Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
AI and the Software Supply Chain with Endor Lab's Varun Badhwar
1 Plays5 seconds ago
Varun Badhwar, CEO and Co-Founder of Endor Labs, joins Scott to explore the expanding software supply chain risk in the age of AI-generated code. They discuss how developers have gone from writing code to assembling it from layers of dependencies like open source, third-party libraries, and now the outputs of AI...and what all this means for security. From hallucinated npm packages that could be squatted on, to developers becoming part of the attack surface themselves, this is a wake-up call for anyone building software today.
https://www.endorlabs.com/
Recommended
Transcript
00:00:00
Speaker
And today, that is the developer workstation. I just need a developer to do an NPM install or PyPy install, something that has malicious intent. That malicious library most commonly is now going to exfiltrate any variables and credentials and keys that it can find off the machine, and it's out in five seconds.
00:00:23
Speaker
Like there is no notion of, well, I have some checks baked into my pull request. When it gets there, I'll catch it so it won't go in my CICD. I got everything I needed, Scott. It's a smash and grab attempt. Hey, friends. I'm Scott Hanselman, and it's another episode of Hansel Minutes. Today, I'm chatting with Faroon Badwar. He's the founder and CEO at Endor Labs. How are you, sir?
00:00:44
Speaker
Very well, Scott. Great to be here. yeah I have been having so many conversations about bringing AI into an organization and people are finding it to be very unnerving because they're saying, well, I don't trust this code. And I think that's so funny because I never trusted anyone's code, whether they work for me or not. So I wonder why they why they frame things in that way.
00:01:07
Speaker
Yeah, it's a great opening. And I think... I kind of say that there's two i that they're kind of um two eyes in the storm right now. One is that there are more people writing more code than ever before. And it's not just limited to your trained software professionals that have computer science degrees, but it's a financial analyst that wants to build a forecasting app in Vercel or Replit today.
00:01:31
Speaker
And that's code. And then The other side of this is the conversation these days in the industry has shifted more from productivity to security and safety of models, right? Like Mythos can't be out because it is so dangerous to humanity because of its cyber powers.
00:01:49
Speaker
What people don't realize though is while Mythos is being limited in its adoption, there's open source models out there available on Hugging Face today that are good enough at doing a lot of these tasks. So I think, look, it is,
00:02:03
Speaker
appropriate for people to be concerned about speed and safety and scale at which all of this is coming at them. ah It's about, you know, we're starting from ground zero on how to build the guardrails and the safety harnesses for all of this.
00:02:17
Speaker
Unfortunately, security is always an afterthought. It's no different here, although I would say here it's being talked about much sooner than say it was in the cloud era or you know or or other previous technology shifts.
00:02:30
Speaker
So I get it. I feel the pain. But the good news after we hopefully spend the next 30 minutes is there's hope There's a strategy we can apply to ah you know doing this well because ah the same agents that you're scared about can now be used to actually do things at scale more securely with the right intelligence integrated in the right workflows and so on and so forth.
00:02:54
Speaker
Some organizations have a mature open source You know, open source programs office, they're used to ingressing untrusted code from random people.
00:03:06
Speaker
Should we look at code written by an agent the same way we look at open source code? Because I think that I've been consuming Internet strangers code for 20 years. I wouldn't treat an agent's code any more or less trusted than I would treat random Internet persons.
00:03:22
Speaker
Well, we certainly had capabilities in the more mature organizations to vet open source. But even that vetting was mostly focused on legal and license compliance and on known vulnerabilities.
00:03:36
Speaker
I think ah one of the biggest shifts that's happened in the open source ecosystem is this idea that now people are either maliciously or accidentally shipping malware that's not even targeting malware.
