Yossi Shaul on Securing the Software Supply Chain with Full Visibility and Compliance | swampUP 2025

Hey, everyone. Welcome back here to our day two coverage of, uh, swamp Up J Frog's, uh, conference out here in beautiful Napa Valley this year. We're happy to be back.

Uh, we're continuing with some of the people we've been meeting. I wanna introduce you to a frog right now. His name is Yossi Shaul.

Yossi is the SVP of DevOps, right? Which is a great job when you're working for a DevOps company, right? So, first of all, Yossi, welcome to Text Drunk tv.

I, you know, an all the years that I've been interviewing frogs, I don't think I've had the chance to sit down and talk with you before, so it's great to have you on. Um, if you don't mind, share with the audience a little bit about kind of your journey, how you got to be here. Okay, thank you.

So, I'm Yoi, and I'm in this business for, um, I would say for most of my career. I started with, uh, jfo about 16 years ago. 16, right from the beginning.

Long time. Yeah. Yeah.

Uh, we were working, uh, at the beginning of Artifactory, creating the, this new domain before DevOps was a term even. Mm-hmm. Uh, so I've been working on Artifactory since the beginning.

I managed the, the team and the, and the product for quite some time. Uh, then I shifted a little bit to do some more, um, architectural, uh, leadership inside jfo. Okay.

And in the last, uh, three years, I'm, uh, back to leading the entire DevOps organization in, in jfo, uh, both product and engineering. Product and engineering. Yeah.

So that's, uh, that's really challenging. Really interesting. Yes, it is.

And very, very interesting time. So, yeah. Glad to be here with you.

You know, it's funny you say that. It's, it is interesting times. Look, I, you know, I've, I'm in tech 30 years, 30 something years.

Mostly cyber was in infrastructure then security. We didn't call it cyber, then we called it info, right? And then when, when DevOps first around 2012 maybe mm-hmm.

I, I said, wow, what a great thing for security, right? DevOps is right. Is going to be, and that's when I started really getting involved.

com in, uh, 2013. And, you know, I will sit here as you sit here, the DevOps we were talking about and doing and, and working on. Then today, it's a different animal, a little bit, right?

Today, it's, it's not radical. We don't have to explain what DevOps is. We don't have to fight on whether it's real or not.

But on the other token, you know, people become too familiar with it. They take it for granted. Mm-hmm.

Right? Ah, yeah. It's DevOps, right?

It's just DevOps. What, I mean, I see this as a challenge. Okay.

com, what do you see from where you sit? Yossi is, are people like, just shrug their shoulders, like DevOps is built into the table here and it's, or do they, you know, they continue to explore. They continue to evolve.

Okay, G, great question. So I am, as I said, I'm long time in this and I remember myself, uh, explaining absolutely. I, Artifactory is a thing, Uhhuh, okay.

And arguing with people why they should not, uh, store their binaries in subversion, for instance. Mm-hmm. So we've, we've been a long way, uh, Stumbled a long Way.

And, um, and while I think that many organization, um, discovered and now maybe even think that they know what DevOps is, the world keeps shifting and keeps changing, and it never ends. Okay. The, uh, we had the first revolution, then another one with Docker, then with Kubernetes, and now we are what we are doing with ai.

It's keep shifting, keep changing. Mm-hmm. And also the security is a big part of it.

And while I think we also discuss it in one of the keynotes, that it's not a, so it's not a solved, um, issue. Okay. No.

Not DevOps and definitely not, not dev, DevOps, And definitely not with, uh, new regulation, new, uh, things that AI brings with it. So I think that we, we come a long way, as you said, but, uh, I, I wouldn't say that, um, we nail it. Okay.

There's still lots of things to, to discover to, Well, the, the thing is, and, and I tried to explain this to someone the other day. I was talking to a younger person wanted to be in tech. Mm-hmm.

And, you know, they were making it like, you know, like, uh, like tech is done. Not, not that it's over, but that there's nothing new. You know?

