WEBVTT - The $5 Billion Effort to help Secure the World’s Shared Software 0:00:02.680 --> 0:00:06.080 Big companies inform insiders and investors of their comings and 0:00:06.120 --> 0:00:09.460 goings through a steady stream of press releases. Written in 0:00:09.480 --> 0:00:12.770 plain language, press releases typically serve as a chronicle of 0:00:12.810 --> 0:00:16.050 the prosaic details of corporate life. If you were to 0:00:16.110 --> 0:00:18.549 scroll through the news releases from IBM from last May, 0:00:19.110 --> 0:00:22.610 you would see news of an AI collaboration, updates to 0:00:22.650 --> 0:00:26.660 the IBM consulting service, a sports tech startup challenge, a 0:00:26.700 --> 0:00:28.880 new quantum chip manufacturing facility. 0:00:29.080 --> 0:00:29.740 You get the picture. 0:00:30.380 --> 0:00:34.409 But keep scrolling. until you reach May 28th, a press 0:00:34.430 --> 0:00:38.410 release that dwarfs nearly everything else. IBM and Red Hat 0:00:38.650 --> 0:00:43.690 today announced Project Lightwell, a $ 5 billion commitment backed by 0:00:43.770 --> 0:00:47.410 new frontier AI capabilities and a global force of more 0:00:47.450 --> 0:00:52.620 than 20,000 engineers to help enterprises secure open source software. 0:00:53.180 --> 0:00:56.240 IBM and Red Hat, the open source software leader that 0:00:56.300 --> 0:01:03.250 IBM acquired in 2019, are committing $ 5 billion and 20,000 0:01:03.250 --> 0:01:07.860 engineers to a cybersecurity project. Even in an age when 0:01:07.880 --> 0:01:11.280 we have become inured to very large numbers, these are 0:01:11.300 --> 0:01:12.119 very large numbers. 0:01:13.140 --> 0:01:13.580 Keep reading. 0:01:14.180 --> 0:01:17.430 Paragraph 4. The press release then lists just some of 0:01:17.450 --> 0:01:21.149 the companies that have already agreed to collaborate as early adopters. 0:01:21.910 --> 0:01:24.830 Bank of America, Bank of New York, Citicorp, Goldman Sachs, 0:01:25.170 --> 0:01:30.619 JPMorgan Chase, MasterCard, Morgan Stanley, Royal Bank of Canada, State Street, Visa, 0:01:30.980 --> 0:01:34.520 and Wells Fargo. Four of the biggest banks in the US, 0:01:34.740 --> 0:01:37.380 the biggest bank in Canada, two of the biggest investment 0:01:37.400 --> 0:01:39.959 banks on Wall Street, two of the world's biggest credit 0:01:40.000 --> 0:01:44.010 card networks, the firm that probably holds your 401k, just 0:01:44.610 --> 0:01:49.730 for starters. Press releases do not normally require explanations. This 0:01:49.870 --> 0:01:50.330 one does. 0:01:53.270 --> 0:01:53.990 I'm Malcolm Gladwell. 0:01:54.290 --> 0:01:57.730 You're listening to Smart Talks with IBM, a podcast where 0:01:57.750 --> 0:02:01.870 we explore how AI and emerging technologies are reshaping the 0:02:01.910 --> 0:02:06.990 way businesses and industries operate. In this episode, I want 0:02:07.030 --> 0:02:10.769 to explain why one of the world's largest technology companies 0:02:11.169 --> 0:02:14.370 felt compelled this past spring to launch one of the 0:02:14.410 --> 0:02:19.430 largest dedicated commitments to open source security to date, and 0:02:19.470 --> 0:02:23.130 why the minute they did, much of the financial services 0:02:23.169 --> 0:02:29.750 industry raised their hand and said, count me in. You 0:02:29.830 --> 0:02:34.230 are the head of information security for a large, very 0:02:34.270 --> 0:02:38.390 large multinational bank. I put the question to Manish Sharma, 0:02:38.770 --> 0:02:42.470 the chief information security officer for Wells Fargo, one of 0:02:42.490 --> 0:02:46.710 the early adopters on Lightwell. Why did Wells Fargo participate? 0:02:47.210 --> 0:02:50.790 You know, what we've seen with the progress in AI 0:02:51.350 --> 0:02:56.850 is has created an element of urgency about everything from 0:02:56.889 --> 0:03:01.870 maintenance to lifecycle management to operational stability, every aspect of it. 0:03:01.910 --> 0:03:06.220 So it's really in the past few quarters that we've 0:03:06.260 --> 0:03:08.160 started to look at things differently. 