Uncapped #39 | Daniele Perito from depthfirst

Daniele Perito is Co-founder and Executive Chairman of depthfirst, an AI-native security platform that understands your code, business logic, and infrastructure to find real vulnerabilities, slash false positives, and give developers actionable fixes in their workflow. Daniele is also Co-founder and Board Member of Faire, where he previously served as Chief Data Officer and helped build the company’s data, risk, and analytics foundations from the early days to a multi-billion dollar valuation. Before co-founding Faire, Daniele worked at Square and was on the founding team of Cash App, where he focused on security, fraud, and risk systems supporting products used by millions of merchants and consumers. We covered: Inception stories from Faire and Cash App The ultimate truth seeking machine Building superhuman attackers with AI Who wins over time: attackers vs defenders Why security feels like its own world --- Timestamps: (0:00) Intro (0:40) The founding Faire insight (4:34) Operational rigor of marketplace businesses (10:39) Starting a company now vs in 2017 (12:01) The inception story of Cash App (16:22) depthfirst’s mission (18:08) AI security landscape (26:10) Security is a fantasy world (31:15) Building superhuman attackers for defense (38:27) Roles of humans and AI in security (39:14) Platform vs pipeline businesses --- More on Daniele: https://depthfirst.com/ https://www.linkedin.com/in/danieleperito/ More on Jack: https://www.altcap.com/ https://x.com/jaltma --- https://linktr.ee/uncappedpod Email: [email protected]

• 0:00Speaker 00

  There is this saying in security circles that in order to survive a bear attack, you don't need to outrun the bear, but you need to outrun the person running next to you. That's the way that the business has been operating for a very long time. But with AI, you can think about the fact that there isn't just going to be one bear. There's going to be a thousand AI bears.

• 0:16Speaker 01

  That's terrible.

• 0:18Speaker 00

  So we're really trying to secure the world software from AI bears, really.

• 0:23Speaker 01

  Today, I'm here with Daniele Perito, who co-founded Fair. Before that, you were a founding team member at Cash App at Square, and you also ran data and security there. And then most recently, you've now become the founder of DepthFirst, which is an awesome AI security company. Really excited to be doing this podcast with you today.

• 0:39Speaker 00

  Thank you for having me.

• 0:40Speaker 01

  I want to start by learning about Fair and sort of like what your experience was like there. But maybe if you could take us back to sort of the founding insight or what sort of led to the creation of the company?

• 0:49Speaker 00

  I would say that Fair was probably a little bit of a contrarian bet. People at the time didn't think that Brick and More Retail was this place where there was going to be a lot of growth, like Fair proved. But at the time, Max, Marcel and I were talking about ideas and companies to start together with Jeff Polison as well. And Max was introducing a high-end umbrella from New Zealand to the US market. He was seeing, that was a side gig, you know, he was working at Square, but he had a little bit of a side gig. And he was seeing how getting sales on Amazon was extremely hard. Getting into Nordstrom or Walmart was also extremely hard. And working with hundreds of thousands or millions of retailers was just impossible

• 1:32Speaker 00

  because there were many, many regional sales reps and things like that. So we thought that there had to be a better way. And then from Square, we knew that sort of taking risk on behalf of your customers, it was always a good way to create value because, you know, Square is in the risk management business in a sense. And we had learned that there. So we decided to give retailers the ability to order. And not have to pay for sixty days and be able to return anything that they don't like. So and taking the discovery risk off of their balance sheet and then not even asking brands to offer that value prop, but us sort of trying to use technology to offer that value prop. So that was a big insight.

• 2:09Speaker 01

  Yeah.

• 2:09Speaker 00

  Starting fair.

• 2:10Speaker 01

  Did it go sort of the way you expected from the beginning? Like, how linear was it from like that concept to just like the company, you know, taking off and going the way that it ended up going?

• 2:18Speaker 00

  Yeah, I would say the free through product market fit, there was a little meandering. I think at the time, we were unsure exactly what was going to give enough value to retailers to order unfair. We were experimenting with a lot of things. We're experimenting with something called consignment, which is a little bit of a technical term in the business, but it's just a bit easy to like, put something on someone's shelves without actually, without them having to actually buy the merchandise, right? Then we were experimenting with consignment that was extremely capital intensive for us and very, very risky. We were experimenting with like points programs and we were experimenting with other things. And I remember one night, this was maybe August of July or August of twenty seventeen, Max was at a trade show

• 3:02Speaker 00

  in Atlanta. Every single day he was at the trade show and Marcel and I were in the background like coding changes so that he could like sell them the day after. And he was just like, I think we need to go with like try before you buy, which is the same thing we've been throwing experimenting around, which is like net terms plus the ability to return. But I'm gonna talk about it as try before you buy. And so a night I coded that behind the scenes. The day after he went in front of customers, they immediately got it. And that's when we knew we had something.

• 3:31Speaker 01

  Yeah, it's amazing how like those early days, the speed you can move, the way customers react when you do that is crazy. You know, like I remember we had some experiences like this early on at Lattice where you like take, you know, take some customers like bug and you fix it within the hour. And then it's just like, it completely changes the relationship. I'm sure you had a lot of that.

• 3:50Speaker 00

  Yeah, a hundred percent. And I think it's really, you know, product market fit is this thing that everybody talks about, of course. But I feel like until you see. Now being there to then it be there.

• 4:01Speaker 01

  Yes.

• 4:01Speaker 00

  And that shift that is real because before that that actual shift, you try to convince yourself. I think we have.

• 4:07Speaker 01

  Yeah, because you don't want to tell yourself you're wasting all your time.

• 4:09Speaker 00

  Right.

• 4:10Speaker 01

  Yeah.