00:03:49
Speaker
kind of your CI CD pipelines or anything, it's targeting straight the developer that does that NPM install the moment that install happens on a machine well before it's vetted and put into a, you know, code repository or into a CI CD pipeline. So there is certainly, i think that the the the risks have shifted and are more serious today in terms of malicious intent being shipped through open source. That's one. But yes, if you do move to a zero trust development environment from the 100% implicit trust to strangers on the internet that many organizations operate in today, then I think you're getting closer and closer to how you treat agent and AI-generated code.
00:04:34
Speaker
Because there's a lot of similarities in AI-generated code. I mean, the AI models didn't learn novel code. They were trained on all of the last 20, 30 years of code on GitHub and on the internet. And so they've learned the good, they've learned the bad, they've learned the ugly. If you figure out how to put the right guardrails, that's fine.
00:04:49
Speaker
But Scott, like we have to talk about the volume at which that's shifting, right? Like how many new packages did people install every week? A handful. But today, that the volume in which code is being produced that appears to be first party code dependencies are being installed but it's not just dependencies from npm and pi pi it's now hugging face models and get of actions and like there's so many more things in the software supply chain so the surface area has expanded And the last piece I'll mention, I was having a very interesting conversation with a CIO of a very big, reputable company.
00:05:23
Speaker
And he said, look, our finance team is building these apps and we found some security issues. We kind of emailed them and said, hey, could you please update your app to fix this vulnerability? Scott, you want to guess what the response was from the team?
00:05:35
Speaker
No. What's a vulnerability? So now we're not talking to trained software professionals. Now you're trying to level up the citizen developers in your company. oh now It's like, what do you mean? This software is generated. It must be fine. Oh God. That's not where I thought you were going with that at all. That is awful.
00:05:54
Speaker
Wow. Yeah, and see, this is the thing you've said before that we're moving from writing software to assembling software. And, you know, before it was like, write some code, find a library that hides a bit of abstraction. But we're sitting on top of this massive pyramid of abstractions. We've got executable instructions, sure, but dependencies, deployed bytes, ah pulling in opaque libraries that are binaries, pulling in open source libraries, NPM, ah particularly, you call that one out.
00:06:24
Speaker
I've even seen my my bot hallucinate packages that it thought might exist yeah that did not exist. And I'm trying to figure out where did you even get that from, which arguably then could be squatted on and someone could put a package underneath that and attack me as well. I wanted to dig in a little bit more to the idea that the developer is now an attack vector. I'm used to people trying to steal production data, but now I have to worry about my own computer and what it has access to. That's all new as well.
00:06:57
Speaker
Yeah, totally. Right. I mean, traditionally, when we thought about software security, software assurance programs, we focused a lot on the code. We wanted to run static analysis tools, find vulnerabilities, fix vulnerabilities.
00:07:08
Speaker
Today, the problem is not just these accidental vulnerabilities in code. It's actually people, including a lot of nation states, targeting organizations, targeting public sector developers. So why developers?
00:07:21
Speaker
well, developers are basically crown jewels in any company right now. You have coding agents that are running on almost every machine, which have extremely high privileges and ability to take action autonomously.
00:07:32
Speaker
You've got credentials to your cloud environment, to your Git environment, all of that sitting on the Git developers environment. So look, I always say their attackers are lazy, right? They're going to find the easiest path with the fastest and the greatest blast radius in any company. And today that is the developer workstation. I just need a developer to do an NPM install or PyPy install.
00:07:57
Speaker
something that has malicious intent, that malicious library most commonly is now going to exfiltrate any variables and credentials and keys that it can find off the machine and it's out in five seconds.
00:08:12
Speaker
Like there is no notion of, well, I have some checks baked into my pull request. When it gets there, I'll catch it so it won't go in my CICD. I got everything I needed, Scott. It's a smash and grab attempt.
00:08:25
Speaker
on a developer workstation that is usually highly successful. And the implications of that is if I get access to Git or your company's source code, chances are that source code repository has hundreds of other keys embedded in there.
00:08:39
Speaker
That's just reality where we live, right? And so you just get tremendous access doing so. Last thing I'll say is our research team, we have a Station 9 research team that spends a lot of time looking at novel attack vectors in the software supply chain.