0:03:09.040 --> 0:03:14.359 Anthropic released Mythos in preview mode just six weeks before 0:03:14.400 --> 0:03:18.550 the launch of Lightwell. A frontier AI model so powerful... 0:03:18.720 --> 0:03:22.700 that Anthropic, its developer, said that it would, quote, surpass 0:03:22.940 --> 0:03:26.500 all but the most skilled humans at finding and exploiting 0:03:26.960 --> 0:03:31.910 software vulnerabilities. It's right there in the press release. Paragraph three. 0:03:32.590 --> 0:03:36.670 Anthropic recently reported that its mythos preview model identified nearly 0:03:36.670 --> 0:03:43.450 3,900 high or critical severity vulnerabilities in open source software alone. 0:03:44.630 --> 0:03:50.640 Thousands and thousands, of critical vulnerabilities. But there was a 0:03:50.680 --> 0:03:53.680 moment where you're like, oh. Yeah. Give me a kind 0:03:53.720 --> 0:03:56.780 of more specific understanding of that. So when you say 0:03:56.810 --> 0:03:59.790 the pace has changed, it's gone from what to what? 0:04:00.230 --> 0:04:04.390 Potentially from days and weeks to minutes. 0:04:05.490 --> 0:04:09.060 To understand the urgency behind Lightwell, you have to understand 0:04:09.120 --> 0:04:14.400 something about software that most people never think about. Open source. 0:04:15.360 --> 0:04:20.560 Unlike proprietary code, open source software isn't controlled exclusively by 0:04:20.720 --> 0:04:24.500 one company or person. In a hypothetical universe where there 0:04:24.660 --> 0:04:28.730 is no open source, where code is written the way 0:04:30.190 --> 0:04:33.089 music lyrics are written or books are written, where they're 0:04:33.210 --> 0:04:36.589 owned exclusively by the person, by the creator, how does 0:04:36.610 --> 0:04:39.589 that affect the shape of the digital revolution? 0:04:40.050 --> 0:04:41.950 Well, so actually I'm going to correct you. 0:04:42.310 --> 0:04:45.409 I'm talking to Gunnar Hellickson. who runs the Lightwell Initiative 0:04:45.690 --> 0:04:47.029 for IBM and Red Hat. 0:04:47.890 --> 0:04:51.289 In fact, open source only works because of copyright. So 0:04:51.310 --> 0:04:53.910 what happens is I write a piece of software, I 0:04:53.930 --> 0:04:57.010 have a copyright to it, and I use that copyright 0:04:57.190 --> 0:05:00.660 not to say all rights reserved and restrict access to it. 0:05:00.760 --> 0:05:02.700 I use those same rights to then, I can now 0:05:02.779 --> 0:05:06.300 ascribe those rights to other people. So it's actually what 0:05:06.339 --> 0:05:08.520 was most clever about open source is it kind of 0:05:08.920 --> 0:05:11.720 inverts the intent of the copyright law and makes it 0:05:12.060 --> 0:05:13.640 it turns it into a tool for sharing as opposed 0:05:13.660 --> 0:05:14.599 to a tool for restriction. 0:05:14.660 --> 0:05:16.740 Yeah. But books and music are not written as tools 0:05:16.779 --> 0:05:17.180 for sharing. 0:05:17.300 --> 0:05:17.640 No, that's true. 0:05:17.660 --> 0:05:19.620 There's a million books I've read where I've said I 0:05:19.660 --> 0:05:21.930 could make this better and I'm not allowed to. 0:05:22.070 --> 0:05:23.010 Yeah, that's right. That's right. 0:05:23.370 --> 0:05:28.130 And so the mechanics of sharing become important because using 0:05:28.170 --> 0:05:30.350 the copyright law, you can actually ensure that things are 0:05:30.910 --> 0:05:33.900 shared over time and consistently. So if I write a 0:05:33.920 --> 0:05:35.560 piece of software and I give it to you, you 0:05:35.580 --> 0:05:39.350 can improve it, but the license stipulates that you then 0:05:39.470 --> 0:05:41.560 also have to share any improvements that you made, right? 0:05:41.620 --> 0:05:43.260 And so in this way, it kind of folds in 0:05:43.300 --> 0:05:44.260 on itself, right? 0:05:44.279 --> 0:05:44.419 Yeah. 0:05:44.900 --> 0:05:48.320 Open source software often works in tandem with proprietary code. 0:05:48.920 --> 0:05:52.200 Imagine a pyramid. At the top of the pyramid is 0:05:52.260 --> 0:05:56.320 the specific, carefully tailored code that an individual company might 0:05:56.440 --> 0:06:00.390 use to solve a specific problem. That code is typically 0:06:00.430 --> 0:06:05.350 written in-house or purchased from a software company. It's curated. 