AI Threats & Opportunities in Cyber Security With Material Security Co-Founder Ryan Noon

Cyber Security is going to change significantly in the era of AI, according to Ryan Noon, cofounder of Material Security, a security company that makes cloud-based Google and Microsoft email a safe place for sensitive data. Elad Gil and Ryan talk about how Material Security started to use LLMs, potential security threats from AI hacks, and the role of the government in securing the Internet. Ryan also shares his advice for founders. Ryan co-founded Material Security in 2017 after seeing high profile email hacks in the 2016 Presidential election. Previously, he led various engineering teams at Dropbox after it acquired his first company, Parastructure. Prior to Parastructure, he led engineering at a data analysis company spun out of Stanford by DARPA. He holds both an MS in Computer Networks and Security and a BS in Computer Science from Stanford. Show Links: Ryan Noon LinkedIn Material Security Website The Market for Silver Bullets by Ian Grigg Sign up for new podcasts every week. Email feedback to [email protected] Follow us on Twitter: @NoPriorsPod | @Saranormous | @EladGil | @InternetMeme Show Notes: (00:00) - How 2016 Election Hacking Inspired Ryan to Start Material Security (05:00) - Generative AI Use Cases in Cyber Security & Fine Tuning (11:36) - Predictions on Effective Threat Levels from AI Hacks (14:45) - Democracy, the Department of Defence, DARPA and Cyber Security (20:14) - Is there room for startups in the Cyber Security industry? (26:40) - New Challenges On Horizon After 7 Years as Cofounder (32:30) - Advice to Founders

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:05Speaker 00

  So this week, I'm joined by Ryan Noon. He's the co-founder and chairman of Material Security, the cybersecurity company making cloud-based email a safe place for sensitive data. He previously started Paristructure, which was acquired by Dropbox, where he was an engineering manager prior to starting Material Security. Ryan, welcome to New Pryors.

• 0:22Speaker 01

  Hey, it's great to be here, man. Always lovely to talk to you.

• 0:25Speaker 00

  It's always fun to chat with you. So one of the reasons I'm excited to be chatting with you today is I feel like you have such a great perspective on both the broader security industry, various tech topics, et cetera, but also specifically how this all starts to tie into AI. And I know that at Material, you were a very fast adopter, actually, of AI-related technologies as the first sort of APIs really came out and you started playing around with them quite early and doing interesting things with them. Do you want to first talk a little bit about how you started Material and then maybe we can touch on how you started getting involved with the AI side of it?

• 0:55Speaker 01

  Yeah, sure. So we started Material, I guess, 2016, 2017 or so. I'd left Dropbox and was living in Europe and fell in love with all the election hacking that happened that year. That year was pretty nasty. Like, every random Gmail account kept getting dumped on the internet. So I had an idea for how to protect a Gmail account, just an ordinary, personal one, in a fairly novel way. I coded it. It shockingly worked. The Gmail API let you do it. I brought it back home and showed it to some friends and we realized this is actually a special case of a broader way of thinking. Now, seven years later, it's a cybersecurity unicorn thing and we get to work with the

• 1:39Speaker 01

  coolest companies in the world by far. And the stuff that you get to do at this scale is just mind-blowing. It's wild to think just where it started and where it's come.

• 1:50Speaker 00

  And what are the main products that Material focuses on, just for the audience, so they have a better sense?

• 1:55Speaker 01

  Yeah, so the broad thesis is basically we've all kind of got these Google and Microsoft accounts. Email is sort of where we started, but since then, we've kind of just... Went deeper and deeper and deeper into sort of everything that you can use, you know, a Gmail account or a Microsoft account for. The bread and butter of the business is selling, you know, to companies, you know, midsize and up with these kind of these big Google Workspace and Office 365 deployments. The product has a bunch of different modules that are all kind of based around the the main things people worry about. The the kind of the first big product that you mentioned, you know, in the intro was people have years and years of sensitive information sitting in these accounts. If somebody, you know, gets into your Google account,

• 2:39Speaker 01

  they're just going to download all of your email and go through it later. And your whole life is in there. It's even worse, you know, in a corporate environment. And so that product, what it can do actually is finds, you know, sensitive stuff that's just sitting around, kind of just sitting in your inbox, your archive, whatever. And then it can basically redact it and then replace it with a clean copy. So that if somebody gets in and downloads the whole thing, they don't get anything good. But then if you happen to need it, like I like having all this information at my fingertips, you can just press a button and do an extra face ID or a touch ID or, you know, more advanced policies and work, but just something that's easy for you but hard for the attacker. So we started there and then we expanded into

