Democratizing Security for the Agentic Web with Cloudflare CTO Dane Knecht

In the transition to the agentic web, security has become an afterthought. Now, organizations are racing to figure out what AI security means, and how to keep their data safe. Live from Cloudflare Connect, Sarah Guo sits down with Cloudflare CTO Dane Knecht to discuss the changing attacker landscape, and how his company is allocating its engineering resources to meet this emerging security challenge. Dane explains how enterprises that have moved away from castle-and-moat infrastructure to more of a zero trust infrastructure for security are in better positions than those who haven’t. He also discusses the challenges of patching 70 years of software and why the software development lifecycle will need to change for security for the agentic web, why he sees token spend in the next 18 months primarily going towards security rather than engineering, how the current web is in a ‘messy middle’ state where humans and agents are riding the same ‘rails’ on the internet, Cloudflare’s conference monetization gateway release as well as its Signals project with OpenAI, the rationale behind the release of Cloudflare OS, and the thinking behind a recent company restructuring. Plus, why Cloudflare hired one thousand interns, and why curiosity about AI is required to be successful at Cloudflare. Sign up for new podcasts every week. Email feedback to [email protected] Follow us on Twitter: @NoPriorsPod | @Saranormous | @EladGil | @Cloudflare | @dok2001 Chapters: 00:00 – Trailer 00:55 – Cloudflare CTO Top Priorities 05:03 – Today’s Attacker Landscape 06:16 – State of Internet Infrastructure 07:31 – Shift Towards Security Spend 08:39 – Road to Better Software and Internet Security 09:50 – Building Secure Production Software 11:41 – Reducing Surface Area 12:54 – Near Future of the Web 17:27 – Monetization and Signals 19:13 – Success for Content Creators 20:07 – Workplace OS and Use Cases 24:07 – Restructuring for AI-First 27:11 – Token Budgeting 29:32 – Cloudflare’s Intern Strategy 33:39 – Importance of Curiosity 35:29 – Attacking the Legacy Software Security Problem 37:08 – Engineering Team Prioritization 38:25 – Open vs. Closed Models 39:43 – Democratizing Security for Everyone 41:29 – Conclusion

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  AI has become the tool that's causing this kind of security apocalypse is also the tool that can help us solve it faster as well. It went from how to get everyone just to using AI. Now, all of a sudden, everyone's racing to figure out what AI security means.

• 0:11Sarah Guo?

  I've heard serious technical people say things like air gap, everything important, and we're like not going to be able to trust the internet for a while. And we just assume all the critical infrastructure and government services fall down at some point. Is that your expectation for what happens?

• 0:34Sarah Guo?

  Dane, I'm so excited to do this with you.

• 0:36Speaker 00

  Yeah, thank you. Thanks for coming here, too.

• 0:38Sarah Guo?

  I'm sure I'm not the first person to make this joke, but your last name, Connect, that's pretty good for the Cloudflare value prop.

• 0:46Speaker 00

  Yeah, yeah. There's been some jokes about renaming the show next year, so.

• 0:51Sarah Guo?

  So with everything that Cloudflare is doing, what are your top few priorities as CTO right now?

• 0:57Speaker 00

  Well, I mean, this past year, it feels like 10 years compacted into one. So those priorities are constantly shifting, but you know, it all goes back to our mission of helping build a better internet. And that really hasn't changed over the last 15 years, where we want to make sure that the internet's secure, that everyone has access to be able to get their content online easily and scale it up. And just, you know, over the arc of the AI changes in the past year, you know, it went from, you know, how to get everyone just to using AI, how do you make it easy for them to deploy and their agents deploy, to like most technical transitions, security is kind of an afterthought.

• 1:38Speaker 00

  And now, all of a sudden, everyone's racing to figure out what AI security means. And it means things for different sides view it kind of differently. You know, one side is, as a company, is how do you keep your data safe from AI leaking the data out? But it's also how do you keep people from getting in as well, too? And, you know, over the last, I would say, three to six months, just the number of vulnerabilities that are getting reported in CDEs has just gone up exponentially. You know, previously on the internet, we would see these log for J moments, or these shell shock, or type of incidents, maybe once a year.