0:06:05.890 --> 0:06:11.349 It's controlled. systematically. Someone's in charge of it. But beneath 0:06:11.410 --> 0:06:15.550 that sits something much larger. Billions of lines of open 0:06:15.589 --> 0:06:20.720 source code. Shared software components or packages built collectively by 0:06:20.779 --> 0:06:25.060 developers all over the world over decades. Anyone can use them. 0:06:25.760 --> 0:06:29.500 Anyone can improve them. Someone fixes a bug, submits the 0:06:29.560 --> 0:06:32.419 update to the volunteer running that particular package, and the 0:06:32.440 --> 0:06:42.600 project evolves. A famous essay in the technology world refers 0:06:42.640 --> 0:06:46.180 to these two models of software production as the cathedral 0:06:46.640 --> 0:06:51.280 and the bazaar. The cathedral is quiet and composed and hierarchical. 0:06:52.220 --> 0:06:56.630 The bazaar is sprawling and noisy and chaotic. And the 0:06:56.690 --> 0:07:00.330 argument in the essay was that the bazaar, against all expectations, 0:07:00.750 --> 0:07:03.310 was far better suited for the kind of creative work 0:07:03.690 --> 0:07:07.570 that produces innovative software. Here's an excerpt from the essay. 0:07:07.920 --> 0:07:12.220 describing the emergence of the most famous of all open-source projects, Linux, 0:07:12.920 --> 0:07:17.000 started by Linus Torvald in the early 1990s, the operating 0:07:17.060 --> 0:07:22.620 system that would become the backbone of modern computing. I 0:07:22.690 --> 0:07:26.150 believed that the most important software needed to be built 0:07:26.330 --> 0:07:31.370 like cathedrals, carefully crafted by individual wizards or small bands 0:07:31.410 --> 0:07:34.850 of mages working in splendid isolation with no beta to 0:07:34.910 --> 0:07:39.280 be released before its time. Linus Torvald's style of development, 0:07:39.780 --> 0:07:43.480 release early and often, delegate everything you can, be open 0:07:43.540 --> 0:07:48.040 to the point of promiscuity, came as a surprise. No quiet, 0:07:48.460 --> 0:07:52.300 reverent cathedral building here. Rather, the Linux community seemed to 0:07:52.360 --> 0:07:56.780 resemble a giant babbling bazaar of differing agendas and approaches, 0:07:57.730 --> 0:08:01.790 aptly symbolized by the Linux archive sites who take submissions 0:08:01.830 --> 0:08:05.230 from anyone, out of which a coherent and stable system 0:08:05.550 --> 0:08:09.990 could seemingly emerge only by a succession of miracles. The 0:08:10.030 --> 0:08:13.610 fact that this bizarre style seemed to work, and work well, 0:08:14.450 --> 0:08:23.620 came as a distinct shock. Could we have gotten to 0:08:23.660 --> 0:08:29.220 the level of technological sophistication that we have today without 0:08:29.260 --> 0:08:29.760 open source? 0:08:29.960 --> 0:08:30.960 No, no, no. 0:08:31.180 --> 0:08:31.980 Here's Gunner again. 0:08:32.480 --> 0:08:38.580 Open source is so widespread right now. Aircraft in the sky, waterworks, electricity, roads, governments, 0:08:39.870 --> 0:08:43.870 they all rely on software that was largely developed by 0:08:43.970 --> 0:08:50.089 volunteers who were just scratching their own itch. And no 0:08:50.170 --> 0:08:53.870 single firm could capture all of that work, couldn't afford to. 0:08:53.870 --> 0:08:55.450 Pay them, right? 0:08:55.809 --> 0:08:59.690 And even if it could, the innovation loops that happen 0:08:59.770 --> 0:09:01.890 in all of the sharing would be confined to that 0:09:01.970 --> 0:09:05.199 one firm it would be very, very difficult for three 0:09:05.220 --> 0:09:07.220 or four of these firms to share the information as 0:09:07.340 --> 0:09:09.020 easily as they can with open source. 0:09:09.340 --> 0:09:12.839 To give you a sense of the scale of open source, GitHub, 0:09:13.100 --> 0:09:17.630 the largest archive of open source code, has over 420 0:09:17.630 --> 0:09:23.150 million software packages in its library. 