• 4:10Speaker 00

  But after that, as you actually say, oh, yeah, I was putting myself before. And yeah, this is actually what it is.

• 4:16Speaker 01

  Yeah, I don't know. I mean, for us, we had some, something, something similar where it's like a product was built and all of a sudden it went from like no to yes. I think maybe there's some companies where it's more of like a gradual thing that happens. I don't know.

• 4:28Speaker 00

  Yeah.

• 4:28Speaker 01

  We can talk about this when we get to depth first, but like, I'm curious like how that experience compares to like the current experience. Before we get there, I want to stick with fair a little bit longer. You, you talked about how like it was an operationally intensive business that required a lot of rigor. Can you talk about like what that looked like in practice?

• 4:45Speaker 00

  Look, one of our values at Fair is seeking the truth. And that is sort of necessary in operating a marketplace business. You are providing value to retailers by having more brands on the platform that can sell to them, providing value to brands insofar as there are retailers on the platform that buy from them. There are all sorts of balances. You're trying to make sure that exists between supply and demand. You want to give retailers an amazing discovery. You want to manage risk so that retailers can get as much payment terms on the platform, they can order on terms as much as possible.

• 5:17Speaker 01

  Yeah.

• 5:18Speaker 00

  But without, you know, risking too much on your end and to brands, you want to onboard them as fast as possible, but also making sure that in their first week, in their first month, they get as many orders as they possibly can. So there is many, many factors in a marketplace business and you're trying to make decisions in within a system that is highly recursive, where small, it's chaotic. Small changes can ripple out. And so intellectual rigor and data analysis.

• 5:49Speaker 00

  It's crucial, but of course, that always needs to be paired with a sort of intuition and a sort of ambition, because otherwise you can be a little bit too incremental, right? So you want to balance out these two things. But in operating a marketplace business, you really need to be rigorous.

• 6:06Speaker 01

  Yeah, I often think about that, where like a software business, you know, another another cut on this software business has these high margins and that affords a lot of, you know, error underneath. When you're operating a business that has a different margin structural, say of a 10% margin versus a 85% margin, there's just a lot less underneath there that you can operate within. So I imagine that sort of daily workings of the company have to be more precise and measured.

• 6:31Speaker 00

  Yeah, I mean, one thing to say is the marketplace businesses are not, you know, depending on how you compute them, but usually you compute them over sort of gross revenue.

• 6:38Speaker 01

  Yeah.

• 6:38Speaker 00

  So in general, they're more like 50% margin businesses.

• 6:41Speaker 01

  Yeah, yeah, yeah.

• 6:41Speaker 00

  So.

• 6:42Speaker 01

  Yeah, I was even thinking of, you know, there's like a business like Amazon or something like, you know, it's like at the extremes, like how careful do you have to be today?

• 6:49Speaker 00

  There is a lot of rigor that you need to build in. You know, you have all of these machine learning models, they're making predictions at all times, and the business really relies on them to actually operate and flourish. The marketplace is really something that needs to flourish, where demand must meet supply and really.

• 7:09Speaker 01

  I'd imagine that means you also need like a culture of like a lot of testing, rather than like maybe in like a B two B company, you can do a lot of sort of just like, here's a plan, we kind of know this is roughly going to work, takes a lot of effort and you like do the plan once versus I'd imagine in a marketplace business, there's a lot more like test things, like see what happens in reality and then you can grow programs over time.

• 7:27Speaker 00

  Yeah, I would say that operating fair has given me a healthy amount of epistemic modesty and humbleness, because.

• 7:35Speaker 01

  About like how much you can really know?

• 7:36Speaker 00

  How much you can really know. And I come from academia, right, where. I was trained in some sense to be skeptic of my own beliefs. But there is not nothing quite like trying to test your beliefs in the market.

• 7:48Speaker 01

  Yeah.

• 7:49Speaker 00

  To actually know the limits of your beliefs.

• 7:51Speaker 01

  Yes.

• 7:51Speaker 00

  Where you was launching an A B test and be like, I am certain that this A B test will land.

• 7:56Speaker 01

  Uh huh.

• 7:57Speaker 00

  And then you'll discover that there is a second, third order concern that you have, you will never have anticipated. That completely sort of undermines the hypothesis that you had.

• 8:06Speaker 01

  Yes.

• 8:07Speaker 00

  And so this idea that there are limits to human knowledge and you kind of need to experiment your, your way into things. It's really just be there into you if you're operating a marketplace business.

• 8:16Speaker 01

  Yes. I mean, in general, I really appreciate when people can like express the confidence interval that they have on whatever they're saying.

• 8:23Speaker 00

  Right.

• 8:23Speaker 01

  When someone's like, I'm really sure about this thing. I'm eighty five percent sure I'm right. Like, I really like that, actually, when people can just like, just sort of admit that like whatever strong view that they have, unless it's like a, a piece of arithmetic, it's like, you probably don't know for sure.

• 8:36Speaker 00

  Yeah, I have this little quip, which is that I say that the market is an incredible truth seeking machine for the type of questions that it can investigate. Now, you're not going to know whether neutrinos are a certain way or another way with the market.

• 8:49Speaker 01

  Mm hmm.

• 8:49Speaker 00

  Uh, but for the types of questions like, does a certain type of sign up flow work best for retailers? Or another type of sign up flow work best?

• 8:57Speaker 01

  Yeah.

• 8:57Speaker 00

  The market is really good at getting the answer to that question.

• 9:00Speaker 01

  Right on the other side of price market fit, when you're like, hey, there's things, you know, we've got something people want, it's working. Did you experience ease from there? Like, did employees and candidates, did like investors, like, did people see what you saw at that point? Or was it like, ah, this is still niche, you know, the TAM's not that big, or was it easy to get people excited?

