Decoder with Nilay Patel
00:18:01 · S3
[00:18:01] S3: Okay. So, like, the operational security side is watching your logs, looking at, ah, somebody is running our techs against us. I am now going to trigger an investigation. I am going to look to see what is going on, and I'm going to make an intelligent decision of what I am going to do to respond to this without shutting down the entire company. That is SOC work, that security operations center work. Companies that want to survive this era are going to have to replace human beings who do that work with the first tier and then eventually the second tier. You can do that with current LLMs. The the first tier actually has to be not an LLM. It has to be something much dumber because you're looking at terabytes or petabytes of logs, and it is just completely uneconomical to do that with actually an LM. We have other things, TFIDFs, MLBERTs, traditional classifiers that can operate at much faster. But then that's just off an alarm, and then you you send it to a small LM, and then the small LM calls its bigger brother, and that might call it an even bigger brother. Right? But for those models, we need to do a lot more work to optimize them, and we need to make them cheap. Right? And I have a colleague who works at, like, one of the large security platform companies who said that, like, doing an investigation on one of the big frontier model... Cyber models cost on their product $900 to do an investigation. That is not going to work when the the Russian ransomware guys are either using MACs or they're using, you know, thrown away cyber... You know, crypto mining rigs. Right? And their marginal cost is zero. So this is, like, one of the things we're working on at Cognition is, like, we train our own models, retrained open weights, and we're trying to drive this cost way down. It's something we've done, but we have a lot more work to do here, and a lot of other people have work to do here. And I I think this is where, like, as an industry, we have to focus on, like, the Pareto frontier between cost and efficiency on cyber because it's not just bug finding. Yeah. The other place here is just, like, people talk about Mythos. Mythos is great. AstraCyber is great. They're incredible models. But even the people who have access to it, which is a tiny number of companies, they only scan, like, their most important code.
00:20:15 · S3, S0, S1
And there are hundreds of billions of lines of code out there that are not the Linux kernel, that are the crap c sharp and j two e e code that was win... Written by Infosys fifteen years ago. All of that code is not is not going to go through a frontier cyber model that cost a gazillion dollars. And so that's the kind of stuff that we need to work on cost efficiency for. Ad[00:20:44] S0: Support for the show comes from engine. Running a small business means every dollar has to work hard. But if your team is still booking travel the old way, it's costing you more than you think. Engine is the fastest growing travel and spend platform in the country built specifically for businesses like yours. Ad[00:21:01] S1: Book a trip in as little as two and a Ad[00:21:03] S0: half minutes. Earn up to 10% back on hotels. And in 2025, engine customers save more than $300,000,000 on travel with zero booking fees, no contracts, and no BS. More than a thousand businesses join engine every month. Join them and get $500 when your business signs up and starts traveling at engine.com/vox.
00:21:03 · S0, Nilay Patel
Ad[00:21:03] S0: half minutes. Earn up to 10% back on hotels. And in 2025, engine customers save more than $300,000,000 on travel with zero booking fees, no contracts, and no BS. More than a thousand businesses join engine every month. Join them and get $500 when your business signs up and starts traveling at engine.com/vox. [00:21:34] S2: It It feels like you're describing this cliche that I hear all the time. And again, I'm just gonna keep asking really dumb questions about all this. But the cliche I hear all the time is everything's gonna get so much worse before it gets totally secure forever. And it doesn't seem like the model you're describing leads to that result. Result. Right? We're not gonna fix all the bugs forever in some valley of despair and then always have perfect code. At some point, there's some cost advantage to the attacker always. Right? Like you running a company, you can't write defense that has zero marginal cost. Like, someone has to do it even if the attackers are so infinite that their marginal cost is effectively zero. So are are we gonna go through a period where everything is so much worse and then it's perfect forever, or how does the cost manage itself at into balance?
