Loris Degioanni: Why AI Is Breaking Cybersecurity, and What Comes Next

AI has fundamentally changed the cybersecurity threat landscape, not by inventing new attack types, but by collapsing the timeline. The same tools that make software developers more productive are now being used by attackers to move from vulnerability disclosure to active exploit in a matter of hours. That shift, argues Loris Degioanni, CTO and founder of Sysdig, changes everything about how defense needs to work. In this episode, Craig Smith talks with Loris Degioanni about why human-centered security is becoming a structural liability, what "headless cloud security" means in practice, and why the coding agent (tools like Claude Code or Codex) may become the new operating system through which all enterprise security workflows run. It's a conversation about architecture, urgency, and what it actually means to fight a tank when you've been trained to use a baseball bat. If this conversation made you think differently about AI and security, subscribe to Eye on A. I. for weekly conversations with the people building and defending the future.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Craig S. Smith?

  AI has done a lot of wonderful things, but it's done a lot of scary things.

• 0:05Speaker 01

  Attacks can be scaled much faster through the use of AI.

• 0:08Craig S. Smith?

  It makes it easier for cyber criminals to attack systems.

• 0:14Speaker 01

  So every time there's something new that has been discussed, first of all, these tools can find new vulnerabilities in software. But then, once something is found, the speed at which this can be leveraged to perpetrate attacks is, you know, used to be weeks, now it's hours.

• 0:30Craig S. Smith?

  Okay, so I usually start by having you introduce yourself, give your background so far as it's relevant, and how you got to Systig. But I wanted, because Systig is sort of a deep tech, and a lot of the listeners are not necessarily familiar with that. So I'm gonna ask you, from what I understand, Systig is a cloud and container security platform that gives users visibility into what's running in their Kubernetes,

• 1:15Craig S. Smith?

  container and cloud environments. Can you just explain in very brief terms to listeners who don't know what a container is, what Kubernetes is, and how that relates to security? And then we'll start asking questions.

• 1:37Speaker 01

  Yeah, in a nutshell, Systig is an AI-powered, real-time cloud defense platform. What does it mean? Let's start from cloud. Cloud is where all of the software that you, I, our listeners are using on a daily basis, right? You do a checkout at the supermarket, you do your banking, you do your Uber. It doesn't matter. Anything that you do, you know, nowadays, is powered in the cloud and is powered by software that is running in the cloud. AI is running in the cloud. So we are talking about AI here, you know, and all of the AI

• 2:21Speaker 01

  infrastructure is definitely working on cloud-based and cloud-native infrastructures. So, uh, cloud is where software runs nowadays, and CSD protects and defends the software that is running in the cloud. Software running in the cloud normally is based on stacks, on ways to, you know, organize and run the software, uh, which are, you know, based on some of the terminology that you mentioned before, containers, Kubernetes, these are, these are the way, the same way you run your software, you know, on your Mac, on macOS. Typically, software in the cloud runs on

• 3:02Speaker 01

  a distributed software infrastructure that is, uh, you know, based on so-called containers, which are, you know, little, uh, it's a way to, to partition your software in little independent pieces that can be deployed easily and they can run everywhere and can scale up and down. And Kubernetes is essentially the operating system for the cloud, right? So it's what takes the software and runs it and makes sure that the software, you know, like the software that you're running is able to grow when there's more demand and shrink when there's less demand and use the appropriate resources and so on and so forth. CSD is a company that specializes,

• 3:44Speaker 01

  uh, and leads essentially, you know, the ability to protect all of this kind of stuff. So CSD also protects most, you know, uh, most of the environments where AI runs.

• 3:57Craig S. Smith?

  Okay, uh, thanks. That's, that's very concise. Uh, so can you, I mean, and I'm sorry, I didn't ask you to introduce yourself before that. Introduce yourself and, uh, give a little bit of your background. I know that, uh, that you've navigated a few major cybersecurity transitions.

