0:00AI has become the tool that's causing this kind of security apocalypse is also the tool that can help us to solve it faster as well. It went from how to get everyone to using AI. Now all of a sudden everyone's racing to figure out what AI security means. >> I've heard serious technical people say things like air gap everything important and we're like not going to be able to trust the internet for a while and we just assume all the critical infrastructure and government services fall down at some point. Is that your expectation for what happens?

0:34Dane, I'm so excited to do this with you. >> Yeah, thank you. Thanks for coming here, too. >> I'm sure I'm not the first person to make this joke, but your last name connect. That's pretty good for the Cloudflare value prop. >> Yeah. Yeah. Uh there's been some jokes about renaming the show next year. So, >> so with everything that CloudFare is doing, what are your top few priorities as CTR right now? Well, I mean, this past year, uh, it feels like 10 years compacted into one. Uh, so those priorities are, uh, constantly shifting, but, you know, it all goes back to our mission of helping build a better internet. And, uh, that really hasn't changed over the last 15 years. Uh, where we want to make sure that, uh, uh, the internet's secure, uh, that everyone has access to, uh, be able to, uh, get their content online easily and, uh, scale it up.

1:20uh and uh just you know over the arc of uh the AI um changes in the past year you know it went from you know how do you get everyone just to using AI how do you make it easy for them to deploy and their agents to deploy uh to like most technical transitions uh security is kind of an afterthought and uh now all of a sudden uh everyone's racing to figure out what AI security means and uh it means uh things are you know different sides uh view it kind of differently uh you know one side is you know as a as a company is how do you keep your data safe from uh uh AI leaking the data out uh but it's also how do you keep people from getting in as well too and you know over the last uh I would say 3 to 6 months uh just the number of vulnerabilities uh that uh uh are getting reported in CDES uh has has just gone up exponentially.

2:12Um, you know, previously on the internet, we would see these log forj moments uh or these shell shock or uh uh type of incidents maybe once a year and it would be all hands- on deck internally at Cloudflare to make sure how we protect not just uh um you know uh our enterprise customers but also all of our free customers because we you know view it as a kind of a public good and making sure that the internet stays safe. Uh to these things are now happening weekly. uh not all of them are publicly reported on uh but there are things that uh uh uh you know are as serious as the like the log for J type things but uh uh just happening at a a greater frequency um you know and I expect that you know through the rest of this year uh and in the next year by the next 18 months uh majority of uh uh teams time is going to be spent on security you know uh you I think there was a stat that was put up earlier today that uh during one of our keynotes uh uh where it was showing that I think uh over 50% of um uh engineering time is going to be start to be spent uh on uh the security and I don't think that will last forever.

3:12I think that will be a uh a short transition uh you know uh at some point the AI will have uh surveyed majority of the code and found most of the bugs uh or found most of the shortcuts. Um, you know, there there's a uh uh one that's kind of uh coming out today and has been started to uh be blogged about and tweeted about uh where one of the keys on the internet uh is uh uh that protects all TLS and webk webpki uh which secures all your connections uh was uh um was secured by the number four uh literally uh the basically uh used uh if you know about cryptography uh uh I mean uh It's all about randomness, right? Uh you know that's why software has our lava lamps is so that uh uh you can get good randomness.

3:58Uh and when uh uh a key out there is uh they use the seed they use the initial uh uh thing to uh uh kind of create it uh with a single number four uh uh is going to be uh uh reverse engineered. Um you know and AI can just do all these things you know it doesn't sleep. It's not like the one engineer you had that was uh red teaming things. Um you know uh last week I uh I think OpenAI found the seeds uh for uh the NIS the NIS curves uh that were uh back in 2000 uh that were released. Um so just you know these things are just moving so fast uh and uh the bar is going up and the models are just getting so good at uh you know uh uh uh cyber security you know midas was just kind of the tip of the iceberg there uh where you know and and since then it's uh not just been the the models getting better it's harnesses it's uh how people know how to how humans know how to use them and use those frontier models uh in order to uh find those exploits >> given your you know visibility What do you know about the humans behind, you know, these attacks and harnessing these models and taking the volume of vulnerability discovery up so quickly?

