WEBVTT - The $5 Billion Effort to help Secure the World’s Shared Software 0:00:00.350 --> 0:00:03.020 Hey everyone, it's Oz. Today we're bringing you a new 0:00:03.060 --> 0:00:07.200 episode of Smart Talks with IBM. This season, Malcolm Gladwell 0:00:07.240 --> 0:00:10.730 talks to leaders using AI and emerging technology to change 0:00:10.770 --> 0:00:13.989 the game in their industries. From Heineken using AI to 0:00:14.030 --> 0:00:17.670 become the world's best connected brewer, to UFC using data 0:00:17.710 --> 0:00:21.570 to turn chaos into clarity for fans and commentators, to 0:00:21.710 --> 0:00:26.050 Cleveland Clinic using AI and quantum computing to accelerate discovery 0:00:26.130 --> 0:00:30.500 in biomedical research. Smart Talks with IBM explores how organizations 0:00:30.540 --> 0:00:35.560 are applying technology in unexpected and transformative ways. New episodes 0:00:35.620 --> 0:00:39.460 drop every month, wherever you get your podcasts. Learn more 0:00:39.560 --> 0:00:44.470 at ibm.com slash smarttalks. This is a paid advertisement from IBM. 0:00:45.610 --> 0:00:48.850 Hey, Tech Stuff listener. Thanks for tuning into this episode 0:00:49.050 --> 0:00:52.560 of Smart Talks with IBM. If this episode sparked a 0:00:52.580 --> 0:00:56.160 question you'd like to ask an IBM technical expert, submit 0:00:56.180 --> 0:01:01.620 your questions at ibm.com slash smart talks. We're exploring ways 0:01:01.660 --> 0:01:04.770 to bring your questions directly to the experts, and we'd 0:01:04.830 --> 0:01:10.229 love to hear what's on your mind. You get the picture. 0:01:10.250 --> 0:01:40.810 But keep scrolling. until you reach May 28th, a press 0:01:40.830 --> 0:01:44.810 release that dwarfs nearly everything else. IBM and Red Hat 0:01:45.050 --> 0:01:50.080 today announced Project Lightwell, a $ 5 billion commitment backed by 0:01:50.170 --> 0:01:53.820 new frontier AI capabilities and a global force of more 0:01:53.860 --> 0:01:59.020 than 20,000 engineers to help enterprises secure open source software. 0:01:59.580 --> 0:02:02.640 IBM and Red Hat, the open source software leader that 0:02:02.700 --> 0:02:09.660 IBM acquired in 2019, are committing $ 5 billion and 20,000 0:02:09.660 --> 0:02:14.240 engineers to a cybersecurity project. Even in an age when 0:02:14.280 --> 0:02:17.680 we have become inured to very large numbers, these are 0:02:17.700 --> 0:02:22.669 very large numbers. Keep reading. Paragraph 4. The press release 0:02:22.790 --> 0:02:25.389 then lists just some of the companies that have already 0:02:25.430 --> 0:02:29.390 agreed to collaborate as early adopters. Bank of America, Bank 0:02:29.430 --> 0:02:34.360 of New York, Citicorp, Goldman Sachs, JPMorgan Chase, MasterCard, Morgan Stanley, 0:02:34.680 --> 0:02:38.200 Royal Bank of Canada, State Street, Visa, and Wells Fargo. 0:02:39.460 --> 0:02:41.560 Four of the biggest banks in the US, the biggest 0:02:41.620 --> 0:02:44.150 bank in Canada, two of the biggest investment banks on 0:02:44.160 --> 0:02:47.049 Wall Street, two of the world's biggest credit card networks, 0:02:47.410 --> 0:02:51.589 the firm that probably holds your 401k, just for starters. 0:02:52.730 --> 0:02:56.730 Press releases do not normally require explanations. This one does. 0:02:59.680 --> 0:03:02.700 I'm Malcolm Gladwell. You're listening to Smart Talks with IBM, 0:03:03.100 --> 0:03:06.960 a podcast where we explore how AI and emerging technologies 0:03:07.370 --> 0:03:12.570 are reshaping the way businesses and industries operate. In this episode, 0:03:13.190 --> 0:03:16.180 I want to explain why one of the world's largest 0:03:16.200 --> 0:03:20.560 technology companies felt compelled this past spring to launch one 0:03:20.580 --> 0:03:25.150 of the largest dedicated commitments to open source security to date, 0:03:25.770 --> 0:03:29.109 and why the minute they did, much of the financial 0:03:29.150 --> 0:03:32.250 services industry raised their hand and said, count me in. 0:03:36.010 --> 0:03:39.690 You are the head of information security for a large, 0:03:40.470 --> 0:03:44.790 very large multinational bank. I put the question to Manish Sharma, 0:03:45.170 --> 0:03:48.870 the chief information security officer for Wells Fargo, one of 0:03:48.890 --> 0:03:53.110 the early adopters on Lightwell. Why did Wells Fargo participate? 