00:08:53
Speaker
One of the more common growing ones is not even like somebody doing code obfuscation. It's somebody writing a skill. That skill looks like a very popular skill. It literally in simple English instructions states to the coding agent that it needs to export SSH keys or environment variables here and there.
00:09:11
Speaker
And that's the extent of the attack vector, right? So we live in a very complicated world right now with lots of different ah technology components that are moving that are outside of our control.
00:09:22
Speaker
And so kind of talking about zero trust development is extremely important now. Yeah, I remember 20, 30 years ago, we would call casual hackers script kitties. But when you phrased it as smash and grab, it really kind of underscores the lack of sophistication and the fact that there doesn't need to be any sophistication. All they need is one developer to accidentally have a production you know s three bucket or Azure bucket and ah in an ah in an environment variable and They run in, they smash a bunch of stuff, they grab and maybe they get the hope diamond, maybe they don't, but then they can do it with a bot swarm.
00:09:58
Speaker
They can do it N number of times. There's no need to for sophistication and it only takes once. They only have to be right one time. Yeah. yeah I think that's very true. By the way, the so we're talking obviously of this dynamics of malware. the The other thing is the attackers are way faster and more sophisticated to take unconstrained use of these new technologies and LLMs.
00:10:23
Speaker
to to attack us, while an organization is going through their AI council to get approval, to use the latest model, to do A, B, and C, and then find the right evaluation and run a few processes.
00:10:34
Speaker
The attackers are on it. Scott, the average time for an attacker to build an exploit for a CVE, ah a actual known vulnerability, has gone from what used to be two years in 2008,
00:10:51
Speaker
to 23 days last year to 10 hours this year. So then you've got to kind of think about this and say, like, which organization is prepared today from a software development lifecycle perspective to discover a new vulnerability, triage it, create a fix for it, test it, and ship it in production in under 10 hours. But that's what we're dealing with.
00:11:14
Speaker
Okay, and see, and this underscores another thing that I want to talk about, which is that it's, for me, and maybe this is ignorance, but I feel like it's less about AI and it's more about having a healthy SDLC. If your company is not doing continuous integration, continuous deployment, and all the stuff we told them they should have been doing 15 years ago, you are in big trouble.
00:11:35
Speaker
Would you agree? Yes, that plus, if you really didn't think about shifting security left, I fundamentally believe software security is an engineering problem. And I think the security team can certainly help you with the verification loop.
00:11:50
Speaker
But a lot of security teams that have operated in this construct of, well, we run these scans on release candidates, and then we'll go you know give a report of JIRA tickets and then somebody's going to go fix it. It doesn't work. right This has to be in the in the coding loop now. right As your agents are producing code, before they're considered done, there needs to be a set of security checks run on that code output because we know agent code or human code is going to have problems.
00:12:17
Speaker
What if you can just fix those problems pre-PR? get them out of the way autonomously. And then when you get to a pull request, you kind of do the more thorough detailed review and analysis, give feedback, fix. So like you keep weeding off the simpler things earlier and earlier in the process, such that by the time you have a release artifact, you have a high degree of certainty that this is not going to have any surprise problems in it, is the only way to go. Just like we moved QA to QE, right?
00:12:44
Speaker
It's how every developer is expected to have working code, not just code and working features You now need them to have secure and working features integrated. Let me let me challenge you on something though, because if we remember that the corpus on which these things are trained is kind of all visible open source code and we make the assumption that in a normal distribution curve, the mediocrity is where the gravity well is. So these security, these these coding models rather are going to generate average code unless someone steers it to be better than average.
00:13:20
Speaker
And as such, average code is insecure. So then to your own point, you've you've said that 60% of AI generated code is insecure by default. That puts you right in the fat part of the bell curve.