And what I try to explain to them is no, we, it reinvents itself. Right. It's constantly changing.

It's constantly evolving. Yes. AI is what we're all crazy with right now.

Right. It's, it's kind of the biggest revolution in my, I think, almost as big as the internet itself maybe. Right?

I agree. Um, but every little piece of it, whether it's DevOps or or, or agile or cloud native as you you mentioned mm-hmm. It's all still evolving.

Right. And, and we learned this now. You did a keynote yesterday.

True. Here at Swamp Up, you know, most of the people watching this were not here. Mm-hmm.

Obviously that's why they're watching. Um, tell them what you spoke about. Alright.

So yesterday we introduced a new product, a new solution, uh, in the Jfor platform. It's called Up trust. Yes.

And I think this is another big step of the evolution that actually shows that DevOps is not yet done. Right. Um, we are, uh, offering now solution that allows, uh, development teams to manage their applications inside the platform with a clear lifecycle and policies that cont controls it.

So, as you all know, we all manage in one way or another, a lifecycle for software development lifecycle, it's called like that. Yeah. Uh, but we used to code it, and still it is coded and scattered in many, many places inside the CI where there's no, um, one location that you can control it and visualize it.

Um, and this is what we are offering now. So the APTA solution is, uh, built upon three different pillars. One of them is the concept of an application.

So we are releasing applications. All of us application can be a library, it can be a full blown application. Um, so that's one thing.

Now it has a representation inside the j foc platform that you can, uh, you can fully control. The second, the second pillar is evidence. Evidence is basically a signed metadata or an attestation that you can attach to a binary, to an artifact.

Um, now this can be, uh, internal, uh, evidence that the J Foc platform generates. And it can be, uh, things that we are partnered with GitHub, like attestations from GitHub that are attached. And it can be any other, uh, evidence.

I can talk about it a bit more later. So that's the second pillar. And the last pillar is the actual lifecycle that you can predefine.

That's my lifecycle. It can be as simple as dev, qa, staging, production, and it can be much complex than than that. And you can customize it per each team.

Now, besides, um, having a clear visual lifecycle, you can put gates, what can get in and out of this gates based on the evidence that I just mentioned. And this, I think it's a big, big change that we are bringing, uh, uh, to the table. Absolutely.

It's a huge change. It's a huge change. And you know what's funny is it's, it's almost common sense.

It makes sense when you explain it. We sit here and say to ourselves, why did it take this long? That's true.

Like, you know what I mean? We, we kind of knew this was what to do. So you've put good words around the titles, right, right.

To the, to the process. But, but this is why when we talk about why things don't are, it's never done. It's just like we're constantly things that we were apparent but not apparent.

Do you know what I'm saying? I agree. Yeah.

It was there, but we never kind of wrapped around. Definitely takes time. And even for us, it's the second iteration that, uh, we, we try to nail it and we did a lot of improvement.

And that's the second iteration. But that's DevOps, iterate, reiterate, learn feedback, loop, iterate. Right.

Exactly. And, and that, that's what it's about. I wanna talk AI with you a little bit though.

Okay. So, as I said, I think this could be as big or bigger even than what the internet was mm-hmm. When it first came out.

Um, I mean, it's had a profound, if you were on the, you know, I reported yesterday on from the keynotes and everything, it was a lot of ai. Right. I think Shlomi said, if you're not using AI now, you might want to step out.

Mm-hmm. Right? Correct.

How is, how are you leading the DevOps team mm-hmm. Sort of eating your own dog food. How are you using AI to make J Rog better?

Okay. Great question. So definitely, um, J Rog was always, um, a company where we had a lot of innovation and a lot of, um, adoption new technology.

So we are doing it for quite some time. Um, like many other companies, we are doing it to increase our productivity, and it's internal, and we are doing a lot of it. And it's very, very interesting.

