now produced code that is, that functionally works and is secure, and this happens well before even a pull request is generated. Love it.

Look, there's only about, what, 30 million something GitHub users out there, 40 million Now, um, how can they get their hands on this indoor labs plug? Not, and I don't know if plugin's the right word, but, you know, companion, copilot, whatever you want to call it. com and kind of kick, kick off from there.

Also in the marketplace, you can have our GitHub action and our GitHub apps are available. Um, it is a subscription service, so, uh, you know, depending on the number of developers in your enterprise, we can, we can kinda set you up. But that's the best way to get going.

And I always say the, the proof of this is in seeing it in action with your repos. So we're always happy to set you up with an evaluation, connecting into your own code repositories. Love it.

I love it. If you don't mind, Varun, I'd like to turn to something else. You are getting two for one here today, folks out here, uh, Varun, you got Indoor Labs also.

I partnered with like eight other security companies on something called Open gre. Yeah. What, what's that one about?

Yeah, so, you know, it's a good, it's a good segue, right? We've been talking about GitHub and we've been talking about how great GitHub's native capabilities are for, uh, first party code security with static code analysis and such. But look, not, not a hundred percent of the world is on GitHub or not a hundred percent of the world is ready to pay for a commercial product for security.

And so, uh, you know, for, for many, many years, uh, out there in the market has been a, an open source community edition product from a company called SEM Rep. The engine is called a SEM rep engine that essentially allows you to write grip rules very easily, um, to kind of look for functional issues, security issues and such, right? It's a, it's basically like a linting tool and, you know, there's also a lot of community behind that, but unfortunately for commercial reasons, as a business, EM rep decided to make some changes to their licenses, remove some functionality from the Open Source edition, really forcing people to go think about paying for their, their commercial edition.

And we fundamentally believe a grab pool like that is extremely important to keep independent and continue harnessing the community that has trusted it, believed in a, worked around it to scan your custom first party code. And so essentially, um, when in December, EM rep announced these changes that are licensed, we worked with several other companies to create this independent, essentially an independent framework where no single company now owns the future of this critical open source project for it. So open grab and essentially the nine companies that we are, have come together and funded full-time engineers to bring back in the functionality that Emre took away and continue to expand on that functionality to arguably make it even better than the commercial variant of that engine.

And the idea is that we would over time, hand out, over open grab to a foundation so it continues in its long-term existence, independent without the risk of a single company kind of changing licensing or limiting its use as it is. And where Open Grab comes in is, it's a great LinkedIn tool and a grab tool for, for developers to, um, kind of right rules and customize finding, finding problems in first party code. Again, like I said, not everybody can, uh, be paying for a GitHub advanced security license.

Not everybody lives in GitHub. And so I think it's a great tool for, uh, for the community. Yeah.

First of all, look, anytime you can get eight, nine security companies together, rally behind a particular open source tool, static code analysis, you know, that, that coopetition, whatever you want to call it, right? You, you, I mean, the potential is there to make this a game changing piece of a game changing tool in the quiver of, of AppSec professionals. So I, I commend you, I commend the other companies involved for, for doing this.

It's a great thing. Where can people go get open grab? It's all, it's a community product.

So, so, you know, you just go, go, go Google, Google search for open grab, it's available, the roadmap is published and you're, you'll be really impressed. Follow open grab on LinkedIn, I would say, because the velocity at which we are introducing new innovative features is incredible. I haven't seen that before, uh, in many, many, many open source projects that I've, I've and I paid attention to.

And primarily because the nine of us companies are literally Allen writing checks and funding full-time engineers to create this. So this is no longer a best effort of, hey, community, Not a hobby. It's not anyone's, you know what, look, Varun, I've been an entrepreneur 30 plus years.

A lesson I learned pretty early on is if it's no one's job, it doesn't get done right? It's gotta be someone's job. Hobbies are nice, passion is great, but it's gotta be, if you want something done, someone's gotta have that job, right?

And so the fact that you're doing it is that's why you're getting the results. You are, someone is getting paid to do this and, and open, I love open source, I'm a huge supporter, but the day of the, you know, Richard, Dr. Richard Stallman, and we're doing this for the love of, of software and Freedom, people need to get paid.

