The $5 Billion Effort to help Secure the World’s Shared Software | Smart Talks with IBM

Today we're sharing a recent episode from another show Malcolm hosts, Smart Talks with IBM https://podcasts.apple.com/us/podcast/smart-talks-with-ibm/id1558889546. Earlier this year, IBM and Red Hat launched Lightwell, a $5 billion initiative backed by a force of 20,000 engineers with the goal of securing the open source software that powers a great deal of modern life — from banks and payment systems to transportation and critical infrastructure. Malcolm Gladwell speaks with cybersecurity leader Jen Easterly, Wells Fargo Chief Information Security Officer Munish Sharma, and Red Hat’s Gunnar Hellekson about how AI is transforming vulnerability discovery, how open source software can introduce risk, and what it will take to secure the shared digital infrastructure much of the world depends on. If this episode sparks a question you’d like to ask an IBM technical expert, submit your question at ibm.com/smarttalks http://ibm.com/smarttalks This is a paid advertisement from IBM. The conversations on this podcast don't necessarily represent IBM's positions, strategies or opinions. See omnystudio.com/listener https://omnystudio.com/listener for privacy information.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  This is an iHeart Podcast. Guaranteed Human.

• 0:08Malcolm Gladwell?

  Big companies inform insiders and investors of their comings and goings through a steady stream of press releases. Written in plain language, press releases typically serve as a chronicle of the prosaic details of corporate life. If you were to scroll through the news releases from IBM from last May, you would see, news of an AI collaboration, updates to the IBM consulting service, a sports tech startup challenge, a new quantum chip manufacturing facility, you get the picture. But keep scrolling until you reach May 28th, a press release that dwarfs nearly everything else. IBM and Red Hat today announced Project Lightwell, a $5 billion commitment backed by

• 0:49Malcolm Gladwell?

  new frontier AI capabilities and a global force of more than 20,000 engineers to help enterprises secure open source software. IBM and Red Hat, the open source software leader that IBM acquired in 2019, are committing $5 billion and 20,000 engineers to a cybersecurity project. Even in an age when we have become inured to very large numbers, these are very large numbers. Keep reading. Paragraph four. The press release then lists just some of the companies that have already agreed to collaborate as early adopters. Bank of America, Bank of New York, Citicorp, Goldman Sachs, JP Morgan Chase, Mastercard,

• 1:32Malcolm Gladwell?

  Morgan Stanley, Royal Bank of Canada, State Street, Visa, and Wells Fargo. Four of the biggest banks in the US, the biggest bank in Canada, two of the biggest investment banks on Wall Street, two of the world's biggest credit card networks, the firm that probably holds your 401K, just for starters. Press releases do not normally require explanations. This one does.

• 1:58Malcolm Gladwell?

  I'm Malcolm Gladwell. You're listening to Smart Talks with IBM, a podcast where we explore how AI and emerging technologies are reshaping the way businesses and industries operate. In this episode, I want to explain why one of the world's largest technology companies felt compelled this past spring to launch one of the largest dedicated commitments to open source security to date, and why the minute they did, much of the financial services industry raised their hand and said, count me in.

• 2:34Malcolm Gladwell?

  You are the head of information security for a large, very large multinational bank. I put the question to Munish Sharma, the Chief Information Security Officer for Wells Fargo, one of the early adopters on Lightwell. Why did Wells Fargo participate?

• 2:52Speaker 02

  You know, what we've seen with the progress in AI has created an element of urgency about everything, from maintenance to lifecycle management to operational stability, every aspect of it. So it's really in the past few quarters that we have, if we've started to look at things differently.

• 3:14Malcolm Gladwell?

  Anthropic released Mythos in preview mode just six weeks before the launch of Lightwell. A frontier AI model so powerful that Anthropic, its developer, said that it would, quote, "surpass all but the most skilled humans at finding and exploiting software vulnerabilities." It's right there in the press release. Paragraph three. Anthropic recently reported that its Mythos preview model identified nearly 3,900 high or critical severity vulnerabilities in open source software alone. Thousands and thousands of critical vulnerabilities.