• 2:21Speaker 00

  And it would be all hands on deck internally at Cloudflare to make sure how we protect not just, you know, our enterprise customers, but also our free customers, because we view it as kind of just a public good and making sure that the internet stays safe. These things are now happening weekly. Not all of them are publicly reported on, but there are things that, you know, are as serious as like the log for J type things, but just happening at a greater frequency. You know, and I expect that, you know, to the rest of this year and into next year, by the next 18 months, majority of teams' time is going to be spent on security. You know, I think there's a stat that was put up earlier today, that during one of

• 3:02Speaker 00

  our keynotes, where it was showing that I think over 50% of engineering time is going to be spent on security. And I don't think that'll last forever. I think that will be a short transition. You know, at some point, the AI will have surveyed majority of the code and found most of the bugs, or found most of the shortcuts. You know, there's a one that's kind of coming out today and has been started to be blogged about and tweeted about, where one of the keys on the internet is that protects all TLS and Web PKI, which just secures all your connections, was secured by the number four.

• 3:45Speaker 00

  Literally, they basically used, you know about cryptography? It's all about randomness, right? You know, that's why Cloudflare has our lava lamps is so that you can get good randomness. And when a key out there is, they use the seed, they use the initial thing to kind of create it with a single number four, it's going to be reverse engineered. You know, and AI can just do all these things, you know, it doesn't sleep. It's not like the one engineer you had that was red teaming things. You know, last week, I think OpenAI found the seeds for the NIST curves that were back

• 4:30Speaker 00

  in 2000 that were released. So just, you know, these things are just moving so fast, and the bar is going up, and the models are just getting so good at, you know, cybersecurity. You know, MIT's was just kind of the tip of the iceberg there, where, you know, and since then, it's not just been the models getting better, it's the harnesses. It's how people know how humans know how to use them and use those frontier models in order to find those exploits.

• 4:59Sarah Guo?

  Given your, you know, visibility, what do you know about the humans behind, you know, these attacks and harnessing these models and taking the volume of vulnerability discovery up so quickly? Like, are they, you know, nation-state actors? Are they script kiddies? Like, what can you say about how the attacker landscape has changed?

• 5:24Speaker 00

  Well, I actually think for some of these, some of these large vulnerabilities that have come out more recently, actually, haven't been nation-states. They've been, you know, high school kids even, that are.

• 5:38Sarah Guo?

  We're going to call them agent kiddies now.

• 5:40Speaker 00

  Yeah, that are just spending their time, you know, like they used to do, kind of capture the flag, security contest. They're pointing their agents at an area and doing that. You know, there's also, you know, and they're just financial award for them, there's buck bounties that they get paid out of sizable amounts. But it's given the tools that honestly the nation-states have had in some forms for much longer, either through agents or just through, you know, sheer number of people that were working on the problems, given it to the masses.

• 6:12Sarah Guo?

  This is the first time in 15 years I've heard serious technical people say things like, "Well, we should just like air gap everything important, and we're like, you know, not going to be able to trust the internet for a while, and we just assume all the critical infrastructure and government services fall down at some point." Is that your expectation for what happens?

• 6:34Speaker 00

  Humans, we are pretty adaptable, and we can move fast when we need to. And, you know, I've seen the industry kind of partner together. When things like this happen, people that you usually think of competitors, no longer competitors, we're just literally protecting critical infrastructure, as you said. And I think when those kind of critical moments happen, people will rise to that challenge. So I'm a little less doomsday. I do think that a lot of the things that we've done over the past, you know, five to 10 years, moving away from a kind of a castle moat infrastructure for security, to moving to more of a zero trust, does put a lot of companies in a better position, where, you know, you're not saying this office is completely air gapped, you're saying, you

• 7:19Speaker 00

  know, these devices, these flows are secured in a different way. And everything's going to be tightened.

• 7:28Sarah Guo?

  What is it going to take for organizations to do what you're describing? Like, 50% of engineers do not work on security right now. I had Greg Brockman from OpenAI on the No Priors podcast last week, and he said that he thought in 2027, people are going to spend as much money on tokens for security as engineering, like you're saying, very related idea. What is going to drive that shift?

• 7:58Speaker 00

  Just emergency, right? So you're going to move forward all your security spend over the next 18 months, both from the red team side, which is more the offensive, trying to actively try to exploit things, as well as the defensive side, how you prepare things. But I don't think that's going to last forever. You know, I see a world in like 18 months where, you know, new software productivity goes way up, because, you know, all those resources are back focused on that. But there's definitely this going to be this period where security is mostly on everybody's mind.

• 8:35Sarah Guo?

  What are some of the key elements of getting to a better place in terms of overall software and internet security? I think people discover, of course, that there are libraries and services everyone uses that had vulnerabilities that took effort to discover and now do not. And I think we'll hit some of those. What else is important there? Because part of the concern that I have is the rate of software production is also going up a great deal. So to some degree, we've got to go hatch everything that we have already made and then keep up and get ahead of the pace of delivery.

