The Human Element in the Agentic AI Era: The Future of AppSec and Venture Capital

Hey everyone, welcome back to our day two coverage of RSAC. RSAC Conference here in San Francisco at Moscone. I couldn't think of a better person to end our day two coverage than with my friend here.

If you're in security, you may know her. Her name is Chenxi Wang. Chenxi has held about every title you could think of within the security food chain.

From analyst to CSO to chief strategy officer to VC, founder. Founder. She's done it all.

Chenxi, welcome. How are you? Thank you for having me.

All right. It's great to be back. Thank you for coming here.

You don't have to thank me. Chenxi, I didn't want to embarrass you, but all of those roles that I mentioned, and did I mention she's Dr. Chenxi Wang as well, technically, with a PhD.

You know, I did all these things because I didn't know what I want to do when I grow up. Grow up. And I hope you stay that way- I still don't know.

for the rest of your life. Yes, thank you. Because that keeps you young.

Thank you. Well, let's jump into it. You just came off the stage.

You were on a panel that you put together. Yeah, yeah. NVIDIA, Cerebras, and I'm missing one.

And Glean. And Glean. Mm-hmm.

Tell us about that. So NVIDIA, as you know, is the fastest maker of billionaires. Yes, it is.

Right? Glean is now a very fast maker of millionaires. And Cerebras is getting there.

Yes. They are already billion, like double-digit billion. We've seen them broken.

And super interesting companies, obviously, Cerebras and NVIDIA, are both chip makers. NVIDIA has more software stacked today, but Cerebras is getting there. And Glean is purely software layer.

Mm-hmm. An enterprise AI layer for search, for building agents. So they're all in the ecosystem, tightly integrated together.

And I had three of them on stage today just to talk about, from their respective points of view, where this agentic enterprise trend is going. So it's a super, super interesting discussion. We had a room full of people and questions, and love to talk about that.

So what was the consensus? Well, there wasn't any consensus per se, but we talked about how this is a security conference, right? Mm-hmm.

So security people like to put controls in place and feel comfortable before things move. The panel talked about why we need to move with imperfect controls, imperfect infrastructure, imperfect data, move fast, refine controls, iterate, and then potentially achieve perfection. So some people call that DevOps, you know?

You're right. You're right, DevOps. Yeah.

That's exactly what they're describing. Yes, yes. Right?

MVP. Yeah. Get your MVP out, iterate, feedback loops, reiterate.

Yep. Yeah. Some people have tried that before.

But look, I have to admit- Mm-hmm ... we have been on our own agentic adventure at Techstrong. I wouldn't call it enterprise per se, but we have been not even playing.

We've been really digging in- Mm-hmm ... on agentic. And we're not a software development shop, right?

We don't write a lot of software. Right. But we produce an awful lot of content.

Mm-hmm. And everything that's involved in distributing and getting that content out to market and all of the pieces of it. Yep.

Everything from shooting this video, editing the videos, writing the articles, publishing the articles- Mm-hmm ... distributing, amplifying, everything that goes into the business. I made a deal with my people.

Okay. It's very similar to Jensen. I'm no Jensen Huang.

Oh. Very similar to Jensen. Hmm.

I'll give them- Jensen shimout. Yeah, Jensen. No leather coat, nothing.

But I'll give them money to run agents. Mm-hmm. Token money, whatever you want to call it.

Yeah, yeah. I just ask that every week, give me a progress report on how your agent work is doing. And at the end of the month, let's talk about what did you do this month.

How did this month go? Mm-hmm. And should we continue it?

Yeah. And I got to tell you, it is like a Cambrian explosion of ideas and life and looking at things we haven't looked at. Ah.

Yeah. And so there's not a doubt in my mind. Isn't that exciting?

Super exciting. It's beyond exciting. It's almost drugs.

It's intoxicating. It's intoxicating. Beyond even intoxicating.

It's drugs. I'm telling you, I've got people coming in the office on weekends, staying late at night, coming in the next day like they've been up all night with their agents doing things. That is drugs.

That's drugs. That's drugs. Yeah.

It's not just liquor. But it's better drugs than the actual drugs. Yes.

So I'm all for it. It's healthier for you, I think. I'm not sure how healthy it is.

Well, you're right. Staying up late and not getting sleep. No, you're right.

But it's fine. It's funny, we turned Mitchell onto it. Mitchell Ashley, you know, who used to work for Futura.

Oh, yeah. He still works with me. I hooked him up on Perplexity Computer last night.

Oh. At dinner, he was on his phone, he didn't even eat dinner. " But it's true.