5:12Like are they, you know, nation state actors? Are they script kitties? Like what what can you say about um uh how the uh how the attacker landscape has changed? Uh well, I actually think for some of these uh um these some of these larger vulnerabilities that have come out more recently actually uh haven't been nation states. They they've been uh um you know, high school kids even uh that are uh >> we're going to call them agent kitties now. >> Yeah. Yeah. That are that are just uh spending their time, you know, like they used to do kind of capture the flag security contest. Uh they're uh pointing their agents at a uh an area and uh doing that. Uh you know, uh there's also, you know, and there's financial award for them. whether it's buck bounties that uh they get paid out uh you know sizable amounts. Um but uh it's it's given the tools that honestly the nation states have had in some forms for much longer uh um either through agents or just through you know sheer number of people that were working on the problems uh given it to the masses.

6:10This is the first time in 15 years I've heard serious technical people say things like, "Well, we should just like air gap everything important and we're like, you know, not going to be able to trust the internet for a while and we just assume all the critical infrastructure and and government services fall down at some point." Um, is that your expectation or what happens? >> Humans uh we are pretty adaptable and we uh can move fast when we need to. Um uh and uh you know I I've seen the industry uh uh kind of partner together when things like this happen. Uh uh people that you usually think of competitors are no longer competitors. We're just literally protecting critical infrastructure as you said. Um and uh I think when those kind of critical moments happen uh uh uh people and uh will rise to to that challenge.

6:59Uh um so I'm a little less doomsday. I I do think that uh a lot of the things that we've done over the past, you know, 5 to 10 years, moving away from a kind of a castle remote infrastructure for security to moving to more of a zero trust, uh does put a lot of companies in a better position where uh you know, you're not saying this office is completely airgapped. You're saying, you know, these devices, the these flows are uh secured in a different way. Um uh and and everything's going to be tightened. What is it going to take for organizations to do what you're describing? Like 50% of engineers do not work on security right now. I had uh uh Greg Brockman from OpenAI on the um No Priors podcast last week and he said that he thought in 2027 people were going to spend as much money on tokens for security as engineering.

7:50Like you're saying very related idea. uh what is going to drive that shift? >> There's emergency, right? So, you're going to move forward all your security spend uh over the next 18 months uh both from uh uh the red team side uh which is more the offensive uh uh trying to actively try to exploit things as well as uh the defensive side uh uh uh how you prepare things. Um but I I don't think that's going to be last forever. uh you know I see a world in like 18 months uh where uh you know uh new software productivity goes way up because you know all those resources are back focused on that uh but there there's definitely this period uh uh where uh security is is needs to be on everybody's mind >> what do you what are some of the key elements of getting to you know a better place in terms of overall software and internet security um uh I think people discover of course like that there are uh libraries and services everyone uses use that had vulnerabilities that took effort to discover and now do not and I think we'll hit some of those what what else is important there because part of the concern that I have is the rate of software production is also going up a great deal right so to some degree we got to go like patch everything that we have already made and then keep up and get ahead of the pace of delivery >> yeah um well so I mean for one we're right now we're are patching 70 years of of software uh out there.

9:19So so some of it is just catchup. Uh and then on a go forward basis you know uh uh I think this you know the software development life cycle the agent development life cycle is going to need to change uh uh and you know luckily this the same way that we can use security right now uh for red team and things like that it'll just be built into the process every step of the way um and I think you know software will just get more secure over time. What have you learned about building secure production software internally already that you think people can learn from? Like what does that mean? Like shift left and like can we there there are there are many theories of how to do this including you know broader use of formal verification using agents for security in the development process like what what do you think is going to uh create better software from uh first delivery?