• 4:20Speaker 01

  In your career. So can you, yeah, talk about that? Sure. And thanks for having me. My name is Lawrence De Giovanni. I'm a CTO and founder of SSD. SSD is my second company. My first company was called Case Technologies, was the company behind a very well-known open-source network analyzer called WarShark. This is a tool that pretty much everybody that has to do with the computer network in the world uses, you know, to observe, troubleshoot, optimize computer networks. Still going strong now. The company was acquired in 2010 and then after a few years of taking a break,

• 5:05Speaker 01

  I started SSD essentially with the goal of securing modern cloud infrastructures and bringing all of my expertise in visibility and security and open source to the world of cloud. And cloud is, you know, where all the software in the world runs. Whatever you do in the cloud, whatever you do in your life, sorry,

• 5:32Speaker 01

  checking in your bank account, paying at the supermarket, chatting with friends, getting a cab. It's all, you know, run by software that runs in the cloud. So SSD, you know, originally set out to solve the problem of securing these infrastructures that are running in the cloud, which is also incidentally where most of the AI, not most, all of the AI runs nowadays. Today at SSD, I'm a CTO. I run product and engineering and also I focus on all the initiatives that we have at SSD related to AI, including some of the stuff that we're going to talk about today.

• 6:16Craig S. Smith?

  Yeah, you know, AI has done a lot of wonderful things, but it's it's done a lot of scary things. And one of the scary things is it makes it easier for cyber criminals to attack systems, to to increase their speed and scale. Uh, so there's this, as there always has been in cybersecurity, this uh, sort of arms race between the attackers and the defenders. Uh, the defenders generally uh catch up to a new attack vector fairly quickly and unfortunately are saying ahead, it seems, but

• 7:01Craig S. Smith?

  um, but there's uh, we're in a new era of cybersecurity with with the implementation of AI.

• 7:11Craig S. Smith?

  Can you talk about the current threat landscape for me? Uh, break it down somewhat.

• 7:20Speaker 01

  Yeah, and um, we are in a new era for humanity, in my opinion, you know, and and therefore, you know, cybersecurity is no exception here. Uh, and uh, uh, first of all, my first comment is, uh, this is evolving so quickly that the the moment, you know, you make you make a comment on this, it's already outdated. Uh, and uh, uh, this is particularly interesting because it feels like, uh, you know, uh, with stuff like, uh, um, you know, mythos and project glass wing, for example, from anthropic, it really feels like we've reached the point where

• 8:04Speaker 01

  AI is becoming very, very relevant for cybersecurity. In general, in terms of a threat landscape, I feel that the threat landscape remains similar to what we've seen, you know, historically in cybersecurity, but with incredible acceleration, right, and incredible increase in volume and speed in terms of what we're seeing in terms of attacks.

• 8:39Speaker 01

  Attacks can be scaled much faster through the use of AI. You know, the same coding tools that make developers so productive and are sort of revolutioning the software development arena are leverageable very effectively by attackers. So, you know, stuff like, I don't know, producing, going from vulnerabilities to exploits of this vulnerability, which required, you know, advanced programming and development skills, now can be largely done by, through the help of an AI, which means that, for example,

• 9:23Speaker 01

  our threat research team a couple of weeks ago released an article where they were showing that between the disclosure of a vulnerability, so essentially a fault in a piece of software that can be exploited for security attack purposes. And being able to see the attacks, the exploits based on the vulnerability, now it's a matter of hours, you know, just few hours. So every time there's something new that has been disclosed, first of all, these tools can find new vulnerabilities in software, but then, once something is found, the speed

• 10:03Speaker 01

  at which this can be leveraged to perpetrate attacks is, you know, used to be weeks, now it's hours. In general, you know, things that used to be complex to

• 10:18Speaker 01

  Attack and leverage and used to be the domains of sophisticated attackers that could invest, you know, like like state actors or stuff like that, that could invest heavily, you know, in maintaining this list of vulnerabilities and creating, you know, the attacks and using them at the right time and so on. We can say it's been democratized, you know, so many, many more people and many more entities are in a position to do stuff at levels of speed and sophistication that was first earlier in the domain of people that had much bigger budget.

• 11:02Speaker 01

  And in general, what we are seeing is that

• 11:08Speaker 01

  these attacks are also look impersonating humans better and better, right? So when we're talking about stuff like phishing, like, you know,

• 11:22Speaker 01

  fake videos and all this kind of stuff is becoming easier and easier essentially to be fooled, even people that are very well prepared to this. It's easier and easier to be fooled because these technologies are becoming more and more credible.

• 11:37Craig S. Smith?