So I do believe that what they're saying is the... And I'm a security person, it hurts me to say this, but they're right. Yeah.

We are in the middle of an evolution, right? A revolution. A revolution, not evolution.

A revolution. And everybody wants to be on the cutting edge. If you're not, you're not only left behind, but you kind of feel like it's a societal tide- Yes ...

that you want to be part of that, right? We all want to be cool, right? Yeah.

The cool kids. Exactly. Some of-- Especially in tech, a lot of us weren't cool kids growing up.

Yes, but for businesses, it's almost existential. Yes, it is. Right?

And so if you don't tell your employees to experiment, to really understand the full power of AI and agentic AI as an extension, then you're not doing yourself- No ... the right service. Right?

And also, it's like-- What's the analogy people are saying that it's all the kids are running and you're staying here, and the world is running, too. And what are you staying here for? Right.

Right. Well, is it worth staying there for? There may not be anything to stay at- Exactly ...

if the world moves. Yeah. So, now let me turn this around.

I'm going to put on your VC hat for me. What does this mean? It's hard.

For a VC, it's really hard because things are changing so fast. What's hot or what's interesting this month, next month, the month after, may be completely obsolete because it could be built into the AI platform. I know we saw with Anthropic's announcement of their- Scan ...

product security capability. Right? " Is AppSec done?

Is AppSec done? I don't think it's done, per se. No.

But if you're an AppSec founder, you'd be like... You really need- So I've written about this. Look.

Yeah. AppSec, for the most part, was founded on finding bugs. We scanned, we fuzzed.

Mm-hmm. We found bugs, and then someone has to fix them. But someone moved the cheese in a week.

We could find as many bugs as- Yeah ... more bugs than you could handle. Yeah.

People are shutting down their bug-bounty programs. Mm-hmm. The focus in AppSec now has to be governance.

It's possible because the way I think about it is, we moved from assembly code to high-level language code. Mm-hmm. And now the high-level language code is written by AI.

So what are we moving to as a human? We're moving to a higher level of abstraction, and that is probably requirements and governance controls and, at the end, testing controls, right? Yes.

So human like-- Today I saw a term says we're not doing human in the loop anymore because that's just too expensive, not scalable. We're doing human at the helm. Yes.

Right? I've seen this, too. Right.

So human at the helm, meaning that we are higher level abstraction thinkers, so we have to test things and look for bugs at that level, right? Because if we're still looking for bugs at the language level, we're obsolete. You're done.

You'll never... Exactly. Yeah.

So AppSec has to move to that level. And then if you think about that level, looking for bugs and fixes, the current technologies may not be relevant. I got a really personal hard question for you.

So I wrote another article earlier this month. I was going to call you to get your opinion, but then I just published it. I was reading an article, I don't know if it was in "The Times" or "The Wall Street Journal"- Mm-hmm ...

about VCs. Okay. And AI- Mm-hmm ...

making some VC functions- Mm-hmm. Yeah ... obsolete.

Yeah. Right? " You may not.

Yeah. But you know "Moneyball"- It's the Brad Pitt movie. Yes.

Yeah. Well, you think of it as a Brad-- My wife does, too. To me, it's a baseball movie.

But anyway, the- We know what we're focusing on here. Yeah, exactly. Okay, but the thing about it is there's two schools here.

One is, let's look at the analytics of baseball and make decisions based on- Mm-hmm ... pure analytics. The other school of thought is baseball lives in the gut.

Mm. Your knowledge of baseball. You make a gut decision.

This guy could really pitch, this guy could really hit, he's a player, he's not, et cetera. And there was this big fight, and eventually "Moneyball," the analytics one- Mm ... right?

The analytics don't lie. It's the same thing I see happening with VCs now. Some VCs say- Mm ...

you could run spreadsheets till the cows come home. It's a gut feeling. It's an art, not a science, to pick a winner- Mm ...

as a VC. How do you feel? I agree.

Meaning that you can probably use AI agents to make decisions maybe even better than we can make decisions. But I can tell you, as a VC, making decisions, picking the company is only part of the job. Another part of the job, let's say it's a very hot company.

It only has room for four VCs, and you have 10 VCs who want to go in. Who wins? Who wins?

Everybody's got agents. Who wins? It's the personal relationship.

It is. It is, and still today is, right? " To work with.

To work with. Who's going to have my backs? And if everyone has agents, how do you make that decision, right?

So still, you have to have the personal trust, and that is a thing that I think a level of relationship that agents do not replace today. You know what? " Right?