Um, there are also, we are also serving this audience, uh, whether it's the data scientist or the new ML ops, uh, audience. So we also are providers of solution, uh, to this area. Now, the third pillar is how do we actually integrate AI inside our products?

So some of it you heard about, um, when, uh, staff, uh, leader from, uh, security Yes. Um, mentioned how, how we can provide a mediation based of data from our, uh, catalog. That's, that's one, one offering.

The other one was the AI catalog that was also announced yesterday. And this is amazing. And, and even us GE folk, we are not huge company.

It's very, and we want, as I mentioned, we want to adopt new technology. We want to adopt ai, but we don't to do it in responsible manner. And we need to help our legal and compliance team to help us.

Sure. And AI catalog is one of those solution that, that can help us promote it internally. So you have one location where you can see all of the models, all of the services, external APIs that you, you want to use.

And this is where you can approve it and you make sure it's secured and you can know who's using it. And so I'm very excited, uh, about it, both as offering solution. I was too, but also using it.

I, I think this will wind up being one of the big compliance tools because Right. You know, what's this is like, remember when cloud first came out, every developer had whipped out his credit card and, and spinning up instances. Mm-hmm.

They weren't shutting him down, and then they submit the expense. Right. All of a sudden someone would add up and say, oh my God, we got how much cloud instances running.

Right. I think at some point, what, what's going on now is everybody's experimenting. Right.

It doesn't seem a, like, you pay $20 a month here, $20 a month there, it comes with my Google over here. Mm-hmm. You know, you know, we don't recognize the full scope of, of how much AI we're actually using at the, at the company wide.

Even a small, we're smaller than you. Right. Yeah.

But I see every single one of these people have their own $20 a month accounts. And that's just the foundational models. And they got video editing, ai, uhhuh, graphics, ai, and marketing ai.

You know, sooner or later something's gotta blow up. Right. Hopefully we'll be there to control.

Well, Unless we do something like this Exactly. Right. That can controls, so we know at least what we're doing.

But here's the other side of that. I know as, as you know, the manager of my team as the CEO of Textron Uhhuh, I don't wanna stifle experimentation. I don't want to crimp their style.

Right? Right. I want them to use AI figure, show, figure out new ways of doing things, how to leverage this to be better.

Mm-hmm. So I gotta balance, right? I don't want to be like the, oh, you can't use that.

'cause it's not in the catalog. Mm-hmm. I wanna say use what you want.

Just put it in the catalog. Okay. Got it.

Right. Make sure we know about it. So when something happens, we, we have something to point to.

Mm-hmm. Is what do you see? You have a bigger team than me.

What do you see with that? Let, let me give you an example, which is, um, the reality. So in my keynote yesterday, uh, I mentioned that we have, uh, controls gates to make sure that you, you path through what we think.

I, as a development manager wanted my team to go through, uh, testing, coverage, quality, et cetera. Uh, so for this demo, I asked the team, Hey, I'm going to use Cursor and I'm not going to click a button to, to release it. I'm going to do it like you are doing it.

I'm going to tell it, Hey, release it to production. Um, and they got panicked. Really?

Yeah. Why? Listen, you are going to do a live demo and this agent is not predictable.

We are telling you sometimes it works, sometimes, sometimes it doesn't Work. That's AI today. So my answer was, okay, but that's exactly what we are building.

We are building gates that if it doesn't work, we stop it. We detect it. Exactly.

We stop it, and then we tell it how to do it the right way. Uh, so it's actually was exactly what we needed for the demo. And it's actually what happened.

It didn't work. Yeah. We till it didn't work.

Like I expected it not to work. Okay. Um, we told it to release something to production and this is how we want to work.

Right. Uh, future. Yeah.

Release something to production. And guess what? It actually tried to take, uh, from the development, the release from the development stage, and put it right into production, no testing, no coverage, no security scanning, oid.

And this is what he tried to do and it failed. And that's exactly what I wanted to demonstrate. So it Was so it actually worked.

Yeah. The failure was a good thing. Yeah.

