The State of AppSec in 2025 with Digital.ai’s Derek Holt

This is Textron tv. Hi everyone, it's Alan Hummel and it's, uh, another interview here on techron tv. You know, I haven't had the pleasure of having this gentleman on now.

I bet it's been at least a year, if not more. That is right. Kind of bumed.

Um, but hopefully he'll in 2025, he'll be a more a, a more regular, uh, guest here. It's my friend Derek Colt. He's the CEO of digital ai.

Hey, Derek, welcome. How are you man, Alan? I'm great.

Always a pleasure. And my apologies. It has been so long.

I, I always love our discussions. Absolutely. So, so what have you been up to lately?

Well, look, we've, we've been staying busy, obviously. Um, uh, I, I'm sure as I follow, uh, your work and, and, and, and watch videos, uh, you know, we've got AI everywhere in terms of how people are thinking about, um, the future of software development and delivery. And I, I've said this in a few forums.

I think, uh, we are in the midst of the biggest change in the way software is being developed and delivered since the late nineties, right? When the internet became an obvious thing and it empowered, uh, uh, agile development and incremental delivery. And so we've been really, really busy, uh, working with the world's biggest companies to figure out how to navigate, to take advantage, but also to, to recognize that AI is not one size fits all, and it doesn't solve all problems.

And being a little bit more, uh, targeted around, uh, making sure we've got a, a solution to a problem, not just the solution looking for a problem. You know, it's interesting, Derek, is, I remember the day digital AI launched, right? It was, it was a roll up of a couple companies and Yeah.

And, and all of a sudden it was ai, I think it might've been the first do ai Yeah. That I dealt with. This was, this was AI before AI was the, was the, was the stuff, right?

I, I think that's, I think that's right. And I tell you, it's interesting, you know, when we first started the company, the, the thesis, which is still held true, is all the data that is thrown off by the automation that we're doing across the SDLC. All that data can give us not only great rear view mirror views, what what is now called software engineering intelligence, but also can predict the future using machine learning and AI in that context.

What we probably didn't know, but found out very shortly after the founding of the company was how dramatically AI was gonna also improve, uh, individual productivity, but also how it can be built into how you test, how you secure, how you deliver software. Uh, so it's been, uh, uh, a great name. I think we probably were ahead of the curve, but, um, uh, the opportunity has only gotten bigger, uh, over the last few years.

Absolutely. And it's always good to be ahead of the curve than behind the curve. I Think a little luck never hurts as well.

Now It sometimes it's better to be lucky than smart. It's good right. To be both.

That's, um, Hey, Derek, you're, you're of course, as I mentioned, you're CEO of digital AI now, but you weren't always right. You've been That's right. With the company before that you've also got a whole career behind you.

Give people a sense of kinda where you've been. Yeah, I, I tell you, I mean, at, at my core, I'm a software engineer. Uh, so I'm the CEO.

Now, they don't let me write code un unfortunately. It's probably good for our customers. It's probably unfortunate for me.

But, but, um, you know, I, at the end, I, I really had this opportunity not only have a front row seat, but but ultimately be in the, uh, in the game, uh, when it comes to this evolution from sort of the late nineties all the way through now around, um, how software is changing the world. And in particular, I've spent most of my time in the context of big companies as well as, uh, in startups around how do we help make the business process of building and delivering great software, uh, easier, cheaper, more predictable, et cetera. And so it's been, it's been just a, a phenomenal run.

And I think I always, I always view myself as a, as, as an engineer, and if I root myself in that, um, it helps us really focus in on the, the ultimate goal here, which again, is making a great software and, and helping folks do that in a predictable, uh, more efficient way. Excellent. You know, one of the interesting evolutions I've seen in, in the whole DevOps space over the last couple years, and there's been a lot going on, platform engineering, and of course, AI and all of that, but really is the, at the core is the importance of security and DevOps.

This whole DevSecOps, if you want to call it SecOps dev SecOps and, and how, I mean, it's core in the mission of, of getting software out the door, right? Yeah. Um, and so today, many of our, you know, DevOps kind of platform, you know, foundational companies like digital AI or, uh, GitLab or Jfr or any of these, they all lead with security, right?

And, and digital AI is no different. Security is core to the mission there. Um, you guys recently came out with your 2025 AppSec threat report, and well, I don't want to steal your thunder, but you know, you, you give a, give us, give us the, the, uh, straight dope there, Derek.

Yeah. Yeah. I'll give you a little bit of an overview.

So this is, uh, actually the third annual report that we brought, uh, out. And, um, this is, uh, working with a lot of our customers and a, a broad set of global data, as you know, uh, we, we protect, uh, many, many apps globally. And so this gives us the ability to aggregate that data, anonymize that data, and use it to help educate the market, right?