• 3:22Speaker 01

  anti-phishing. You know, people can send you tricky emails and get you to do things and steal money from you. We expanded into account takeover protection, which is, you know, more of the things that people do after they compromise the account. And, you know, I try to reset all your other accounts and steal your bank account and all of that. Just the the operative concept is defense in depth, which is just, you know, like, just assume that the bad guy got in, like, what do they want? You know, like, they got over the wall, there should be another wall and a machine gun. You know, it's like, history has all these fairly basic lessons about resiliency that never really always get applied the right way when it comes to computers. So

• 3:58Speaker 00

  Yeah, so it's kind of like, I guess, the part of the impetus was the 2016 election, where, you know, there is all the things around the Podesta emails and Hillary Clinton and everything else. And the basic idea is Somebody's able to hack your account, but it doesn't matter because your email is not accessible to them or the sensitive information that you designate.

• 4:15Speaker 01

  Yeah, I mean, it matters, but we used to call the company like seat belts for email or whatever back in the day. It's like, it sucks to crash your car. It really sucks to go through the windshield. Google and Microsoft, you know, have a total duopoly on all of this. And kind of whatever little thing that they missed from a security perspective is, you know, world altering. You got like, I mean, there's a headline every couple of months, like every cabinet secretary just got their email hacked because all of the eggs were in Microsoft's basket, you know? And, and so we kind of just exist to fill the gaps in whatever doors they leave open. That's, you know, it's, it's very fragile having a duopoly. Duopolies are stable in the market, but, but very fragile when it comes to security.

• 4:59Speaker 00

  Yeah, that makes a lot of sense. You were one of the fastest adopters, I feel, in terms of hands-on use of L L Ms for security applications. How did you start thinking about the use cases where generative AI would be useful?

• 5:09Speaker 01

  The, the second you give a coder a REPL, uh, you know, we will, we will start iterating basically, right? And ChatGPT, if nothing, was not the world's greatest REPL. So, I mean, we just started playing with it and then we're like, there's a lot of security domain knowledge like baked into this thing. It turns out if you feed, you know, precisely one internet to precisely a million GPUs, it picks up a thing or two about cybersecurity. And so, you know, it's, it's the kind of thing that obviously like the bad guys are, are, are starting to figure out in earnest. Uh, and, you know, it's not like you can prevent this stuff from getting democratized, but we just, we just, you know, you could do simple things like you could feed it.

• 5:46Speaker 01

  You know, like a bunch of, you know, raw email headers, anyone who's coded with these things, it's, it's like this weird wetware grafted into the middle of a computer. You know, it's like, it's, uh, it's, it's squishy and, and stochastic and parody, you know, but you have to integration test and, and model around it. I think the analogy I used at the time is like Shang Tsung from Mortal Kombat, like it has, it has eaten the souls, you know, of, of thousands of, of security engineers. And so like, you might as well use it because honestly, like, there's a lot of just raw operational work that happens in security of just like, we need to, you know, rarify this signal, filter out the noise, and then honestly feed it through a human being who has some experience as to what the bad guys are trying to do.

• 6:30Speaker 01

  Uh, and, you know, it turns out L L Ms are fantastic at that. And so that was, that was the first use case, um, that we really kind of productionized. But, you know, beyond that, it's, it's kind of. Gone crazy. So there's a lot of engineering you have to do that.

• 6:41Speaker 00

  It's kind of amazing because if you look at modern LLMs, they have this mixture to your point of sort of this deep knowledge base, which is the internet and to your point, sort of the souls of security engineers on the internet. And then, you know, it has this sort of chain of thought or sort of reasoning that is very useful to use in certain circumstances. Is there any data that you feel is really missing or a specialized corpus you need to provide or anything else that really helps from a security perspective that you, you know, you need to augment or fine tune or do something with?

• 7:06Speaker 01

  Honestly, like, you know, I I've seen a lot of, you know, startups starting from scratch here and whatever. And, you know, as as an engineer, like, I know when I have headroom and honestly, even in like GPT three and a half, there was plenty to work with. I'm seeing a lot of shovel selling, obviously, right now in the AI market. And I'm seeing a lot of like, you know, I need to pretend that I have a moat, so I need to, you know, fine tune all this stuff and whatever, whatever. But yeah, no, I mean, so many things that were very, very, very hard for computers, you know, 18 months ago are very, very easy for off the shelf models. So like, I I think, you know, maybe chew your food first, security industry.

• 7:48Speaker 00

  Yeah. What do you think are the best application areas then for generative AI and security? Is it pen testing? Is it phishing? Is it something new? Is it some form of like supply chain?