• 9:21Speaker 00

  I think there was probably another two or three years, I don't remember the exact dates, but another two or three years of just pushing, just to get people to understand.

• 9:28Speaker 01

  Even though you knew it was working?

• 9:30Speaker 00

  Even though we, I mean, I think we had a very good idea that it was working. We had no idea about TAM.

• 9:35Speaker 01

  Mm hmm.

• 9:35Speaker 00

  And that's why when sort of founders talk to me and they're like, how do you think the TAM, about the TAM of this business? I think TAM is just a directional thing where for the first two or three years, we were trying to estimate the size of the fair market in a thousand. There were these signals that will tell us there are millions of stores across the globe, trillions of dollars of wholesale orders. And it was just hard to wrap our heads around it. It took really like two or three years for us to be like, okay, this is a gigantic market. And we have a place in it, but investors didn't quite get that. Or like many investors did, of course, the ones that bet on us uh did, but uh and and and I was in a lot of just one on one conversations with candidates where I was just like, no, this is gonna be big.

• 10:20Speaker 00

  Trust me. But yeah, I think it took a while to really just get the word out. And I remember maybe like it was four years into starting the business where now people were starting to like repeat back to me things I was trying to tell people like three years earlier.

• 10:33Speaker 01

  You're like, oh, where did I hear that before?

• 10:34Speaker 00

  Right. And and and finally, it was just like, oh, finally people get it now.

• 10:38Speaker 01

  Yeah. When you look around like AI landscape right now and you think about like comparing this moment in time, starting a company today versus, you know, when you started FAIR, does it feel qualitatively different and sort of like the psyche of founders or how people are thinking about these types of questions? Or is it similar?

• 10:56Speaker 00

  Very different. I feel like you could rely on an assumption of some type of steady state system underneath you nine years ago. And right now, the assumption is that everything is about to change every three months in ways that are hard to predict. And you have to just stay alert to all the potential changes. And everybody's sort of trying to see where the puck is going. It's extremely hard. So I would say the level of energy, paranoia, the level, and I think it's also because the the rewards are

• 11:26Speaker 01

  Much bigger than ever.

• 11:27Speaker 00

  Bigger than ever.

• 11:27Speaker 01

  I mean, stuff growing faster than it ever has.

• 11:29Speaker 00

  Yeah, exactly. And so there is just a level of the sticks are higher and everything is just so intense all the time. And this was, I mean, don't get me wrong, things were extremely intense at FAIR too. But it was kind of like, we had our market where we knew that it was there and we we just had to figure it out within that market. But now things are just changing all the time.

• 11:49Speaker 01

  Right. Both because it's like, you know, the market might completely change. What product you could build might completely change. Competition might completely change, just like way faster.

• 11:57Speaker 00

  Yeah, or we might get the singularity in a month and everything changes.

• 12:00Speaker 01

  That's right. Yeah. Can we talk about Cash App, your time at Square and sort of the beginnings there? So I, you know, you were on this sort of funding team at Cash App and um. You talked to me about how like there was a certain mindset that you went into that with, where you're like, you know, taking a bet inside a big company. Can you talk about that?

• 12:18Speaker 00

  Yeah, so this is something that I like to tell people a lot. Just establishing my frame of mind at the time. I joined Square as my first sort of corporate job. I was a researcher before, like in academia. I was doing a postdoc and I joined Corporate America. And at first

• 12:38Speaker 01

  Went into industry.

• 12:39Speaker 00

  Went into industry. And at first, my feelings were, oh my God, everybody's going to be on top of it. I don't know, you know, sort of imposter syndrome. But then I think right after that, I started having this belief. And the belief was simply like, literally was stated in my mind as individually, in a company of a few hundred people, there has to be a way for me to to X the value of this entire business. I don't know how, why I had that belief, but I did. And I think that when you have a belief like that, a belief like that, it has a way of being self fulfilling. Why?

• 13:20Speaker 00

  Because I think you, another way of saying it, if you know, if you knew the success was guaranteed, what would you do to achieve that success? If you knew there was a way, then your brain is just going to try to find a way through solution space to try to find the set of actions that you can actually take. So the way that manifested itself for me was Cash App was a hack week project. It was spearheaded by Jack. At the time, we were using a trick, which was sending an email cc in [email protected]. And as you know, emails can be spoofed and things like that. So everybody was a little bit worried of Square that things were going to get weird with security. I was working in security at the time at Square. And I was just like, hey, put me in coach. I want to work on this problem.

• 14:04Speaker 00

  And I was like, I want to make sure individually that this is implemented correctly. Yeah. Now, a few months later, we moved away from the email trick. And luckily, because we built an app and it was much better. But the other thing that then happened is that the, our risk losses, our fraud losses from sort of stolen credit cards and things like that were a little too high. And I remember going to my boss at the time and being like, I want to work on this problem. Uh, I think I can make a big dent and it was still through this mindset that I had at the time, which was like, what is the biggest thing where I can have an impact? You know, my, I think my brain is very sort of anxious paranoid and I tried to like always find ways in which things can go wrong. But that was very well suited to the problem of fraud and combating fraud.

• 14:45Speaker 00

  So I came up with a whole system. I implemented all these rules and these machinery models where I had like one or two people helping me at the time. And so we implemented the system and we reduced the risk losses by eighty percent. We brought them into a sort of range that was actually like healthy. And then, you know, in some sense, that allowed Cash App to thrive and survive and go on to become the massive business that is there. I think according to public data and earnings calls, I think it's a ten plus million dollar revenue business.

• 15:14Speaker 01

  It's amazing.

• 15:15Speaker 00

  So in some sense, that did end up happening, you know, that belief ended up materializing. Of course, it was a large team, like many, many people had.