0:03:53.610 --> 0:03:57.200 You know, what we've seen with the progress in AI 0:03:57.750 --> 0:04:03.230 is has created an element of urgency about everything from 0:04:03.290 --> 0:04:08.280 maintenance to lifecycle management to operational stability, every aspect of it. 0:04:08.320 --> 0:04:12.620 So it's really in the past few quarters that we've 0:04:12.660 --> 0:04:14.560 started to look at things differently. 0:04:15.440 --> 0:04:20.770 Anthropic released Mythos in preview mode just six weeks before 0:04:20.810 --> 0:04:24.950 the launch of Lightwell. A frontier AI model so powerful... 0:04:25.130 --> 0:04:29.109 that Anthropic, its developer, said that it would, quote, surpass 0:04:29.330 --> 0:04:32.909 all but the most skilled humans at finding and exploiting 0:04:33.370 --> 0:04:38.289 software vulnerabilities. It's right there in the press release. Paragraph three. 0:04:38.990 --> 0:04:43.070 Anthropic recently reported that its mythos preview model identified nearly 0:04:43.070 --> 0:04:49.839 3,900 high or critical severity vulnerabilities in open source software alone. 0:04:51.020 --> 0:04:57.040 Thousands and thousands. of critical vulnerabilities. But there was a 0:04:57.080 --> 0:04:58.180 moment where you're like, oh. 0:04:58.740 --> 0:04:58.920 Yeah. 0:04:59.600 --> 0:05:02.320 Give me a kind of more specific understanding of that. 0:05:02.360 --> 0:05:04.820 So when you say the pace has changed, it's gone 0:05:04.870 --> 0:05:06.190 from what to what? 0:05:06.620 --> 0:05:10.789 Potentially from days and weeks to minutes. 0:05:11.890 --> 0:05:15.450 To understand the urgency behind Lightwell, you have to understand 0:05:15.510 --> 0:05:20.789 something about software that most people never think about. Open source. 0:05:21.770 --> 0:05:26.960 Unlike proprietary code, Open source software isn't controlled exclusively by 0:05:27.140 --> 0:05:30.900 one company or person. In a hypothetical universe where there 0:05:31.060 --> 0:05:35.119 is no open source, where code is written the way 0:05:36.580 --> 0:05:39.479 music lyrics are written or books are written, where they're 0:05:39.600 --> 0:05:42.979 owned exclusively by the person, by the creator, how does 0:05:43.000 --> 0:05:45.979 that affect the shape of the digital revolution? 0:05:46.460 --> 0:05:48.340 Well, so actually I'm going to correct you. 0:05:48.720 --> 0:05:51.800 I'm talking to Gunnar Hellickson, who runs the Lightwell Initiative, 0:05:52.080 --> 0:05:53.440 for IBM and Red Hat. 0:05:54.279 --> 0:05:57.680 In fact, open source only works because of copyright. So 0:05:57.700 --> 0:06:00.310 what happens is I write a piece of software, I 0:06:00.350 --> 0:06:03.410 have a copyright to it, and I use that copyright 0:06:03.589 --> 0:06:07.060 not to say all rights reserved and restrict access to it. 0:06:07.150 --> 0:06:09.110 I use those same rights to then I can now 0:06:09.190 --> 0:06:12.690 ascribe those rights to other people. So it's actually what 0:06:12.730 --> 0:06:14.910 was most clever about open source is it kind of 0:06:15.310 --> 0:06:18.130 inverts the intent of the copyright law and makes it, 0:06:18.130 --> 0:06:20.030 it turns it into a tool for sharing as opposed 0:06:20.050 --> 0:06:20.989 to a tool for restriction. 0:06:21.050 --> 0:06:23.150 Yeah. But books and music are not written as tools 0:06:23.190 --> 0:06:23.570 for sharing. 0:06:23.690 --> 0:06:24.029 No, that's true. 0:06:24.050 --> 0:06:26.040 There's a million books I've read where I've said I 0:06:26.060 --> 0:06:28.320 could make this better and I'm not allowed to. 0:06:28.320 --> 0:06:29.400 Yeah, that's right. That's right. 