10:14I kind of go back to first principles there is you want to reduce your uh attack surface area. The easiest thing you can do is to give uh less uh places for there to be vulnerabilities. So you know looking at all your software and saying how can I simplify this? how can I uh uh reduce uh this you know the the footprint the code um uh and then you know beyond that I mean things like formal verification like and uh I think things that uh you know safer programming languages and things that kind of built into the runtimes that make everything safer will come but you know I think it just starts with uh uh and you know AI at least you know for uh the early AI is is very verbose it likes to create complexity so you know AI in a sense of what we've been dealing with has actually uh uh not been kind of uh helping build a a more secure stuff right now.

11:03But I I think we'll get there. And I think uh uh the you know that that's where humans still come in and human judgment comes in and uh making sure that we design the software in a way that uh uh can stand on you know its own securely. >> Uh that was actually going to be my reaction when you say um we want to reduce the surface area. I'm like, "Oh, yes, of course, in principle." And that's not the natural inclination of today's uh models, right? And like, you know, I ask you to do something and I'm like, "Well, like with onetenth the complexity, please try again." Um, is is that the role of engineering and security engineering today? Is that something that's going to be solved to the model level? >> The way that humans did before, agents, it needs to be solved kind of at all levels. You need to train uh the uh engineers that are writing the the code, the product engineers.

11:50you need to the security teams still need to be involved in making sure that uh they're getting a you know checks and balances, second set of eyes on things. You need to build in processes. Uh we've gone to uh uh um uh defining things a lot more internally on on how we build at Cloudflare. Uh writing down our principles. Uh we have a a document called the codeex which is kind of like uh you know build up a lot of RFC's that the teams have built for here's how you build secure software cloud. here's how you build available software at Cloudflare. Here's our best practices and then it kind of gets boiled up into some ten commandments that uh the agents know how to follow and uh uh use at every part of the review process uh that can help enforce those things. So, you know, you you have agents out there that are, you know, just riding a lot of the the slop and then you have deeper down in the factory, you have uh uh people that are, you know, doing the performance runs and the secure security runs.

12:41And just like how the company operated before, I think you need those adversarial uh uh uh reviews. uh when you zoom out a little bit and just look at overall traffic on the internet and how much of it has become uh agent-driven over the last year. Um I I think it's outpaced most people's expectations. What has updated in your worldview of like what the web a year from now looks like either from an economic model perspective or a um security or requisite infrastructure perspective? >> Yeah. Um, I mean, I kind of think of it as we're in the messy middle right now where humans and agents are, uh, uh, riding the same rails, uh, uh, on the internet, uh, where, you know, agents are trying to, uh, parse a a human web, uh, when that's just, you know, one is just inefficient.

13:32Uh, you know, and, uh, was designed for humans that could do things at different speeds. uh you know going to a website and be able to uh read and uh uh you know uh see the ads and uh participate in the more the econ full economic model versus an agent that now can go to a thousand web pages in in the same period of time uh which is which is which is great. It's just you need to find a new economic model uh to support that. >> Can we get parallel webs? Is there like a human web and a machine web like everybody's trying to do uh what is it called uh AEO now? >> Yeah. Uh I mean yes I I think we do I think I think uh um we find ways to deliver the content uh and and meet and meet agents and humans where they are as opposed to trying to meet them in the same place. Um and uh uh right now there's like translation layers.

14:21You know there's a lot of companies that like you know help you uh uh uh you know an agent view a web page. Uh these are just all extra you know burning of tokens for things that probably don't need to be need need to happen. you know, the website usually knows what data and and you know, we've had things like this called, you know, we've had APIs, uh, you know, ways that computers talk to each other for years. Uh, it just, you know, APIs only covered a small fraction of the information on the internet. Uh, and agents, uh, have a thirst to to, you know, understand everything. Uh, and so they're going out and trying to explore the the human internet. Um, and, you know, we need to make it, uh, easier for them. uh we need to make it you know less costly for the the site owners and we need to find a way for uh um them to get compensated you know uh you know I think I think it's in a world where it can get very simple you know uh you know most like a content website like a substack that you know they know what their CPM uh is for how much money they should be making on ads uh uh u for that site and so uh if if an agent's reading that site uh I think there is a world where you get to the point where uh uh an agent can decide whether or not they want to read the content and then they can decide uh if they want to pay the the CPM rate, right?