00:13:32
Speaker
Why should we trust models to be able to detect security issues if models by themselves are the problem that cause these security issues? had Great question. Oh my God. one one One of my favorite topics. So we're going to riff on this for a little bit.
00:13:47
Speaker
One, by the way, it's not just 60% insecure. The data shows against you know the benchmarks we run testing on, even the most sophisticated models, 70 to 80% of the code being recommended by them is insecure by default.
00:14:02
Speaker
Lots of reasons we can get into that if you're interested. Okay, now the next question is, can you trust the same models that cannot produce secure code to find stuff? Like, look, I think the defensive security by default versus offensive security problems are slightly different.
00:14:19
Speaker
So yes, like they find stuff, right? They are very good at finding stuff. But are they finding the right things in the context of the application, the way it works for you, and at what price point?
00:14:33
Speaker
Are the questions like I have, you know, there's a company that I know that has access to Mythos. They ran Mythos on 32 repos for about a month and the bill was a million dollars.
00:14:44
Speaker
Oh Lord. Is this sustainable? No. You run some of those on PR checks. Sometimes it'll take 20 to 30 minutes to run a completely non-deterministic scan on a PR check. So like the token cost, the speed, it's untenable, right? There's a lot of value in these models, but I think you have to really solve the core problem, which is the context problem. As you know, Scott, these AI coding agents and just LLMs in general, when you interact with large code bases, they're super greppers.
00:15:13
Speaker
They can grab across your code bases, but they assume, that assumes by nature, that it's a flat, that an application is flat. But an application is a complex graph of first-party code that connects to a library that connects to 77 other libraries.
00:15:28
Speaker
If we can extract that context with static analysis and program analysis that, by the way, you know we have a lot of expertise at Endor Labs and that's what we do. What we have seen is when we extract that context and the heat map And we give that to the LLMs. This multimodal approach of static analysis plus LLMs is very powerful at a very cost-effective way and at a speed where you can actually do this on average for and in 64 seconds per PR versus 20 minutes per PR.
00:16:00
Speaker
And so you now actually can run this in a developer workflow. So my my meta point is the models themselves don't have the intelligence necessarily to create secure code, but companies that specialize in that area like Endor, we have created years and years of custom proprietary datasets that are annotating all of that security intelligence on that trained dataset so we can help.
00:16:26
Speaker
And that's where traditionally you'll always find even with cloud, with code, with network, with endpoint, security tends to be an independent function with independent set of expertise and tooling. yeah Now that doesn't mean it can't be integrated in the SDLC. It absolutely needs to be.
00:16:43
Speaker
See, this is this is good this is good stuff. This is why I think Endor is interesting because I don't like when i hear an AI company say, you have a problem because your AI makes bad code and we have the solution.
00:16:55
Speaker
It's another AI. You're acknowledging that static analysis, proprietary models, not just LLMs, not just a million monkeys with a million typewriters slapping on the keyboard and hoping for the best.
00:17:09
Speaker
You're calling out that there is formal correctness and you are recognizing that those correctness checkers Yes. Are not just throwing one LLM after another and burning tokens because we all know token maxing is nonsense.
00:17:24
Speaker
Correct. The cybersecurity into a great degree is it requires a determined some high degree of determinism. Yes. In the solution.
00:17:36
Speaker
Agreed. By nature, LLM needed just LLMs cannot provide that. So you got to have this fusion. Right. Hybrid model. a hybrid capability where I always say this, if you can do two plus two on a calculator, you don't need an LLM that. So like you got to fix the things that make sense to do with static analysis. At Endor, we have 14 PhDs that are world-round experts in static analysis. Like that's all they do is creating tools in context that we can then feed the LLMs to be 10 times more powerful at one-tenth the cost.
00:18:11
Speaker
Right. and it's And I respect also that you're calling out the cost because this token maxing thing is out of control. People are using the biggest models, like you said, run it for a month, cost a million dollars. God knows what it does to the ecosystem and to the ecology. Who knows how much water got burned because they ran you know Fable for that long.