  Yeah, the, you know, that's again for, for listeners who aren't that familiar, can you break down what are the main attack vectors? I mean, I, I certainly phishing is one and it's, it's amazing that it's so effective because it's relatively crude.

• 12:00Craig S. Smith?

  But I, I know that there are.

• 12:04Speaker 01

  Still one of the main entry points, I would say, you know, typically

• 12:09Speaker 01

  there's the entry points to do attacks on software. Typically, there's mistakes and misconfigurations.

• 12:20Craig S. Smith?

  Right.

• 12:21Speaker 01

  Bugs and people taking advantage of people like phishing and so on, right? So mistakes and misconfiguration, at least in the cloud, which is the domain where CSD operates and where the most expertise. Still tend to be, you know, like the prevalent ones. It's like you just human mistakes, you know, you forget your data on a storage that is open to the internet and not protected by password, you know. This is how and then somebody can easily discover it. Or your firewall is not configured to block

• 13:05Speaker 01

  certain specific traffic, maybe to certain specific targets. And you didn't realize that, you know. And so very, very often, this is basic, you know, like we, we call it posture. So and the, the attack surface is essentially a function of you being able to figure out this kind of stuff and realize where, where, where these issues are. And then, you know, the other one is bugs. So you, you can have the best possible posture and you cover your bases. But then people are able to come and find, you know,

• 13:46Speaker 01

  a disclosed or undisclosed bug in your software that can be leveraged to, you know, create a buffer overflow or remote execution or stuff like that. So this is stuff that sometimes you're actually, most of the times you're not even aware of, you know. And this is the kind of sophisticated ones that I was mentioning before. And the third one is, yeah, people. So a lot of these attacks are like being able to impersonate maybe contractors, you know, in your organization. And through that, you know, escalate the privileges or phishing.

• 14:29Speaker 01

  So having to do with email, with instant messaging by, you know, essentially, you know, social engineering and being able to take advantage of the natural weaknesses that we have as human beings and the natural, you know, maybe lack of attention that we have with human beings, even if we're, you know, very trained and sophisticated in this.

• 14:52Craig S. Smith?

  Yeah. Yeah, and on, on the misconfigurations. A few years ago, I had a guy showing me that. There is a website, I think, uh, or, or he had a tool that could scan the internet for uh, public S3 buckets or, or uh, exposed S3 buckets, you know, these uh, these uh, data stores and, you know, he could go in and, you know, read the documents, uh, there, there was during COVID, he could look at people's lung

• 15:33Craig S. Smith?

  x-rays and it was really remarkable. Um, is, is, is there a difference between securing

• 15:44Craig S. Smith?

  servers that are on-premise and servers that are in the cloud?

• 15:51Speaker 01

  Yeah, um, for sure. And yeah, the S3 example that you, that you made is a, is a classic one in cloud, you know? And uh, yeah, the, that's why I was saying, it's still based on what we're seeing, as is the probably, you know, this, this kind of uh, attacks, uh, this kind of issues are still the most common ones. Uh, and uh, um,

• 16:17Speaker 01

  when comparing uh, traditional data centers with, with the cloud, I often uh, use a metaphor which is uh, the medieval castle versus the modern city. Right? Typically on-prem data centers uh, used to contain, you know, uh, all of, all of your hardware and software. You were managing it, you were controlling it. Uh, the solution essentially to secure them was uh, uh, put firewalls at the edge, make sure that you control everything that enters and exits this data center and make, make sure that you're as tight as possible at, you know, blocking or killing what, what enters.

• 16:59Speaker 01

  And comparing this to a medieval castle, because it's like, you know, big walls. The important stuff inside these big walls, a little bridge. Uh, and everybody has to go through that little bridge, that's the firewall, you know? And you do careful thorough checking uh at the bridge. And you make sure that only, you know, the people that you select uh enter and exit, you know? And that's the way you protect it. A modern cloud infrastructure are are designed, are running uh in uh on hardware that is provided by the cloud provider, right? Amazon, Microsoft, Google, you you mentioned, right? There's there, there's many of them.