00:22:20 · S3
[00:22:20] S3: I am neither, like, the hardest doomer or the most positive person about this. I feel like we are not gonna p do. Right? Like, we're not all gonna die or be uploaded to the Singularity in the next two years, nor do I think when things get better, they're gonna be perfect. Right? The metaphor I've been using is we are entering a dark age. Right? Things are going to get more bleak, and the... Our responsibility of those of us who work in cybersecurity and especially those of us who work in cybersecurity at the AI companies, and we are a lab, if a smaller one compared to the big l labs. It is our... Especially our responsibility to help shorten that dark age. So the dark ages were bad, but we survived them. Right? And then we had the the enlightenment and the renaissance. But it's not like the renaissance was perfect. Right? Like, it wasn't, you know, Utopia and everything was perfect. We will still have hacks. All kinds of bad things happen even when you don't have a security flaw. There's tons of security breaches that do not require a flaw in the software itself, and we still will have flaws in software even if LMs are writing all of them in strong languages, and it will take a long period of time to get rid of all the flaws. I I do think, however, things will start to get better as the median code becomes code that was written by an LLM in a a memory safe and type safe language. But the problem is is we we have a couple of decades of stuff that Yeah. Human beings wrote and that wrote in languages that we should have replaced years ago. And my feeling is is to shorten this age, we we we have to do a couple things. One is we have to stop to get out of this, like, we're just gonna find bugs and patch them. A bunch of stuff just needs to be refactored. Right? Like, if you're looking at your code base and you scan it and you've got 10,000 bugs, then probably now we are at the point where rewriting it is actually cheaper. That is my observation from looking at these customers of ours is that if if you can get a working build, then it is actually much easier to write a whole humongous suite of tests and to spec out how this thing works and then to rebuild it within that spec and those tests securely than it is to find all the bugs and fix them. It it actually is.
00:24:32 · S3
And so I don't know what is going on through the mind of the Linux kernel developers, but that thing... Again, that talk I gave, like, at the beginning of this year, I posited two possible futures, and the one was we're now at superhuman bug finding. Maybe we just have a pool of superhuman bugs, and we're gonna drain it. That's the good future. But the bad future is every time we get a new model, there's a new superhuman bug pool that's a little more superhuman. And, unfortunately, we seem to be closer to that, and that the Linux kernel got a bunch of fixes for Mythos and then Mythos preview. And then we had Mythos five one, and there's another pool. And then we got Astra Cyber, and we just got another thousand Linux kernel patches. It's like, it's not slowing down yet, and I I don't think we're just going to scan our way through the c code of the Linux kernel. There's only, like, two companies, honestly, in the world who could probably do this. It'd be Google or Amazon. I I wish instead of, like, the Fuchsia project or rebooting the Google Book or the Chromebook again, Google would take all of those incredibly brilliant engineers, and they just tell them, take the Linux kernel and rewrite this in Rust. And that would be their gift to the world. And it would be an incredible advertisement for Gemini four Carbon or whatever, would be, like, get rid of all the drivers that nobody needs. Like, this thing doesn't have to run on the forty sixty x three or whatever. I mean, I I I know it doesn't, but, you know, you know what I'm saying? Like Yeah. And then just release it and call it whatever you want, the g Linux kernel, just like they did this with OpenSSL. Right? And I would run that. Right? Like, Cognition would run that on our servers, like... Or have Google and Amazon do it together, and it would cost them a $100,000,000. But compared to the societal cost that this is costing us every time we have to patch Linux kernel and you have to reboot every every Linux machine on the entire planet, that's what has to happen. But for whatever reason, the technology industry has not been able to get together and Yeah. Make these hard decisions of these fundamental things that underlie the entire human race, we have to completely rebuild.
00:26:42 · Nilay Patel
[00:26:42] S2: This is why I started by talking about how the economics of cyber led to the culture of cyber. I mean, this is, like, the most Decoder way of approaching this conversation, I know. But there... You know, when you describe the the research teams, the NSA, and then the operational teams, that is a org chart that comes out of economics of of the work. You're saying, oh, someone has to make a big decision here. You need to look at it from a very high level and say it is cheaper to spend a $100,000,000 to fix Linux, rewrite Linux today than it is to successively patch new bugs when every new model comes out. I don't think anyone's in that position. Like, I don't think Linus Torvalds is in that position.