• 3:55Malcolm Gladwell?

  But there was a moment where you're like, oh, yeah, give me a kind of more specific understanding of that. So when you say the pace has changed, it's gone from what to what?

• 4:05Speaker 02

  Potentially from days and weeks to minutes.

• 4:10Malcolm Gladwell?

  To understand the urgency behind Lightwell, you have to understand something about software that most people never think about: open source. Unlike proprietary code, open source software isn't controlled exclusively by one company or person. In a hypothetical universe where there is no open source, where code is written the way music lyrics are written, or books are written, where they're owned exclusively by the person, by the creator, how does that affect the shape of the digital revolution?

• 4:45Speaker 03

  Well, so actually, I'm going to correct you.

• 4:47Malcolm Gladwell?

  I'm talking to Gunner Hellickson, who runs the Lightwell Initiative for IBM and Red Hat.

• 4:53Speaker 03

  In fact, open source only works because of copyright. So what happens is I write a piece of software, I have the copyright to it, and I use that copyright not to, not to say all rights reserved and restrict access to it. I use those same rights to then, I can now ascribe those rights to other people. So it's actually, what was most clever about open source is it kind of inverts the intent of the copyright law and makes it, it turns it into a tool for sharing as opposed to a tool of restriction.

• 5:20Malcolm Gladwell?

  Yeah, but books and music are not written as tools for sharing.

• 5:22Speaker 03

  No, that's true.

• 5:23Malcolm Gladwell?

  There's a million books I've read where I've said I could make this better, and I'm not allowed to.

• 5:27Speaker 03

  Yeah, that's right. That's right. And so the, the mechanics of sharing become important because using the copyright law, you can actually ensure that things are shared over time and consistently. So if I write a piece of software and I give it to you, you can improve it, but the license stipulates that you then also have to share any improvements that you made, right? And so in this way, it kind of folds in on itself, right?

• 5:49Malcolm Gladwell?

  Yeah. Open source software often works in tandem with proprietary code. Imagine a pyramid. At the top of the pyramid is the specific, carefully tailored code that an individual company might use to solve a specific problem. That code is typically written in-house or purchased from a software company. It's curated, it's controlled systematically, someone's in charge of it. But beneath that sits something much larger: billions of lines of open source code, shared software components or packages built collectively by developers all over the world over decades. Anyone can use them, anyone can improve them. Someone fixes a

• 6:33Malcolm Gladwell?

  bug, submits the update to the volunteer running that particular package, and the project evolves.

• 6:45Malcolm Gladwell?

  A famous essay in the technology world refers to these two models of software production as the cathedral and the bazaar. The cathedral is quiet and composed and hierarchical. The bazaar is sprawling and noisy and chaotic. And the argument in the essay was that the bazaar, against all expectations, was far better suited for the kind of creative work that produces innovative software. Here's an excerpt from the essay describing the emergence of the most famous of all open source projects, Linux, started by Linus Torvalds in the early 1990s, the operating system that would become the backbone of modern computing.

• 7:27Malcolm Gladwell?

  "I believed that the most important software needed to be built like cathedrals, carefully crafted by individual wizards or small bands of majors working in splendid isolation with no beta to be released before its time. Linus Torvalds' style of development, release early and often, delegate everything you can, be open to the point of promiscuity, came as a surprise. No quiet, reverent cathedral building here. Rather, the Linux community seemed to resemble a giant babbling bazaar of differing agendas and approaches, aptly symbolized by the Linux archive sites who take submissions from anyone, out of which

• 8:08Malcolm Gladwell?

  a coherent and stable system could seemingly emerge only by a succession of miracles. The fact that this bizarre style seemed to work, and work well, came as a distinct shock."