00:18:28
Speaker
when the problems can be solved by, to your point, PhDs, static analysis. i when i think about like the static When I think about the software development lifecycle, and we mentioned like CICDs, and we know that in 2026, there are companies that do not even have a mature DevOps pipeline.
00:18:47
Speaker
The number of folks that don't know what like cyclomatic complexity is, that don't run any static analysis on their code at all to look at the complexity of the code or the security issues around the code is a little scary. Like we were talking about this in the late 90s. How often are you finding when you walk into a customer with with Endor Labs products and they're thinking that this is like this is magic and you're like, no, it's actually science.
00:19:14
Speaker
Yeah. You know, Scott, unfortunately, we come from a world where security was mostly built around compliance. Like even this problem with open source, if you think about it 20 years ago, this whole ingestion pipeline, if you will, or verification or OS, like the open source program offices were built around license compliance originally.
00:19:33
Speaker
And then they evolved to take on some of the vulnerability management aspects. And today they're evolving to kind of software supply chain security aspects. It's look that a lot continues to change. though The thing I love about being in the cybersecurity industry is it's a cat and a mouse game, right? One door shuts, and another opens, and you're always trying to out innovate.
00:19:55
Speaker
And yeah, traditionally we didn't write this much code. Traditionally, we didn't use this much open source, right? Our reliance on open source was what, maybe 20, 30% of our legacy application was open source.
00:20:06
Speaker
Today it's 80 or 90%. I would argue 99%, 99.9% of code in a modern application won't be written by your developer. And so like things are shifting so rapidly, like, you know, skills didn't exist last year. MCP was hot and then Something else comes around and now CLIs are great again. like the The beautiful thing about being in software development is it is constantly changing for the better.
00:20:31
Speaker
But that puts a moving target to say, like okay, how you innovate, you have to kind of make some grounded assumptions. And that assumption we made is one, more code, not less code, will be out kind of from the outside of your trust boundary. Mm-hmm.
00:20:47
Speaker
The second was the, you know, the convolution, like code is a graph, you have to solve this as a problem, a graph problem, right? Like trying to scan manifest files and say, oh, I see this import, so must be there.
00:21:02
Speaker
Doesn't work in modern application architectures. Yeah, well, and modern applications and modern development now is not just I write some code and I check it in my coding agent or myself. I'll have GitHub right access. I'll have package manager credentials. I'll have MCP tools. I'll have cloud credentials. I have CI access.
00:21:20
Speaker
Everyone has way more access than they need to, so which brings me to my next question, which is they expect us to go faster than ever. But doesn't this just mean that they're just going to lock our developer workstations down and make us all just RDP into the cloud somewhere? Like, I want to move fast and I don't want Defender or whatever agent thing that's running on my machine to slow me down. How do you find that balance between the only secure machine is one that's not plugged into the internet, you know, and the speed and the expectation that they they want us to go Yeah.
00:21:54
Speaker
It's a great question. it's There is no perfect solution, right? like the the history Security always comes at a cost. The question is, is that a tolerable cost or not? but I think traditionally when you used to build applications and then you would receive an 800 page web inspect report of vulnerabilities that would take you another six months to fix before you could release, like we don't have you know the ability to tolerate that today. right Do we have ability to tolerate 5 million findings from our platform every six months? No.
00:22:24
Speaker
But I think as long as we are reasonable to know today, you cannot live with security through obscurity. What I mean by that, we would make a series of compromises to ship fast, which would mean security would not be taken seriously in software.
00:22:40
Speaker
And you would hope that nobody would find those vulnerabilities. Today, with models like Mythos and Fable and GPT-5-5, every vulnerability that is in existence in your software will be found.
00:22:52
Speaker
So the question becomes, you can't make those trade-off decisions. So what you're now trying to do is, what is the lowest cost at which I can inject security into my development workflow? Because I can no longer accept the risk and ship it.