• 15:22Speaker 01

  Yeah, but it's a good mind. It's a good mindset because I also think when you, um, when you either feel like I could work really hard and nothing's going to come of it. That's super demotivating. Or if you're like, I can work really hard, but you know, the best I can accomplish just doesn't matter that much. It's like that sort of mindset. It's hard to, it's hard to care when you think those things.

• 15:39Speaker 00

  Yeah, and absolutely. And I think it's actually a mindset that is related to security in a sense, right? Because what do hackers do? Hackers find a way in where nobody else sees a way in. This suspension of disbelief is similar.

• 15:50Speaker 01

  For the hacker.

• 15:51Speaker 00

  It's similar to how a hacker will think. It's like, there has to be a way to create value. There has to be like a path for me, a set of actions, but a few, a few words to whisper to the right people at the right time, a piece of code that I can write. An idea that I can have, a partnership that I can form, a customer, you know, whatever that may be.

• 16:11Speaker 01

  Yeah.

• 16:11Speaker 00

  That will inflect the business. And there is, you know, I guarantee you, no matter who you are and whatever company you work.

• 16:18Speaker 01

  There basically always is.

• 16:19Speaker 00

  There is a way for you to have just an outside, outside impact.

• 16:22Speaker 01

  So let's talk about depth first. So you're doing it again. You got sort of the, the motivation to, you know, go back through the journey and you're sort of doing it with full force. What's the sort of idea behind it? What's the mission that you care about with that first?

• 16:38Speaker 00

  I think I'm doing this again. For me, it's a very mission driven endeavor. Maybe a year and a half ago, I was listening to a podcast episode between Sam Harris and Max Dagmark. And they had this point that really resonated with me, which was without much better computer security, we do not get to play the AI safety and control game. If you think about it, AI safety and control are going to be mediated by software. And to the degree that our software is not secure, which it isn't, and we need to make it a lot more secure, then what are we even talking about? And so I was like, okay, if I can create a business that is both commercially successful, but it's aligned with the mission of making the world software more secure, then maybe

• 17:20Speaker 00

  I can create a flywheel there. And the flywheel is like helping secure open source software, building better AI to find vulnerabilities and fixing them in, you know, the software runs the world, creating infrastructure, open source, anything, creating goodwill with that. And on the other hand, using the same technology that we build to create a product that customers want. And here we're talking about corporations like Square, Fair, Lattice, you know, companies that are trying to secure their perimeter, making sure that their customers are secure. And I really thought that there was a way to create a massive business with a tremendous amount of positive impact by creating this like flywheel. I would say that I think we're starting to get a good way of the way there. And like the pieces are really falling in

• 18:02Speaker 00

  place. And I'm really excited about the mission. I could not be more excited.

• 18:08Speaker 01

  What's like broadly speaking, before we get into the specifics, what is the sort of landscape for security with AI? Like, what's the, if you had to sort of try to like describe the most important parts of like the new territory now that like, you know, there's AI, AI generated code, you know, sort of the ability to sort of, you know, do reasoning, to look at, you know, if you're an attacker, like, what does this all mean for security?

• 18:31Speaker 00

  There are multiple lenses through which we can answer that question. But at the macro level, like at the mission level, I'll say the mission level and then the sort of the commercial side. At the mission level, software runs the world. There are billions and billions and trillions of lines of code and systems and configurations that make, you know, to turn the lights on and the operating banks and all the things. Every sort of serious security professional will tell you that there is always a way in. I think AI is fundamentally changing the equation that we can go maybe into that a little bit later, if you like. On the commercial side, I think people are figuring it out. Our take at that first is that two years from now, a company like Fair will operate pretty differently to the way that they operate today.

• 19:15Speaker 00

  Today, a company like Square or Fair will buy a certain number of SaaS security products. They scan certain subsets of their code or their infrastructure. They do so largely using old school techniques like heuristics and rule based systems. Those techniques necessarily have higher false positives, lower detection rates, and can only discover shall lower problems. With reasoning and AI, what we really see happening is a convergence of all these subcategories in security. And essentially what we're building is an AI security engineer. Think about a swarm of independent agents that are going through your organization,

• 19:58Speaker 00

  going through the lattice infrastructure, and they're saying, hey, there is a code bug here that allows someone to log in as someone else. And nothing before could detect that. That was not possible. It needed like the intuition and judgment of a human. But today, we're starting to approach the point where we can do that. Or there is a misconfiguration in your cloud that will allow someone to get in into this way. The pieces were there, the detection rates were lower, the false positives were higher. The technology only before only allowed to like solve a little sliver of the problem. But with AI, we really think we can put it all together and make it feel like you have an AI security engineer all the time.

• 20:35Speaker 01

  Should it end like self-driving, you know, to a degree where it's like you don't need to like name, okay, here's it for permissions and here's what we care about for logins and here's what we care about for API keys and whatever else. And you're able to just say, I want this thing to just very intelligently say like, what are all the possible vulnerabilities and just swarm and look at it all?

• 20:53Speaker 00

  I think a lot of that is true. I think there is probably the human element is still going to be something different.

• 20:58Speaker 01

  Like call somebody big, oh, I dropped my password. Like, can you give me your login?

• 21:02Speaker 00

  Yeah, I think the human element, I think there is always companies that need to like understand how to interact. With the human side and making sure that they are thinking properly and they don't do.

• 21:10Speaker 01

  But on the software side, do you think that's basically where this is getting?

• 21:13Speaker 00

  I think there is going to be a great unification because the technology, I mean, to me, it's just a mechanistic claim. Before, technology is called address small slivers of problems. And now the technology is actually able to generalize a lot better.

• 21:27Speaker 01

  Do you think in theory, at the end state, like, let's go ahead four or five years and just assume things kind of stay what we expect, which we expect, whatever that means. Do attackers or defenders have the edge over time?

