Tech Talks Daily
00:02:04 · Frank Emery
[00:02:04] S1: Definitely. So my name is Frank Emery. I'm the VP of product here at Checkmarx overseeing our platform and our engines. So a good chunk of all things that Checkmarx works on. And I joined Checkmarx about a year and a half ago. So it's been a... An interesting year and a half. I would say joining a a security company right before Mythos came out and right before the entire industry changed has been a really interesting experience. And I started my career fifteen years ago counterintuitively working in finance, is what I went to school for, but did not stick around in. But I've been working in product ever since then. Starting out after going to school for finance, learning about agile and being an agile coach before switching into product for a couple of years and really focusing on startups and database startups, really, for most of my career before moving into security. So I've been working with technical customers and technical teams my entire life. But definitely, things have been, as I said, interesting the last year and a half with all the changes that we've been seeing in the space.
00:03:10 · Neil C. Hughes
[00:03:10] S0: Yeah. The pace of technological change is phenomenal at the moment. And over the last few years, there's been a lot of talk of Gen Z and the first generation to enter the workforce with before. Well, they cannot remember a time before the iPhone and the iPad. Of course, iPhone was 2007, iPad 2010, but we're now moving on that conversation to the first generation of developers who have learned to code alongside AI, and they're entering the workforce. So I've got to ask from what you're seeing. What skills have become more valuable now, and which traditional skills maybe are at the risk of of being neglected from what you're seeing?
00:03:45 · Frank Emery
[00:03:45] S1: Yeah. The way I've always thought about this is I like to use the the system one versus system two thinking. And when I've seen AI come along, what I've really seen it primarily start with, especially with the younger generations is it's replaced sort of the system one thinking that we've all been doing. So if you think of coding, these are sort of the day to day tasks that they're not particularly difficult, but they do take up the bulk of time during the day. So this is like building websites, basic implementation of code, not really the architecture side of it. And that's what I've seen AI take over for first, which is sort of the traditional skill set that has then led to be neglected. And so what you have is a bunch of folks that are entering the industry that never had really got a chance to learn how to do the basic system one stuff. But the problem is, if you don't learn that that basic stuff up front, then you never get the ability to build out the really valuable skill sets, which is your system twos, which is your architecture, your planning, your thinking, all of the really complex stuff that is now more valuable than ever. And that's sort the change that I've seen. So nowadays people will say, Hey, AI, go build me a website and AI will do that. And you know, it's doing all that easy stuff for you, but then you never get the ability or the experience of going back and saying, okay, well, did it build the right thing? You know, how can I review this to make sure that's what's built is going to work in production? I was talking to some some classmates of mine last year, and they were all like, oh, building these applications. And so for them, coding used to be this really difficult skill to learn. Now coding is just speaking. And they were all saying like, yeah, I built this amazing startup in an afternoon. Like, you work in security, how can I take this production? And then I'd ask them, okay. Well, cool. Did you, like, review your code? What's the architecture look like behind it? Like, have you tested it yet? And they all said, like, what's architecture? What do you mean review? What what... Security? Well, no one's gonna break into my house. And it kind of dawned on me that like, you have all these like super empowerable...
00:05:54 · Frank Emery, Neil C. Hughes
Empowered, like, bright people that are now they can take on these these new tasks and build these new companies. And they literally have no idea about all of this other stuff, which is unfortunate. Because if you do have that skill set now, you're like the, you're what everyone wants to talk to. So if you do understand how to do architect reviews, security reviews, you know, look at an application and understand like, is it doing the right thing? Is it gonna work properly? Like that, that's where all of the value is now. [00:06:24] S0: Yeah. It feels like we've come full circle and gone straight back to let's move faster and break things again. You know? And, of course, what we're talking about here is AI assisted developers. They can commit code three to four times faster than their peers. So what happens when that output grows faster than security teams can realistically review it? Or are those security teams using AI too?
00:06:47 · Frank Emery
[00:06:47] S1: Yeah. It's... I would say, yes. Security teams are using AI. But to the first part of the question is, you know, what happens when you commit that fast is you accumulate issues. So, you know, I know in some circles, they talk about AI contributing to management debt or compounding where decisions compound on decisions. It's the same thing that happens with code. So if you're developing four times as fast, unless you have really, really good checks and balances throughout the development process, then you have risk compounding on risk. Vulnerabilities accumulate on vulnerabilities. And unfortunately, a lot of the guardrails that exist within coding assistance today, they don't necessarily scan everything, they're not necessarily as comprehensive as they could be. And so if you imagine, say, every time you make a commit, you know, the systems that in place catch 20% of your vulnerabilities. Well, if you're committing four times as fast now, then each time you make a commit, that 80% you're missing grows and grows. And unfortunately, if there's nothing there to catch everything once it's made it into production, you end up with a fairly large backlog of risk that exists. And in fact, what we see in our future of AppSec report is only about 9% of organizations fix 90% of their vulnerabilities. And even 90 isn't everything. If there's a critical vulnerability in that 10% you didn't scan, you still get hacked. There's actually you only need one vulnerability to be hacked. And so this accumulation means that backlogs are growing more and more. And though there are tools in the security space to help organizations catch up, you really need to make sure that whatever tool you're using is able to find as much as possible because of the compounding code commits that are happening.
00:08:33 · Neil C. Hughes
[00:08:33] S0: Yeah. And anyone that's work... Worked in a technical team will know all about that accountability problem. And when something goes wrong, the developer, the deployer, the vendor, the network guy, everyone's pointing at each other at that moment. Everything goes wrong like that Spider Man meme. You know? But if if AI generates vulnerable code and it does pass through several tools and teams, which it can do, especially as it gets more smarter, who should own the risk when something goes wrong? Who's gonna be the the person accountable for that?