• 17:43Speaker 01

  You, your team, your developers are sort of, you know, accessing this uh this environment from all over the world. Your users are accessing the software that you're building and you're providing them from all over the world. There's a million entry and exit point, and exit points. There's a million uh different people and personas that are entering and exiting, you know? To with with different scopes, uh with different goals, with different tasks that they have to perform. Uh, it's like a city, you know? There are many highways going in and out. Uh, and uh, there's uh, it it it's not only useless, but it's counterproductive to try to block

• 18:28Speaker 01

  these people from from going in and out, right? You, you actually want to do the opposite. You want, you want, you, you, in a city, you are productive if you have all of these people that can move, you know? And can interact with each other and so on. So the solution is not anymore, you know, just the firewall at the edge. There's no edge anymore. And the solution is to do much more with being able to police, uh being able to detect. So, for example, one thing that CSD does that that we are very strong at doing is what they call a security camera for for software infrastructures, right? We have an open source tool called Falco for this, which is a very popular open source tool. And this is something that you can place in different places of your cloud infrastructure, collects the data, brings it to a centralized point.

• 19:12Speaker 01

  So that you can then understand what's happening, the same way the police does by putting, you know, like security cameras in different parts of the city. And then you can first of all detect. When something happens and you can also react very quickly. And the better this data is, the more granular, the more real time this data is, the more you can react. So there's a difference, you know, between on-prem and cloud. It's like city versus medieval castle.

• 19:40Craig S. Smith?

  Yeah, yeah, that's a good analogy. That's interesting. The, I mean, you know, cybersecurity has developed very quickly when you look in terms of of technological history. And, you know, originally, it was professionals that were looking at code or looking at

• 20:10Craig S. Smith?

  at systems as humans. But as the attacks become increasingly automated, security is now a machine driven. So how do we stay ahead? What's broken or not working about our current approach to cybersecurity?

• 20:33Speaker 01

  Yeah, what's broken, what's not working? Let's, let's talk about the problem. And this mirrors what we were talking about earlier. When we were mentioning essentially how security is changing. Now that it's and the threat landscape is changing as the attackers become more and more empowered by AI, right? So we have a situation where attackers are at this point leveraging AI effectively and aggressively with all of the implications that we discussed before. And on the other hand, we have

• 21:13Speaker 01

  a defense landscape, in particular, when we're talking about approaches, tooling that is still in the early stages of evolving. And, you know, security traditionally has been human centered, tool supported, but human centered, right? And the goal, I've been part of this industry now for quite a bit, you know, and trying to provide tools that make the good guys as effective as possible. But the purpose has always been.

• 21:48Speaker 01

  Build tools that empower humans to be as best as possible at defending from the bad guys, right? This is quickly becoming not good enough. When the attackers move at AI speed,

• 22:10Speaker 01

  this just doesn't work if the defenders work at human speed. Right? So you were asking, what's the issue? The issue is that either we find a new paradigm that allows the defenders to do the same and to move at AI speed, or there's going to be a huge imbalance and it's going to be very, very hard to protect.

• 22:43Speaker 01

  Not only cloud software, but everything, you know, in general in cyber security.

• 22:51Craig S. Smith?

  Yeah, I mean, you mentioned, did you say Falco? Was that the camera product that you put into a system? Do the attackers at this point, because we're now into the age of agentic AI,

• 23:10Craig S. Smith?

  do they have, are there agents that crawl through

• 23:18Craig S. Smith?

  publicly facing software, looking for vulnerabilities?

• 23:24Craig S. Smith?

  Autonomously, is that what's happening? And something like Falco,

• 23:33Craig S. Smith?

  what exactly does it see? Because this is all happening at the level of bits and transistors.

• 23:42Speaker 01

  Yes. Stuff like Falco is essentially,

• 23:47Speaker 01

  it works by having a set of agents, sensors that you deploy across your infrastructure and this collects essentially data coming from multiple sources. Data coming from, you know, running software, so which

• 24:09Speaker 01

  Network connections are done, which files are open, you know, which commands are executed, all of this kind of stuff. It also collects signals that are coming from cloud trails and logs. So you know what AWS actions you are executing. AWS, you know, is the Amazon cloud. So what are you doing there? You know, are you starting something? Are you changing configurations? Are you opening? Are you putting data in some place? You know, this kind of stuff. So it collects all of these signals. And then it's able to tell you, you know, by analyzing the signals,

• 24:52Speaker 01

  if something either is an attack or is it something that is suspicious, essentially. And Falco traditionally, and here where we're talking about, you know, like what's changing in security is data is becoming more and more important, right? So Falco provides the best data that can be, you know, consumed for this purpose.

