Today’s AI is Tomorrow’s Security Threat: Is Your Executive Team Ready? | The Six Five Summit

Hey everyone. Welcome back to the six five Summit. Daniel Newman here, CEO of the FU and Group.

I'm excited for this next conversation, part of our DevOps track. We've got Sonatype joining us, and it's CEO Wayne Jackson. Wayne's a first timer, and I couldn't be more excited to have you have you, Wayne, as part of the conversation.

Welcome to the six five Summit. Thanks, Daniel. Great to be with you.

It is, it's really exciting times. Um, look sonatype com, the company has a huge pedigree, very respected, very known in the communities in which it's served. Six five Summit, we go chips to SaaS.

So we've got executives across from semiconductors to automotive, and so much more. Give me the quick, you know, 62nd on sonotype for those that maybe aren't familiar with all the work you're doing, I'm happy to. Um, so we're very much focused on innovation, um, by way of software.

Um, for those who aren't aware, most software, uh, these days is assembled rather than being written. And most of the parts that, that, uh, are used in that assembly are open source. And so, uh, we think of that, um, all in supply chain context.

Um, so helping organizations optimize their supply chains using the best projects, the best open source, um, and of course securing their supply chains, uh, to, to keep out emergent threats, uh, like malware. So there are a lot of different problems that can be solved with software. Um, I like how you kind of use that assembly line.

Of course, anybody that's sort of following, you know, the GitHub growth, the, the co-pilot innovations that have been discussed in the marketplace, you kind of listen to even, uh, Nvidia Jensen, CEO, Jensen Wong, talking about just how, uh, program and coding developing is gonna change. I imagine that you guys are identifying and seeing different new problems. So what is the big problem that Sonatype is solving right now for its customers?

Um, uh, I think, uh, probably a multidimensional problem. Um, you know, there are so many, uh, open source projects out there, tens of millions. Um, we see literally a million to 2 million commits a week now.

Uh, and so for developers, uh, picking the highest quality projects, picking the sets of functionality that most align to the goals for innovation that they have, um, is just not easy. Um, and then you start to layer in the security dimension. Um, now you're asking folks who aren't necessarily trained in making security decisions, um, you're entrusting them with, with making choices, um, that directly relate to, uh, and effect the, the cyber hygiene of an organization.

Um, you may remember back to, um, struts, um, which was such an impactful event for companies like Equifax. Um, more recently Log four J, which was a global, um, uh, impact related to open source and open source vulnerabilities. Um, and so helping people organ, uh, avoid those kinds of scenarios is a, is a huge responsibility.

Um, and then as a more emergent phenomenon, we're starting to see, uh, nefarious actors targeting open source ecosystems themselves, um, and, and delivering malware into those ecosystems, um, with the intent of actually compromising developers, um, and development pipelines. Yeah, I'm glad you pointed that out. You know, the session title is, today's AI is Tomorrow's Security Threat.

And, you know, I love that because, you know, as you, as I'm listening to you talk, Wayne, I'm sort of thinking to myself, well, there's kind of these two parallel tracks, right? Develop in critical applications as fast as you can, and then there's the, oh, we gotta do that securely. And AI is accelerating things super fast, right?

You can build apps really, really quickly. And by the way that this was revolutionized even before this last few years of generative and, and speech to code and image to code, but even just with low code and no code, how fast app development got, um, but whose problem is this? Like, you know, the developers, probably most of them would, would say that they're not security, you know, they're focused on building the app, you know, is it the CISO with problems of this size and security problems scaling as quickly as they are?

Who, whose job is it to solve this problem? I, I think there's a shared responsibility. Um, you know, the, the, the, the thing that's become obvious to me is that the, is the original design of application security and application related hygiene, uh, where you have a silo that is security and a silo that is innovation.

And sort of in between, there's this thunder cloud of dispute for who's creating problems and who's slowing down innovation. Um, I think that model's broken. Uh, and, and so ultimately I think there's a shared responsibility and hopefully the same kind of unification of, of, uh, of function that we saw with qa.

Um, you may remember back in the old days when I was actually writing software, um, QA was a standalone function. Uh, and ultimately we had to see that, uh, that function dissolve into the process of innovation. And I think you're going to have to see, um, the same thing happen with traditional AppSec.

