Tech Talks Daily
00:06:47 · Frank Emery
[00:06:47] S1: Yeah. It's... I would say, yes. Security teams are using AI. But to the first part of the question is, you know, what happens when you commit that fast is you accumulate issues. So, you know, I know in some circles, they talk about AI contributing to management debt or compounding where decisions compound on decisions. It's the same thing that happens with code. So if you're developing four times as fast, unless you have really, really good checks and balances throughout the development process, then you have risk compounding on risk. Vulnerabilities accumulate on vulnerabilities. And unfortunately, a lot of the guardrails that exist within coding assistance today, they don't necessarily scan everything, they're not necessarily as comprehensive as they could be. And so if you imagine, say, every time you make a commit, you know, the systems that in place catch 20% of your vulnerabilities. Well, if you're committing four times as fast now, then each time you make a commit, that 80% you're missing grows and grows. And unfortunately, if there's nothing there to catch everything once it's made it into production, you end up with a fairly large backlog of risk that exists. And in fact, what we see in our future of AppSec report is only about 9% of organizations fix 90% of their vulnerabilities. And even 90 isn't everything. If there's a critical vulnerability in that 10% you didn't scan, you still get hacked. There's actually you only need one vulnerability to be hacked. And so this accumulation means that backlogs are growing more and more. And though there are tools in the security space to help organizations catch up, you really need to make sure that whatever tool you're using is able to find as much as possible because of the compounding code commits that are happening.
00:08:33 · Neil C. Hughes
[00:08:33] S0: Yeah. And anyone that's work... Worked in a technical team will know all about that accountability problem. And when something goes wrong, the developer, the deployer, the vendor, the network guy, everyone's pointing at each other at that moment. Everything goes wrong like that Spider Man meme. You know? But if if AI generates vulnerable code and it does pass through several tools and teams, which it can do, especially as it gets more smarter, who should own the risk when something goes wrong? Who's gonna be the the person accountable for that?
00:09:01 · Frank Emery
[00:09:01] S1: Ultimately, it's the organization. So at the end of the day, if you're the end user of a product and that product gets breached or hats, you know, you're not necessarily gonna know the individual team that dropped the ball, but you are gonna know the organization that dropped the ball. And so I think ultimately, you know, the buck stops with the the company that's putting products out. I think within an organization, if you look at the individual team levels, it's gonna come down to, if you're having an AI write your code, you know, you're responsible for that AI's writing of your code, and that all bubbles up. And so the individual developer, they're accountable for validating that whatever they wrote is secure. And that's, you know, to the original point about why that skill set of validation review is so important now. And then if you're a team leader, you're responsible of making sure that every developer on your team is validating their changes. And if you're running an AppSec organization or an AppSec program, your response for making sure that all those team leads are adhering to application security standards. And so it does all ultimately bubble up, but that is still a lot of points of failure along the way where as people speed up and as they lose the ability over time to do, you know, reviews, security architecture, all of that just increases risk across time. And unfortunately, AI is making it a lot easier to exploit things, but at the same time, it is helping both with detection remediation as well. So it's not all bad. There there are ways to fix this. And we're seeing a lot of organizations starting to actually use AI to help with detection remediation to keep up pace with vulnerability creation as well.
00:10:39 · Neil C. Hughes
[00:10:39] S0: And if we do have a young Gen Z developer who's entering the workplace for the first time, maybe even going to an interview and wanting to make the employer understand that they know what they're talking about and what they're responsible for, what should they be expected to understand about reasoning, validation, secure design when they're orchestrating AI generated output rather than writing every single line themselves like it used to be done?
00:11:02 · Frank Emery
[00:11:02] S1: I think first and foremost, they need to understand what the code being generated does. I have seen far too many instances of people firing off a prompt and getting something back and immediately executing a pull request. So they're they're going right from prompts to deployment. And when you do that, you're not necessarily understanding what that code is doing. And a lot of the times, vulnerabilities aren't necessarily just across a scripting vulnerability, they're more logical, they have more to do with what that code does in context. And so I think if you're a new grad, if you're new in the industry, I would say don't just trust what AI is doing blindly, you have to understand what that code is meant to do, how it fits into the overall design of your application. And I think you need to have a good idea of, you know, what secure design looks like. We see a lot of blogs online that'll talk about, hey, AI passed this functional test. The AI made code and it did what it's supposed to do. Like if you press this button, the AI made that button will do what you expected the button to do, but there's a big difference between being functionally correct and being secure. And I think that's where people really need to do research and figure out and understand what that that difference is and and how to make the the code that's being developed by AI, not just functionally correct, but secure as well.
00:12:30 · Neil C. Hughes
[00:12:30] S0: And that is the young developer lab. An organizational level, how can they decide which changes an AI coding tool should make independently while others will still require that human review? It's a