• 25:16Speaker 01

  What's changing now is that this data normally traditionally goes to humans in the end, you know, for, under the form of alerts, logs and so on, for judgment, for prioritization, and then for taking action.

• 25:35Speaker 01

  The way I describe it is the traditional software stack is B to H, right? Business to human.

• 25:48Speaker 01

  And what, what is changing and in particular, what CSG is changing in, in, in the way we're doing it? And what we're changing in, in cloud security is that we're working, we're moving toward the model that I define more like B to A, right? Business to agent. So uh since this week is introducing headless cloud security, which means that it's security, it's cloud security, but built for agents. So assume that, you know, we provide a software that still needs to be, you know, like the best software for for cloud security. But now assume that it's not designed anymore for consumption by humans.

• 26:30Speaker 01

  So we're abandoning, you know, like the traditional uh UIs and we're making it headless. We're making it essentially, you know, a agent first, API first, so that it's designed essentially, you know, not to be consumed by humans as at least, you know, the main users of this, but but it's designed to be consumed by agents so that workflows can be accelerated and automated by essentially basing them on agents first.

• 27:01Craig S. Smith?

  And is, how do you know, you know, and that requires a tremendous amount of trust in the agents. Uh so is it simply through testing that you develop that trust that you you know these agents are not going to block legitimate activity or that they're not going to miss uh illegitimate activity? How how do you develop the trust in those agents?

• 27:32Speaker 01

  Yeah, let's talk a little bit about uh what we mean when we talk about headless cloud security. Uh in my opinion, there are some really important, you know, paradigms here. Uh and first one is data is everything, right? This is in general being uh made very clear, you know, in the world of AI. Even when we're looking at all of these companies that are providing, you know, like the best incredibly powerful uh AI models, in the end, data is the mod, right? Uh the Model that can be trained on the best data is the model that produces the best results.

• 28:18Speaker 01

  This is also very true in cloud security. So these agents operate on data and the better, the more granular, the more valuable this data is, the better outcome you will get from these agents and the less mistakes they will make. Paradigm number two, core concept number two is, everything needs to be API based, right? So that is designed for consumption by agents. So the UI, this is quite radical, but the UI, you know, the dashboards, the point and click and so on, is something of the past because if you need, you know, like a dashboard,

• 29:02Speaker 01

  you just point your agent to the data coming from the security tool and the agent will create the visualization that you need. We call this hyper-personalization. So the security experience, the security product at this point is hyper-personalized for every single use, for every single outcome, for every single individual that points the agents to the security product. The third important element is, this becomes outcome and workflow oriented.

• 29:41Speaker 01

  So you need to infuse these agents and this, you know, speaks to your question. How do you make them reliable and accurate? It's a work, you know, players like CisD, what they bring is they bring deep expertise in areas of security, right? So the question is, how do you infuse the agents with the workflows, with the expertise, with the ability to reach the outcomes that are, become goals, you know, when you need to detect in real time what's happening, prevent it, block it, take action, remove vulnerabilities, understand the attack surface,

• 30:23Speaker 01

  understand, you know, when sensitive data is exposed to the internet and remediate it automatically, right? So it's all about outcomes and it's all about making sure that these outcomes are converted in skills that are heavily validated. And then there's the how do you make the last the part to to answer your question is think about humans. How do you make humans more reliable at performing tasks? Because humans fail too, right? Humans can make mistakes as well. What we do in companies is we assemble them in teams.

• 31:07Speaker 01

  And then we put together processes and give them tools that allow them to work productively and constructively in teams and minimize mistakes. Because there's a proper workflows and proper, you know, checking of what everybody else is doing, right? We there's a whole industries in software. Git is essentially, you know, if you if you if you look at the core of what it is or or Jira, you know, these are just tools that are designed to essentially make humans cooperate in solving issues and do that with less mistakes. And this is something that these are tools, for example, that are used heavily in cybersecurity.