• 9:13Speaker 00

  Yeah. Also, for one, right now, we're patching 70 years of software out there. So it is just catch-up. And then on a go-forward basis, I think the software development lifecycle, the agent development lifecycle is going to need to change. And luckily, the same way that we can use security right now for Red Team and things like that, it'll just be built into the process every step of the way. And I think software will just get more secure over time.

• 9:46Sarah Guo?

  What have you learned about building secure production software internally already that you think people can learn from? What does that mean? Shift left? And there are many theories of how to do this, including broader use of formal verification, using agents for security in the development process. What do you think is going to create better software from first delivery?

• 10:15Speaker 00

  I can go back to first principles of there is you want to reduce your attack surface area. The easiest thing you can do is to give less places for there to be vulnerabilities. So looking at all your software and saying, how can I simplify this? How can I reduce the footprint, the code? And then beyond that, things like formal verification, and I think things that safer programming languages and things that are kind of built into the runtimes that make everything safer will come. But I think it just starts with, and AI, at least, the early AI is very verbose, likes to create complexity.

• 10:55Speaker 00

  So AI, in a sense of what we've been dealing with, has actually not been kind of helping build a more secure stuff right now. But I think we'll get there. And I think that's where humans still come in, and human judgment comes in, in making sure that we design the software in a way that can stand on its own securely.

• 11:16Sarah Guo?

  That was actually going to be my reaction when you say, we want to reduce the surface area. I'm like, oh, yes, of course, in principle. And that's not the natural inclination of today's models. Right? And I ask you to do something, and I'm like, well, with one-tenth the complexity, please try again. Is that the role of engineering and security engineering today? Is that something that's going to be solved at the model level?

• 11:42Speaker 00

  The way that humans did it before agents, it needs to be solved at all levels. You need to train the engineers that are writing the code, the product engineers. The security teams still need to be involved in making sure that they're getting checks and balances, second set of eyes on things. You need to build in processes. We've gone to defining things a lot more internally on how we build a CloudFlare, writing down our principles. We have a document called the Codex, which is kind of like a buildup of a lot of RFCs that the teams have built for it. Here's how you build secure software CloudFlare. Here's how you build available software CloudFlare. Here's our best practices. And then it kind of gets boiled up into some Ten Commandments that the agents know how

• 12:26Speaker 00

  to follow and use in every part of the review process that can help enforce those things. So you have agents out there that are just riding a lot of the slop. And then you have, deeper down in the factory, you have people that are doing the performance runs and the security runs, and just like how the company operated before, you need those adversarial reviews.

• 12:48Sarah Guo?

  When you zoom out a little bit and just look at overall traffic on the internet and how much of it has become agent-driven over the last year, I think it's outpaced most people's expectations. What has updated in your worldview of what the web a year from now looks like, either from an economic model perspective or a security or requisite infrastructure perspective?

• 13:18Speaker 00

  Yeah. I mean, I kind of think of it as we're in the messy middle right now, where humans and agents are riding the same rails on the internet, where agents are trying to parse a human web when that's just inefficient and was designed for humans to do things at different speeds. Going to a website and being able to read and see the ads and participate in the more the economic model versus an agent that now can go to 1,000 web pages in the same period of time, which is great. It's just you need to find a new economic model to support that.

• 13:57Sarah Guo?

  Do we get parallel webs? Is there like a human web and a machine web? Like, everybody's trying to do, what's it called? A O now?

• 14:05Speaker 00

  Yeah. I mean, yes, I think we do. I think we find ways to deliver the content and meet agents and humans where they are, as opposed to trying to meet them in the same place. And right now, there's like translation layers. There's a lot of companies that like, help you, an agent view a webpage. These are just all extra burning of tokens for things that probably don't need to happen. The website usually knows what data. And we've had things like this, we've had APIs, ways that computers talk to each other for years. It's just, APIs only covered a small fraction of the information on the internet.

• 14:46Speaker 00

  And agents have a thirst to understand everything. And so they're going out and trying to explore the human internet. And we need to make it easier for them. We need to make it less costly for the site owners. And we need to find a way for them to get compensated. I think it's, in a world, it can get very simple. Most of the content website, like a Substack, they know what their CPM is for, how much money they should be making on ads for that site. And so if an agent's reading the site, I think there is a world where you get to the point where an agent can decide whether or not they want to read the content, and then

• 15:30Speaker 00

  they can decide if they want to pay the CPM rate. And that's where you need to then get new payment rails for the internet that can do millions of transactions a second for all these little micropayments. All these things that we've been talking about for years, micropayments, always are two years away. I think agents will actually push that forward and actually we'll see a world where actually there is a new economic model for content creators.