230 new repositories were 0:09:23.210 --> 0:09:28.690 created every minute in 2025. That year, software developers around 0:09:28.730 --> 0:09:32.050 the world made just under a billion commits to that archive. 0:09:32.740 --> 0:09:36.800 This year, in 2026, GitHub is seeing over 2 billion 0:09:36.840 --> 0:09:40.420 commits a month due to an explosion in AI-assisted coding. 0:09:41.220 --> 0:09:45.430 Open source is massive. But the very thing that makes 0:09:45.590 --> 0:09:48.990 open source so dynamic, the fact that there is no 0:09:49.050 --> 0:09:53.250 central controlling authority, is also what makes it so fragile. 0:09:54.650 --> 0:09:57.870 So who actually worries about the security of open source code? 0:09:58.470 --> 0:10:03.310 So as the software graduates and moves into commercialization, it's 0:10:04.010 --> 0:10:06.290 real clear, right? There's not just one, but probably several 0:10:06.350 --> 0:10:08.350 companies who are interested in making sure that that software 0:10:08.390 --> 0:10:10.650 is secure, right? So things work really well at that point. 0:10:11.270 --> 0:10:13.240 So really what we're talking about is the software that 0:10:13.380 --> 0:10:16.060 doesn't quite get swept up in the commercialization process, but 0:10:16.100 --> 0:10:19.780 it's still essential. And the way I just described it 0:10:19.820 --> 0:10:22.040 makes it sound like that's like 5% of the problem, 0:10:22.520 --> 0:10:26.729 but across the, all of it, it's about 60 to 70% 0:10:26.730 --> 0:10:29.640 of the software that we're running falls in that chasm, uh, 0:10:29.750 --> 0:10:33.750 between it's not actually commercially supported and it's not software 0:10:33.790 --> 0:10:37.090 that the, uh, company has written itself. It's a, these are, 0:10:37.530 --> 0:10:40.240 we call them dependencies, right? Um, so these are software 0:10:40.260 --> 0:10:43.100 that we need to go write other software, right? Um, 0:10:43.280 --> 0:10:49.080 and that's, uh, to date, uh, We have not tended 0:10:49.160 --> 0:10:52.860 not to think very hard about the security of those dependencies. 0:10:53.300 --> 0:10:56.670 Much of the software underneath modern life doesn't belong to 0:10:56.770 --> 0:11:01.030 anyone in particular, which raises an obvious question. If everyone 0:11:01.070 --> 0:11:04.840 depends on it, who's responsible for maintaining it? 0:11:05.670 --> 0:11:09.319 Well, this is the whole thing about open source software 0:11:09.980 --> 0:11:15.689 is it's incredibly important and it is maintained by a 0:11:16.230 --> 0:11:21.349 relatively small number of people. And so you can think 0:11:21.410 --> 0:11:25.550 about these enormously consequential projects that we all rely upon, 0:11:26.090 --> 0:11:29.840 basically maintained by a handful of people. And that's been 0:11:29.880 --> 0:11:32.700 the biggest issue of it, sort of industrial use and 0:11:32.740 --> 0:11:38.600 then artisanal scale maintenance. And because of where we're at 0:11:38.660 --> 0:11:43.530 right now with respect to infrastructure and software being under 0:11:43.610 --> 0:11:49.080 increasing threat, given these very powerful AI capabilities, there's now 0:11:49.160 --> 0:11:52.500 been a big flashlight on, wow, we depend on this 0:11:52.580 --> 0:11:56.219 open source software, but it is maintained by, in a 0:11:56.260 --> 0:11:57.720 lot of cases, volunteers. 0:11:57.980 --> 0:12:02.270 That's Jen Easterly. She has spent her career thinking about risk. First, 0:12:02.630 --> 0:12:07.410 as a soldier and intelligence officer, later inside the cybersecurity establishment, 0:12:07.850 --> 0:12:10.209 and now as the head of RSAC, one of the 0:12:10.250 --> 0:12:14.860 world's leading cybersecurity conferences and communities. Talk a little bit 0:12:14.880 --> 0:12:18.839 about your own path to worrying about this problem. How 0:12:18.880 --> 0:12:19.559 did you get into this? 0:12:20.620 --> 0:12:24.600 Yeah, I mean, a pretty circuitous path, to be honest. 0:12:25.700 --> 0:12:28.950 It sort of started out right after my 18th birthday, 0:12:29.040 --> 0:12:31.710 where I entered the gates of the United States Military 0:12:31.750 --> 0:12:32.710 Academy at West Point. 