Now, what that means is that we're going to have to get much better at delivering the ideals of the AppSec function into the innovation process itself, um, and much in the way that we have with qa. Um, and, and, and so, uh, and so I think that's a cultural shift, which is always a bit of a challenge that has to happen. You know, companies like Sonar type, um, who are developing tooling and, and providing data and, and better insights for the development processes.

We have to get better, um, at integrating into developer workflows, um, and, and to help security, um, you know, do the assurance efforts that they need to, as developers are doing their thing. Because ultimately, you know, developers are working because of businesses need innovation. And so we can't get in that in the way of that process.

Um, but you know, as evidenced by some of these, you know, horrible events, uh, over the last few years, we can't, we can't just turn a blind eye to the, to the risks, um, that are associated with, with vulnerable software. And now we enter ai, right? The whole event that we're doing here, AI unleashed, AI accelerates everything.

ai, you know, drives faster, uh, you know, both innovation, adoption, um, you know, shorter diffusion of innovation into the market. It also creates, you know, with every new technological wave, it creates just as many bad actors as good. Sometimes it feels like even more meaning the speed and keeping up and dealing with the bad actors.

So like, you know, AI isn't, you know, like I said, there's a lot of debate on the good and the bad of it, but when it comes to the security aspects of it, how much are you seeing AI complicating it? How much are, are we seeing more malicious intents? Has it been notable in your world?

And, uh, what are the potential risks? What are the downfalls for companies if they can't figure out how to deal with this? Well, I think most folks agree that one of the main challenges of especially generative AI in the context of cyber is that it makes developing malware easier.

Um, and there are actual models out there on the market, uh, both, um, uh, the, the light net and the dark net, um, where people can acquire models to dev to, to generate, um, even very sophisticated polymorphic, uh, malware. Um, and so that is going to make things a challenge. Uh, it's just inevitable.

Um, but on the other hand, we're getting better at leveraging models and AI to do malware detection. Um, you know, I mentioned the number of commits that we see, you know, numbering a a million to 2 million commit events, uh, per week. Um, you know, we have to, if, if, if we care about stopping the malware problem in open source, um, you know, then we have to inspect every one of those commits.

Uh, and doing that with humans would be practically impossible. Um, but fortunately, AI does make inspection and identification of speci suspicious behavior, um, illicit committer activity, um, something that is possible. And so, you know, I guess insofar as malware or, or AI is making malware more prolific, uh, we're also being able to use AI to, to detect, uh, suspicious behavior, um, and to stop the delivery of malware at the source.

So, uh, a bit of a double-edged sword. Um, you know, in terms of the use of models, uh, one of the things that we're also focused on is helping organizations get a handle on what models are being brought into their organizations. Um, because as you know, they all have different uses of data, different copyright terms, um, you know, and different implications in terms of the quality of output.

Um, and so, um, as with, you know, back in the old quote unquote days where we were helping people get their hands around where open source and creating transparency around the number of libraries in their infrastructure, we're also trying to do the same thing for, for AI models. And so when you look at that, like a lot of ai, right, even in the way it's fragmented or segmented in the market right now, right, is they're sort of open and closed, right? That's kinda the way it's being debated.

There's a large subset of AI that's being developed in open, uh, you know, and you're seeing the kind of the rise of the, the hugging faces and others that are really trying to democratize it. And then you're seeing other companies sort of like, the irony of open AI is that it's, it's actually not particularly designed to be open. It's actually designed, it's, it's open for us to use.

Um, but having said that, like, you know, is that the layer where a lot of the exposure and risk comes into though, because like when it's open, right? Obviously the way it gets iterated upon, the way it gets developed and built upon, it also does create more risk because of the way it's, it's it's managed kind of cohorted as opposed to kind of being, you know, in its own little, in its own little bubble. So, you know, Wayne, what are you seeing there?

Is that, is that the big exposure point open source or is it something else? Um, it's certainly a reasonable debate point, um, but I'm of the view that openness and transparency ultimately win. Uh, and if you look at, um, at traditional cyber as an example, I think the days of security through obscurity are dying.

Um, you know, the, the, the notion of making your softwares more secure by obscuring its flaws, um, is ultimately a recipe for disaster. Uh, and if you look at regulation now, um, you know, uh, the White House pronounce requirements for, for software, bills of materials, uh, as an example, basically an ingredients list of the things that are being delivered to the federal government. Even more, uh, aggressive regulation in the eu, um, are all about transparency, uh, and democratizing what vendors are sharing and what consumers should know about the software that they're using.