In what is a, certainly a, a dramatically evolving and accelerating, um, a threat landscape. So, um, we look at that data, um, uh, at, at a global level, at an industry level, at the geography level, uh, and, and different types of threats and techniques that are being used. And we use it in two ways.

One, it helps inform our product roadmaps, right? It helps us better understand the things we need to be doing to drive things forward. But number two is the educate, educate the market.

And, and, you know, while everything is moving quickly, I don't know if there is a space that is moving more quickly than, than than security. And it kind of, uh, people ask sort of why. And, and one of the, the reasons is the old adage, right?

It's sort of that notion of like, why do people rob banks? Well, that's where the money is. And, and frankly, when it comes to the, to the, to the, uh, threat actors or the bad guys, if you will, um, they are seeing this evolution of the fact that there's now, uh, uh, six, uh, billion mobile devices worldwide.

There's over 4 million apps between the iOS and, and Android store. Uh, there's over 130 billion downloads and installs. Boy, that's a big, big threat vector.

And, and, um, and the bad guys are, as we see in the report, and I'll hit on a couple highlights or, or low lights depending on how you look at it. Um, uh, but, but, um, uh, the, the, the, the threat has never been bigger. No.

Yeah. I, I, I agree with you. And we were talking off camera before we saw, well, we were on camera, but we weren't recording.

We were talking. And, you know, certainly, here's the good news. Certainly we've made progress over the last five, 10 years, even for sure on, on AppSec, right?

We, you, you don't see as many buffer overflows or, or, you know, uh, um, SQL, you know, injections, these kind, you know, that garden variety kind of stuff. We, we've, we've made real progress in, in cutting that stuff down and, and hardening our apps a bit. However, you know, it's like, as time goes on, the complexity wi grows and, and things like ai for instance, because you, you call it AI threat actors, it's the same threat actors.

They're just using AI now, right? Supercharged. That's right.

Yep. And, and so they're more, they're, they're more effective. And, and so the mission has not gotten easier.

And, and so I think we gotta keep that in mind when we look at some of the metrics from reports like this that, hey, you know, it's far from rosy. I'm not saying it's a rosy picture, but the mission's gotten a lot harder and, and we are working harder to try to, to meet it. I, I, I, look, I think that's exactly right.

In fact, yeah, as you saw in the report, uh, even with all the investment, even with all the maturity, uh, attacks on the client side, applications are up 20% year over year. You know, 83% of applications are experiencing threats. So, like, it, it is a daunting, never, you know, never finished, you know, area.

And in particular, I think part of the dynamic there, you described it, the, the, the threat actors have been supercharged with AI adoption and whatnot. At the same time, there's also been always this, uh, old adage, which is, the good guys gotta be, have to be right a hundred percent of the time, if they're wrong, once there's a problem. Whereas the bad guys just have to be right once.

And so that dynamic, you know, certainly, uh, uh, makes for, for challenges. And look, we saw it in the report. I think, you know, you see that the operating systems are getting a little bit stronger.

You can see, uh, the data distributed. If you look at older versions, they have more vulnerabilities in it. Um, you see more and more, uh, uh, customers of, of ours, for example, we, we do code obfuscation, antit tampering, key in data protection, et cetera.

Many, many of those over the last few years have protected their, their, um, core apps. They're now starting to say, okay, now I gotta look at the secondary and tertiary apps, right? That maybe were previously not gaining as much attention, but you lock the front door, somebody's gonna try to go around back and, and get in through a window or through a side door.

And so, um, we're seeing that evolving within, within the landscape, and, and we're working every day to try to do everything we can to not only help people survive, but thrive in this, in this really, really dynamic, uh, environment. Absolutely. Derek, I assume the report is available for download on the digital ai AI site?

Yeah, a hundred percent. It, it, it's on the website. I'd encourage everybody to download it.

We've tried to make it, um, Alan, and, and obviously you can imagine there's like really, really technical, uh, details behind it, but we've tried to make it really approachable, um, because I actually think security is something that has to be everybody's job, right? Obviously, the CISO's gonna wake up every day thinking about it, but when you think about, uh, the realities, like developers need to be very aware of it, testing professionals, DevOps professionals, it, it really does take a unified whole company, um, uh, um, sort of mantra, right? To, to really make sure that in every corner at every turn, we're, we're, we're, we're driving that forward.

And, you know, I would say additionally to that, um, it takes a, a great partner network as well, right? So, um, there is no one singular company out there today that's gonna help you solve every security dimension. It's gonna require bringing together a set of, of folks.