• 16:01Sarah Guo?

  Who do you think the players are? What are the variations of that infrastructure? Like, I think, obviously, CloudFlare has an important role to play here, but the rise of personal agents like Instinct and Muse have also made this like an immediate question from a transactional perspective?

• 16:19Speaker 00

  I don't think everyone knows, on the other side, what the business outcome is going to look like. Everyone's been through these transformations where the internet, it thought it was going to kill Main Street. It didn't kill Main Street. There's small businesses that are still thriving. But there were people that were displaced. And so there's always kind of some skepticism there. And so there's some natural inclination to just block them out. You saw Amazon just say, no personal shopping there from an agent. I mean, I think these are all people that are in that messy middle, but they're trying to figure out what that path forward is and trying to keep some of their negotiation

• 17:03Speaker 00

  leverage there. I think we will get to a place where Muse and Dots and all those personal agents will be able to accomplish tasks seamlessly as you as a human could do, even easier. But I don't know if the technology's quite caught up to that yet and the business models either.

• 17:23Sarah Guo?

  Is there anything you're personally excited about on the roadmap or just from a technical exploration perspective on the CloudFlare front that you feel like is going to enable this ecosystem in the future?

• 17:37Speaker 00

  Well, yeah, absolutely. On the content side, we've released a conference monetization gateway, where we make it easy for people to put their sites behind us and take microtransactions for their content, including providing wallets for agents to use and a staple point that's going to be able to help facilitate that transaction as well. We're also doing things with OpenAI, a project called Signals, where we're making it easier for agents to actually discover content instead of having to crawl the entire internet and continually go back to pages.

• 18:19Speaker 00

  We're making it easier for them to know what's new content and actually kind of more proactively do that. So it's a win for the AI labs, as well as a win for the site owners not having to get constantly crawled and pay for that infrastructure. So there's a whole set of new laws of the internet that I think I'm really excited to see those kind of grow, to see the X402 from when Stripe came out with it. I loved it because it went back to the 402 HTTP code, which was, Tim Berners-Lee created 20-plus years ago, 30-plus years ago, for payments. So you kind of always knew that you needed a better payments rail on the internet, but

• 19:04Speaker 00

  we haven't been able to kind of figure it out. And I think agents will lead us to that as well.

• 19:09Sarah Guo?

  When you think about these initial products that you've released, what would success for a content creator or somebody who ostensibly had a website on the internet that they were monetizing with ads before? What's the killer success case you guys need to see or show the world where it just becomes like a default to do this?

• 19:33Speaker 00

  Well, I mean, I think we're, instead of them paying us, we're paying them. Right? Where it's covering their infrastructure costs, it's providing money that supports their livelihood. We can actually increase the number of content creators out there, which the last generation of the internet has done very well, like with YouTube and TikTok. We can actually make it even exponentially larger.

• 20:03Sarah Guo?

  And when you look at the Workspace OS, like, release and ecosystem work that you guys have been doing, what is, what are you hoping are the, like, biggest use cases of it coming up?

• 20:17Speaker 00

  It's transitioning a little to a, we released one called CloudFlare OS. And CloudFlare OS was, is our internal platform for how our employees use AI every day. Where we, you know, and it actually goes back to security roots where, you know, we were very worried about customer data, internal data leaking out. And we wanted to make sure that our employees could, you know, use all the new AI tools and models, but have a way to safely deploy them internally to understand how that data is being used and flowing and have, you know, kind of good governance over that. In addition, the reason why we call it CloudFlare OS is, uh, we started to realize that, uh,

• 21:00Speaker 00

  you know, as we have more and more agents, uh, you know, we needed to be able to teach them what we call for special, how we build a CloudFlare. Um, you know, and for humans, we did that through CloudFlare University and the onboarding process and, you know, meeting your colleagues and working with them. Uh, but we needed to kind of more clearly define that and document that for agents. And so CloudFlare OS is both the platform where our employees can build anything that they want in a secure way without having, you know, security, it's not something they have to think about. Um, you know, the B R that's trying to create a call list, uh, they don't have to worry about uh, security, um, it's just built in there for them. Uh, but they also know that it's being done in a way that is, uh, consistent with the themes and values of how CloudFlare works.

• 21:42Sarah Guo?