15:33And you know that's where you need to then get new payment rails for the internet uh that uh can do you know millions of transactions a second uh for uh these all these little microp payments uh all these things that we've been talking about for years uh you know u microp payments you know always are two years two years away and uh um uh you know uh I think agents will will actually push that forward and actually I think we will see a world where where actually there is a new economic model for content creators. what who do you think the players are or what are the variations of that infrastructure right like I I think obviously um Cloudflare has an important role to play here but the the rise of personal agents like Instinct and Muse have also made this like an immediate question from a transactional perspective >> I don't think everyone knows on the you know on the other side what the business outcome is going to look like you know everyone's been through these transformations where the internet you know it was going to kill Main Street it didn't kill Main Street there you small business are still uh uh thriving.

16:31Um uh but you know there were people that were displaced and so there there's always kind of some skepticism there and so you know there's some natural inclination to like just block them out right uh you know you saw Amazon just say uh no no personal no personal shopping there uh from an agent. Um uh I I mean I think these are all people that uh are are are you know this that messy metal where they're trying to figure out what what that path forward is and uh trying to keep some of their you know negotiation uh uh leverage there. Um I think we will get to a place where uh uh uh muse and uh dots and uh all those personal agents will be able to uh accomplish tasks uh seamlessly as you as a human could do even even easier.

17:17But uh I don't know if the technolog is quite quite caught up to that yet and the uh business models either. >> Is there anything you're personally excited about on the road map or just from a technical exploration um perspective on the cloudflare front that you like feel like is going to enable this ecosystem in the future? Um well yeah I mean absolutely on the uh uh content side you know we've released u a conference monetization gateway where we make it easy for people to put their sites behind us and uh uh uh take microtransactions uh uh for their content. uh we uh um including uh providing a wallets for agents to use um uh uh and uh and a stable coin that's going to be able to help kind of uh facilitate that transaction as well.

18:05Um you know, we're also doing things uh with OpenAI, a project called Signals where uh we're making it easier for uh um agents to actually discover content instead of having to crawl the entire internet and uh continually go back to pages. are making it easier for them to uh uh know what's new content and actually kind of more proactively do that. So, you know, it's a it's a win for the uh AI labs as well as a win for uh the site owners not having to get uh constantly crawled and pay pay for that infrastructure. Um so, you know, there's a whole set of uh kind of new laws in the internet uh that I think really excited to see uh those uh uh kind of grow to see you know the uh you know X42 from uh when Stripe came out with it. loved it because it went back to the 402 uh HTTP code uh which was uh uh you know um Tim Burns leak created uh you know 20 plus years ago or 30 plus years ago uh for payments.

18:58So like you know we kind of always knew that you needed a payments a better payments rail on the internet uh but we haven't been able to you know kind of figure it out and uh uh I think agents will lead us to that as well. when you think about these um initial products that you've released, like is there what what would success for a content creator or somebody who ostensibly had a website on the internet that they were monetizing with ads before? Like what's the what's the killer success case you guys need to see or show the world where it just becomes like a default to do this? >> Uh well, I mean, I think we're instead of uh them paying us, we we're paying them, right? you know uh uh where it's it's covering their infrastructure costs. It's providing uh uh money that uh uh uh that uh uh supports their livelihood.

19:46Um uh you know, you know, we can actually increase the number of content creators out there which uh you know the the last generation of of the internet has done very well like with YouTube and Tik Tok and uh XA um uh I think we can actually make it even exponentially larger. And when you look at the workspace um OS like release and ecosystem work that you guys have been doing, what is uh what are you hoping are the like biggest use cases of it coming up? >> This is kind of transitioning a little to a we released something called Cloudflare OS. Uh and Cloudflare OS was uh is our internal uh platform for uh how our employees uh use AI every day. uh where uh we you know and it actually goes back to security roots where uh you know uh uh we were very worried about uh customer data internal data leaking out and we wanted to make sure that our employees uh could you know uh use all the new AI uh tools and models uh but have a way to safely uh uh deploy them internally uh to understand uh uh how that data is being used and flowing um and uh have have you know kind of good governance o over that.