• 8:28Malcolm Gladwell?

  Could we have gotten to the level of technological sophistication that we have today without open source?

• 8:35Speaker 03

  No.

• 8:35Malcolm Gladwell?

  No.

• 8:36Speaker 03

  No.

• 8:36Malcolm Gladwell?

  Here's Gunner again.

• 8:37Speaker 03

  Open source is so widespread right now. Aircraft in the sky, waterworks, electricity, roads, governments, they all rely on software that was largely developed by volunteers who were just scratching their own itch. And no single firm could capture all of that work, couldn't afford to pay them. And even if it could, the innovation loops that happen in all of the sharing would be confined to that one firm. It would be very, very difficult for three or four of these firms to, to share the information as easily as they can with open source.

• 9:14Malcolm Gladwell?

  To give you a sense of the scale of open source, GitHub, the largest archive of open source code, has over 420 million software packages in its library. 230 new repositories were created every minute in 2025. That year, software developers around the world made just under a billion commits to that archive. This year, in 2026, GitHub is seeing over 2 billion commits a month due to an explosion in AI assisted coding. Open source is massive. But the very thing that makes open source so dynamic, the fact that there is no central controlling authority, is also what makes it so fragile.

• 10:00Malcolm Gladwell?

  So who actually worries about the security of open source code?

• 10:03Speaker 03

  So as the software graduates and moves into commercialization, it's real clear, right? There's not just one, but probably several companies who are interested in making sure that that software is secure, right? So things work really well at that point. So really what we're talking about is the software that doesn't quite get swept up in the commercialization process, but it's still essential. And the way I just described it makes it sound like that's like 5% of the problem. But across all of IT, it's about 60 to 70% of the software that we're running falls in that chasm between it's not actually commercially supported and it's not software that the company has written itself. It's a, these are, we call them dependencies, right? So these are software that we need to go write other software, right?

• 10:48Speaker 03

  And that's, to date, we have not tended not to think very hard about the security of those dependencies.

• 10:58Malcolm Gladwell?

  Much of the software underneath modern life doesn't belong to anyone in particular, which raises an obvious question. If everyone depends on it, who's responsible for maintaining it?

• 11:11Speaker 04

  Well, this is the whole thing about open source software is it's incredibly important and it is maintained by a relatively small number of people. And so you can think about these enormously consequential projects that we all rely upon, basically maintained by a handful of people. And that's been the biggest issue of it, sort of industrial use and then artisanal scale maintenance. And because of where we're at right now with respect to infrastructure and software being under increasing threat, given the, given these very powerful AI capabilities,

• 11:53Speaker 04

  there's now been a big flashlight on, wow, we depend on this open source software, but it is maintained by, in a lot of cases, volunteers.

• 12:03Malcolm Gladwell?

  That's Jen Easterly. She has spent her career thinking about risk, first as a soldier and intelligence officer, later inside the cybersecurity establishment, and now as the head of RSAC, one of the world's leading cybersecurity conferences and communities. Talk a little bit about your own path to worrying about this problem. How did you get into this?

• 12:25Speaker 04

  Yeah, I mean, a pretty circuitous path, to be honest. It sort of started out right after my 18th birthday, where I entered the gates of the United States Military Academy at West Point.

• 12:38Malcolm Gladwell?

  Easterly was in the military for the fall of the Berlin Wall. She served on the ground in Haiti, Bosnia, Kosovo, Somalia. She returned to West Point to teach economics.

• 12:49Speaker 04

  And I was there during 9/11, where the world changed again. And the next decade became all about terrorism. I was at the White House, working for Condi Rice as her executive assistant, and then went off to the National Security Agency, of course, the world's largest and most powerful intelligence agency. And I was there for over a decade in Iraq, in Afghanistan, and that's where I got into cyber. Stood up the Army's first cyber operations battalion, went to stand up US Cyber Command, and then ended up in the private sector at Morgan Stanley, and then at CISA, which is America's cyber defense agency. And now I run the largest platform for cybersecurity. And so a very circuitous path, which all kinds of different threats, but right now a huge focus on cyber.