0:06:29.760 --> 0:06:34.539 And so the mechanics of sharing become important because using 0:06:34.580 --> 0:06:36.760 the copyright law, you can actually ensure that things are 0:06:37.300 --> 0:06:40.300 shared over time and consistently. So if I write a 0:06:40.300 --> 0:06:41.940 piece of software and I give it to you, you 0:06:41.960 --> 0:06:45.779 can improve it, but the license stipulates that you then 0:06:45.880 --> 0:06:47.960 also have to share any improvements that you made, right? 0:06:48.020 --> 0:06:49.660 And so in this way, it kind of folds in 0:06:49.700 --> 0:06:50.820 on itself, right? Yeah. 0:06:51.300 --> 0:06:54.719 Open source software often works in tandem with proprietary code. 0:06:55.320 --> 0:06:58.600 Imagine a pyramid. At the top of the pyramid is 0:06:58.660 --> 0:07:02.730 the specific, carefully tailored code that an individual company might 0:07:02.850 --> 0:07:06.790 use to solve a specific problem. That code is typically 0:07:06.830 --> 0:07:11.750 written in-house or purchased from a software company. It's curated. 0:07:12.270 --> 0:07:17.740 It's controlled. systematically. Someone's in charge of it. But beneath 0:07:17.810 --> 0:07:21.940 that sits something much larger. Billions of lines of open 0:07:21.980 --> 0:07:27.120 source code. Shared software components or packages built collectively by 0:07:27.180 --> 0:07:31.460 developers all over the world over decades. Anyone can use them. 0:07:32.160 --> 0:07:35.900 Anyone can improve them. Someone fixes a bug, submits the 0:07:35.940 --> 0:07:38.810 update to the volunteer running that particular package, and the 0:07:38.850 --> 0:07:49.000 project evolves. A famous essay in the technology world refers 0:07:49.040 --> 0:07:52.580 to these two models of software production as the cathedral 0:07:53.050 --> 0:07:57.690 and the bazaar. The cathedral is quiet and composed and hierarchical. 0:07:58.610 --> 0:08:03.030 The bazaar is sprawling and noisy and chaotic. And the 0:08:03.090 --> 0:08:06.730 argument in the essay was that the bazaar, against all expectations, 0:08:07.150 --> 0:08:09.710 was far better suited for the kind of creative work 0:08:10.090 --> 0:08:13.970 that produces innovative software. Here's an excerpt from the essay. 0:08:14.320 --> 0:08:18.619 describing the emergence of the most famous of all open-source projects, Linux, 0:08:19.320 --> 0:08:23.400 started by Linus Torvald in the early 1990s, the operating 0:08:23.460 --> 0:08:29.030 system that would become the backbone of modern computing. I 0:08:29.090 --> 0:08:32.550 believed that the most important software needed to be built 0:08:32.730 --> 0:08:37.770 like cathedrals, carefully crafted by individual wizards or small bands 0:08:37.809 --> 0:08:41.250 of mages working in splendid isolation with no beta to 0:08:41.309 --> 0:08:45.680 be released before its time. Linus Torvald's style of development, 0:08:46.160 --> 0:08:49.890 release early and often, delegate everything you can, be open 0:08:49.929 --> 0:08:54.450 to the point of promiscuity, came as a surprise. No quiet, 0:08:54.850 --> 0:08:58.710 reverent cathedral building here. Rather, the Linux community seemed to 0:08:58.750 --> 0:09:03.200 resemble a giant babbling bazaar of differing agendas and approaches, 0:09:04.140 --> 0:09:08.200 aptly symbolized by the Linux archive sites who take submissions 0:09:08.240 --> 0:09:11.620 from anyone, out of which a coherent and stable system 0:09:11.950 --> 0:09:16.390 could seemingly emerge only by a succession of miracles. The 0:09:16.429 --> 0:09:20.010 fact that this bizarre style seemed to work, and work well, 0:09:20.860 --> 0:09:30.020 came as a distinct shock. Could we have gotten to 0:09:30.059 --> 0:09:35.620 the level of technological sophistication that we have today without 0:09:35.660 --> 0:09:36.160 open source? 0:09:36.360 --> 0:09:37.360 No, no, no. 0:09:37.570 --> 0:09:38.370 Here's Gunner again. 0:09:38.890 --> 0:09:44.970 Open source is so widespread right now. Aircraft in the sky, waterworks, electricity, roads, governments, 0:09:46.270 --> 0:09:50.280 they all rely on software that was largely developed by 0:09:50.380 --> 0:09:56.510 volunteers who were just scratching their own itch. And no 0:09:56.590 --> 0:10:00.160 single firm could capture all of that work. Couldn't afford 0:10:00.200 --> 0:10:05.100 to pay them. And even if it could, the innovation 0:10:05.140 --> 0:10:07.710 loops that happen in all of the sharing would be 0:10:07.750 --> 0:10:10.030 confined to that one firm. It would be very, very 0:10:10.070 --> 0:10:12.910 difficult for three or four of these firms to share 0:10:12.929 --> 0:10:15.429 the information as easily as they can with open source. 