20:53Uh in addition uh the reason my company called Cloud for OS is uh um we started to uh realize that uh you know as we had more and more agents uh you know uh we needed to be able to teach them uh what made Cloudflare special how we built a cloudflare um you know and for humans we did that through Cloudare University and uh the onboarding process and you know meeting your colleagues and working with them. Uh but we needed to kind of more clearly define that and document that uh for agents and so Cloud OS is both the platform where our employees can build anything that they want. uh in a secure way without having to you know security it's not something that they have to think about. um you know the the BR that's trying to create a call list uh they don't have to worry about security um is just built in there um for them but they also know that it's being done in a way that is uh consistent with the themes and values of uh how cloud works >> and and why release I think of this as like somewhat different from the other products that cloudfire offers today in that it is not infrastructure it's like an enduserfacing um uh product for managing um AI use within within the organization like Why release it or do you think of it as a departure?

22:01>> Yeah, I mean uh um for one it was it's kind of a reference architecture really. Uh it's you know we over the past 10 years we've built some uh uh our developer platform where we started with just a simple uh serverless compute primitive uh and and now you know over a 100 different uh uh uh developer platform tools uh from storage to databases to durable objects. Um uh we wanted to show someone show how you can build it completely on on Cloudflare. Um and how we build things internally and kind of uh uh uh give people the option to uh you know fork it and build uh their own version of uh their own company OS on top of >> um and and what is a way in which it is helping your people and your organization that you think is like clear success?

22:48>> Uh it's actually used more by uh uh our go to market teams and our GNA teams. uh uh than it is even used by our engineering teams. uh you know uh uh it's you know giving them a a a very fast you know early on I thought you know we saw training was the biggest gap for people using uh AI and when you just kind of point them at a a chat interface um or another byputting tool uh it's too much a blank slate for them uh and so uh you know this is a platform that's design you know you design everything for it for how your business works and you they immediately can go there and you get access to all the data that they need. Uh they can uh get guided and taken taken through uh where they quickly realize, oh, this is not, you know, trying to replace me.

23:34This is trying to make me better at my job. Uh and that's been really exciting to see uh just uh just all the different ways uh uh people at the company have done that. Uh you know, a lot of the the uh uh how this the conference got put together. the marketing team uh I mean built hundreds of internal tools where previously you know they would have they would have to go out and uh uh work with different agencies but they can you know the speed that they can move with a smaller team now it's just amazing. >> Assuming this is a continuation of you know starting in May you guys did this restructuring to be an like sort of AI first organization um what what else reflecting on you know the last number of months uh has worked or not worked that you would recommend to others? Yeah, I mean so uh you know that the the restructuring was hard um you know saying goodbye to some of our colleagues was the first time cloud for ever did it.

24:26Um you know we had always been very uh careful not to overhire and uh um but this was for different reasons. Uh this is because we we saw the uh the way AI was transforming some teams and how they work. Um and you know we kind of thought of it as like a factory floor where you needed to re actually rebuild rethink how things happen. you know uh the there were some processes or some you know the way a product manager would send an email for to customers. It involved three teams. You know it involved a team where uh you know uh you went to BI to go get a cohort of uh uh the people that you wanted to send an email to. You went to the marketing team to help you design the email and and get the voice right. Uh you went to the marketing operations team to get the email out. uh where you know it you're never going to be able to uh actually redesign that process unless you kind of kind of make some hard changes and uh uh force people to kind of rethink well what actually is the right way to do that.

25:22Uh and it might not involve those three teams at all. It might just involve uh a new way of doing things and you know so what came out of that was a a tool where a product manager now goes in and describes the cohort. Uh they write an email it rewrites it in CloudFare's voice. it sends it to their manager uh um and the manager can click approve if they like it and it it goes out. Uh where you know we didn't go from three teams getting faster at uh doing that. We went to you know one tool that can kind of uh let a product manager now have a superpower that they didn't have before. When you think of all of the different workflows and tasks within an organization that's got about 5,000 people like Cloud Players, like how do you decide who the owner is of rethinking that process? And and like was it bottoms up from one of those teams in this case?