0:12:33.140 --> 0:12:35.300 Easterly was in the military for the fall of the 0:12:35.320 --> 0:12:40.720 Berlin Wall. She served on the ground in Haiti, Bosnia, Kosovo, Somalia. 0:12:41.260 --> 0:12:43.420 She returned to West Point to teach economics. 0:12:43.920 --> 0:12:46.709 And I was there during 9-11, where the world changed again. 0:12:47.090 --> 0:12:50.370 And the next decade became all about terrorism. I was 0:12:50.410 --> 0:12:52.690 at the White House working for Condi Rice as her 0:12:52.710 --> 0:12:56.250 executive assistant, and then went off to the National Security Agency, 0:12:56.290 --> 0:13:00.250 of course, the world's largest and most powerful intelligence agency. 0:13:00.290 --> 0:13:02.210 And I was there for over a decade in Iraq. 0:13:02.880 --> 0:13:06.690 in Afghanistan, and that's where I got into cyber. Stood 0:13:06.730 --> 0:13:09.750 up the Army's first cyber operations battalion, went to stand 0:13:09.830 --> 0:13:12.910 up U.S. Cyber Command, and then ended up in the 0:13:12.950 --> 0:13:16.210 private sector at Morgan Stanley, and then at CISA, which 0:13:16.270 --> 0:13:19.750 is America's Cyber Defense Agency, and now I run the 0:13:19.820 --> 0:13:24.480 largest platform for cybersecurity. And so a very circuitous path, 0:13:24.620 --> 0:13:27.699 which all kinds of different threats, but right now a 0:13:27.780 --> 0:13:29.540 huge focus on cyber. 0:13:29.559 --> 0:13:31.079 Craziest career path I've ever heard. 0:13:31.340 --> 0:13:32.180 It is a little crazy. 0:13:32.860 --> 0:13:36.349 Easterly is, in the world of cybersecurity, a unique figure. 0:13:37.550 --> 0:13:41.070 She's a soldier and a strategist, not a coder. She 0:13:41.110 --> 0:13:44.209 spent her career moving between the military government and the 0:13:44.250 --> 0:13:47.750 private sector, not growing up in Silicon Valley. And most 0:13:47.790 --> 0:13:49.970 of all, she's someone who has spent her career looking 0:13:50.030 --> 0:13:53.010 at problems through the lens of national security and resilience. 0:13:53.750 --> 0:13:57.550 Who threatens us? Where are we vulnerable? How do we 0:13:57.610 --> 0:14:00.130 reduce risk? And how do we make the systems we 0:14:00.170 --> 0:14:02.910 depend on harder to break and and faster to recover 0:14:03.150 --> 0:14:07.170 when they do. That combination has given her an unusual 0:14:07.290 --> 0:14:12.370 and influential voice on cybersecurity. And one of Easterly's mantras is, 0:14:12.910 --> 0:14:15.880 the world does not have a cybersecurity problem. It has, 0:14:16.390 --> 0:14:19.840 and to her mind, this distinction is crucial, a software 0:14:19.940 --> 0:14:20.800 quality problem. 0:14:21.280 --> 0:14:25.160 So security has always been a bolt-on, right? That's arguably 0:14:25.220 --> 0:14:29.020 what created the multi-billion dollar cybersecurity aftermarket. 0:14:29.160 --> 0:14:31.750 What she means is that cybersecurity is is thought of 0:14:31.930 --> 0:14:35.940 as a layer added to software after the fact, often 0:14:36.040 --> 0:14:39.540 by someone other than the original software developer to keep 0:14:39.660 --> 0:14:44.600 the software secure. Her question is, why isn't the security 0:14:44.740 --> 0:14:50.180 baked into the software itself? Answer, because the incentive structure 0:14:50.490 --> 0:14:52.650 around writing software is all wrong. 0:14:53.300 --> 0:14:56.760 I mean, it comes down to without getting too geeky or, 0:14:57.020 --> 0:14:57.280 you know. 0:14:57.660 --> 0:14:58.580 No, you can get geeky. 0:14:58.600 --> 0:15:02.860 This is IBM smart talks. You can be geeky as 0:15:02.880 --> 0:15:03.200 you want. 0:15:03.220 --> 0:15:07.910 All right. We're going to do a quick econ 101. 0:15:09.250 --> 0:15:12.470 So it all comes down to like basic economics, right? Goods, right? So, 0:15:12.870 --> 0:15:16.050 you know, you have search goods where you can tell 0:15:16.070 --> 0:15:18.050 the quality of a good before you buy it. Pair 0:15:18.090 --> 0:15:21.180 of shoes, nice shirt. And then you have experienced goods. 