0:10:15.750 --> 0:10:19.230 To give you a sense of the scale of open source... GitHub, 0:10:19.490 --> 0:10:24.030 the largest archive of open source code, has over 420 0:10:24.030 --> 0:10:29.550 million software packages in its library. 230 new repositories were 0:10:29.590 --> 0:10:35.100 created every minute in 2025. That year, software developers around 0:10:35.120 --> 0:10:38.480 the world made just under a billion commits to that archive. 0:10:39.150 --> 0:10:43.199 This year, in 2026, GitHub is seeing over 2 billion 0:10:43.240 --> 0:10:46.820 commits a month due to an explosion in AI-assisted coding. 0:10:47.640 --> 0:10:51.530 Open source is is massive. But the very thing that 0:10:51.590 --> 0:10:55.150 makes open source so dynamic, the fact that there is 0:10:55.250 --> 0:10:59.650 no central controlling authority, is also what makes it so fragile. 0:11:01.050 --> 0:11:04.250 So who actually worries about the security of open source code? 0:11:04.870 --> 0:11:09.710 So as the software graduates and moves into commercialization, it's 0:11:10.429 --> 0:11:12.689 real clear, right? There's not just one, but probably several 0:11:12.750 --> 0:11:14.770 companies who are interested in making sure that that software 0:11:14.809 --> 0:11:17.030 is secure, right? So things work really well at that point. 0:11:17.670 --> 0:11:19.630 So really what we're talking about is the software that 0:11:19.770 --> 0:11:22.450 doesn't quite get swept up in the commercialization process, but 0:11:22.490 --> 0:11:26.189 it's still essential. And the way I just described it 0:11:26.230 --> 0:11:28.460 makes it sound like that's like 5% of the problem, 0:11:28.929 --> 0:11:33.140 but across all of IT, it's about 60 to 70% 0:11:33.140 --> 0:11:35.400 of the software that we're running falls in that chasm 0:11:36.140 --> 0:11:40.140 between it's not actually commercially supported and it's not software 0:11:40.179 --> 0:11:44.010 that the company has written itself. These are what we 0:11:44.030 --> 0:11:47.350 call dependencies. These are software that we need to go 0:11:47.370 --> 0:11:54.660 write other software. And that's to date we have not 0:11:55.160 --> 0:11:58.380 tended not to think very hard about the security of 0:11:58.440 --> 0:11:59.260 those dependencies. 0:11:59.720 --> 0:12:03.080 Much of the software underneath modern life doesn't belong to 0:12:03.160 --> 0:12:07.420 anyone in particular, which raises an obvious question. If everyone 0:12:07.460 --> 0:12:11.219 depends on it, who's responsible for maintaining it? 0:12:12.090 --> 0:12:15.689 Well, this is the whole thing about open source software 0:12:16.350 --> 0:12:22.110 is it's incredibly important and it is maintained by a 0:12:22.630 --> 0:12:27.750 relatively small number of people. And so you can think 0:12:27.820 --> 0:12:31.959 about these enormously consequential projects that we all rely upon, 0:12:32.520 --> 0:12:36.240 basically maintained by a handful of people. And that's been 0:12:36.280 --> 0:12:39.100 the biggest issue of it, sort of industrial use and 0:12:39.140 --> 0:12:45.000 then artisanal scale maintenance. And because of where we're at 0:12:45.059 --> 0:12:49.940 right now with respect to infrastructure and software being under 0:12:50.020 --> 0:12:55.480 increasing threat, given these very powerful AI capabilities, there's now 0:12:55.559 --> 0:12:58.880 been a big flashlight on, wow, we depend on this 0:12:58.990 --> 0:13:02.630 open source software, but it is maintained by, in a 0:13:02.670 --> 0:13:04.130 lot of cases, volunteers. 