26:10Like is it an organizational leader? Like when you have so many of these things that could change to be faster and make more sense as you described. Yeah, I mean Cloud For has always had a thousand more things that we could we could ever do, whether it was, you know, products and features or things like this. And so, uh, we we we always look for people that, uh, uh, are going to take initiative and ownership. Um, and so, you know, it doesn't really matter if you're ordering it, you know, one to 100 and try and prioritize it. Any one of those hundred things, uh, are are probably safe if someone's passionate about it. So, you know, we we we kind of gave people at the beginning of last year the uh the tools and started seeing how they were experimenting and you know, people quickly kind of uh broke out into different cohorts of people that were really leaning in and uh um you know, just naturally doing those things and taking ownership of them.

26:56Uh so, you know, I think it was very uh bottoms up from the uh how we're going to uh do those things. Uh it's been a major topic of conversation for organizations as to how they should think about um token budgeting right like you know what's a reasonable amount to spend how do I think about this versus human capital who should get tokens even within our organization like what is your philosophy on this now >> it's definitely changed uh you know uh each model kind of makes you re rethink it as the the cost dynamics change but uh um you know in in general uh Um, uh, you know, I think it's kind of silly that we're actually asking humans to decide which model to do each task. Um, >> like it should be intelligently routed.

27:43>> Exactly. Like humans just aren't aren't going to ever be good at that, right? Like uh um you know uh uh um but you know early on you do it kind of uh brute force and you you know people you get people to experiment and you say hey well you know let's try for the planning part let's use the you know the uh top frontier models for that. Um and then uh you know once the plan's written out and agreed upon and iterated on then you know uh potentially some more of the open source models uh can go do that and then you go back and you have a uh one of the frontier models do the the reviews and the red teaming and and things like that. Um now all that today is you know fairly manual. Um uh but I I think you know as we start to learn and experiment I think people will become intelligent uh and uh you know uh uh uh and you know over time there'll be more governance on that you know coughware um has been in a place where uh uh you know largely we've let people use the models and tools that uh they they see fit um for the job.

28:39Uh you know we don't have we don't have a token uh leaderboard. Uh we don't encourage it. encourage people to focus on the output. Um the uh uh uh you know they're not graded on, you know, if they used it, they're graded on, you know, what they've shipped and what they've built. Um but then uh u you know, we do have some kind of uh we found like just kind of like giving people notices like, you know, if you happen to use $300 a day, they just get an email, right? Like says, "Hey, did you know?" And because most of the time people didn't realize they were doing it >> and they're like, "Oh, huh." Uh, and then I think if it gets to like 500, it goes to your manager. If it goes to a thousand, it goes to a VP in a day. But it's it's uh, you know, it those things rarely happen and and usually it's it's it's people are actually happy to get those notices.

29:25Where do you think you are in your overall evolution of like take things just for the current level of capabilities of of models assume no new development of you know rethinking the way different things at cloudflare are done from go to market to engineering to be >> oh I I think still so early uh um you know uh uh comfort did something uh you know two years ago we had about 200 interns and uh what we saw was those interns uh I think were you know uh really the first you know fully kind of AI native uh you know where that if you took AI away from them I don't think they would be able to work and uh uh >> is that good >> I actually I think it is I I think they know how to use the tools better than us it's just like you took Google away from me you know over the last 10 years you know like you know how would I learn anything right like uh uh that's just that's where they reached to first um and and and we actually saw the managers that had interns that from that uh that that summer uh actually adopt AI faster so then this past summer uh this past year uh we decided we're going to hire a thousand interns.

30:29>> So that's you know uh >> for 5,000 person company. >> Yes. Wow. >> Yeah. Uh over the course of the year still >> Yeah. And uh it's just been amazing because you know uh one uh uh just the number of ideas that come from the interns you you know that's something that you know with AI less people experiment faster and so having more ideas uh to get more people in there but also uh just seeing the the way that they uh uh use AI like uh you know um they need to fill out a form uh they they reach for AI um and and I still find myself you know there are so many things where I'm like oh wait I've just been doing this manually still uh And then I'm like, "Yeah, oh wait, actually I should be using AI." And I I don't think that that's a natural uh um uh natural for most of us yet. Um uh and I think that will that will take time.