• 8:00Speaker 01

  Yeah, I mean, it's obviously the the offensive side is what you're not supposed to talk about too much. But obviously, the bad guys are talking about it. And in security, you know, it it does have this arms racey sort of aspect to it. So like, you know, we need security LLM companies because the bad guys exist. Honestly, like the the orders, you're a thing. When I keep meeting with founders, you hear this, there's all these like kind of classic cliches in the cybersecurity industry, like the cybersecurity skills shortage, like America needs, you know, to bring back the draft and make everyone get a security certificate or something. Okay, like, you you know that you have like 90% of a human that you can use for like a penny and a half, right? Okay, start there, you know?

• 8:46Speaker 01

  And so like, there's just basic things like that. But it it gets, it gets more interesting, I think, from there. But like, let's go to Disney World collectively after we do that and then we'll come back, you know?

• 8:56Speaker 00

  Do you see any CISOs actively using LLM tools today? Or is it still kind of early and it's like there's an adoption curve? And or is it going to just be in the hands of the vendors?

• 9:07Speaker 01

  Well, I, I think the best thing about the security industry is that there's also the security cottage industry of like, it's not the fancy security vendor who's, you know, buying the CISO steak and having them drive Ferraris around Vegas every August. It's like just a strong like security engineer who's just hacking something together. And so some of the best companies that I've seen, you know, are just that. And, and so you're seeing all these like, there are cool projects out there. You know, I, you know, I don't want to name drop too many of my friends on this podcast, but like, you know, just like the, the stuff that sockets doing, just like analyzing NPM dependencies, like, you know, even just like stack analysis, like looking for like, you know, hey,

• 9:51Speaker 01

  you, you dropped sensitive information in the middle of your code base. Like, that's like such a messy, hard problem as any like computer science can, you know, person can tell you. And like, these things are pretty good at reading code, you know? So like, all sorts of just basic stuff like that is, is starting to, to pull through. So.

• 10:07Speaker 00

  What do you think is the biggest risk or cyber threat from this technology?

• 10:11Speaker 01

  Oh, I mean, like, it can be a human and I'm just, I'm just talking about the text models, right? Like so much of cybersecurity is just text. And there's nasty hacks, you know, that are, that are reported, you know, where someone's voice was fake very convincingly. And they made a phone call and blah, blah, blah, like humans, you know, trust humans through computers. That was, I think, the key mistake we made, you know?

• 10:35Speaker 00

  Yeah, I guess there's a lot of APIs now that do voice cloning like LMNT or 11 or some of these other folks, right? And so basically I guess the threat is that somebody voice clones and then they can use it to call you and pretend that you're, they're your bank and ask for permission to do a wire or spoof you on the other side where.

• 10:52Speaker 01

  It doesn't even have to be that hard. Like as in the standard, like, you know, new employee joins company, receives text message claiming to be CEO thing. Like it works at scale, you know?

• 11:05Speaker 01

  Uh, so like, and it's, you know, the sheer amount of like, you know, you go, you go see these attacks that, that random bad guys are sending to people and like, they're not even like using grammar properly. Like, all they could do was like, spell check the bad guys and that's all you were using, like, whatever off the shelf, you know, open source LLM for. Like, even that would make a, a, a difference materially on, you know, cybersecurity policy returns.

• 11:29Speaker 00

  How bad do you think this gets on what timeframe? So say we're at, you know, it's three years from now and we're at GPT six or something. Do you have any predictions in terms of the, the sort of effective threat level or the capabilities or what might happen then?

• 11:42Speaker 01

  Yeah, I think we all kind of like wonder about this. Um, I was talking to somebody from the White House who was like, trying to figure out how to talk about security LLMs a little bit, like, think the operative analogy that ended up helping was like, Bronze Age versus Iron Age kind of thing. And that like, if you're, you know, if you're, if you're a, but like a tribe or something and you have bronze weapons and your neighbor next door gets iron weapons, uh, then like, you're, you're going to have a bad time. Like, you're going to need to go and get iron weapons. And so all of this talk about like, you know, we need to, you know, airstrike the data centers and, and prevent it from being aligned or not aligned or whatever the current term is. Like, that's like saying, you know, well, this super high grade carbon steel from space, you know, needs to be restricted.