If I said my agent, you- Keep walking. I keep walking. Keep walking.

Right? You know what? I think that's very analogous also to the whole IT analyst industry.

Mm-hmm. Right? You look at the Gartners, the Forresters, the four or five ones, and you were an analyst.

Mm-hmm. You know this. Mm-hmm.

If the AI could do the analysis as good or better- Mm-hmm ... than the human can, well, what value does the analyst bring to me? Well, it's the personality.

It's that human-to-human relationship. It's trustworthiness. It's the gravitas- Yeah ...

of the person- Mm-hmm ... not just of the numbers- Yeah ... and number crunching or analysis like that.

And I think it's still a very easy thing to think about is on LinkedIn now, everybody's writing their LinkedIn post with- AI. Yeah, right. So all the posts are similar, but still, some people get more likes than others.

Why? Because they have personalities. Personalities.

Right? And here's the thing I learned. I strive really hard to put my personality- Mm-hmm ...

into my AI stuff- Mm-hmm ... because I want it to be me. Yeah.

I despise the AI tells, as I call it, and all of that. I'll talk to you offline about it, but I've got a whole toolkit to talk right for the AI to talk in Shimmy voice. Yes.

And then I have two, actually. I have classic Shimmy and Brooklyn Shimmy. Because when I really want to go off, I tell it right in Brooklyn Shimmy.

But, it's a personal thing for me, but I think that's the world we're headed towards, where people are going to count, personality's going to count- Mm-hmm ... reputation is going to count. And icon.

Yeah. And look, that's going to be good for some people, and I'm not knocking Gartner. But Gartner, for the last 10 or more, maybe 20 years, 15 years, has tried to sort of anonymize their agents or their analysts, right?

Because their analysts, I grew up in John Pescatore being at Gartner. Oh, John Pescatore. Right.

I remember him. Yeah. Yeah.

They were giants. They were personalities. Personalities, yeah.

You think today, who are the personalities at some of these large analyst firms? So- They're almost interchangeable. Yeah.

Analyst is one industry that it's hard to pinpoint, but the other industries have the analogy of a lot of things are done by agents. Yeah. And what distinguish you is your personality, your emotional sharpness, and whatnot, right?

And I think that continue will be- Yeah ... an interesting point because I subscribe to 30-some YouTube channels. Too many.

Me too. So in the beginning of the year, I'm like, "Oh, too many. " Right?

So I noticed in the past six month, a lot of them started having AI-generated content, right? The channels I visit more are the- Are human ... human channels.

The channels that have more and more AI-generated content, I visit them less and less. Not because I consciously think about it- No ... just because I'm just not interested in them anymore because they all look the same.

I've heard some people say there's no soul. Sorry. There's no soul to it.

Right. So you want that when all the cities look like Dubai, you're going to want something else. Right.

Right. Someone used to say that because growing up in New York and then moving to Florida- Mm-hmm ... right, I always, whoa, the weather's beautiful here.

Yeah, the weather's beautiful. But you can only appreciate Florida if you understand what the weather is in New York. Yeah.

Mm-hmm. Otherwise, it's just all the same. But I love New York, so.

Me too. Yeah. But my wife won't move back there, so I'm stuck in Florida.

But, we go to New York once a quarter at least, and my oldest son's up in Boston now, so we go there pretty often, so I get my share of that- Yeah ... I'm home. Yeah.

But Hawaii's like that, too. Well, now they just had terrible flooding, and I'm sorry, but generally, it's 82 degrees every day, all year round. And it's paradise, but- That gets boring, right?

It did. When everything's manufactured, then you crave for organic things. It's like that movie, what was the movie?

The guy lived in a-- It was all just like a big movie set. Jim Carrey was in it. " Mm-hmm.

That's kind of- Yeah. It's boring. Yeah.

It's boring. Yeah. Anyway, Chenxi, it's so great catching up with you.

You are always a pleasure to talk with. Enjoy the rest of RSA. I will.

Good luck. Where can people follow you and find out more about what you're doing? Yeah.

Find me on LinkedIn, Chenxi Wang, Rain Capital. I publish a lot of content- Yes, you do ... on LinkedIn, and I'm on X too, although LinkedIn is my primary- Me too ...

vc. Absolutely. Chenxi, thank you.

Thank you. All right. We're going to wrap up day two.

Yeah, I guess it's day two. Yesterday. Thank you.

We'll be here tomorrow. We'll be here Thursday. But for now, this is Alan Shimel.

Enjoy. Take care. It's Jensen Shimel.

Jensen. Jensen. I'm getting a leather coat.