0:13:04.390 --> 0:13:08.670 That's Jan Easterly. She has spent her career thinking about risk. First, 0:13:09.030 --> 0:13:13.819 as a soldier and intelligence officer, later inside the cybersecurity establishment, 0:13:14.240 --> 0:13:16.619 and now as the head of RSAC, one of the 0:13:16.660 --> 0:13:21.260 world's leading cybersecurity conferences and communities. Talk a little bit 0:13:21.280 --> 0:13:25.240 about your own path to worrying about this problem. How 0:13:25.260 --> 0:13:25.959 did you get into this? 0:13:27.020 --> 0:13:30.980 Yeah, I mean, a pretty circuitous path, to be honest. 0:13:32.100 --> 0:13:35.340 It sort of started out right after my 18th birthday, 0:13:35.440 --> 0:13:38.100 where I entered the gates of the United States Military 0:13:38.140 --> 0:13:39.100 Academy at West Point. 0:13:39.550 --> 0:13:41.709 Easterly was in the military for the fall of the 0:13:41.730 --> 0:13:47.130 Berlin Wall. She served on the ground in Haiti, Bosnia, Kosovo, Somalia. 0:13:47.650 --> 0:13:49.809 She returned to West Point to teach economics. 0:13:50.330 --> 0:13:53.089 And I was there during 9-11 where the world changed again. 0:13:53.490 --> 0:13:56.770 And the next decade became all about terrorism. I was 0:13:56.809 --> 0:13:59.070 at the White House working for Condi Rice as her 0:13:59.110 --> 0:14:02.650 executive assistant and then went off to the National Security Agency, 0:14:02.690 --> 0:14:06.650 of course, the world's largest and most powerful intelligence agency. 0:14:06.690 --> 0:14:08.610 And I was there for over a decade in Iraq. 0:14:09.290 --> 0:14:13.090 in Afghanistan, and that's where I got into cyber. Stood 0:14:13.130 --> 0:14:16.150 up the Army's first cyber operations battalion, went to stand 0:14:16.230 --> 0:14:19.300 up US Cyber Command, and then ended up in the 0:14:19.360 --> 0:14:22.620 private sector at Morgan Stanley, and then at CISA, which 0:14:22.680 --> 0:14:26.160 is America's Cyber Defense Agency, and now I run the 0:14:26.220 --> 0:14:30.890 largest platform for cybersecurity. And so a very circuitous path, 0:14:31.030 --> 0:14:34.110 which all kinds of different threats, but right now a 0:14:34.190 --> 0:14:35.930 huge focus on cyber. 0:14:35.950 --> 0:14:37.470 Craziest career path I've ever heard. 0:14:37.750 --> 0:14:38.490 It is a little crazy. 0:14:39.270 --> 0:14:42.750 Easterly is, in the world of cybersecurity, a unique figure. 0:14:43.950 --> 0:14:47.490 She's a soldier and a strategist, not a coder. She 0:14:47.510 --> 0:14:50.609 spent her career moving between the military government and the 0:14:50.650 --> 0:14:54.160 private sector, not growing up in Silicon Valley. And most 0:14:54.200 --> 0:14:56.380 of all, she's someone who has spent her career looking 0:14:56.440 --> 0:14:59.400 at problems through the lens of national security and resilience. 0:15:00.160 --> 0:15:03.960 Who threatens us? Where are we vulnerable? How do we 0:15:04.020 --> 0:15:06.540 reduce risk? And how do we make the systems we 0:15:06.580 --> 0:15:09.670 depend on harder to break and faster to recover when 0:15:09.690 --> 0:15:13.770 they do. That combination has given her an unusual and 0:15:13.930 --> 0:15:18.780 influential voice on cybersecurity. And one of Easterly's mantras is, 0:15:19.320 --> 0:15:22.280 the world does not have a cybersecurity problem. It has, 0:15:22.800 --> 0:15:26.240 and to her mind, this distinction is crucial, a software 0:15:26.340 --> 0:15:27.200 quality problem. 0:15:27.680 --> 0:15:31.560 So security has always been a bolt-on, right? That's arguably 0:15:31.620 --> 0:15:35.420 what created the multi-billion dollar cybersecurity aftermarket. 0:15:35.560 --> 0:15:38.160 What she means is that cybersecurity is is thought of 0:15:38.340 --> 0:15:42.340 as a layer added to software after the fact, often 0:15:42.440 --> 0:15:45.940 by someone other than the original software developer to keep 0:15:46.040 --> 0:15:51.000 the software secure. Her question is, why isn't the security 0:15:51.140 --> 0:15:56.590 baked into the software itself? Answer, because the incentive structure 0:15:56.890 --> 0:15:59.050 around writing software is all wrong. 0:15:59.700 --> 0:16:03.160 I mean, it comes down to without getting too geeky or, 0:16:03.420 --> 0:16:03.680 you know. 0:16:04.060 --> 0:16:07.590 No, you can get geeky. This is IBM smart talks. 