• 13:34Malcolm Gladwell?

  Craziest career path I've ever heard.

• 13:36Speaker 04

  It is a little crazy.

• 13:38Malcolm Gladwell?

  Easterly is, in the world of cybersecurity, a unique figure. She's a soldier and a strategist, not a coder. She spent her career moving between the military, government, and the private sector, not growing up in Silicon Valley. And most of all, she's someone who has spent her career looking at problems through the lens of national security and resilience. Who threatens us? Where are we vulnerable? How do we reduce risk? And how do we make the systems we depend on harder to break and faster to recover when they do? That combination has given her an unusual and influential voice on cybersecurity. And one of Easterly's mantras is, the world does not have a cybersecurity problem.

• 14:20Malcolm Gladwell?

  It has, and to her mind, this distinction is crucial, a software quality problem.

• 14:26Speaker 04

  So security has always been a bolt-on, right? That's arguably what created the multi-billion dollar cybersecurity aftermarket.

• 14:34Malcolm Gladwell?

  What she means is that cybersecurity is thought of as a layer added to software after the fact, often by someone other than the original software developer to keep the software secure. Her question is, why isn't the security baked into the software itself? Answer, because the incentive structure around writing software is all wrong.

• 14:58Speaker 04

  I mean, it comes down to, without getting too geeky or, you know.

• 15:03Malcolm Gladwell?

  No, you can get geeky. This is IBM Smart Talks. You can be geeky as you want.

• 15:08Speaker 04

  All right, we're going to do a quick Econ 101.

• 15:14Speaker 04

  So it all comes down to like basic economics, right? Goods, right? So, you know, you have search goods where you can tell the quality of a good before you buy it. Pair of shoes, nice shirt. And then you have experience goods. You tell the quality after you buy it, like a meal in a restaurant or a nice, you know, trip, right? But, but software security is a quintessential credence good. What does that mean? It means that a person can't actually tell the quality of a good before you purchase it or even after you purchase it. So the average human is not going to look at a piece of software and say, that is the most secure software, that is the best, most resilient code ever. Or I am definitely going to get hacked and all my money's going to get stolen. You, you can't look at that, right?

• 15:59Speaker 04

  And so because of that, consumers don't really know what to ask for. And so the makers of the software were never incentivized to prioritize it. They were incentivized to prioritize getting that product to market first or driving down the cost. And so you have basically a classic market failure, where the market is not going to reward something that consumers don't actually care about. And then the further problem is, what happens? You know, how do you fix a market failure? Well, the government steps in with regulation to protect consumers. But in this case, the technology vendors who make this stuff have said, you know, at the end of the day, these flaws, these defects, these vulnerabilities, they're just the cost of doing business.

• 16:45Speaker 04

  You know, we'll tell customers that there's a flaw and you need to patch it and just take care of it after the fact. And so there's never been any sort of technology regulation. There's never been any sort of a software liability. So anybody who buys software, I challenge you, whether you're a corporation or an individual, look at that contract that you sign. And somewhere on that contract, it will say, you buy this product entirely at your own risk. I guarantee you, it will say that. And of course, we all check that box. But essentially, we've set up a world where software quality is not prized. And so that's where developers have never been, you know, security has never been the

• 17:28Speaker 04

  number one thing that developers have focused on. It's not, certainly not a malicious thing. It's just they're writing code and they are moving out products. And there's not been this incentive to write secure code.

• 17:41Malcolm Gladwell?

  With open source software, this misalignment of incentives is in some ways even more pronounced because you have this far-flung group of developers working independently on a single project, improving, evolving in fits and starts. Some things just fall through the cracks. Here's Gunner again. Why isn't the open source innovator in the beginning motivated to make the, the code as secure as possible? Are they indifferent to it? Or do other things take priority? Or what's the kind of?