  And why release, I think of this as like somewhat different from the other products that CloudFlare offers today in that it is not infrastructure. It's like an end user facing, um, uh, product for managing AI use within, within the organization. Like, why release it? Or do you think of it as a departure?

• 22:01Speaker 00

  Yeah, I mean, um, for one, it was, uh, it's kind of a reference architecture, really. Uh, it's, uh, you know, we, over the past 10 years, we've built some, uh, our developer platform where we started with just a simple serverless compute primitive. Uh, and now, you know, over a hundred different, uh, uh, developer platform tools, uh, from storage to databases to durable objects. Um, uh, we wanted to show someone, show how you can build it completely on CloudFlare, um, and how we build things internally and kind of, uh, give people the option to, uh, you know, fork it and build, uh, their own version of their own company OS on top of it.

• 22:40Sarah Guo?

  Um, and what is a way in which it is helping your people and your organization that you think is like clear success?

• 22:48Speaker 00

  Uh, it's actually used more by, uh, uh, our go-to-market teams and our G and A teams than is even used by our engineering teams. Uh, you know, uh, it is, you know, giving them a very fast, you know, early on, I thought, you know, we saw training was the biggest gap for people using AI. And when you just kind of point them at a chat interface, um, or, uh, another by putting tool, uh, it's too much of a blank slate for them. Uh, and so, uh, you know, this is a platform that's designed, you know, you design everything for it for how your business works. And you, they immediately can go there and, you know, get access to all the data that they need. They can, uh, get guided and taken, taken through, uh, where they quickly realize,

• 23:33Speaker 00

  oh, this is not, you know, trying to replace me, this is trying to make me better at my job. Uh, and that's been really exciting to see, uh, just, uh, just all the different ways, uh, people at the company have, uh, have done that. Uh, you know, a lot of the, uh, uh, how this conference got put together, uh, the marketing team, uh, we built hundreds of internal tools where previously, you know, they would have, they would have to go out and, uh, work with different agencies, but they can, you know, the speed that they can move with a smaller team now is just amazing.

• 24:00Sarah Guo?

  Assuming this is a continuation of, you know, starting in May, you guys did this restructuring to be in, uh, like a sort of AI-first organization. Um, what, what else reflecting on, you know, the last number of months has worked or not worked that you would recommend to others?

• 24:18Speaker 00

  Yeah, I mean, so, uh, you know, the, the restructuring was hard, uh, you know, saying goodbye to some of our colleagues, uh, it was the first time CloudFlare ever did it. Um, you know, uh, we had, we had always been very careful not to over-hire and, um, oh, this was for different reasons. Uh, this is because we, we saw the, uh, the way AI was transforming some teams and how they work. Um, and, you know, we kind of thought of it as like a factory floor where you needed to be, actually rebuild, rethink how things happen. You know, uh, there were some processes or some, you know, the way a product manager would send an email forward to customers and involve three teams. You know, it involved a team where, uh, you know, uh, you went to B I to go get a cohort of, uh, uh, the people that you wanted to send an email to.

• 25:03Speaker 00

  You went to the marketing team to help you design the email and then get the voice right. Uh, you went to the marketing operations team to get the email out. Uh, where, you know, it, you're never going to be able to, uh, actually redesign that process unless you kind of, kind of make some hard changes and, uh, force people to kind of rethink, well, what actually is the right way to do that? Uh, and it might not involve those three teams at all. It might just involve, uh, a new way of doing things. And, you know, so what came out of that was a tool where a product manager now goes in and describes the cohort, uh, they write an email, it rewrites it in CloudFlare's voice, it sends it to their manager, uh, um, and the manager can click approve if they like it, and it goes out.

• 25:44Speaker 00

  Uh, where, you know, we didn't go from three teams getting faster at, uh, doing that. We went to, you know, uh, one tool that can kind of, uh, let a product manager now have a superpower that they didn't have before.

• 25:56Sarah Guo?

  When you think of all of the different workflows and tasks within an organization that's got about 5,000 people like CloudFlare is like, how do you decide who the owner is of rethinking that process? And, and like, was it bottoms up from one of those teams in this case? Like, is it an organizational leader? Like, when you have so many of these things that could change to be faster and make more sense, as you described?

• 26:19Speaker 00

  Yeah, I mean, CloudFlare's always had a thousand more things that we could, we could ever do, whether it was, you know, products and features or things like this. And so, uh, we, we, we always look for people that, uh, are going to take initiative and ownership. Um, and so, you know, it doesn't really matter if you're ordering it, you know, one to 100 and trying to prioritize it. Any one of those hundred things, uh, are probably safe if someone's passionate about it. So, you know, we, we, we kind of gave people, beginning of last year, the, uh, the tools and started seeing how they were experimenting. And, you know, uh, people quickly kind of, uh, broke out into different cohorts of people that were really leaning in and, uh, um, you know, just naturally doing those things and taking ownership of them.