• 12:27Speaker 01

  But honestly, like, if someone's got iron weapons against your bronze armor, like, good night, you know? And so these LLM things, it's, it's a step function. Like, you know, forever often, you know, we used to whine that we only had, you know, 140 characters and not like flying cars. Like, technology does give you step functions every once in a while. Uh, and like, this is just that, you know? So it doesn't mean that like, you know, we're all doomed now. Uh, and I think we, getting a, a, like a sense of the scope of the threat is really hard in cybersecurity. Cause you could be like, you know, hey, you know, we're a Fortune 500 and we left the front door open for a year and no one walked in it. Like hackers are fake, cybersecurity industry is BS, right? Or you can be some like little no name company and just get run over and you're like, the barbarians are at the gate.

• 13:11Speaker 01

  And it's like really hard to know exactly what you're up against, right? Uh, but what's interesting is that like, Automation, like it's like the you can be more human and you can like one human can now supervise a thousand humans, you know, you don't need a room full of like jerks trying to hack grandma or whatever, uh, when honestly like one jerk will now suffice, you know, with a for loop.

• 13:35Speaker 00

  Yeah, to that point, it feels like there's a few different types of actors in the cybersecurity world, right? To your point, there's sort of individual players, sometimes that's ransomware or sort of financially driven folks. And then there's state based actors, right? And it seems like some of the attacks we had a year or two ago on parts of our more physical infrastructure and supply chain may have been through state based actors. How do you think about that in the context of these things? Is that, you know, we must continue to invest in L L Ms at scale as a broader national security side of things? Does it modulate your thinking at all?

• 14:07Speaker 01

  Yeah, I mean, fundamentally, like you have to invest in cybersecurity, like my, my moral basis for cybersecurity existing is that is essentially like the, the waste heat of all other innovation in, in computing and information, which is like, you know, if a computer is doing something new for you that it wasn't doing last year, then like the utility of that will drive adoption and then like cleaning up after it for like whatever the side effects of that are, uh, is what, you know, essentially cybersecurity, you know, does, right? And so we are the, the cleanup crew for all other innovation, uh, which is, you know, it's, it's a, it's a living, it's a, you could, it's an honest living. So whenever innovation happens, like the entire world will adopt it before they realize

• 14:50Speaker 01

  like, oops, it messes up democracy or like, oops, whatever, you know, like utility drives adoption, not safety, like welcome to earth, you know? And so, uh, so I, I think like the, on the, the nation state side, like it, it's, you know, you don't have to even be hyperbolic with like, you know, it's the atom, it's the whatever. It's because like, you know, fundamentally like intelligence is now a commodity that we can arms race, you know, like weird, you know, it's, it's not, uh, you know, like atomic power can arms race, like no, like intelligence itself can now go red queen.

• 15:25Speaker 00

  Yeah, that was the original premise under OpenAI, right? The concern was that, uh, Google and a few other folks had, uh, you know, real advancements in AI and they were driving most of it. And so OpenAI, I think originally was meant to be kind of a counterbalance to that. So there wasn't a single player that would effectively dominate all of AI or if it was, it'd be under this sort of, um, Philanthropic guys, right? And so it's interesting that even in the early days of this stuff, a lot of the emphasis was on this, let's avoid some over aggregation of power within AI.

• 15:58Speaker 01

  But if you have a lot of intelligence that is extremely online, like you have a ton of power and, you know, the West, I think, is especially vulnerable to this, like open societies, I think, are extra vulnerable when it comes to infosec stuff because, like, we, we put it all out there, we, we adopt these systems, we open them up, we let the private sector totally handle them, you know, like, we, we, we are early adopters of every digital technology and we are very happy to wave our soft underbelly on the internet as a society. We don't, we don't lock it down.

• 16:30Speaker 00

  How, how does that differ from totalitarian states from a cybersecurity perspective?

• 16:34Speaker 01

  Like, you could literally, you know, if you're like North Korea, you're gonna say, you're all gonna use this to the next distribution, but it doesn't support, you know, whatever I want. I'm sorry, we're an authoritarian state. Like, oh, oh, well, what, you know, like, what if I get phished? Sorry, like, that's not how bank accounts work in our country, you know, like, it's just like, you can control information, you know, you can't, this usually gets like viewed through the lens of like, social media disinformation. If you can, you know, regulate and lock down, you know, the entire social media discourse, then like, you know, what election is going to get hacked and where would it get hacked? You know, but the same thing, I think, holds true for all of, all of cybersecurity. The other interesting, you know, like way of looking at this that's always kind of baffled

• 17:15Speaker 01

  me is that, you know, if, if cyberspace is a space, right? Like, in, in like, US military terminology, it is a command, just like, you know, North Africa is a command, like, cyberspace is a command, like William Gibson, you know, would be proud, right? But like, in this space, like, you are kind of on your own as an American, like, you know, it's like, if I, if I was in, you know, like, like, the, the military protects Americans and guards our borders, what does that even mean, you know, with like, cyberspace? Like, I hope you're harder to see, so, uh, you know?