00:23:08
Speaker
And what is that low toleration of costs? The more left in the process, the cheaper it gets. it's like It's like car manufacturing. If you try to issue a recall once you've sold the 50,000 cars to your like customers, it's going to be expensive. If you had quality controls in the assembly line and you were just fixing those things well before the car was out to a showroom or client's hands, way cheaper. So in software factories, the cheapest place to insert security and in the loop is in the agentic workflow.
00:23:41
Speaker
Developer gets the spec, agent bills. Okay. As the agent is building, we know they don't have the intelligence of being very secure. But if we fuse and in so insert the end or intelligence, for example, in there, the code before it's complete, the plan being complete, you would have more secure code.
00:23:58
Speaker
Great. Okay. Then it goes to PR and so And so you kind of keep reducing the security issues till you get to a zero point, you know, on the other side. Okay, so you beat me to it because that was my next question because I was trying to visualize. You keep saying shift left, how far left do you go?
00:24:14
Speaker
And RI, is that pronounced correctly? A-U-R-I? The security? ari So EnderLabs RI is the security intelligence layer for coding agents, right? so we've got the deterministic aspect, we've got the probabilistic model reasoning, and then you've got...
00:24:29
Speaker
you know Parts you can prove and parts that are that are special herbs and spices, EnderLab-specific herbs and spices. But this should be, should the secure coding agent be in the generation loop, preventing the mistake so it never escapes is what you're saying.
00:24:46
Speaker
don't Yes. The worst thing we can do in this agentic STLC when we're trying to ramp up code generation is ramp up the number of security tickets we push to humans. there is yeah Agents create the code and make all of those things post-generation review, find the problem, put it as tickets in the backlog of human.
00:25:05
Speaker
We did not solve for anything in terms of innovation or acceleration of software development. The only way to do this is the code being created by the agents Those agents have to be held accountable to improve the security efficacy. How do you do that?
00:25:21
Speaker
Agents are smart. They follow instructions. They follow tools. You give them the tools. You give them the instructions. You tell them what to go fix, um which you know is the is the he's a key part of the end or value proposition. We didn't talk about this. You talked about the static analysis and the tools and the herbs and spices.
00:25:36
Speaker
One of the most important herbs in spice is for all of this code on open source that these models are trained on, which they don't know what is secure or insecure, Endor does. We have been labeling hundreds of thousands of vulnerabilities that have been created over the last 20 years to understand which lines of code in open source have them, which lines of code in which future releases fix them, et cetera, et cetera.
00:25:58
Speaker
So when we fuse that intelligence to a model that is recommending some code that has a problem, we can help it rewrite it correct. Right. This is where things get interesting. So we mentioned a couple of minutes ago or maybe 10, 15 minutes ago about how if you train an AI like the frontier models on everything, you get mediocrity. But if you're doing targeted training on CVEs, you are doing a focused train on specific models and saying, this is what is wrong. And we know how these CVEs have been fixed over 20 years.
00:26:31
Speaker
You know so much more. This is a a very laser focused kind of model and not a general purpose correct kind of model. yeah Interesting. Okay. So then what do you think the next big attack is? Is it going to be supply chain like we're seeing to target source code? Is it going to be someone attacking the agentic loop itself? Or is it going to be script kiddies making skills? where Where should we be turning our attention?
00:26:57
Speaker
So then there's two sets of problems. i think one, as I said, every security weakness in your software will be found. It's not a question of if, it's a question of how fast. And so I think we're playing this cat and mouse game to go fix 20 years of software vulnerabilities in the next six to 12, 18 months. It's going to be extremely painful.
00:27:16
Speaker
There's a lot of security debt that we all have to clear up. And, you know, we're going to have to go through the cycles because mythos, fable, like models are going to find everything. And the volume is going to be successive. Just if you look at the project glass wing update from Anthropic, 40,000 CVs already reported to open source zero day.