Um, I think the same thing is going to happen inevitably and in, in, in, uh, ai and I, I hope that what we've learned about openness and cyber will translate into an acceleration of the openness of, of AI models. Yeah. And by the way, I'm a huge open source fan.

It's simply just the size and scale with what, about three quarters to 80% or so all softwares developed that way. Um, so it's, it's a huge part. So it creates risk because it's also just the largest part.

It was kind of like the old, remember the old apple windows debate about how many vulnerabilities? Well, it's like, look at how many users. So you always, you know, you always have to sort of weigh out the actual market adoption to the market size, and you go, of course there's gonna be some risk created there.

You know, you said something that, that, that is really important too. And, and, you know, um, it's probably, I wanna, I don't wanna hit you on regulation, but actually right before I wanna do that, I wanna go back a little bit and kind of couple that with Sonatype's market position. You know, you guys have something around like 70% of the Fortune 100.

Um, you work with a lot of these regulated, uh, companies, financial institutions, et cetera. Why do regulated industries, uh, find what the work you do, work sonotype does to be so important to their, you know, DevOps and, and then continue development of their software? Um, I think in, in the, the re regulated industries, um, you know, as, as you know, finance is one of our biggest verticals.

Um, you know, they've had a have a massively important critical mission. Um, and beyond just being regulated, I think they instinctively care about, um, the quality of their infrastructure, the quality of the software that they produce, uh, and the integrity of their organizations generally. Um, and so, you know, I'd like to think that we're pretty well proven as a best of breed provider of what we do.

Um, and so the folks that naturally care, uh, the most about, um, innovating, uh, in a very hygienic way are going to be biased towards, uh, making best of breed choices. Um, you know, that often doesn't happen further down market where there isn't just the bandwidth to make best breed choices about everything that's being used. Uh, but in the large organizations, again, and and regulated industries like finance, there generally is the bandwidth and the interests, uh, to make those kinds of choices.

Um, you know, and, and, uh, you know, you, you touched on the, the level of open source, you know, the typical software, um, but critical systems, um, you know, the, the, the, the software that runs the world, um, facilitates, interbank transfers. Um, you know, most of those systems are mostly open source. Um, and, and so the choices that are made with the regard to the open source is, is literally critical to the world functioning.

Well, listen, I've got about a minute with you left, and Wayne, it's been a lot of fun learning both about what you're, you know, what sonotype is doing and sort of your perspective on the impact AI has on the market and why executives are gonna be chasing, keeping up with, with the challenges and, and security. But for those regulated industries, you know, uh, the government stuff, like what is a piece of advice or two that you're, you're, you would give as kind of a best practice to, to stay up to par given how fast things are moving? Um, uh, I, I'll, I'll sort of lean on a, a, a gentleman named Edwards Deming, uh, who as you may know, was the transformative figure in supply chain automation, uh, and optimization for the, for, for Toyota, uh, helped transform them from a textural manufacturer to the world's leading automobile producer, or one of them anyway.

Um, and, and he, he, he emphasized, uh, transparency, uh, first and foremost, um, be aware of, you know, what's being integrated, uh, how it's being integrated, uh, and so forth. Um, picking the best suppliers, uh, and picking the highest quality parts from those suppliers. So on open source terms, picking the best projects, uh, but maybe most importantly was empowering developers, um, to, to make decisions in the natural course of, of what they do just as Toyota does with the Endon court empowering, uh, line workers to identify defects, to, to stop the assembly line if necessary, to not just fix the defect but fi fix the issues that led to the possibility of a defect.

Um, and so I think, you know, embracing sup, uh, supply chain principles and software, uh, can have the same kind of transformative effect, especially nowadays with the acceleration of, of innovation with ai, um, that we saw in traditional manufacturing. Well, Wayne, I think you did a really nice job there, summing it up and bringing together the good old people in people, process and technologies. Wayne Jackson, CEO Sonatype, thanks so much for being part of this year's six five Summit.

It's gonna be very exciting to watch the company Sonatype continue to innovate in advance, and of course, the impact that AI has on all of us and all of our businesses. Stay tuned, everybody. Stick with us for more coverage and content here at the six five Summit Studio, sending it back to you.