0:16:07.790 --> 0:16:09.610 You can be geeky as you want. 0:16:09.630 --> 0:16:10.110 All right. 0:16:10.190 --> 0:16:15.850 We're going to do a quick econ 101. So it 0:16:15.870 --> 0:16:18.870 all comes down to like basic economics, right? Goods, right? So, 0:16:19.270 --> 0:16:22.430 you know, you have search goods where you can tell 0:16:22.480 --> 0:16:24.460 the quality of a good before you buy it. Pair 0:16:24.500 --> 0:16:27.580 of shoes, nice shirt. And then you have experienced goods. 0:16:27.620 --> 0:16:29.870 You tell the quality after you buy it, like a 0:16:29.900 --> 0:16:33.570 meal in a restaurant or a nice, you know, trip, right? 0:16:33.670 --> 0:16:38.210 But software security is a quintessential credence good. What does 0:16:38.230 --> 0:16:41.650 that mean? It means that a person can't actually tell 0:16:41.700 --> 0:16:44.120 the quality of a good before you purchase it or 0:16:44.200 --> 0:16:47.020 even after you purchase it. So the average human is 0:16:47.060 --> 0:16:49.300 not going to look at a piece of software and say, 0:16:49.320 --> 0:16:52.880 that is the most secure software. That is the best, 0:16:52.990 --> 0:16:56.700 most resilient code ever. Or I am definitely going to 0:16:56.740 --> 0:16:59.000 get hacked and all my money is going to get stolen. 0:16:59.500 --> 0:17:03.130 You can't look at that, right? And so because of that, 0:17:04.050 --> 0:17:07.570 consumers don't really know what to ask for. And so 0:17:07.650 --> 0:17:12.149 the makers of the software were never incentivized to prioritize it. 0:17:12.210 --> 0:17:15.330 They were incentivized to prioritize getting that product to market 0:17:15.369 --> 0:17:18.660 first or driving down the cost. And so you have 0:17:18.720 --> 0:17:22.500 basically a classic market failure situation. where the market is 0:17:22.560 --> 0:17:25.639 not going to reward something that consumers don't actually care about. 0:17:26.359 --> 0:17:28.939 And then the further problem is, what happens, you know, 0:17:28.960 --> 0:17:31.160 how do you fix a market failure? Well, the government 0:17:31.220 --> 0:17:35.770 steps in with regulation to protect consumers. But in this case, 0:17:36.310 --> 0:17:39.270 the technology vendors who make this stuff have said, you know, 0:17:39.290 --> 0:17:42.609 at the end of the day, these flaws, these defects, 0:17:42.670 --> 0:17:46.680 these vulnerabilities, they're just the cost of doing business. We'll 0:17:46.740 --> 0:17:49.590 tell customers that there's a flaw and you need to 0:17:49.630 --> 0:17:52.030 patch it and just take care of it after the fact. 0:17:52.710 --> 0:17:55.990 And so there's never been any sort of technology regulation. 0:17:56.050 --> 0:17:58.790 There's never been any sort of a software liability. So 0:17:59.070 --> 0:18:02.010 anybody who buys software, I challenge you, whether you're a 0:18:02.050 --> 0:18:06.220 corporation or an individual, look at that contract that you sign. 0:18:06.760 --> 0:18:10.420 And somewhere on that contract, it will say, you buy 0:18:10.460 --> 0:18:15.330 this product entirely at your own risk. I guarantee you 0:18:15.470 --> 0:18:17.410 it will say that. And of course, we all check 0:18:17.430 --> 0:18:21.390 that box. But essentially, we've set up a world where 0:18:21.550 --> 0:18:27.100 software quality is not prized. And so that's where developers 0:18:27.150 --> 0:18:29.659 have never been, you know, security has never been the 0:18:29.720 --> 0:18:33.119 number one thing that developers have focused on. It's certainly 0:18:33.160 --> 0:18:36.780 not a malicious thing. It's just they're writing code and 0:18:37.040 --> 0:18:39.480 they are moving out products and there's not been this 0:18:39.590 --> 0:18:42.250 incentive to write secure code. 0:18:42.490 --> 0:18:46.280 With open source software, This misalignment of incentives is in 0:18:46.340 --> 0:18:49.859 some ways even more pronounced because you have this far-flung 0:18:49.880 --> 0:18:54.600 group of developers working independently on a single project, improving, 0:18:54.920 --> 