0:15:21.220 --> 0:15:23.460 You tell the quality after you buy it, like a 0:15:23.500 --> 0:15:27.160 meal in a restaurant or a nice, you know, trip, right? 0:15:27.260 --> 0:15:31.810 But software security is a quintessential credence good. What does 0:15:31.850 --> 0:15:35.250 that mean? It means that a person can't actually tell 0:15:35.290 --> 0:15:37.710 the quality of a good before you purchase it or 0:15:37.790 --> 0:15:40.620 even after you purchase it. So the average human is 0:15:40.660 --> 0:15:42.920 not going to look at a piece of software and say, 0:15:42.940 --> 0:15:46.479 that is the most secure software. That is the best, 0:15:46.580 --> 0:15:50.310 most resilient code ever. Or I am definitely going to 0:15:50.330 --> 0:15:52.600 get hacked and all my money is going to get stolen. 0:15:53.100 --> 0:15:56.740 You can't look at that, right? And so because of that, 0:15:57.660 --> 0:16:01.160 consumers don't really know what to ask for. And so 0:16:01.240 --> 0:16:05.760 the makers of the software were never incentivized to prioritize it. 0:16:05.810 --> 0:16:08.930 They were incentivized to prioritize getting that product to market 0:16:08.990 --> 0:16:12.250 first or driving down the cost. And so you have 0:16:12.310 --> 0:16:16.250 basically a classic market failure. where the market is not 0:16:16.270 --> 0:16:19.240 going to reward something that consumers don't actually care about. 0:16:19.960 --> 0:16:22.540 And then the further problem is, what happens, you know, 0:16:22.560 --> 0:16:24.780 how do you fix a market failure? Well, the government 0:16:24.820 --> 0:16:29.360 steps in with regulation to protect consumers. But in this case, 0:16:29.900 --> 0:16:32.870 the technology vendors who make this stuff have said, you know, 0:16:32.890 --> 0:16:36.210 at the end of the day, these flaws, these defects, 0:16:36.270 --> 0:16:40.280 these vulnerabilities, they're just the cost of doing business. We'll 0:16:40.340 --> 0:16:43.180 tell customers that there's a flaw and you need to 0:16:43.240 --> 0:16:45.620 patch it and just take care of it after the fact. 0:16:46.300 --> 0:16:49.590 And so there's never been any sort of technology regulation. 0:16:49.670 --> 0:16:52.410 There's never been any sort of a software liability. So 0:16:52.670 --> 0:16:55.610 anybody who buys software, I challenge you, whether you're a 0:16:55.670 --> 0:16:59.810 corporation or an individual, look at that contract that you sign. 0:17:00.350 --> 0:17:04.020 And somewhere on that contract, it will say, you buy 0:17:04.060 --> 0:17:09.119 this product entirely at your own I guarantee you it 0:17:09.160 --> 0:17:11.560 will say that. And of course, we all check that box. 0:17:12.220 --> 0:17:16.220 But essentially, we've set up a world where software quality 0:17:16.420 --> 0:17:21.440 is not prized. And so that's where developers have never been, 0:17:21.460 --> 0:17:23.980 you know, security has never been the number one thing 0:17:24.020 --> 0:17:27.820 that developers have focused on. It's certainly not a malicious thing. 0:17:28.020 --> 0:17:31.439 It's just they're writing code and they are moving out 0:17:31.500 --> 0:17:35.830 products and there's not been this incentive to write secure code. 0:17:36.070 --> 0:17:39.879 With open source software, This misalignment of incentives is in 0:17:39.940 --> 0:17:43.460 some ways even more pronounced because you have this far-flung 0:17:43.480 --> 0:17:48.200 group of developers working independently on a single project, improving, 0:17:48.520 --> 0:17:51.980 evolving in fits and starts. Some things just fall through 0:17:52.000 --> 0:17:56.590 the cracks. Here's Gunnar again. Why isn't the open source 0:17:56.609 --> 0:18:01.590 innovator in the beginning motivated to make the code as 0:18:01.630 --> 0:18:04.859 secure as possible? are they indifferent to it or do 0:18:05.580 --> 0:18:07.859 other things take priority or what's the kind of. 0:18:08.100 --> 0:18:12.070 Yeah, well, it's a, it's a combination of things. It's, uh, uh, well, 0:18:12.220 --> 0:18:15.470 do you brush your teeth every day? I do. Oh, okay. 0:18:15.510 --> 0:18:19.649 That's a bad example then. My children, maybe you could 0:18:19.710 --> 0:18:20.210 use my kids. 0:18:20.390 --> 0:18:22.250 So do they know that they need to brush their 0:18:22.270 --> 0:18:22.850 teeth every day? 0:18:22.950 --> 0:18:23.170 Yes. 0:18:23.390 --> 0:18:24.969 Will they actually brush their teeth every day? 0:18:24.990 --> 0:18:26.600 No, we're all human. We all have reasons. 