• 17:51Speaker 00

  Is there anything specific you think the DOD should be doing relative to these sorts of threats right now? Or if you were magically in charge of it, like what would you change or what would you do differently?

• 18:00Speaker 01

  I mean, they do a fantastic job on a lot of levels. Like, you know, it's like, obviously, like, we were all had to, the valley had to deal with like Snowden and everything, you know, 10 years ago and whatever. And I'm not, I don't need to take a side on that one. But the point is like, we have some pretty incredible people, you know, doing offensive stuff as well in cybersecurity and deterrence works pretty well a lot of the time as what, you know? So I, when it comes to LLM specifically, I think everyone is still figuring out what the hell is even going on, you know, like it's, it's going to take them a while. I think you see DARPA doing really interesting stuff, you know, like there are interesting projects out there.

• 18:38Speaker 01

  But I think, and this is maybe a motif that I see broadly with LLMs is like, you know, the, unless you go super, super deep on this stuff, you kind of see everything through the lens of like the popular discourse of chat GPT. Like whatever, you know, the, the, you know, the New York Times or whatever has said about chat GPT or whatever experience you had the first time you used it six months ago, when you were on the free version is how you see everything. And so they'll be like, we need to make sure it doesn't make stuff up. We need to, you know, have it generate blah, blah, blah. It's, it's all kind of like order zero stuff. I think people have yet to realize that like the computer can think in like a much more salient way than like it ever could before. And so I think people are still playing catch up.

• 19:23Speaker 00

  Yeah, that makes sense. Yeah, it feels very underappreciated. Yeah, I feel like there in general, people are viewing AI as this continuum where it's like, it's a CNN, RNN, and now we have transformers and it's just a straight line. And instead, obviously, it's a big discontinuity in terms of capabilities. And I think most people still don't think about it that way. Or at least I should say many people, particularly outside of tech. And I actually think it's underhyped in all sorts of ways, which may be a different conversation.

• 19:43Speaker 01

  Shovel selling is overhyped, but I think the, the thoughtful, you know, discourse on what our society will be like in 10 years is probably underhyped.

• 19:51Speaker 00

  Yeah, yeah, good point. So one of the big debates that people have in this area is what degree of things will go to incumbents versus startups? And in security, the incumbents are really strong, right? They are very good at buying things and bundling and cross selling and sort of the traditional enterprise playbook, which parts of tech have sort of forgotten for a while and maybe are coming back to now that we don't have ZERPA anymore.

• 20:12Speaker 00

  How do you, how do you think about the things that incumbents will do versus startups? Like, is there any room for startups right now on the, on the AI security side?

• 20:20Speaker 01

  I mean, there's, there's always room for startups. The cynical take here, or like the, the, the, the take I can give that is perhaps most informed and most cynical, whether this is whatever uninformed, informed pessimism versus informed, whatever, is, is that basically, you know, in the cybersecurity industry, there's some basic economics, right? There's, if you care about this, like, there's a great paper that is actually required reading for everyone who's ever joined material, which I've never enforced, but it's called The Market for Silver Bullets, right? Like Ian Greg wrote it. I think I've sent it to you once. And it's like fundamentally, you know, there's, there's like markets for lemons and whatever, but there's markets for silver bullets, which is that like fundamentally, there's, there's the buyer, there's the seller, and there's the attacker, you know? And so like, the buyer cannot really be

• 21:05Speaker 01

  sure of the effectiveness of what they're buying and whatever, whatever. And so you can't really like, look at a solution and be sure that it will save you, right? Like, you know, you, you could buy an insurance policy, you know, and, and there's a, you know, like a truism that all cybersecurity products are just, you know, complex insurance policies or whatever, right? But the, the, the point is like, that, that mushiness exists. And so what has resulted in, in, in the free market here is these incredible distribution machines, right? You have, you know, think like Cisco or Palo Alto Networks, or even, you know, Microsoft and Google to an extent, right? Where they just, they have the sales force, they have, you know, the, the bundle,

• 21:47Speaker 01

  they have, you know, the, the big conference with all the glitzy stuff or whatever, right? But they don't really know, like, if you ask the product manager at that company or whatever, like, and they're being honest, like, they don't know what bad guys are going to be doing in five years any better than anybody else does, right? And they don't know what's going to be effective. So why would they plant seeds from scratch when they could just go harvest crops that are already growing and, and transplant them into their yard and water them with all these salespeople and all this bundling and all this market power, right? And so these, these like paved roads, I think there's just a function of, of the extra, you know, like technological and product uncertainty that is just compensated for. That, that risk must