• 21:40Speaker 00

  So I think it's a dynamic system. I'll use an analogy, like, perfect security is not achievable. And I think this might seem like a scary claim if you're not into security, but everybody understands this intuitively. Like, everybody knows that there is no such a thing as a perfect bank vault, that a bank vault is only as secure as two things. Number one is how difficult we can make it to attack it, to like get in. And that's a matter of like cost, equipment, expertise to actually like drill into it or lock the lock or things like that. And then the second aspect is how likely it is that you're gonna get caught and, you know, what are the sort of disincentives there?

• 22:19Speaker 00

  So you do the equation and then, you know, sort of thieves and attackers do pretty rational math there where they say it's not worth it or it is worth it, you know? In software, it's similar. There is no perfect vault. That's just impossible from a purely theoretical perspective. And attackers are making the same judgment call and it has to do with how hard is it to get in? And it has to do with like how good your protections are and then how good enforcement is. But the reality is that online enforcement is last, it's much more difficult, like it's much more anonymous. You know, you're not gonna leave like fingerprints and you might be in a state where, a nation where, you know, there is no beliter treaties for things like that.

• 23:00Speaker 00

  So the equation is, has the same factors. Enforcement is a lot of a smaller thing. Now, so therefore, it's really about cost. How much does it cost to get in? With abundant intelligence, that cost is bound to go down. And I think what's gonna happen because of that is that we're going to see a lot more frequent. Attacks for organizations. And on the other side of that, I think we need to get far ahead of the attackers. And so, but I'll get to the actual question, which is, so I think a company like that first is going to have to get in front of the problem. Help organizations secure themselves for this coming wave. And I think we're doing that. On the other hand, though, I think that the balance of attackers and defenders is not going to change drastically.

• 23:44Speaker 00

  Because defenders still have a certain advantage, which is they have full context. At that first, we spend hours and hours of compute on one of our customers' code bases to fully understand how it works. The AI spends hours and hours in there understanding, oh, those are the ingress points, those are egress points. This is the inputs and the outputs. This is how everything works together. Yeah. And using that knowledge, the AI helps secure the business. Attackers need to fly blind. Now, there is another advantage that attackers have, which is defenders need to find every attack. Attackers need to find one. Yeah. But I do think that with the technology that we're building at that first, we can tilt the scales in favor of defenders.

• 24:29Speaker 00

  You also, I guess, have some advantages as a defender because you can know everything about your own systems versus an attacker. You can't know everything about the system. Exactly. So, yeah, this is the context point that I was making. You know, our AI spends hours and hours just mapping out everything. I guess every time you push new code, though, it exposes a potential for new vulnerabilities, too. Yes, exactly. And that's why we have one of our products is one that scans all of your pull requests as they're being written. And, you know, I think one thing that I've noticed at both Square and Fair is that there's always been a little bit of a difficulty between prioritizing security versus productivity. And I really think that this is a false dichotomy at this point.

• 25:11Speaker 00

  I think another big thing that I think AI will enable is a great reunification piece between, so the InfoSec teams and the security teams. And they'll be able to achieve that security that they want without impacting productivity. Yeah, it's like a drag. Yeah, security engineers had to sort of sometimes say, hey, folks, we need to look at this. Give us a day or two and we need to. And that was totally irrational. Yep. It was the way to do it. But, you know, if you move at the speed of AI, you can sort of do those reviews much faster. And so I think we're also going to see a little bit of reunification. Yeah. We will be able to achieve security with productivity as well.

• 25:49Speaker 01

  Yes, it's funny also because like outside of engineering, I think there's like a people understand security is like password protection and random stuff, you know, like, hey, if somebody like sends you a phishing email, be careful, but like, and that is part of it. And there's probably a whole separate, you know, approach needed there. But for the software piece, it does seem like everything's about to probably look very different.

• 26:09Speaker 00

  That's why I'm here too, because I want to sort of tell how to people how cool security is. I got into security originally in grad school because of how fantastical it is.

• 26:20Speaker 01

  Yeah, it's funny.

• 26:21Speaker 00

  There's attackers and defenders and firewalls and bastions.

• 26:23Speaker 01

  Yes.

• 26:23Speaker 00

  It's really just like a fantasy world.

• 26:25Speaker 01

  It's really funny because like it was security, like the the excitingness of it ranges from like password manager and, you know, just like somebody at your company telling you like, hey, you got to follow these protocols. Like, that's one side. And then the other side is like Ocean's Eleven.

• 26:39Speaker 00

  Exactly. So people, I think the first thing, if I ever say, tell someone that I'm working on security, I think the first thing that they think about is just like, oh, shoot, the other day I had to reset my password.

• 26:49Speaker 01

  Yeah.

• 26:49Speaker 00

  That was painful. Like, I think that's the first thing they think about. But the reality is that what they should really be thinking about is those crazy hackers that are doing like daring

• 26:59Speaker 01

  Yeah.

• 27:00Speaker 00

  things to get into systems.

• 27:02Speaker 01

  High level government agencies.

• 27:03Speaker 00

  High level government agencies. That actually is what security is at the limit.

• 27:07Speaker 01

  Uh huh.

• 27:07Speaker 00

  And it's incredibly intellectually stimulating. It's really just at the edge of technology.

• 27:12Speaker 01

  It's also possible that like, sort of like by the end of like the cloud software generation, like it was getting a little bit boring. And now with AI, it's like back to this like very fresh thing.

• 27:21Speaker 00

  Right. Because I think it goes back to that point I was making, which is security is relative to the level of attacks, right? So we had reached sort of a steady state where a company like Federal Lattice could operate and having a team of ex-security engineers and business would go on and the likelihood of attacks was relatively low. So you could just do your thing.