That's how things get done. Yes. dev, we've, we've put in the value, the mission, the long-term focus of this project, and then you can obviously interact with our development team on, on x, on LinkedIn, on Reddit, wherever you choose to be.

Uh, we are, we are there and we're really excited for the community, uh, just to use it. You know, we've, we've got, uh, early feedback from people that have moved from re to open rep that have seen 30% faster scanning. Uh, really, so it's just pretty significant, uh, improvements.

And so we're, we're excited to embrace the community as they start moving over. Very cool. And you know, with nine companies involved, you don't have to be worried about locking in and, and all of that other stuff.

It's a great, thank you. Thank you guys for doing that. Hey, so I could, you know, so what are you doing in your spare time?

It's a busy world. It's a, it is a busy world besides running around twin boys. We're almost turning five later this month.

Um, good For you, man. I, I think that right now the biggest software revolution is ahead of us, and it's happening in front of our eyes, which is every enterprise is adopting an AI assistant or co-pilot to write tool. The implications of that are pretty significant.

You will have way more lines of code, you will have way more bugs. So quality engineering, platform engineering, security, engineering all become important except all these hundreds of millions and billions of dollars are being poured from venture capitalists to create these copilots and create this problem of a lot more code. We need to retool the, the, the kind of defenders of this software, the people that are in charge to make sure this software softwares shipped securely with confidence to have their set of AI tools to do their jobs at a much faster, more effective pace.

So for us, we think there's a entirely new set of problems that emerge, right? Traditionally in security, we always worry about CVEs vulnerabilities known and C Ws a lot of companies were addressing the architectural questions and design questions by doing design reviews, threat modeling, security champions programs, security office hours, all of that falls apart, uh, with the velocity of code changes that are coming. And so we announced at RSA, uh, or just before RSA, a new new product, an entirely new suite of products that are actually doing security code reviews with ai.

So we built a multi-agent framework. The idea was with indoor for the last four years, we had been building this very deep moat of, um, knowledge on open source software deeper than any other company on the planet. You know, we knew billions of risk factors on every open source projects kind of existence over time.

We had the call graphs, we'd done deep program analysis and inspection of the code. We had built an entire database of that software. So now when AI starts generating code for you, that's not novel, that's variations of open source.

We have the best insights to be able to secure it. And so Azure developers are writing this code and checking it in. We are now doing code reviews with AI agents that are looking at understanding not just the CD and the tactical stuff, but really architectural problems, design flaws in the application.

Did somebody change a session timeout from four hours to eight hours on an application? Unintentionally? Okay, somebody paying attention to that.

Are they aware that that's something that shouldn't happen? Or they're introducing a secret, a new secret manager, but that's not your enterprise standard of how you score seekers, who's paying attention to that or somebody's introducing a new API and not putting in the right authentication authorization per your superior coding guidelines. Who's paying attention to that?

These are not known vulnerabilities. These are design flaws and architectural flaws that are getting introduced with AI generating code and invite coders. And we have now built this multi-agent platform that is reviewing every pull request, threat modeling, every pull request, understanding the intentionality of the developer versus the reality of how it affects the architecture, and essentially automating that entire process of code and architectural reviews and threat modeling.

I love it. Did we, did we mention indoor labs? URL?

I don't remember it saying it. Varun. Yeah, it's really simple.

com. Uh, come check us out. There's a lot there.

Uh, there's just, I, I will also say, unlike many companies, most of our technical blogs are written by our engineers. So, uh, um, you know, we have certainly a marketing team like everybody else does, but our content is very, uh, original and authentic by engineers for engineers. And there's one more thing Ellen I'll mention is we have a community for application security professionals called Lean AppSec.

com, uh, which is really love it, just like open rep. We're kind of creating this community for application security teams that are typically overworked, understaffed, to come get together as a community, talk about their problems, get recommendations from each other, and we're often doing virtual events and talks that the community is doing, we're facilitating. So, you know, if you're interested in application security, definitely check it out.

Fantastic. Farrun. Hey man, I think we covered everything.

I, I didn't think, you know, we didn't think we'd get it all, but we did continued success. Keep up the great work. Come back and visit us soon.

Varun Badis, CEO co-founder and or labs here on Techstrong tv. We'll take a break. We'll be back.