• 31:51Speaker 01

  So the question is, how do you create something similar but for the world of agents? How do you make sure that, for example, there's a common shared memory for these agents in terms of, you know, security and protecting? So that alarming from one agent can be taken, the other agents can be taken advantage and it's coordinated. You know, there's not, there's less guesswork because the decision is taken together and agreed, you know? So the other thing that Cisik is working on when working on headless cloud security is these constructs, you know, to make sure that not only agents can operate well independently,

• 32:34Speaker 01

  but we truly heavily believe that agents make less mistake if they are properly trained and they're properly aligned with with each other with the proper support and touring that is coming from products and tools like ours.

• 32:49Craig S. Smith?

  Yeah, and you talked about personalization. Can you explain a little more what that means? Personalization, personalizing data for enterprises and.

• 33:04Speaker 01

  The era of the dashboard is over. You know, uh, cybersecurity, the cybersecurity industry for decades, you know? Like if you look at these products and it's, you know, data collection and then a bunch of data visualization on top of it, you know, and every product is a way, you know, to assemble, you know, like the views and get the reports and generate them as PDFs because again, that supports very much the human workflows, right? When, when I do some kind of work in cybersecurity, for example, in posture, I then need to share my results with the CISO

• 33:48Speaker 01

  and the CISO takes my results and the results from the other teams and creates essentially, you know, like a report for the board. So it's like humans that are working together in secure, in securing infrastructure. Now, there's two things that are happening here. Number one is data is the important thing at this point. And if you need a specific, specific view on the data, gone are the days where you go in the product and the product is hyper, you know, customizable. Because what you do is you just point an AI to this data and it's like, I need this, this report for my CISO next week, you know? The CISO is going to talk to the board and needs this for me.

• 34:25Speaker 01

  Let's build it and let's build it in a way that is compatible with the look and feel of what our, our organization presents to the board, you know? And the, the AI becomes, that's why I say hyper personalized, you know? Because the AI builds exactly what you need, exactly with the data you need. And, and it's the goal, it's the purpose of the AI and, and, and to go and find the right data, slice and dice it, organize it, present it, and then you can iterate, you know, with, with, with the AI. But this becomes, you know, like conversation, the same way you would do with a teammate, with an assistant,

• 35:08Speaker 01

  rather than, rather than pointing and clicking on, on the user interface. So that's number one. Number two is.

• 35:17Speaker 01

  More and more will automate and delegate this kind of stuff to agents that will do it for us. Does the CISO really need to invest the valuable time of a skilled analyst in just, you know, creating a report with the right look and feel? No, probably you can do it once or twice and that gets converted at a certain point into a skill for an AI, which will also be connected to your calendar and know when the presentation for the board meeting needs to be delivered and the prior night will, you know, put in your folder or in your email,

• 35:58Speaker 01

  you know, the report and maybe the first time it's not exactly what you need, you will provide feedback and the second time it will be much better and the third time it's ready to go and you don't have to worry about it anymore and you can just, you know, give it to, give it to the board and it's prepared like that. So all of these together makes us believe, as Sisik said, that, as I was saying, the AI is, is, is, sorry, the UI is a thing of the past and that the future is exposing the data, the right data in the right way, so that you can enable this workflow.

• 36:39Craig S. Smith?

  Yeah, and the interface for the user then is a conversational, I mean, text-based, natural language?

• 36:51Speaker 01

  The user interface for the user, so this is, this is interesting as well because if we look at the evolution of how cybersecurity and not cybersecurity, software in general, has been embracing AI, I would say there's, we are at step number three. Step number one is, okay, wow, there's these models that can speak and reason like a human. Let's include a chatbot in our software that can be an assistant, you know, inside the user interface of our software and brings, you know, like the, our user interface to be conversational. Sisik has done that very early on, years ago, big results, you know, very, very nice.

• 37:36Speaker 01

  And you see this in many cybersecurity products and all of the first wave of announcement was all about that. Then there's been Wave 2, we're currently part of the Wave 2, which is Agentic, you know. So more and more, this kind of AI that is embedded in cybersecurity products goes from being single step and question and answer into becoming more and more independent and being able to perform tasks independently, you know. And this is like the inclusion of Agentic inside cybersecurity products.

