Tech Talks Daily
00:03:10 · Neil C. Hughes
[00:03:10] S0: Yeah. The pace of technological change is phenomenal at the moment. And over the last few years, there's been a lot of talk of Gen Z and the first generation to enter the workforce with before. Well, they cannot remember a time before the iPhone and the iPad. Of course, iPhone was 2007, iPad 2010, but we're now moving on that conversation to the first generation of developers who have learned to code alongside AI, and they're entering the workforce. So I've got to ask from what you're seeing. What skills have become more valuable now, and which traditional skills maybe are at the risk of of being neglected from what you're seeing?
00:03:45 · Frank Emery
[00:03:45] S1: Yeah. The way I've always thought about this is I like to use the the system one versus system two thinking. And when I've seen AI come along, what I've really seen it primarily start with, especially with the younger generations is it's replaced sort of the system one thinking that we've all been doing. So if you think of coding, these are sort of the day to day tasks that they're not particularly difficult, but they do take up the bulk of time during the day. So this is like building websites, basic implementation of code, not really the architecture side of it. And that's what I've seen AI take over for first, which is sort of the traditional skill set that has then led to be neglected. And so what you have is a bunch of folks that are entering the industry that never had really got a chance to learn how to do the basic system one stuff. But the problem is, if you don't learn that that basic stuff up front, then you never get the ability to build out the really valuable skill sets, which is your system twos, which is your architecture, your planning, your thinking, all of the really complex stuff that is now more valuable than ever. And that's sort the change that I've seen. So nowadays people will say, Hey, AI, go build me a website and AI will do that. And you know, it's doing all that easy stuff for you, but then you never get the ability or the experience of going back and saying, okay, well, did it build the right thing? You know, how can I review this to make sure that's what's built is going to work in production? I was talking to some some classmates of mine last year, and they were all like, oh, building these applications. And so for them, coding used to be this really difficult skill to learn. Now coding is just speaking. And they were all saying like, yeah, I built this amazing startup in an afternoon. Like, you work in security, how can I take this production? And then I'd ask them, okay. Well, cool. Did you, like, review your code? What's the architecture look like behind it? Like, have you tested it yet? And they all said, like, what's architecture? What do you mean review? What what... Security? Well, no one's gonna break into my house. And it kind of dawned on me that like, you have all these like super empowerable...
00:05:54 · Frank Emery, Neil C. Hughes
Empowered, like, bright people that are now they can take on these these new tasks and build these new companies. And they literally have no idea about all of this other stuff, which is unfortunate. Because if you do have that skill set now, you're like the, you're what everyone wants to talk to. So if you do understand how to do architect reviews, security reviews, you know, look at an application and understand like, is it doing the right thing? Is it gonna work properly? Like that, that's where all of the value is now. [00:06:24] S0: Yeah. It feels like we've come full circle and gone straight back to let's move faster and break things again. You know? And, of course, what we're talking about here is AI assisted developers. They can commit code three to four times faster than their peers. So what happens when that output grows faster than security teams can realistically review it? Or are those security teams using AI too?
00:06:47 · Frank Emery
[00:06:47] S1: Yeah. It's... I would say, yes. Security teams are using AI. But to the first part of the question is, you know, what happens when you commit that fast is you accumulate issues. So, you know, I know in some circles, they talk about AI contributing to management debt or compounding where decisions compound on decisions. It's the same thing that happens with code. So if you're developing four times as fast, unless you have really, really good checks and balances throughout the development process, then you have risk compounding on risk. Vulnerabilities accumulate on vulnerabilities. And unfortunately, a lot of the guardrails that exist within coding assistance today, they don't necessarily scan everything, they're not necessarily as comprehensive as they could be. And so if you imagine, say, every time you make a commit, you know, the systems that in place catch 20% of your vulnerabilities. Well, if you're committing four times as fast now, then each time you make a commit, that 80% you're missing grows and grows. And unfortunately, if there's nothing there to catch everything once it's made it into production, you end up with a fairly large backlog of risk that exists. And in fact, what we see in our future of AppSec report is only about 9% of organizations fix 90% of their vulnerabilities. And even 90 isn't everything. If there's a critical vulnerability in that 10% you didn't scan, you still get hacked. There's actually you only need one vulnerability to be hacked. And so this accumulation means that backlogs are growing more and more. And though there are tools in the security space to help organizations catch up, you really need to make sure that whatever tool you're using is able to find as much as possible because of the compounding code commits that are happening.
00:08:33 · Neil C. Hughes
[00:08:33] S0: Yeah. And anyone that's work... Worked in a technical team will know all about that accountability problem. And when something goes wrong, the developer, the deployer, the vendor, the network guy, everyone's pointing at each other at that moment. Everything goes wrong like that Spider Man meme. You know? But if if AI generates vulnerable code and it does pass through several tools and teams, which it can do, especially as it gets more smarter, who should own the risk when something goes wrong? Who's gonna be the the person accountable for that?
00:09:01 · Frank Emery
[00:09:01] S1: Ultimately, it's the organization. So at the end of the day, if you're the end user of a product and that product gets breached or hats, you know, you're not necessarily gonna know the individual team that dropped the ball, but you are gonna know the organization that dropped the ball. And so I think ultimately, you know, the buck stops with the the company that's putting products out. I think within an organization, if you look at the individual team levels, it's gonna come down to, if you're having an AI write your code, you know, you're responsible for that AI's writing of your code, and that all bubbles up. And so the individual developer, they're accountable for validating that whatever they wrote is secure. And that's, you know, to the original point about why that skill set of validation review is so important now. And then if you're a team leader, you're responsible of making sure that every developer on your team is validating their changes. And if you're running an AppSec organization or an AppSec program, your response for making sure that all those team leads are adhering to application security standards. And so it does all ultimately bubble up, but that is still a lot of points of failure along the way where as people speed up and as they lose the ability over time to do, you know, reviews, security architecture, all of that just increases risk across time. And unfortunately, AI is making it a lot easier to exploit things, but at the same time, it is helping both with detection remediation as well. So it's not all bad. There there are ways to fix this. And we're seeing a lot of organizations starting to actually use AI to help with detection remediation to keep up pace with vulnerability creation as well.