• 27:41Speaker 01

  Yeah.

• 27:42Speaker 00

  And and and put security a little bit on the on the back burner. There is this saying in security circles that in order to survive a bear attack, you don't need to outrun the bear, but you need to outrun the person running next to you. I think that's the way that the business has been operating for a very long time. But with AI, you can think about the fact that there isn't just going to be one bear, there's going to be a thousand AI bears.

• 28:03Speaker 01

  That's terrible.

• 28:05Speaker 00

  So we're really trying to secure the world software from AI bears, really.

• 28:08Speaker 01

  Why does it seem like security is its own sort of ecosystem, echo chamber world? Like, to me, I'm not like, lucky to invest in you, but in general, I don't do security companies. And what I've found is it seems like its own world. Why is that? Like, why is it not similar to just like other software categories?

• 28:25Speaker 00

  For context, I was in charge of security affair during my tenure there. And I had a team of folks that was super talented, super talented, and as well as cash up. That was within the square ecosystem. I would say that security is such a different market just because of how hard it is for both buyers and sellers to know what they're buying, what they're selling. Like, when you're selling, say, observability software or databases, you know, someone can try your database. You make a claim, I test it, I see it, and it's done. If I run a company like FAIR, I don't necessarily know everything that is wrong or like that is or anything, or any other business, really. And a vendor, a security vendor comes in saying, I think these things are wrong. And I was like, are they really wrong?

• 29:09Speaker 00

  First, you don't know because the claim may be partially incorrect because many security issues may be false positives. Because it's almost true that someone could take advantage of it. But there's this one little detail that makes it not true, right? So first, you need to investigate every single claim, right? So that's the first part, sort of really, both the buyer and the seller might have different opinions on what's really a false positive, what's really a true positive. And then another more pernicious part is like neither the buyer or the seller know what the true positives are. So let's say that I go into your organization and I don't find anything. Did I not find anything because I'm not good?

• 29:44Speaker 01

  Yeah.

• 29:45Speaker 00

  Or did I not find anything because you don't have anything to find? Neither of us knows, right? So the information of the ecosystem is weird.

• 29:55Speaker 01

  Very hard to get.

• 29:56Speaker 00

  It's very hard to get. It's worse than a market for lemons in some sense, you know? Where neither the buyer nor the seller really know what's going on. And I think with AI, actually, we can overcome that because I think the reasoning abilities of these models can actually do that.

• 30:11Speaker 01

  You can trust that the AI will find the bug if there's a bug?

• 30:14Speaker 00

  Well, and also you can make sure, you can trust that it will find a higher percentage of those bugs potentially. And that I think this is why we're investing in technology and I can tell you about our investments there. The percentage of bugs that you can actually find is increasing pretty rapidly. So that part of the equation is changing. And then the second part is that the AI can actually operate almost like a human in the sense that they can verify their work.

• 30:38Speaker 01

  Yeah.

• 30:39Speaker 00

  And they can be like, oh, those were my assumptions. I thought that that was a real security problem because X and Y and Z. And actually, one of the things our customers love about our product is that we tell them all, we list out all the assumptions that we made to conclude that something was a real security issue. And we showed the work that the model has done to actually verify each assumption. Security is a different market because of those reasons. But I do think that AI hopefully will change the equation a little bit where it's going to be much more, much easier for buyers and sellers to be on the same page exactly on the value that is being exchanged.

• 31:15Speaker 01

  Getting into sort of the tactics of depth first. What are the important pieces of technology for you all to build to be able to accomplish this?

• 31:23Speaker 00

  Yeah, so maybe let's digress a little bit. So I'm one of the founders, I'm the executive chairman. Kasim is the CEO, he comes from Databricks. He was director of infrastructure there, also in charge of security. And then Andrea is the CTO, he comes from DeepMind. And he was one of the authors of AlphaDev, which is the reinforcement learning algorithm that found a better way to sort and hash a Google. And I think this is almost like the perfect team to go after this problem. Because AI, so to answer your question, AI has a big infrastructure component, especially when you're doing AI for security. We're doing these technical things, I don't want to go into too much technical detail, but we're spinning up Docker containers to like run code inside so that the LLM can

• 32:08Speaker 00

  test whether certain hypotheses are true or not. And having hired a bunch of folks from Databricks has helped us a ton in setting up that infrastructure. People have been calling it the scaffold, the harness, but you know, it's our intelligence layer that allows us to really repurpose the technology that we built on each new problem. So, when I be discovered is one thing we've applied it to, but we also applied it to other things. And each one thing that we apply it to becomes easier and easier because we built like a really solid AI infrastructure there. The second piece is more like the deep research side, which Andrea has done before at DeepMind. Fundamentally, I believe that reinforcement learning plus large language models will allow

• 32:53Speaker 00

  us to sort of create a superhuman hacker. For defensive purposes, we were talking about the fact that systems, you know, we're only able to find a certain low fraction of the real problems that existed. And that was because the other problems were deeper and deeper and deeper and more and more complex. And I think with reinforcement learning, we can teach these L L M's to go deeper to like find those clever ideas that will allow them to put two small vulnerabilities together and combine them into something that is actually real. We have some security researchers on the team coming from Apple and uh um the security service like I D F. And the way that they they work is phenomenal, like their their brain work differently.

• 33:37Speaker 00

  When Mav and the team tells us that he's discovering a little bit with our L L M and how is like he verified it and how he actually sometimes pieces it together, it's it's wonderful to see.

• 33:49Speaker 01

  Is that way of thinking learned? Or is that like a certain brain type that exists from the beginning? Is it something that comes out of experience or is it something that's by nature?