• 18:13Speaker 03

  Yeah, well, it's a, it's a combination of things. It's a, well, do you brush your teeth every day?

• 18:19Malcolm Gladwell?

  I do.

• 18:20Speaker 03

  Oh, okay. That's a bad example then.

• 18:22Malcolm Gladwell?

  My children, maybe you could use my kids.

• 18:25Speaker 03

  So do they know that they need to brush their teeth every day? Yes. Will they actually brush their teeth every day? No, we're all human. We all have reasons. And an open source project maintainer may, they may not have the skills or the wherewithal to actually make the software secure. That's very common because making software secure is a dark art, right? It's very, it's very complicated.

• 18:46Speaker 03

  And it could be also that they were distracted, right? They could be that they started a project that was very, very promising, but then they got married, they got a dog, and they got distracted, they got a new job, and now that software got picked up by somebody else who didn't go back and, and check the code. You know, there's lots of reasons why.

• 19:02Malcolm Gladwell?

  Historically, that kind of messiness was manageable. The bizarre would inevitably get around to identifying and fixing the most serious of vulnerabilities. Before AI comes along, developers have an intuition about how safe a piece of software is. And what AI does is it says, those intuitions tended to radically underestimate the number of vulnerabilities.

• 19:25Speaker 03

  Yeah.

• 19:25Malcolm Gladwell?

  How radically?

• 19:27Speaker 03

  Quite radically. The number of vulnerabilities that we joke internally, that a lot of the vulnerabilities that we've discovered are old enough to vote. They have been in software for 18, 20 years.

• 19:38Malcolm Gladwell?

  These people just never.

• 19:39Speaker 03

  Yeah. Just never looked or never had an AI that had the patience to look. Right?

• 19:44Malcolm Gladwell?

  Yeah. In the world of cybersecurity, vulnerabilities are given a grade on the Common Vulnerability Scoring System, more commonly referred to as a CVSS score. The CVSS scale measures how serious a vulnerability is.

• 19:59Speaker 03

  So if you say that my piece of software has a critical vulnerability, cool, I'll go fix the critical vulnerability and then we're good. But to date, we've said, well, if you've got 10 low vulnerabilities, it's kind of like, well, I could go fix it. But it's actually probably even more disruptive and risky to fix it than it is to just leave it alone. So we're just going to let it be. And we kind of, as an industry, we kind of collectively decided over the last 25 years, like, when we get these low impact vulnerabilities, let's just leave them be. It's riskier, it's too risky to fix them. So any one of these things is not very important. But when you chain them, when you chain five or six of them together in a very specific way, now suddenly they become critical. That is one of the consequences of now that we've pointed AI at this problem. That's one of the things that we've collectively come to this realization.

• 20:42Malcolm Gladwell?

  We're talking about not just second order effects, but third, fourth, fifth order. It's like chess. This one move doesn't appear to put me in any peril, but what I've done in the first round will come back to haunt me five rounds in. And by then I've lost. There's a flip side to this, though. And that's where the story turns optimistic. If AI has made it much easier for bad actors to find vulnerabilities, it has also made it easier for the good guys to fix them. Here's Munish Sharma again, who has the massive responsibility of ensuring digital security for a major institution, Wells Fargo.

• 21:20Speaker 02

  We've quite literally used AI to sort of combat the risk of AI. And what I mean by that is we've developed automated capabilities using AI to be able to fix, you know, what we detect in our software.

• 21:32Malcolm Gladwell?

  Like any competitive struggle, from a sporting match to human warfare, competition involves a constant back and forth between defense and offense, with each side having a momentary advantage. And while the advantage in software is to the attacker right now, that shouldn't always be the case. Manish says he's also seeing the balance shift with some of the new AI tools.