31:14And uh so yeah, I think we're still very early uh in our AI journey. >> I love it though. The mass intern strategy. Uh I run a very small um partnership and we always have a uh you know an intern or two floating around a team of about a dozen for you know ideas and intern energy and all that but we just converted one of our um you know in college interns to full-time and uh and Jed and had him drop out and everything and I I I think that you're right where maybe like the dial should be turned up on the amount of DNA that is really really native to these tools. Yeah, I think it's great for them as well, too. You see these schools like Waterlue and Nor Eastern like with these uh these co-op programs uh um and and you know, from what we've seen is uh uh people that get that type of real work experience uh just you know uh are some of our best employees uh uh many years in and go on to do you know uh great things.

32:12It is interesting or encouraging though that in instead of it being like hey here's a master plan where we're going to map out every department and sub department at cloudflare and be like here are the key workflows we're going to try to re-engineer the workflows. It is instead a strategy of like assume people are rational about their tokens if given information about their usage hire a bunch of interns and assume high agency people we have here are going to go like >> you know shift shift those workflows to something more intelligent over time. >> Yeah. and then and then brute force and just try things. You know, early on uh um uh we had an email alias called agents at Cloudflare where we uh this back in January of last uh of this year where we uh just told people to uh uh you know you curious can I use AI for this you know email in your jobs to be done you know uh and uh uh that email would this would reply back to the skill file.

33:04Um uh and for a while people thought it was actually you know thought it was all AI and automated. It was actually a bunch of interns that were uh you know uh helping people write scale files. Uh uh but that let us kind of get to see uh uh you know in a a way that's not going out and like you know hiring a consulting firm to come out and like catalog every single thing to be done. It's you know people that uh are recognizing hey this seems harder than it needs to be. I wonder if an agent can help me here. Is there anything else about the last year that's changed um uh beyond the intern level like your hiring philosophy and what you look for in people to bring on? >> Um well I mean one of the biggest things we've always looked for is curiosity and so you know if if people aren't using AI at home in their personal life and all that I mean that's a pretty big red flag like I mean just uh how can you not uh uh be embracing AI if you have you know a level of curiosity out there.

34:01So uh um you know I think just double downing ding down on some of those uh uh kind of key characteristics of you know drive and curiosity and empathy uh um uh play even better for uh this next set of uh people. >> Uh well I I'm I mean I uh I am a alpha user of all products and technology forever. So but I I think the answer is like fear and skepticism, right? Um and and so I I I guess implicit in this um claim about like curiosity including in experimentation with uh with frontier tools is uh like that needs to uh that needs to be a core principle for people who work at Flare.

34:46>> Yeah. I mean I mean a lot of things we're doing we're not you know uh uh we're inventing new ways of doing things. I mean the scale that we operate at uh for the uh number of sites behind us uh um and the the amount of uh free uh services we give away it's just not possible with off-the-shelf technology uh um so you you need people that can come in and literally invent new things and and uh that I mean that that starts with curiosity. >> I have a couple questions for you to to close out and so mainly about security both uh and how to do that in a new way both at um at Cloudflare and then how you think it's going to work in the in the broader ecosystem. Um what do you think is the like process by which if if half the engineering team is going to go work on security and just like fix 70 years of vulnerability um how do you attack that problem internally assuming that not all software is perfect even amazing production internet scale software and then you know we'll talk about the ecosystem >> yeah I mean I think largely uh you know we're you know today we have one red team I I think by the end of the you know the end of the year next year we will probably have four or five red teams Uh so uh you know break people out into groups that are actually um uh you know being more adversarial and actually like uh going out and actively trying to find uh uh vulnerabilities.