• 33:58Speaker 00

  I feel like just almost like everything is probably a combination of nature and nurture. Personally, I feel like the my inclination of being a little bit of anxious paranoid person, that it's always trying to see how things could go wrong, helps is definitely like the background thread in my brain that is constantly seeing how catastrophic is and seeing how things can go wrong is definitely helping in that pursuit. And there are definitely people that are more apt at sort of stepping out of the box and seeing things from a different angle, which is you clearly need. But I will say that it's probably just almost like every other thing. It starts with probably a small talent, which then tells you, oh, I'm good at this.

• 34:42Speaker 00

  And then you you invest more in that.

• 34:44Speaker 01

  Yeah.

• 34:44Speaker 00

  And then you get better at it. But if my if I had to guess, the seed was actually quite small and then it blossomed because you invested all the time because you were good at it.

• 34:54Speaker 01

  So this is sort of like some of the technology underlying, you know, the the product. And then I guess is the idea with the product itself, should it get to a place where, you know, a customer can basically just install depth first and they just know that you're constantly exposing vulnerabilities at a way higher rate than people and you're doing it more thoroughly, faster, cheaper? Is that basically it?

• 35:14Speaker 00

  Yeah, that's the goal. And I think by training our own uh post-training our own uh L L M. Uh, which we're experimenting with right now. But the hope is that we'll have a technological edge and we can tell customers. I think it's two things. One is the technological edge of our sort of AI stack. And then two is really thinking about the problems the right way. So for example, we started with code, but we are now telling customers, hey, if you link your staging environment, we can test the findings against your staging environment to tell you whether something is real or not. So I think expanding into other areas that our customers care about is going to be crucial.

• 35:55Speaker 00

  And really the giving them an interface, whatever that may mean. You know, right now we have a web app, but I'm also thinking that at some point you need to be able to talk with this thing as if you were talking with a security engineer. Being like, hey, can you double check this thing, please, for me? And then giving the AI access to the components, giving them the context. I think the context is super important. Another thing about security is that it's really context specific. If you're operating a social network, the fact that people can see a customer's profile is the way that it works.

• 36:26Speaker 01

  Yeah.

• 36:27Speaker 00

  But if you're creating a, you know, corporate Slack platform, you know, a messaging platform of corporate, you probably don't want the profiles to be public. So that's context specific. So our systems, again, as I said earlier, spends hours in a code base, sometimes going into the old commits. Because if you think about it, whether something was done differently earlier than it is done today may tell you, hey, we actually had an assumption a year ago about how this thing was supposed to work. But now it's not like that anymore. Why? And so it's really about building a centralized repository of context about the security posture and organization. And that's what we're building. Then adding agents that can go in and say, let me look at your code.

• 37:12Speaker 00

  Let me look at your infrastructure. Let me look at your configurations. Let me look at this. Let me look at that.

• 37:17Speaker 01

  Will your system learn as a result of, you know, like, is it the kind of thing where the more customers you have, the more you will learn to be safer for the next one? Or is it, is each one its own new instance?

• 37:27Speaker 00

  So as an enterprise company, you know, wanting.

• 37:30Speaker 01

  Yeah, of course, data can't be shared.

• 37:32Speaker 00

  Data cannot be shared. The customers never makes it into the weights.

• 37:36Speaker 01

  Yes.

• 37:36Speaker 00

  Never makes it. We just don't do that. We cannot and we will not. But what I will say is that there is an outer loop, as the folks in AI like to say, there is an outer loop, which is like we learn from the types of issues that are not.

• 37:49Speaker 01

  You, the people at depth first.

• 37:51Speaker 00

  Yes, the people at that first learn. So what do we do? When we see that like we are not quite doing as well in that type of issue, we will take some open source software, find the issues that are similar and then train on that. You know, so that's, that's the way which we, you're sort of participating in an ecosystem.

• 38:09Speaker 01

  Yeah.

• 38:09Speaker 00

  That's not the difference from how any other product becomes better because more people use it. Because, you know, as you join a platform or a SaaS offering, you're probably benefiting from the fact that other people have discovered ways to use it that have been built into the product.

• 38:25Speaker 01

  Yeah.

• 38:26Speaker 00

  So in that sense, there is some.

• 38:27Speaker 01

  Do you think of depth first, you know, when it's a security engineer operating on the team? Is it like, is its role to like help manage the human security engineers? Or are the human security engineers managing the AI?

• 38:41Speaker 00

  I think it's going to be a collaborator. I think it's going to be like the humans will probably have the ultimate amount of.

• 38:46Speaker 01

  Final say.

• 38:47Speaker 00

  Final say in context. I think, I think you still need that.

• 38:50Speaker 01

  For now, probably one day you don't.

• 38:51Speaker 00

  At that point, it's not this company that changes and then the whole, the whole society changes. And I don't know what happens.

• 38:57Speaker 01

  By the time that's happening, it's like all these roles don't play anyway.

• 39:00Speaker 00

  Yeah. And then I think we need to figure, we need to have an entire different conversation as a society about what, what's going on. But before that, I think that the, no, the security engineers will be the ultimate judges of, of what's going on and making sure that everything works.

• 39:14Speaker 01

  Okay. I want to maybe kind of switch to, back to sort of like generalities around building this company versus building FAIR. And we talked a little bit about sort of like the mindset of like the grounds are shifting faster. The rewards are bigger than ever. So that kind of changes some things. I also imagine just that in some ways like. The types of culture inputs that you want are a little bit different. Maybe the types of people are a little bit different. Like, what have you found when you take that difference in the sort of environment? How does that apply to like building a company now in this era? Like whether it comes to recruiting or, you know, the way you manage the team or anything else like that?

• 39:50Speaker 00

  So there's this book called The Platform Revolution. And they talk about two types of businesses, platform businesses and pipeline businesses. Platform businesses are dual-sided marketplaces, social networks and things like that.