0:18:58.390 evolving in fits and starts. Some things just fall through 0:18:58.410 --> 0:19:02.970 the cracks. Here's Gunnar again. Why isn't the open source 0:19:03.010 --> 0:19:07.990 innovator in the beginning motivated to make the code as 0:19:08.030 --> 0:19:12.040 secure as possible? are they indifferent to it or do 0:19:12.119 --> 0:19:14.350 other things take priority or what's the kind. 0:19:14.190 --> 0:19:18.470 Of, yeah, well, it's a, it's a combination of things. It's, uh, uh, well, 0:19:18.630 --> 0:19:19.609 do you brush your teeth every day? 0:19:20.630 --> 0:19:21.910 I do. Oh, okay. 0:19:21.930 --> 0:19:26.040 That's a bad example then. My children, maybe you could 0:19:26.119 --> 0:19:26.620 use my kids. 0:19:26.800 --> 0:19:28.659 So do they know that they need to brush their 0:19:28.680 --> 0:19:29.240 teeth every day? 0:19:29.359 --> 0:19:29.580 Yes. 0:19:29.780 --> 0:19:31.820 Will they actually brush their teeth every day? No, we're 0:19:31.840 --> 0:19:34.500 all human. We all have reasons. And an open source 0:19:34.760 --> 0:19:39.150 project maintainer may, uh, They may not have the skills 0:19:39.190 --> 0:19:41.670 or the wherewithal to actually make the software secure. That's 0:19:41.710 --> 0:19:44.570 very common because making software secure is a dark art. right? 0:19:44.790 --> 0:19:48.899 It's very complicated. And it could be also that they 0:19:48.940 --> 0:19:51.340 were distracted, right? They could be that they started a 0:19:51.359 --> 0:19:54.740 project that was very, very promising, but then they got married, 0:19:55.340 --> 0:19:57.340 they got a dog, and they got distracted, they got 0:19:57.359 --> 0:20:00.040 a new job, and now that software got picked up 0:20:00.080 --> 0:20:02.570 by somebody else who didn't go back and check the code. 0:20:02.590 --> 0:20:03.670 You know, there's lots of reasons why. 0:20:04.010 --> 0:20:07.820 Historically, that kind of messiness was manageable. The bizarre would 0:20:07.930 --> 0:20:11.440 inevitably get around to identifying and fixing the most serious 0:20:11.480 --> 0:20:16.140 of vulnerabilities. Before AI comes along, developers have an intuition 0:20:16.840 --> 0:20:19.780 about how safe a piece of software is. And what 0:20:19.840 --> 0:20:23.200 AI does is it says those intuitions tended to radically 0:20:23.280 --> 0:20:25.879 underestimate the number of vulnerabilities. 0:20:26.040 --> 0:20:26.220 Yeah. 0:20:26.400 --> 0:20:27.060 How radically? 0:20:28.700 --> 0:20:32.239 Quite radically. The number of vulnerabilities that we joke internally 0:20:32.290 --> 0:20:35.109 that a lot of the vulnerabilities that we've discovered are 0:20:35.170 --> 0:20:38.320 old enough to vote. They have been in software for 18, 0:20:38.320 --> 0:20:39.230 20 years. 0:20:39.550 --> 0:20:40.470 These people just never. 0:20:40.750 --> 0:20:43.550 Yeah, just never looked. Or never had an AI that 0:20:44.070 --> 0:20:45.250 had the patience to look, right? 0:20:45.470 --> 0:20:48.770 Yeah. In the world of cybersecurity, vulnerabilities are given a 0:20:48.810 --> 0:20:53.270 grade on the Common Vulnerability Scoring System, more commonly referred 0:20:53.310 --> 0:20:58.190 to as a CVSS score. The CVSS scale measures how 0:20:58.330 --> 0:20:59.689 serious a vulnerability is. 0:21:00.300 --> 0:21:02.399 So if you say that my piece of software has 0:21:02.440 --> 0:21:05.240 a critical vulnerability, cool, I'll go fix the critical vulnerability 0:21:05.280 --> 0:21:09.240 and then mark it. But to date, we've said, well, 0:21:09.260 --> 0:21:11.870 if you've got 10 low vulnerabilities, it's kind of like, well, 0:21:11.890 --> 0:21:13.910 I could go fix it. But it's actually probably even 0:21:13.970 --> 0:21:15.689 more disruptive and risky to fix it than it is 0:21:15.770 --> 0:21:17.330 to just leave it alone. So we're just going to 0:21:17.350 --> 0:21:19.350 let it be. And we kind of as an industry, 0:21:19.369 --> 0:21:21.560 we kind of collectively decided over the last 25 years, 0:21:21.619 --> 0:21:24.840 like when we get these low impact vulnerabilities, let's just 0:21:24.880 --> 0:21:25.320 leave them be. 0:21:25.380 --> 0:21:25.859 It's riskier. 