0:18:26.920 --> 0:18:31.679 And an open source project maintainer may, uh, They may 0:18:31.720 --> 0:18:34.270 not have the skills or the wherewithal to actually make 0:18:34.310 --> 0:18:36.990 the software secure. That's very common because making software secure 0:18:37.050 --> 0:18:41.510 is a dark art, right? It's very complicated. And it 0:18:41.550 --> 0:18:43.810 could be also that they were distracted, right? They could 0:18:43.850 --> 0:18:47.160 be that they started a project that was very, very promising, 0:18:47.420 --> 0:18:49.919 but then they got married, they got a dog, and 0:18:49.940 --> 0:18:52.180 they got distracted, they got a new job, and now 0:18:52.220 --> 0:18:54.920 that software got picked up by somebody else who didn't 0:18:54.960 --> 0:18:56.159 go back and check the code. 0:18:56.180 --> 0:18:57.300 You know, there's lots of reasons why. 0:18:57.600 --> 0:19:01.410 Historically, that kind of messiness was manageable. The bizarre would 0:19:01.530 --> 0:19:05.040 inevitably get around to identifying and fixing the most serious 0:19:05.080 --> 0:19:09.740 of vulnerabilities. Before AI comes along, developers have an intuition 0:19:10.440 --> 0:19:13.379 about how safe a piece of software is. And what 0:19:13.440 --> 0:19:16.800 AI does is it says those intuitions tended to radically 0:19:16.880 --> 0:19:19.480 underestimate the number of vulnerabilities. 0:19:19.640 --> 0:19:19.820 Yeah. 0:19:20.000 --> 0:19:20.660 How radically? 0:19:22.300 --> 0:19:22.840 Quite radically. 0:19:22.940 --> 0:19:26.359 The number of vulnerabilities that we joke internally that a 0:19:26.440 --> 0:19:29.050 lot of the vulnerabilities that we've discovered are old enough 0:19:29.090 --> 0:19:32.840 to vote. They have been in software for 18, 20 years. 0:19:33.140 --> 0:19:34.080 These people just never. 0:19:34.340 --> 0:19:37.160 Yeah. Just never looked. Or never had an AI that 0:19:37.690 --> 0:19:38.850 had the patience to look, right? 0:19:39.070 --> 0:19:42.369 Yeah. In the world of cybersecurity, vulnerabilities are given a 0:19:42.430 --> 0:19:46.869 grade on the Common Vulnerability Scoring System, more commonly referred 0:19:46.910 --> 0:19:48.649 to as a CVSS score. 0:19:49.330 --> 0:19:49.870 The CVSS. 0:19:50.359 --> 0:19:53.300 scale measures how serious a vulnerability is. 0:19:53.880 --> 0:19:56.000 So if you say that my piece of software has 0:19:56.020 --> 0:19:58.840 a critical vulnerability, cool, I'll go fix the critical vulnerability 0:19:58.880 --> 0:20:02.850 and then work it. But to date, we've said, well, 0:20:02.869 --> 0:20:05.450 if you've got 10 low vulnerabilities, it's kind of like, well, 0:20:05.470 --> 0:20:07.520 I could go fix it, but it's actually probably even 0:20:07.560 --> 0:20:09.300 more disruptive and risky to fix it than it is 0:20:09.359 --> 0:20:10.920 to just leave it alone, so we're just going to 0:20:10.960 --> 0:20:12.919 let it be. And we kind of, as an industry, 0:20:12.960 --> 0:20:15.360 we kind of collectively decided over the last 25 years, like, 0:20:15.400 --> 0:20:19.440 when we get these low-impact vulnerabilities, let's just leave them be. 0:20:19.520 --> 0:20:20.859 It's too risky to fix them. 0:20:22.160 --> 0:20:24.530 So any one of these things is not very important, 0:20:24.570 --> 0:20:27.210 but when you chain five or six of them together 0:20:27.410 --> 0:20:29.929 in a very specific way, now suddenly they become critical. 0:20:30.510 --> 0:20:32.850 That is one of the consequences of, now that we've 0:20:32.910 --> 0:20:35.330 pointed AI at this problem, that's one of the things 0:20:35.369 --> 0:20:37.430 that we've collectively come to this realization. 