• 40:03Speaker 01

  Fair.

• 40:04Speaker 00

  Exactly, like fair. Pipeline businesses are businesses that produce a service of good and sell it to their customers. And there isn't much interactions between the customers or there isn't like a lot of interactions on the other end. I would say that in a company, in a platform business, a marketplace like Fair, I think you need to keep a tighter grip on the business just because everything is so interconnected that it's hard to just let people completely run their things. Because there is always going to be second and third order things that might happen. In a pipeline business, I'm noticing with that first, I think there is a little bit more of letting a thousand flowers bloom and seeing what works. But so that's one potential, but it's a small difference.

• 40:49Speaker 00

  I'm not saying that it's huge. I mean, you're.

• 40:51Speaker 01

  No, it makes sense. So it's almost like you just, you need, you need like greater coordination of efforts in a marketplace business versus a pipeline business. You need like, you basically need systems that like let the flowers bloom.

• 41:03Speaker 00

  I think so. I think so. I think that's a, I think that's a fair characterization. So that's one thing. Those, a lot of things are the same. For example, one of the things I tell the folks that I work with is don't shy away from putting thirty data points on a spreadsheet and look at them and see what's going on. And data points here is a generic term. It may be like thirty customers, it may be like.

• 41:30Speaker 00

  Thirty issues of chargebacks on your platform, maybe whatever it is.

• 41:34Speaker 01

  Thirty is like approachable. I'm like, I could do that in two days for most things.

• 41:36Speaker 00

  Yeah, it could be two days, it could be two hours, you know, just spend some time, you're gonna, a few things are gonna happen. One, you're going to build so much intuition about whatever that is, you know, you're gonna be like, oh, actually, that is how that works, you know, and that was already incredibly valuable. But then I think it forces you to overcome this

• 41:56Speaker 01

  almost like anti-pattern that we have as tech people, which is like, we want big data.

• 42:02Speaker 00

  Because, you know, that's the only way to know. Like, a lot of data is the only way to know. But the reality is that with thirty data points, you're going to know whether something is sixty percent plus or minus ten percent, or it's ten percent plus or minus ten percent. And you can like know a lot from that fact alone.

• 42:17Speaker 01

  Yeah.

• 42:17Speaker 00

  You know, is your conversion rate, is your chargeback rate, whatever that may be.

• 42:21Speaker 01

  It's roughly good or it's roughly bad.

• 42:23Speaker 00

  It's roughly good, it's roughly bad, and make a decision.

• 42:25Speaker 01

  Yeah.

• 42:26Speaker 00

  And then, you know, take the top three things you've learned and try to address them. So even like in everything, like when it came to fare, like get actual a bunch of search results and look at them one by one and form an opinion about when is it that you don't think they're good enough and why? And is it because they're completely irrelevant, or is it because they're just, yeah?

• 42:46Speaker 01

  Even though it's like theoretically a little bit less accurate, I also think when you spend time in thirty anecdotes versus like three thousand, like sort of unemotional pieces of data, it's just very different.

• 42:57Speaker 00

  Yeah, and

• 42:58Speaker 01

  You learn more when you look at an anecdote.

• 42:59Speaker 00

  Absolutely. And, you know, this is, I feel like I want people to form like a deep intuition about the data, the customers, talking with customers and things, and this is one way in which it happens.

• 43:09Speaker 01

  Yeah.

• 43:09Speaker 00

  And it's a little bit of a blind spot. And by the way, I try to do this myself. I seek out times where I can just like put on my AirPods and put on some music and then just kind of like churn through a bunch of data in a spreadsheet because I find that to be an important avenue, which I can actually get through context about what's going on.

• 43:30Speaker 01

  Yeah. What else would you think about, like, because I obviously like decision-making is such a central part of like what, you know, you're trying to, you know, create and what you're trying to do yourself. What else do you think about at this stage for decision-making?

• 43:43Speaker 00

  So another thing with that first is that I'm trying to

• 43:49Speaker 00

  Help with all of the context that I've accumulated at fair, but trying to only take with me the good lessons. I feel like I could potentially overshoot my role by trying to apply the same exact learnings, the same exact patterns. I think, I mean, it is an enterprise security SaaS company and using AI. And it's just a very different type of business. And so now being a pipeline business, I think we can make sure that people can experiment. And so this is giving me the freedom to sort of step back a little bit. But I think there is also an element of trying to take the learnings that I have, but allowing experimentation, I guess.

• 44:30Speaker 01

  Yeah. And I guess probably also with that, you're like, as long as the guardrails are safe, because obviously you need that as a security company. You probably want people to like, try things quickly in general.

• 44:40Speaker 00

  For sure. And, you know, I think we have a lot of security expertise inside. So we really make sure to build things properly from the beginning and in a secure way. But, you know, when I talk about experimentation, I also talk about things that, you know, let's see if the AI is able to solve this problem.

• 44:56Speaker 01

  Yeah.

• 44:56Speaker 00

  You know, you can do that. You're gonna have someone spend two or three weeks on that, you know?

• 45:01Speaker 01

  I always thought like, as long as it's a two-way door decision, just like the faster we can try stuff, the better.

• 45:07Speaker 00

  Absolutely.

• 45:07Speaker 01

  Yeah.

• 45:09Speaker 00

  I'm always about making three 90% confidence decisions every week.

• 45:14Speaker 01

  Yeah.

• 45:15Speaker 00

  Rather than one 99% confidence decision every quarter.

• 45:19Speaker 01

  Yeah. Well, Daniel, like, this was really fun. Thanks for making the time for this and super excited what you're doing at Duff First.

• 45:23Speaker 00

  Thank you so much.