0:21:25.940 --> 0:21:29.220 It's too risky to fix them. So any one of 0:21:29.260 --> 0:21:32.460 these things is not very important, but when you chain 0:21:32.500 --> 0:21:34.840 five or six of them together in a very specific way, 0:21:35.140 --> 0:21:37.679 now suddenly they become critical. That is one of the 0:21:37.740 --> 0:21:40.700 consequences of, now that we've pointed AI at this problem, 0:21:41.090 --> 0:21:43.270 that's one of the things that we've collectively come to 0:21:43.290 --> 0:21:43.830 this realization. 0:21:43.869 --> 0:21:48.370 We're talking about not just second-order effects, but third, fourth, fifth-order. 0:21:48.910 --> 0:21:51.850 It's like chess. This one move doesn't appear to put 0:21:51.890 --> 0:21:53.689 me in any peril, but what I've done in the 0:21:53.730 --> 0:21:56.379 first round will come back to haunt me five rounds in, 0:21:56.600 --> 0:22:00.470 and by then... I've lost. There's a flip side to this, though. 0:22:01.310 --> 0:22:04.320 And that's where the story turns optimistic. If AI has 0:22:04.359 --> 0:22:07.359 made it much easier for bad actors to find vulnerabilities, 0:22:08.000 --> 0:22:10.960 it has also made it easier for the good guys 0:22:10.980 --> 0:22:14.280 to fix them. Here's Manish Sharma again, who has the 0:22:14.400 --> 0:22:19.100 massive responsibility of ensuring digital security for a major institution, 0:22:19.540 --> 0:22:20.179 Wells Fargo. 0:22:21.080 --> 0:22:23.850 We've quite literally used AI to sort of combat the 0:22:23.869 --> 0:22:25.409 risk of AI. And what I mean by that is 0:22:25.430 --> 0:22:29.820 we've developed automated capabilities using AI to be able to 0:22:29.900 --> 0:22:32.340 fix what we detect in our software. 0:22:33.140 --> 0:22:36.680 Like any competitive struggle, from a sporting match to human warfare, 0:22:37.100 --> 0:22:41.619 competition involves a constant back and forth between defense and offense, 0:22:42.100 --> 0:22:45.199 with each side having a momentary advantage. And while the 0:22:45.240 --> 0:22:48.470 advantage in software is to the attacker right now, that 0:22:48.650 --> 0:22:52.830 shouldn't always be the case. Manish says he's also seeing 0:22:52.850 --> 0:22:55.570 the balance shift with some of the new AI tools. 0:22:56.720 --> 0:23:01.630 Done the right way, architected the right way, I don't 0:23:01.670 --> 0:23:07.590 think it's easier or faster for AI to identify than 0:23:08.290 --> 0:23:10.570 to mitigate. You know, obviously there is going to be 0:23:10.590 --> 0:23:12.869 a little bit of a lag between those two, but 0:23:12.890 --> 0:23:15.210 it's not orders of magnitude, meaning it's not as if 0:23:15.260 --> 0:23:19.020 you can find things in a day and it takes 0:23:19.080 --> 0:23:23.460 you months to patch them or to mitigate them. If 0:23:23.500 --> 0:23:24.080 that's where. 0:23:26.010 --> 0:23:29.250 An institution is, I'd be a little concerned. So your 0:23:29.310 --> 0:23:33.859 ability to respond to things has gotten a lot faster 0:23:34.340 --> 0:23:38.560 as well. It's not one-to-one mapping between finding and resolving. 0:23:38.740 --> 0:23:44.260 Usually it's, you know, one-to-many, but using AI, you can 0:23:44.600 --> 0:23:48.580 very efficiently create an architecture where you're able to respond 0:23:48.660 --> 0:23:51.240 to those threats way, way faster. That's our area of focus. 0:23:51.420 --> 0:23:53.550 Can you give me a kind of a a rough 0:23:53.609 --> 0:23:56.350 sense of how much that gap has closed in recent? 0:23:56.609 --> 0:24:00.590 It's closing pretty, pretty, pretty fast. And it's closing pretty 0:24:00.630 --> 0:24:04.449 fast at most institutions that I talk to. And let 0:24:04.470 --> 0:24:07.689 me give you an example. In terms of scale, you 0:24:07.730 --> 0:24:11.879 are now seeing not a factor of two times or 0:24:11.940 --> 0:24:16.179 three times the number of fixes to critical and high vulnerabilities. 0:24:16.220 --> 0:24:22.720 You're seeing a magnitude of 10x, 20x within the same 0:24:23.369 --> 0:24:28.619