• 38:19Speaker 01

  SSD, especially with our launch, with the launch of Headless, has a different point of view. Our point of view is that the user interface of the future for cybersecurity tools, for any kind of software, is the coding agent. It's Claude Code, you know, in practice, to give you an example, or equivalent, Codex, you know, you name it. One of these. People will... These coding agents, let's put it this way, will become the operating system of the future. Will become the Windows or the Mac OS of the future. They will be the place where we, people, sit when we integrate with software.

• 39:01Speaker 01

  This integration will be conversational, probably voice in the future, probably other ways to do this. But we believe that software will escape just the user interface of software. So when we talk about Headless, we don't mean only, you know, like there's Agentic functionality and the AI is able to do stuff. But we really embrace SSD, the fact that workflows will run in the coding agent. And when you do cybersecurity, no matter if it's vulnerability management, posture, threat detection, and so on, you will do it from inside Cloud Code or equivalent.

• 39:44Speaker 01

  So then the question becomes, okay, what is the best way for a cybersecurity product to be... Cloud code first.

• 39:51Craig S. Smith?

  Yeah.

• 39:52Speaker 01

  Uh, rather than providing any kind of user interface. That's the, that's the concept of headless essentially. The place where user, users live is cloud code. Let's make our software integrate and provide as much value as possible uh there. And let's make people uh get the best out of it in uh, in, in, in, in those environments.

• 40:15Craig S. Smith?

  Yeah, so the, so the uh, the, the user as it asks uh the software to do something, it'll code uh a solution on the fly. Instead of it being a, a static piece of software, is that what, what you mean?

• 40:34Speaker 01

  It's coding, uh, yes, uh, but it's also performing tasks.

• 40:40Craig S. Smith?

  I see, yeah.

• 40:41Speaker 01

  Let's, let's take an example, you know, uh, uh, and again, let's go back to nowadays software. Uh, typically, uh, there's uh, um, uh, a bunch of constructs in, in nowadays cybersecurity software that has designed essentially to uh, surface to the user the best data so that the, so that the user, the human can take decisions. Uh, right? Uh, and uh, uh, then, but then the final decision is still uh taken by the human. Vulnerability management, for example, you know, vulnerability management is the area in cybersecurity

• 41:22Speaker 01

  where you go and look at all of your software components, one by one, and all of the software that you've written, you know, uh, line of code by line, by line of, of code, and you try to identify vulnerabilities. Uh, and then, of course, you know, you, you, you try to fix them. And doing this like, software tools, security, security products, what they do is they analyze your software, there's many ways to do that, and they look essentially where, where, where are your vulnerabilities, they tell you what are your vulnerabilities and, and where they are running, you know? And then the human decides, okay, this vulnerability is pretty bad. Uh, it was disclosed yesterday, the whole world is talking about it. Uh, it's a serious one, it's a very bad one, and by the way, it's running in production for me.

• 42:06Speaker 01

  So, uh, what I need to do is, I need to go and upgrade my software uh, to fix this vulnerability, and then I need to push uh a new version of my software. Actually.

• 42:19Speaker 01

  I'm not the person in charge of this software. So what I need to do is I need to go identify the owner of this vulnerability and open a ticket for this person and tell them, hey, there's this urgent. Please take a look because we have this vulnerability now. You need to make a new release with a fix for this vulnerability and you need to push the software in production as soon as you can.

• 42:41Speaker 01

  This is not necessarily writing code in the classic sense, but it's performing all of these actions that are done by humans today, you know? So from within Claude Code, you will be able to do most of this, you know, through agents and through AI assistants. So it's like these AI assistants will be able to take a look, receive the data, you know, in terms of vulnerabilities, express judgment calls like this one is bad and it's running in an environment that is very sensitive for me. So let's focus on this one. And then the AI from, you know, can talk to you and tell you, okay, when you wake up in the morning and you talk to the AI, the AI will tell you, while you were sleeping, I analyzed this data.

• 43:24Speaker 01

  There's this one that is urgent. Should we go ahead and you say maybe yes? What do you propose? And the AI will be like, okay, you know, I see where this is and I see that there's a new version. I searched online, there's a new version of the software. I can make a patch for you. I can open a PR for you for this piece of software. And then I can, you know, communicate with the developer and let the developer know. This is step number one. In the even successive future, the AI could make the fix, decide that the fix is sane and push the software in production for you, right? All of these from your coding agent, where you will discuss with your coding agents.