• 21:55Speaker 02

  Done the right way, architected the right way. I don't think it's easier or faster for AI to identify than to mitigate. You know, obviously there is going to be a little bit of a lag between those two, but it's not orders of magnitude. Meaning it's not as if you can find things in a day and it takes you months to patch them or to mitigate them. If that's where an institution is, I'd be a little concerned. So your ability to respond to things has gotten a lot faster as well. It's not one to one mapping between finding and resolving. Usually it's, you know, one to many.

• 22:39Speaker 02

  But using AI, you can very efficiently create an architecture where you're able to respond to those threats way, way faster. That's our area of focus.

• 22:50Malcolm Gladwell?

  Can you give me a kind of a rough sense of how much that gap has closed in recent?

• 22:55Speaker 02

  It's closing pretty, pretty, pretty fast. And it's closing pretty fast at most institutions that I talk to. And let me give you an example. In terms of scale, you are now seeing not a factor of two times or three times the number of fixes to critical and high vulnerabilities. You're seeing a magnitude of 10x, 20x within the same window of time. So if an organization was mitigating, let's say, 100 vulnerabilities, critical or high in a month, our ability to patch that is is order of magnitude faster now than it was in the past.

• 23:37Malcolm Gladwell?

  If you are someone sitting on a mountain of open source code of uncertain integrity, all is not lost. The same technology that threatens you can also help save you. But you have to be organized. You need a strategy and you need a partner. The AI company Anthropic released a preview of Mythos on April 7th of this year. The model was so good at finding vulnerabilities in software, Anthropic said, that it would give a select group of partners, mostly tech, cybersecurity and critical infrastructure organizations, two months of early access so they could prepare themselves for Mythos's extraordinary abilities.

• 24:20Malcolm Gladwell?

  The same day, Treasury Secretary Scott Besant and the Chair of the Federal Reserve, Jerome Powell, summoned the CEOs of the country's top banks to a closed door meeting in Washington to warn them that AI was posing an unprecedented threat to the banking community. Financial firms have always been high on the hackers' list of preferred targets. As the notorious bank robber Willie Sutton famously said in response to a question about why he robbed banks, that's where the money is. The digital world isn't any different. Lightwell was the logical next step. IBM's Red Hat was already in this game. Their flagship business is aimed at bridging the gap

• 25:01Malcolm Gladwell?

  between the open source software systems and corporate users. Gunnar Hellekson said they had talked about doing a wider effort, but had always dismissed the idea because it seemed too ambitious, too much code to manage, too many people to hire. But he says, once Mythos was announced, we realized the urgency of the problem and that we finally had the tools we needed to solve it. By the end of May, Lightwell was up and running. And one by one, the banks, many of whom had been at that April meeting at the Treasury Department, signed up. The problem was so large, they realized they couldn't tackle it on their own. This is Munish Sharma again on the scale of the task of securing open source code.

• 25:46Speaker 02

  So it is large. It is humongous in terms of how integrated it is in the overall software stack. And our ability to manage it, that's where the various institutions are coming together. And, you know, we are taking a systematic stance on it. Instead of trying to focus and starting to manage the packages ourselves, which is one way of doing things. Another is to partner with industry and really come at it together. So I think there has been a lot of focus on this in the past few months and through various institutions, including Lightwell, where we are focused on making sure that we extensively scan

• 26:28Speaker 02

  and understand the security risks within the open source packages that have been consumed.

• 26:33Malcolm Gladwell?

  You talked about partnerships. What are you looking for in a partner? What is it you need when you look outside your own organization?

• 26:41Speaker 02

  So first and foremost, it's the, the first thing I'd look at is their ability to scale. And followed by a mindset that is security first. This has to be a sustainable at scale solution. We're not talking dozens of packages. We're not talking hundreds of packages. We're talking tens of thousands of packages.

• 27:05Malcolm Gladwell?