0:20:37.450 --> 0:20:41.190 We're talking about not just second-order effects, but third, fourth, 0:20:41.510 --> 0:20:45.150 fifth order. It's like chess. This one move doesn't appear 0:20:45.190 --> 0:20:47.090 to put me in any peril, but what I've done 0:20:47.109 --> 0:20:48.949 in the first round will come back to haunt me 0:20:49.270 --> 0:20:52.770 five rounds in, and by then, I've lost. There's a 0:20:52.890 --> 0:20:55.770 flip side to this, though, and that's where the story 0:20:55.810 --> 0:20:59.020 turns optimistic. If AI has made it much easier for 0:20:59.060 --> 0:21:02.810 bad actors to find vulnerabilities, it has also made it 0:21:03.070 --> 0:21:06.470 easier for the good guys to fix them. Here's Manish 0:21:06.510 --> 0:21:10.629 Sharma again, who has the massive responsibility of ensuring digital 0:21:10.670 --> 0:21:13.770 security for a major institution, Wells Fargo. 0:21:14.670 --> 0:21:17.429 We've quite literally used AI to sort of combat the 0:21:17.450 --> 0:21:18.990 risk of AI. And what I mean by that is 0:21:19.030 --> 0:21:23.800 we've developed automated capabilities using AI to be able to fix, 0:21:24.320 --> 0:21:25.920 you know, what we detect in our software. 0:21:26.760 --> 0:21:30.280 Like any competitive struggle, from a sporting match to human warfare, 0:21:30.700 --> 0:21:35.240 competition involves a constant back and forth between defense and offense, 0:21:35.720 --> 0:21:38.800 with each side having a momentary advantage. And while the 0:21:38.859 --> 0:21:42.080 advantage in software is to the attacker right now, that 0:21:42.240 --> 0:21:46.440 shouldn't always be the case. Manish says he's also seeing 0:21:46.460 --> 0:21:49.200 the balance shift with some of the new AI tools. 0:21:50.330 --> 0:21:55.210 Done the right way, architected the right way, I don't 0:21:55.270 --> 0:22:01.189 think it's easier or faster for AI to identify than 0:22:01.890 --> 0:22:04.560 to mitigate. Obviously, there is going to be a little 0:22:04.580 --> 0:22:06.860 bit of a lag between those two, but it's not 0:22:07.119 --> 0:22:09.120 orders of magnitude, meaning it's not as if you can 0:22:09.180 --> 0:22:13.260 find things in a day and it takes you months 0:22:15.020 --> 0:22:17.760 to patch them or to mitigate them. If that's where 0:22:19.619 --> 0:22:22.860 an institution is, I'd be a little concerned. So your 0:22:22.900 --> 0:22:27.440 ability to respond to things has gotten a lot faster 0:22:27.940 --> 0:22:32.140 as well. It's not one-to-one mapping between finding and resolving. 0:22:32.320 --> 0:22:39.210 Usually it's one-to-many. But using AI, you can very efficiently 0:22:39.690 --> 0:22:42.590 create an architecture where you're able to respond to those 0:22:42.630 --> 0:22:43.810 threats way, way faster. 0:22:43.830 --> 0:22:44.850 That's our area of focus. 0:22:45.010 --> 0:22:47.950 Can you give me a rough sense of how much 0:22:47.990 --> 0:22:50.870 that gap has closed in recent months? 0:22:51.190 --> 0:22:54.970 It's closing pretty fast. And it's closing pretty fast at 0:22:55.420 --> 0:22:58.139 at most institutions that I talk to. And let me 0:22:58.180 --> 0:23:01.439 give you an example. In terms of scale, you are 0:23:01.500 --> 0:23:05.750 now seeing not a factor of two times or three 0:23:05.810 --> 0:23:09.770 times the number of fixes to critical and high vulnerabilities. 0:23:09.830 --> 0:23:16.410 You're seeing a magnitude of 10x, 20x within the same 0:23:16.970 --> 0:23:22.219 window of time. So if an organization was mitigating, let's say, 0:23:22.220 --> 0:23:25.909 100 vulnerabilities, critical or high in a month, Our ability 0:23:26.250 --> 0:23:30.410 to patch that is order of magnitude faster now than 0:23:30.470 --> 0:23:31.490 it was in the past. 0:23:31.730 --> 0:23:33.750 If you are someone sitting on a mountain of open 0:23:33.770 --> 0:23:40.149 source code, of uncertain integrity, all is not lost. The 0:23:40.170 --> 0:23:43.770 same technology that threatens you can also help save you. 0:23:44.450 --> 0:23:47.040