• 44:08Speaker 01

  And in some cases, this will actually produce artifacts that are software. In some other cases, this will produce actions on your software, on your code, on your infrastructure that are what today, you know, the practitioners do. And it will become more and more automatic. That's how you fix, how you solve the problem of the attackers being so aggressive and so quick at doing stuff. You can compensate by automating on the Good guys side as well and by therefore accelerating, you know, the detection and the resolution of these problems. And this starts from the environments where the users live.

• 44:51Speaker 01

  So this is not point and click and you, you, you know, try to figure out, you know, what you should do first, but it's by in your operating system of the future, in your coding agent by talking to, you know, agents and the AIs that have been properly instructed and trained to perform this workflows together with you.

• 45:12Craig S. Smith?

  No, that's fascinating. Um, so, so how should organizations start thinking about the shift? Uh, and, and what will separate companies that succeed in this new model from those who don't?

• 45:30Speaker 01

  Again, I'm putting this in the micro trend of adopting AI, right? I think that we will see, we are already starting seeing a major adoption of AI from organization of any kind, any size in any industry. And this is unescapable. It's a matter of competition and survival for every single enterprise on this planet. And it will require adapting to these workflows and embracing them as quickly as possible. Uh, what we are seeing in software right now?

• 46:15Speaker 01

  I mean, you read, you read the news and especially, you know, like software news, like, uh, uh, you know, news that are specializing in software. And every other day, there's an article about, oh, this, this particular person is claiming that they have not written a line of code since last December, you know, well, non-developers, uh, and so, and so on and so forth. And, uh, uh, it's pretty clear that in software development specifically,

• 46:45Speaker 01

  The future role of humans will be coordinators, right? And enablers. In my personal, you know, daily workflow, essentially, what I try to set as a goal is block AIs as least as possible, you know, keep having the AI working for you. Because you are the one that, especially with the current state of technology, enables these agents, directs them, prevents them from making mistakes, they still very much make mistakes, right?

• 47:23Speaker 01

  So the human will be become more and more an orchestrator and a provider of vision and a provider of strategy and oversight, right? So that's what we'll do as humans. That's pretty clear in code already and we can all see how it looks in code already. My thesis, physics thesis is that the same would just translate everywhere, you know? So no matter what our field is, product management, sales, logistics, I have no idea, you know?

• 48:06Speaker 01

  We'll become orchestrators of little teams that we control to perform what we're doing and we'll get our hands less dirty with the immediate, you know, stuff and like the single line of code, but we'll be empowered to accomplish a lot by having essentially each of us a team of skilled and efficient individuals that can go after our goals and our guidance. That is very much my opinion what will happen in cybersecurity. So I give you some examples before, you know, but the practitioners that right now have

• 48:51Speaker 01

  to worry about, you know, like the single vulnerability inside a single piece of software would be more like, you know, will guide initiatives, will define and guide initiatives inside the organization and then they will leverage their tools to. Perform these initiatives and to make them successful. Since they is designing today. Uh, what? Uh, is this cyber security software that empower people, empowers people to do exactly this?

• 49:23Craig S. Smith?

  Yeah, yeah, that's a. That's a new world and and.

• 49:29Speaker 01

  Take a while time.

• 49:30Craig S. Smith?

  Yeah. Are the companies that that aren't employing AI solutions in to to defend their. Uh, their software infrastructure. And are is is the threat going to overwhelm them? I mean, if companies aren't uh using things like SISD.

• 49:53Speaker 01

  I think the problem will become um. Your ability to just sustain. Uh, the volume, the pace, the quality, the sophistication of these attacks, you know, so. Uh, no matter uh what uh. How many humans you employ and how skilled they are. I believe that if we not don't accelerate them and we don't support them through these technologies. And that's why SISD is embracing them so aggressively. They will become the bottleneck, you know, and uh it's uh, you know, it's like.

• 50:37Speaker 01

  Fine fighting uh a tank with a baseball bat, you know, or or or something like that. If we we won't just be equipped to the to the volume and strength or or what what comes to us. So we need to, you know, uh. Superpower the defenders so that they can, you know, contrast. A a tank with a cannon and and not a baseball bat.

• 51:06Craig S. Smith?

  Yeah.

• 51:07Speaker 01

  And that will be very important.