Um, and, and, you know, hopefully, uh, we can play a big role in that as well. But a set of folks, whether that's, uh, uh, protecting the app from the, from the inside out or protecting from the outside in, or some of the other, uh, more traditional kind of DevSecOps areas around scanning and automated pen testing and whatnot, you gotta look at it holistically. Otherwise, you're gonna, you're gonna have a gap in, in, in your, in your strategy.

Yep. So, Derek, let, let, let's, let's kind of wind down with this. Yeah.

Give our readers our, they're not reading, they're watching. I'm so old. Sorry.

Give our, give our audience, our viewers, I guess is the right word. Give our viewers like the three biggest takeaways from this report that they need to kind of wrap their heads around. Yeah.

So a couple things I'd hit on. One, the attacks are increasing, and interestingly, they're going to, what I would consider some industries that were not traditionally targeted in the past. This used to be a financial services and sort of government problem.

It is now broadened into things like automotive and healthcare and telco. As they become more digitized and as more value is in those mobile apps, you, you're gonna have more threat actors attacking number two, like AI adoption. Um, uh, we talk about it and maybe, uh, uh, theoretically in, in a variety of areas.

But make no mistake about it, threat actors are adopting AI, and they are supercharging their ability to drive. So making sure that you are protected, uh, uh, not just with your flagship app, flagship apps, but, but more, more, um, more holistically. Um, and, and then lastly, I I would say, um, the, the, the cost of, of inaction is higher than it's ever been, right?

So there's not only more attacks coming, but, but the average cost of a security breach is now like averaging around five, uh, million dollars. And those are, are, are, you know, a lot of small ones in addition to the, to the large ones. So this is not just a technical issue, this is a business issue.

It's a brand issue, it's a business continuity issue. And so, again, we need a whole organization strategy and approach and education to, to go, um, you know, compete in this, this really dynamic environment. You know, I'll, I'll tell you, I, it used to be the adage was, well, you know, public company gets a data breach six months later, it's a blip on the stock chart, right?

Momentary, momentary kind of pause. But yeah, we were at, I was recording Textron Gang earlier today. We were talking about the, uh, 23 and me, the DNA company.

Yep. They're on the verge of declaring bankruptcy. I don't know if you saw this story.

Yeah, I saw that yesterday. Yeah. But one of the big, uh, reasons for this that at least, you know, that the pundits are claiming is they had a huge breach Yeah.

Where the, the, uh, attackers targeted specifically Ashkenazi Jews and Chinese people, and then were releasing it, you know, antisemitic and racist kind of things. Hey. And it wasn't just their DNA profile, which isn't in of itself.

It's, you think about it, it's, you know, it's crazy. No, but they had all of the personal data of these people, so they were able to say, Hey, you wanna list the 300,000 Jews, or, or whatever. And, you know, this had such a profound effect that it really nose dive the company and they're winding up in bankruptcy here.

Yeah. Yeah. Um, so, you know, it, the breaches cost people jobs.

It, it, they're not good for business. Yeah. Obviously.

And, and it could wind up bringing the whole company down. Yeah. Well look for things like trust, right?

If you think, I think that old analogy is, if you've got a bucket, you may, you, you kind of build trust one drop of water at a time to fill that bucket. But as we all know, uh, it takes one spill for the whole thing to come out. And, and that is the environment we live in today.

Done. Yep. ai.

I imagine this report is right on the front, On the website. Come download it. Uh, and, and certainly as always, reach out to, uh, and, and if we can be helpful, I, you know, we've got a whole research teams and whatnot that this is all they do.

They wake up every day thinking about how to help the good guys, uh, protect themselves and, uh, and to, uh, avoid these types of, of challenges. And so, uh, yeah, reach out, let us know, download the report, love to get some feedback on what folks, uh, uh, are, are valuing and, and what we need to do differently next year. We always get a lot of good feedback of areas that kind of double click on, and we're constantly evolving the, uh, the report to make it more useful.

Absolutely. Maybe one year we'll see a report where attacks went down. Derek, Uh, you and I can hope and we're gonna work like crazy and make that the case, but, but boy oh boy.

Uh, as long as people keep buying mobile devices and putting more and more sensitive data on it, it it's, it's a, it's a race, that's for sure. Yeah, it is. It is.

It's just too easy. All right. Hopefully, maybe I'll see you in person at RSA, but you'll be back here on Techstrong.

You got it. Tv don't wait a year. I'll be upset.

I won't. All Derek Holt. Derek Holt c Digital ai, uh, to check out their new 2025 AppSec threat report, you can get it on their website.

ai. We're gonna take a break on Techstrong tv. We'll be back in a moment.