  So Lightwell, 20,000 people and $5 billion. Big because it has to be big. It offers a repository or network of fixes and components.

• 27:19Speaker 03

  Lightwell is a clearinghouse for open source vulnerabilities. Companies join the clearinghouse. They submit their vulnerabilities to Lightwell. Lightwell fixes those vulnerabilities and then delivers them back to the customers and to the open source communities they came from.

• 27:40Malcolm Gladwell?

  And you said, you, do you, you have 20,000 people? Or you want to have 20,000 people?

• 27:46Speaker 03

  The aspiration is 20,000 people dedicated to the effort of securing open source software.

• 27:52Malcolm Gladwell?

  It's an astonishing number.

• 27:53Speaker 03

  It's an astonishing number. Yeah.

• 27:55Malcolm Gladwell?

  And are all these people going to be in one place or scattered throughout?

• 27:58Speaker 03

  No, necessarily they have to be scattered.

• 28:00Malcolm Gladwell?

  How busy has it, have you been?

• 28:02Speaker 03

  Extraordinary. I've been at Red Hat for 20 years. And I was talking to another old head at Red Hat. And he and I had the same impression. It's like, this is what, this is what Linux felt like. When we were first, when we first caught the wave of Linux adoption 20, 25 years ago, this is what it felt like. Everyone understood what needed to happen. Everybody was, nobody really knew how it was supposed to work in its entirety. But everyone was kind of rushing in to figure it out. And that's, it feels very much the same.

• 28:35Malcolm Gladwell?

  For Easterly, the moment we are in reminds her of the early days of the Cold War. A super weapon arrived, posing an existential threat. But what happened? The world responded, built institutions, learned how to protect itself. She's an optimist by nature.

• 28:52Speaker 04

  And so we've actually created an environment where defenders are at a massive disadvantage because of the way that technology was created with these flaws and defects. Now, the great news is what we can see with these AI tools as they become increasingly powerful, they can actually shift the advantage to defenders by creating much more secure and much more resilient code than we've ever had before. And importantly, helping us to transform and refactor a lot of the insecure legacy code that we've been dealing with for decades and decades.

• 29:33Speaker 04

  And so I wrote a piece last year that was called The End of Cybersecurity, An Optimist's Guide to, you know, Improving Software Quality. And it was all about how we can look at AI as a cure for insecure code. So I do believe in the next couple of years, we can actually see a significant reduction in cyber risk, a significant improvement in software quality. But the path to get from here to there, I think, is going to be pretty rocky. Because in the short term, attackers will have an advantage by using these AI tools to more rapidly find those flaws, those defects, those vulnerabilities, and potentially weaponize them. So in the short term, the advantage goes to attackers.

• 30:18Speaker 04

  In the long term, it goes to the defenders.

• 30:20Malcolm Gladwell?

  And in the end, maybe that's why this press release felt so different. It wasn't a company announcing a new product. It signaled the arrival of a new era. The recognition that some of the most important infrastructure in the modern world is shared infrastructure. And shared infrastructure requires shared defense. Before you go, we're trying something new. If you have a question you'd like to ask an IBM technical expert, submit it at ibm.com/smarttalks. We're exploring ways to bring your questions directly to the experts and we'd love to hear what's on your mind. Smart Talks with IBM is produced by Matt Romano,

• 31:04Malcolm Gladwell?

  Amy Gaines McQuade, Trina Menino and Jake Harper. Engineering by Nina Bird Lawrence. Mastering by Sarah Brugger. Music by Grammoscope. Strategy by Cassidy Meyer and Alina Choi. Smart Talks with IBM is a production of Pushkin Industries and Ruby Studio at iHeart Media. To find more Pushkin podcasts, listen on the iHeart Radio app, Apple Podcasts, or wherever you listen to podcasts. I'm Malcolm Gladwell. This is a paid advertisement from IBM. The conversations on this podcast don't necessarily represent IBM's positions, strategies, or opinions.