• 26:57Speaker 00

  Uh, so, you know, I think it was very, uh, bottoms up from the, uh, how we're going to, uh, do those things.

• 27:05Sarah Guo?

  Uh, it's been a major topic of conversation for organizations as to how they should think about, um, token budgeting, right? Like, you know, what's a reasonable amount to spend? How do I think about this versus human capital? We should get tokens even within our organization. Like, what is your philosophy on this now?

• 27:25Speaker 00

  It's definitely changed, uh, you know, uh, and each model kind of makes you rethink it as the, the cost dynamics change. But, uh, um, you know, it, in, in general, uh, um, uh, you know, I think it's kind of silly that we're actually asking humans to decide which model to do each task.

• 27:41Sarah Guo?

  Like, it should be intelligently routed, certainly.

• 27:43Speaker 00

  Yeah, exactly. Like, humans just aren't, aren't going to ever be good at that, right? Like, uh, um, you know, uh, um, but, you know, early on, you do it kind of, uh, brute force and you, you know, people, you get people to experiment and you say, hey, well, you know, let's try for the planning part, let's use the, uh, you know, the top frontier models for that. Um, and then, uh, you know, once the plan's written out and agreed upon and integrated on, then, you know, uh, potentially some more of the open source models, uh, can go do that. And then you go back and you have a, uh, one of the frontier models do the, the reviews and the red teaming and, and things like that. Um, now, all of that today is, you know, fairly manual. Um, uh, but I think, you know, as we start to learn and experiment, I think people will become intelligent.

• 28:24Speaker 00

  Uh, and, uh, you know, uh, uh, and, you know, over time, there'll be more governance on that. You know, CloudFlare, uh, has been a place where, uh, you know, largely we've let people use the models and tools that, uh, they, they see fit, um, for the job. Uh, you know, we don't have, we don't have a token leaderboard, uh, we don't encourage it. We encourage people to focus on the output. Um, the, uh, uh, you know, they're not graded on, you know, if they use it, they're graded on, you know, what they've shipped and what they've built. Um, but then, uh, uh, you know, we do have some kind of, uh, we found like, just kind of, like, giving people notices, like, you know, if you happen to use $300 a day, they'll just get an email, right?

• 29:06Speaker 00

  Like, says, hey, did you know, and, and because most of the time, people didn't realize they were doing it. And they're like, oh, huh. Uh, and then I think if it gets to like 500, uh, it goes to your manager. If it goes to a thousand, it goes to a VP in a day. But it, it's, uh, you know, it, those things rarely happen and usually it's, it's, it's, people are actually happy to get those notices.

• 29:26Sarah Guo?

  Where do you think you are in your overall evolution of like, take things just for the current level of capabilities of, of models, assume no new development, of, you know, rethinking the way different things at CloudFlare are done from go-to-market to engineering to be touched on?

• 29:41Speaker 00

  Oh, I, I think we're still so early. Um, you know, uh, CloudFlare did something, uh, you know, two years ago, we had about 200 interns. And, uh, what we saw was those interns, uh, I think were, you know, uh, really the first, you know, fully kind of AI native, uh, you know, where that you took AI away from them, I don't think they would be able to work.

• 30:00Sarah Guo?

  Oh, no.

• 30:01Speaker 00

  And, uh,

• 30:03Sarah Guo?

  It's like, good?

• 30:04Speaker 00

  Yeah, actually, I think it is. I, I think they know how to use the tools better than us. It's just like, you took Google away from me, you know, over the last 10 years, like, you know, like, you know, how would I learn anything, right? Like, uh, that's, that's where they reached to first. Um, and, and we actually saw the managers that had interns that, from that, uh, that summer, uh, actually adopt AI faster. So then this past summer, uh, this past year, uh, we decided we were going to hire a thousand interns. So that's, you know, uh,

• 30:30Sarah Guo?

  For 5,000-person company?

• 30:31Speaker 00

  Yes.

• 30:32Sarah Guo?

  Wow.

• 30:32Speaker 00

  Yeah, uh, over the course of the year.

• 30:34Sarah Guo?