So that's one example. And then I told it, Hey, make sure you run the test. It, it figured it out.

And I guess that if we train it more, it'll know how to do it. This is how our team will work. Uh, but that's one example of, of how those controls and the things that we are bringing with the new solution are making us, making it easier for our customers.

Adopt it and taking it from the risk gap. Yeah. That really, because that's what it, you know, it's all about the risk.

Um, so I gotta ask you the hard question. You're probably hearing it from your team. I know I hear it from my team.

Mm-hmm. Are their jobs safe? Is this gonna replace them?

Should they start looking for a new career? What do you think? Uh, so no one knows the future.

Okay. And I think the, the, they are going to be, and they are already happening, a lot of changes in the way that we work. Uh, and some jobs or some roles will either disappear or change completely.

Uh, I think that, uh, we are still not there. Okay. I think that, uh, and, and again, we are adopting it a lot and it helps with productivity.

Yeah. Mainly, uh, it helps also taking the mundane parts of the work, uh, to someone who doesn't care. Uh, but I don't see it yet replacing, uh, junior developers.

I don't see it increasing, uh, uh, 10 times the productivity of the, it's still not there. Yeah. Um, and I still don't see it happening.

However, look at how it looks like two years ago. So who knows? The advancements are really, really fast, but it's still not there.

It's, it's, uh, now it's a valuable tool, but it's still not replacing, uh, definitely not experienced developers. But I think it'll always be a tool. Right.

And we all, and we're humans. That's what separates us. Yeah.

We're tool users by definition. Right. Right.

That's part of being human. I, I, I think the, like, in my mind, it's going to get better. 'cause you see it gets better week to week, it gets better.

Definitely. Right. I mean, I use it with writing and it's, it's a, it's really getting better every day.

However, I think at the end of the day, it's always will be a tool. Mm-hmm. And it won't replace the spark of creativity that makes a human.

Do you know what I mean? I agree. You'll come up with an idea and it'll help you bring that idea to reality.

Mm-hmm. I don't know if it'll ever come up with the idea itself. Do, do you follow that spark?

I, I follow. Yeah. We'll See.

And, and I, you know, I, I wanna believe that anyway. We'll see. That's exactly.

We'll see. Um, I wanna emphasize something we, I asked a few people yesterday, we spoke about, which is all of the stuff you showed yesterday, it's available now. This isn't pie in the sky coming next year.

It'll be continually improved with feedback and everything else, but all of the things that we've been talking about here for two days now, people could go on Jfr right now and go play with it, see it, use it, test it, whatever they want. Yeah. So, so the concept in, uh, swamp up is that, uh, we arrive here, we are ready.

Right. Okay. We're not showing you anything that's pie in this.

Exactly. It's there. Or it's coming in in several weeks.

Right. That's it. So APTAs is there.

AI catalog is there. We also spoke about, uh, solution for ID extensions. It's there.

Mm-hmm. Uh, identical remediation is there. Yeah.

Um, I also demonstrated, uh, yesterday on stage we have a new partnership with ServiceNow. Yes. I saw, Uh, this is where we, we are connecting the two words of, uh, it Sm Yeah.

It TSM management processes things, amazing things that are done on service now with the evidence and lifecycle management that the DevOps guys are doing. So this is something that we started working, uh, few months ago after the feedback we got in the LEAP event. Uh, and this one is coming.

This one is in development, or we wanted to announce it to put it on the table because our customers are really excited to really ask for it. And we are working on it. This is coming, uh, later this year, or probably at the beginning of the next year.

Other than that, still there. All the things that we announced are out there. Yeah.

Well, you see, 16 years. 16 years ago, do you think you'd be sitting here at something like this? You never know.

You never know, man. You never know. Hey, congratulations.

Thank, thank you. You've done a great job. It's really Fun.

Yoi Shaul. Uh, SVP DevOps here at, uh, JFR. We're gonna continue our day two coverage today.

We've got more coming. So standby here on Tech Drunk tv.