36:01Uh >> why is that the approach when instead of like oh we're finally going to get like our patching systems right our processes right? I >> mean processes and those things could always be better. Uh we have a ven process we have a patching process. >> Uh are they perfect? No. uh but uh uh you know the best way I found for those sorts of things to get better is to out of out of crisis kind of comes uh uh uh uh that that that has that's that's how you get those things fixed. you know when the volumes get too big for uh the engineering team to just do them on using their normal processes you know uh you know engineers are inherently lazy in a good way uh and so they they will they will automate uh away those those things as they as they as they need to as they kind of realize that there's no other way way to do that um so you know you know I think the focus needs to be on the discovery side uh and uh uh you know people will do the right thing and figure out how to patch it in in a scalable way over time.

37:00Do you express a philosophy on just prioritization of this versus like shipping new features? Uh because I guess my understanding of it's it's not as if we didn't have a backlog of like vulnerabilities in every large piece of software to go fix. It was just like whether or not that was a priority for engineering teams previously as one common state. I >> I mean I I think uh you need to figure out how to do both. um you know it might come at the expense of uh cost optimization or other things but I mean uh companies uh if if you're not shipping you're dying is how we think about it. So uh >> so it's not going to be freeze in order to do this. >> Oh no absolutely not. You know you need to you need to be able to continue uh um building and shipping new things.

37:47Um, but you need to be able to uh uh make sure that you're doing it, you know, uh securely and patching and and fixing bugs and uh um uh I I think if we do it right, we actually be able to do them both faster uh with AI. I mean, while while AI has become the uh the tool that's causing this kind of the security apocalypse uh uh apocalypse uh to happen, uh it is also the tool that can help us solve it faster as well, right? So, so, so it's on both sides of it. >> Oh, where do you fall in this debate of um the role uh like good and bad of open and closed models on the cyber front? Right. Um because the the the argument the broad argument is well having defensive and offensive cyber vulner um uh cyber capabilities you know they're parallel in the same model um uh despite uh safety and guardrails being being built into them.

38:46And so you can't have open defensive models without them also being offensive. And then the argument um sort of uh or the concern around only having security capabilities in um a a set of frontier closed models is well how are you going to release them and you can't possibly get them out to the distributed set of actors that need to defend like what what do you think or did I characterize that correctly? >> Yeah. I mean uh I think over over time it all has to be open because everyone's going to get access to it anyways and uh um uh you know >> that's how open source tends to work. Yes. the the bad guys the bad guys are are going to find a way to get it. Um so all you are uh and the you know the top companies will have a way of getting it as well. So I think you're you're just uh excluding a a mass population that just doesn't have have the access that that probably needs it. Mhm.

39:34And um and then so so final question just because you know Cloudflare uh very missionoriented does carry the weight of some you know uh internet uh resilience on on its back. What about all of the people who can't afford to have four red teams or like never had a red team to begin with that run important systems like how do they how do they protect themselves? Also uh you know uh uh I would say put your sites behind Cloudflare, put your infrastruure behind Cloudflare, build on Cloudflare. Uh you know uh when these major vulnerabilities come out uh like the React one uh uh last year uh we don't just give it to our paid customers uh who have like the advanced firewall and WFT capabilities we we give it to everyone. We view those kind of things as a um part of the utility that we offer um and uh you know uh um uh what it provides.

40:24that just like you know uh we want to provide performance for everyone. You know before cloud first started uh you know uh there were probably 3,000 sites in the world that had a large scale CDN uh to cach their stuff at the edge. You know now there's uh hundreds of millions of sites that do uh so you know copper's always viewed our uh our goal as providing democratizing the security and performance for everyone. >> Awesome. Thanks so much for doing this Dane and and you guys heard it first. Uh we have the the agent kitties and the vulp vul apocalypse. Am I pronouncing that right? >> Yeah. Uh but but it's resolvable. All right. Thanks so much, guys. >> Thanks. >> Find us on Twitter at [music] No Prior Pod. Subscribe to our YouTube channel if you want to see our faces.

41:09Follow the show on Apple Podcasts, Spotify, or wherever you listen. [music] That way, you get a new episode every week. And sign up for emails or find transcripts for every episode at no-briers.com.