  Yeah, still, that's

• 30:35Speaker 00

  Yeah, and, uh, it's, it's just been amazing because, you know, uh, one, uh, uh, just the number of ideas that come from the interns, uh, you, you know, that's something that, you know, with AI, less people experiment faster and so having more ideas, uh, getting more people in there. But also, uh, just seeing the, the way that they, uh, uh, use AI, like, uh, you know, They need to fill out a form, they reach for AI. And I still find myself, you know, there are so many things where I'm like, oh, wait, I've just been doing this manually still. And then I'm like, yeah, oh, wait, I should be using AI. And I don't think that that's a natural, natural for most of us yet.

• 31:14Speaker 00

  And I think that will, that will take time. And so, yeah, I think we're severely in our AI journey.

• 31:19Sarah Guo?

  I love it, the mass intern strategy. I run a very small partnership and we always have a, you know, an intern or two floating around a team of about a dozen for, you know, ideas and intern energy and all that. But we just converted one of our, you know, in college interns to full time and jet and had them drop out and everything. And I, I, I think that you're right, where maybe like the dial should be turned up on the amount of DNA that is really, really native to these tools.

• 31:51Speaker 00

  Yeah, I think it's great for them as well, too. You see these schools like Waterloo and Northeastern, like with these, these co-op programs.

• 32:00Speaker 00

  And from what we've seen is people that get that type of real work experience, just, you know, are some of our best employees, many years in and go on to do, you know, great things.

• 32:13Sarah Guo?

  It is interesting or encouraging, though, that instead of it being like, hey, here's a master plan, we're going to map out every department and sub department at CloudFlare and be like, here are the key workflows, we want to try to re-engineer the workflows. It is instead a strategy of like, assume people are rational about their tokens. If given information about their usage, hire a bunch of interns and assume high agency people we have here are going to go like, you know, shift, shift those workflows to something more intelligent over time.

• 32:42Speaker 00

  And then brute force and just try things like, you know, early on, we had an email alias called Agents at CloudFlare, where we, this is back in January of this year, where we just told people to, you know, you curious, can I use AI for this? You know, email in, your job's to be done, you know, and that email, this would reply back to the skill file.

• 33:07Speaker 00

  And for a while, people thought it was actually, you know, thought it was all AI and automated. It was actually a bunch of interns that were, you know, helping people write skill files. But that let us kind of get to see, you know, in a way that's not going out in like, you know, hiring a consulting firm to come out and like catalog every single thing to be done. It's, you know, people that are recognizing, hey, this seems harder than it needs to be. I wonder if an agent can help me here.

• 33:33Sarah Guo?

  Is there anything else about the last year that's changed beyond the intern level? Like your hiring philosophy, what you look for in people to bring on?

• 33:44Speaker 00

  Well, I mean, one of the biggest things we've always looked for is curiosity. And so, you know, if people aren't using AI at home in their personal life and all that, I mean, that's a pretty big red flag, like, hey, just, how can you not be embracing AI? Do you have, you know, a level of curiosity out there? So, you know, I think just double down, double down on some of those kind of key characteristics of, you know, drive and curiosity and empathy play even better for this next set of people.

• 34:20Sarah Guo?

  Well, I'm, I mean, I, I'm a Alfred user of all products and technology forever. So, but I think the answer is like fear and skepticism, right? And so, I guess implicit in this claim about like curiosity, including an experimentation with, with frontier tools is like, that needs to, that needs to be a core principle for people who work at CloudFlare.

• 34:46Speaker 00

  Yeah, I mean, a lot of things that we're doing, we're not, you know, we're inventing new ways of doing things. I mean, the scale that we operate at for the number of sites behind us and the amount of free services we give away, it's just not possible with off the shelf technology. So you need people that can come in and literally invent new things. And that, I mean, that starts with curiosity.

• 35:11Sarah Guo?

  I have a couple of questions for you to, to close out and so mainly about security, both and how to do that in a new way, both at, at CloudFlare and then how you think it's going to work in the, in the broader ecosystem. What do you think is the like process by which if, if half the engineering team is going to go work on security and just like fix 70 years of vulnerability? How do you attack that problem internally, assuming that not all software is perfect, even amazing production internet scale software? And then, you know, we'll talk about the ecosystem.

• 35:42Speaker 00

  Yeah, I mean, I think largely, you know, we're, you know, today we have one red team. I think by the end of the, you know, the end of the year, next year, we will probably have four or five red teams. So, you know, break people out into groups that are actually, you know, being more adversarial and actually like going out and actively trying to find vulnerabilities.

• 36:04Sarah Guo?

  Why is that the approach when instead of like, oh, we're finally going to get like our patching systems, right, our processes, right?