• 22:30Speaker 01

  Must be compensated for with extra low market risk, you know, and so that's what you see, you know, like Cisco just bought Splunk, but Splunk buys things, the whole market just works this way. I think I I wrote a blog post once where I called it the the cybersecurity industrial complex, you know, and it's like their P firms, you know, dressed up as innovators, blah, blah, blah. I was angry. I used to be very angry. But uh, but but fundamentally, this this happens. And so that means that we are kind of, you know, entrepreneurs, you know, at at at their worst, like there can be new gray cybersecurity companies that are, there's still creative destruction that happens, you know, some of the best cybersecurity companies, you know, didn't really exist 10 years ago. And that's like, you can still build big ones, like VCs, you know, don't stop, you know, like VCs,

• 23:12Speaker 01

  you know, when it comes to cyber stuff, will will like, you know, just go for base hits constantly, the worst ones, you know, and a lot of the best VCs like never, you know, make bets in cybersecurity because, you know, at best, you're going to get a $200 million takeout to Palo Alto Networks or whatever, right? That's the the typical outcome. But, you know, you can still build these big companies, uh, and and, you know, people should still try. Uh, but, you know, there's, but that that that farm system is still active, like no one really knows, like innovation will happen. And if the market's big enough, and, you know, you don't, as a founder, you know, you don't want to stop the game on second base or whatever, uh, and you want to keep going, those opportunities are there. Uh, and honestly, like discontinuities breed

• 23:53Speaker 01

  new companies, you know, and there's entire classes of things that are unnecessary and obsolete now. So much of security is, uh, is is emitting logs and alerts and then parsing those logs, alerts again, and aggregating them, you know, I I spent a lot of time doing, you know, did infrastructure and analytics in my life, you know, before, after my cybersecurity grad degree, but before I started using that degree. Uh, and, and it's just like, you know, serializing and deserializing data and parsing some old firewall thing from 20 years ago or whatever, and like an LLM can just eat that, you know, like depending on volume and and all that stuff. But there's just like, a lot of spend, I think, is up for grabs, uh, as long as, you know, people have their expectations, uh, in the right place.

• 24:38Speaker 00

  I guess outside of material, like, um, is there any larger scale security vendors that you that you've, uh, you know, publicly talked about rapidly adopting LLMs? I know material's been very fast on it.

• 24:49Speaker 01

  I mean, obviously, Microsoft had this, you know, top down mandate and had a year on everybody. And so they've been, they've been making a lot of noise and and marketing it. But you know, and that's theoretically cool, but I don't know how, I haven't used it personally yet. But I, you kind of, you probably saw this pattern, which is that like, you know, kind of the, the growthy companies with the nerdy founders, like immediately started integrating this into the product, right? And then the like, youngish public companies that like totally still got it, you know, would do like a thinner feature a little bit later. The big Fortune 500s are doing science projects, God bless them, you know?

• 25:33Speaker 01

  And so I, I think I'm seeing that and I haven't, I've seen plenty of first bucket things that are very impressive. I've seen, you know, like the, the, the, look, you can type in the box and if you have typos, the L N doesn't care. You know, I've seen that from, from the public companies that totally still got it, you know? And then, and then the science projects, you know, are just, just really good for OpenAI's revenue, I assume.

• 25:57Speaker 00

  Yeah, that makes sense. Yeah. And I guess there's also sort of the hybrid or overlap or partnership stuff. Like for example, last year, I know Material did a partnership with Snowflake to support Office 365 and Google Workspace and provided sort of enhanced security benefits to joint users. And so there's like, there's also that sort of approach where you, you partner with the large incumbents to, to bring these new things to market in some sense.

• 26:16Speaker 01

  Yeah. Yeah. I mean, cybersecurity partnerships are super, super, super important because like people, people hate to have to buy like individual things in their cybersecurity stack, but they also hate when they buy a big bundle that sucks, you know? So like the, the right answer for the customer is to like, just for, for the vendors to be grownups and to work better together where possible.

• 26:37Speaker 00

  Yeah, I guess more generally, you know, it's been about seven years since you co-founded Material. What do you think are the biggest changes or evolutions in security since then?

• 26:46Speaker 01

  It's a good question.