00:27:36
Speaker
and And, you know, the open source maintainers are looking at this and going, huh, well, I was just doing this for fun. Now you're going to go throw all this crap of work at me. Like, and then you're going to tell me I got to fix it really, really fast. Like I don't owe you anything. Like this whole trust in open source.
00:27:54
Speaker
like it's gonna come to head because it's like, who's gonna fix all these problems? So we have partnered with Anthropic and Linux Foundation and Microsoft and others to start this project called Project Acreities, which is like us coming together as a community of experts that are going to help maintainers go fix years and years worth of security problems in a very short amount of time.
00:28:16
Speaker
because the world depends on it. Like, I'm not worried about Microsoft or Google or others being able to patch. I'm worried about the water supply, the critical infrastructure, the nuclear power plants. Like, that's where the real risk to humanity is in the short order. so So I think we as an industry have come to this reckoning point. We've got to get through this. It's going to be painful for some time till we normalize all this backlog of security problems found and improve secure code generation moving forward. so that's one.
00:28:45
Speaker
The second thing is, yes, I think the software supply chain is complicated, more complicated with skills and MCP and GitHub Actions and NPM and PyPype. And I think we're going to have to move to operating as on zero trust principles and software development.
00:29:02
Speaker
when we we When we hear the word development environments, we never treated them as production. And so, you know, this whole smash and grab robberies, they're going to continue till as an industry, critical mass shift happens to focus developer workstation security.
00:29:18
Speaker
So i think that's going to be kind of an next big thing. And the third thing is I think we all have to retool for security to be in the agentic workflow, because otherwise we are generating a lot of security slop right now, which will come to bite us in the coming weeks, months and years.
00:29:35
Speaker
Yeah. Figuring out how to get past the slop cannons right now is going to be a mess. You're absolutely right. Do you think, have we proven, i mean, you've got the science and you've got the PhDs, is secure code possible or will we we always be playing whack-a-mole? Is perfectly secure code possible? Yeah.
00:29:54
Speaker
I think it's more possible today than it ever has been. Like trying to do annual security training for software for development professionals and then expecting 10,000 developers in a company to follow the same model at all times doesn't work.
00:30:08
Speaker
But agents are good at following instructions and rules and direction if you can give them consistent direction. So is it gonna be perfect? No, but is there an opportunity for us to create a lot more secure code?
00:30:18
Speaker
Yes, but it won't magically happen. It will not certainly happen with, oh, the frontier labs are just going to do it all and will all be good. right There'll be different expertise required in different area and you'll have to build it all into your common harness.
00:30:33
Speaker
And it's not going to be perfect. The reason it's not going to be perfect is security is all a given a function of time, cost, compute. More things will be found. So it's an evergreen problem. Even if I ship what seems to be completely secure code today,
00:30:48
Speaker
Somebody will find a way to break it tomorrow. the more important workflow we all need to have is that maturity of CICD pipeline, maturity of security, and automation, agentic remediation automation.
00:31:00
Speaker
So when that next thing comes up tomorrow morning, it's solved in 30 minutes and it's handled, right? Like I don't need a war room like we did with log4j from weeks and months to go address that problem. That would be the dream. That would be the dream. And then that's what you're working towards. I mean, that's the goal, right?
00:31:17
Speaker
That's right. We're kind of moving towards much more agentic and more autonomous software security embedded into the workflow, giving that intelligence to the agents to do 90, 95% of the work out of the box. So the humans are kind of the final verification and trust layer, not the core part of how we're going to action everything.
00:31:38
Speaker
Very cool. Well, I want to encourage viewers and listeners to check out EndorLabs.com, particularly check out the research section, the work that you're doing, the agent benchmark, the threat research, the work you're doing with universities is really powerful. And then they can go and learn about all the developer tools and the platforms that you are working on. Thank you so much, Varun Budwar, for chatting with me today.
00:31:59
Speaker
Thanks, Scott. Great to be here. This has been another episode of Hansel Minutes, and we'll see you again next week.