• 36:12Speaker 00

  I mean, processes and those things can always be better. We have a vulnerable process, we have a patching process, are they perfect? No. But, you know, the best way I've found for those types of things to get better is to, out of crisis kind of comes, that, that, that's how you get those things fixed. You know, when the volumes get too big for the engineering team to just do them on using their normal processes, you know, engineers are inherently lazy in a good way. And so they will, they will automate away those, those things as they, as they, as they need to, as they kind of realize that there's no other way, way to do that. So, you know, you know, I think the focus needs to be on the discovery side.

• 36:55Speaker 00

  And, you know, people will do the right thing and figure out how to patch it in a scalable way over time.

• 37:02Sarah Guo?

  Do you express a philosophy on just prioritization of this versus like shipping new features? Because I guess my understanding of, it's, it's not as if we didn't have a backlog of like vulnerabilities in every large piece of software to go fix. It was just like whether or not that was a priority for engineering teams previously as one common state.

• 37:25Speaker 00

  I mean, I think you need to figure out how to do both. You know, it might come at the expense of cost optimization or other things. But I mean, companies, if you're not shipping, you're dying, is how we think about it. So.

• 37:39Sarah Guo?

  So it's not going to be freeze in order to do this?

• 37:41Speaker 00

  Oh, no, absolutely not. You know, you need to be, you need to be able to continue building and shipping new things, but you need to be able to make sure that you're doing it, you know, securely and patching and, and fixing bugs. And I think if we do it right, we're actually able to do them both faster with AI. While AI has become the, the tool that's causing this kind of security apocalypse, vulnerability apocalypse to happen, it is also the tool that can help us solve it faster as well. Right? So it's, so it's on both sides of it.

• 38:19Sarah Guo?

  Oh, where do you fall in this debate of the role, like good and bad of open and closed models on the cyber front, right? Because the, the argument, the broad argument is, well, having defensive and offensive cyber cyber capabilities, you know, they're parallel in the same model despite safety and guardrails being, being built into them. And so you can't have open defensive models without them also being offensive. And then the argument sort of that we're the concern around only having security capabilities in a, a set of frontier closed models is, well, how are you going to release them?

• 39:01Sarah Guo?

  And you can't possibly get them out to the distributed set of actors that need to defend. Like, what, what do you think? Or did I characterize that correctly?

• 39:08Speaker 00

  Yeah, I mean, I think over time it all has to be open because everyone's going to get access to it anyways. And, you know.

• 39:17Sarah Guo?

  That's how open source tends to work, yes.

• 39:19Speaker 00

  The bad guys, the bad guys are going to find a way to get it. So all you are is, and the, you know, the, the top companies will have a way of getting it as well. So I, I, you're just excluding a mass population that just doesn't have the access that probably needs it.

• 39:37Sarah Guo?

  And, and then so, so final question, just because, you know, CloudFlare, very mission oriented, does carry the weight of some, you know, internet resilience on, on its back. What about all the people who can't afford to have four red teams? Or like never had a red team to begin with that run important systems? Like, how do they, how do they protect themselves?

• 39:57Speaker 00

  Also, you know, I would say put your sites behind CloudFlare. Put your infrastructure behind CloudFlare, build on CloudFlare. You know, when these major vulnerabilities come out, like the React one last year, we don't just give it to our paid customers who have like the advanced firewall and WAF capabilities. We give it to everyone. We view those kind of things as a part of the utility that we offer. And, you know, we want to provide that, just like, you know, we want to provide performance for everyone. You know, before CloudFlare started, you know, there were probably 3,000 sites in the world that had a large scale CDN to catch their stuff at the edge. You know, now there's hundreds of millions of sites that do.

• 40:42Speaker 00

  So, you know, CloudFlare's always viewed our, our goal as providing, democratizing those security and performance for everyone.

• 40:48Sarah Guo?

  Awesome. Thanks so much for doing this, Dane. And you guys heard it first. We have the, the agent kitties and the vulnerability apocalypse? Am I pronouncing that right?

• 40:57Speaker 00

  Yeah.

• 40:57Sarah Guo?

  Yeah, but, but it's resolvable. All right. Thanks so much, guys.

• 41:01Speaker 00

  Thanks.

• 41:05Sarah Guo?

  Find us on Twitter at NoPriorsPod. Subscribe to our YouTube channel if you want to see our faces. Follow the show on Apple Podcasts, Spotify, or wherever you listen. That way you get a new episode every week. And sign up for emails or find transcripts for every episode at no-priors.com.