• 26:50Speaker 01

  Honestly, like, I don't know how much has changed. Like, it's like, you know, people still send emails, people still reply to text messages. I think, uh, you know, the, uh, there's always like the, but Slack is gonna have all those problems too, or whatever, whatever. And I think at the end of the day, like, if something's a walled garden, uh, like, it will be involved in attacks, you know, someone will go in and, like, own you because they compromised Slack after they compromised this and escalated that, whatever. But like, entirely new attack surfaces of like, you know, ways to get to users from across the internet, broadly speaking, uh, like, I think have, have, uh, somewhat, somewhat stable.

• 27:35Speaker 01

  What's the sad thing? I, I spend a lot of time thinking about like, mobile stuff. And it's, it's sort of this like tragic thing where like lock these things down like hardcore now, right? It's actually like super limited what like vendors can do. And, and the average employee, I think, understands that their company probably owns their work email account or whatever, uh, and has, has carte blanche to protect that and protect the company. But, you know, like, do you have your phone? Is it my phone? I brought it. I signed it in. Do I have MDM on it? All this stuff. And so that ends up being the situation where, uh, you know, even Apple, who's like so good at locking it down to the extent that, you know, Zuck is super sad or whatever, like, will, will lock down the device and prevent, you know,

• 28:17Speaker 01

  the most, you know, obvious forms of cybersecurity software being made. But like, uh, like, then we'll sit on the problem for years while like everyone gets run over, you know? So it's, people are, are usually, it's a sad thing in the tech industry that you probably see. People are better at keeping people out of their territory than using their territory, you know? Uh, it's this very, very nasty sad thing. So, uh, so I, I think some of these problems, I think have just gotten worse, you know? Um, I think there's always the, the, you know, infrastructure story of like, you know, the...

• 28:52Speaker 01

  Multi-decade mega trend of people getting rid of their data centers and allowing only a small handful of companies to buy all the semiconductors and then renting them from people that centralization. You know, it's, it's not like the most interesting thing for a lot of us, you know, but it's, you, you go to security conferences and it's, you know, I, I had to buy these seven things when I had a, had a data center. Now I have to buy this one thing, but it comes with Amazon, but it sucks, but I have to buy this other thing. So that, that trend is not done. And there have been some great companies that have been built in, in that space, uh, in the last seven years that, you know, like I, you'd think that like AWS and Google and Microsoft could like,

• 29:35Speaker 01

  keep this shit secure that they're renting you, but no, you know, like, so that's, that was, that's been one of my biggest probably misses as a, as a, as an investor, not even independent of security. There's years of like, well, AWS will bundle this one, you know, and then no, they don't. You feel like snow, I did diligence on Snowflake's B and told whoever asked me to pass because I'm like, Redshift exists, like AWS is not asleep at the wheel. And then, you know, AWS subsequently told me when I talked to them about this, they're like, you know, we get paid either way. Like we, they don't own any CPUs, like we can be lazy.

• 30:10Speaker 00

  Yeah, yeah, yeah. Yeah. They're the platform. So it works. Yeah. Are there other areas? Um, I, I know that a lot of founders in both security, but also in enterprise come to you for advice as they first get started, um, in terms of starting their companies. Are there other areas of like enterprise that you're most excited or interested in right now?

• 30:27Speaker 01

  Oh man, I have this love hate things with, with security. Like if I, if there's any founders listening to this, like security, like, like what's annoying is because it's very mushy. No one necessarily knows what products are effective and whatever, whatever. You can kind of just like really put your head down and like grind and sell and like build a beachhead with your company. Uh, you know, and it might be a totally okay product. Like I was, I was talking to a great founder yesterday and they're like thinking about what to build and whatever, whatever. And, and it's like, take a step back and just like, try and build an incredibly useful thing that everyone should buy. Stop thinking about the Gartner categories and you know, whatever CASB, UBA, SIM, whatever, DNR, something, something, something like,

• 31:12Speaker 01

  stop like trying to like, look at, at this like big, like, and you see these, like the, some of the cybersecurity, you know, I've anchors and stuff will put out these big quadrants of everything and how it all fits in. The thing that consumer people make fun of us enterprise people for uh, are, are extra make funnable uh, in cybersecurity, you know? And so, uh, so I'm always just like, you know, like go and go in there and like, just like, if it, if it's a thing that connects to an API that everybody uses and saves them all a bunch of time and makes it way easier, like just build that. Okay. Like stop worrying about your Gartner category. You got like five years uh, to even like, you know, start paying Gartner, you know, like stop it. Well, you know, how many people I've like sent your blog post of like, what is a good market?

• 31:57Speaker 01

  Like market is not the same thing as marketing, you know?

• 32:01Speaker 00

  Yeah.

• 32:02Speaker 01

  Like, that's a product that should exist. Everyone should just buy that. And like, then we have to X-ray it with like, where distribution's going to come from and, and like, you know, like, is this going to be easy to sell on a reasonable time scale and whatever? I think my, my favorite companies I'm spending the most time with tend to be in security, but uh, if you, if you want a, a, a grouchy, yet somehow still optimistic guy uh, on your cap table, just, you know, give me a call. But I'm, I'm looking to do less stuff in security.

• 32:29Speaker 00

  Is there any other advice that you tend to give um, people starting companies for the first time?

• 32:33Speaker 01

  Oh man, uh. Yeah, I, I mean, there's just the basics, like figure out your team. You know, like being a solo founder is actually totally okay. It's way better than being like, we had three coffees together and we just got married, you know? So like, like, just start with the team. Like, everything is built on the team. Like, it's the saddest thing in the world when you see like a beautiful company. And then like, it's just the foundation has a, has a crack in it and you have to tear the whole thing down, you know? Make sure you have the same like risk appetites and stuff like that. Just those basic, basic, basic stuff like, you know, especially when, you know, we are irrationally exuberant again in Silicon Valley. We had a solid six months of being depressed because of the end of, of free money.

• 33:14Speaker 00

  I kind of wish it lasted a year, a year longer or something. I think it would have been very, uh, very healthy for everyone.

• 33:21Speaker 01

  I know people stepped, like all the Warren Buffett quotes came back. I think like R I P good times like seven or whatever, you know, and now it's gone again.

• 33:30Speaker 00

  Yeah, it's, it's back to zerp if you're in AI.

• 33:33Speaker 01

  Just honestly, like, just pick a good market, like, look for a lot of dollars and a lot of other shitty people that, like, you can take those dollars from. The analogy that stuck for people was like, the difficulty level of the game that is starting a company is essentially just like the size of the market, like the inverse of that. You know, like, the bigger the market, like, you can, you can eat mistakes, you know, you can, you can burn time, you know, like, you, it's just, play, play the game on easy if you possibly can, you know?

• 34:00Speaker 00

  Yeah, it's kind of interesting. That's kind of advice that I tend to give people who are working in AI right now because I feel like there's so much low hanging fruit. And you see these people doing these incredibly complicated things or incredibly hard things. And you're like, why are you doing something so hard when it's an early industry, right? And the, and the latter part of an industry, when things have matured and sort of saturated, that's when you do the hard stuff. But in the early days of a new market, you just want to do the easy stuff because that's, that's very tractable. It's faster. It's easier, you know, higher velocity.

• 34:24Speaker 01

  Right. Like, I'm not the only one with this pet peeve, but you see, like, you, you need, like, really talented technologists on founding teams. Like, I really think it's like, we're in the technology industry, like, you know, if you leave the MBAs alone, they're going to do like Casper mattresses, but for mattress pads this time, but they come with razors on them and stuff. Like, they're going to follow the same templates. God bless them. They need to exist. But like, the best companies have a technologist, like, you know, maybe not in the CEO role, but like someone. There and and technologists like we love to to do what we know. And so there's this like massive, you know, like overabundance of engineering recruiting companies and, you know, DevOps, but this time totally different, Dev tooling, like infrastructure monitoring,

• 35:07Speaker 01

  blah, blah, blah. And it's like, dude, just like, get out there and like, learn a market that's not your own. Okay, like, it's just like, like, the world needs your creative energy to paraphrase one of our slogans from Dropbox back in the day. But like, you're gonna have to like, maybe leave your house, sort of, at least on Zoom, you know, and talk to people and find like, find a find a market, you know. And so and I think with AI, you're seeing just the overabundance of shovel selling, like, the world needs next generation data dog for AI, but not that one, because there's already that guy, this one's for testing, but not that kind of test, but mobile testing, that one. Yeah, right. And it's like, stop, like, Cometorics will never let you down. There's always going

• 35:48Speaker 01

  to be a way to cross these things, you know. But like, how big is that actual market? How big is it? You know?

• 35:56Speaker 00

  Yeah, yeah, makes a lot of sense. So Ryan, thank you so much for joining us today on No Priors.

• 35:59Speaker 01

  Yeah, it was great a lot.

• 36:00Speaker 00

  Yeah, it was really fun.

• 36:03Sarah Guo?

  Find us on Twitter at NoPriorsPod. Subscribe to our YouTube channel if you want to see our faces. Follow the show on Apple Podcasts, Spotify, or wherever you listen. That way you get a new episode every week. And sign up for emails or find transcripts for every episode at no-priors.com.