Allie Howe: Hey, my name is Allie Howe. I am the host of the Insecure Agents podcast, and today we're coming to you from RSA. I've got Alex Stamos here with me today. He's the Chief Product Officer at Corridor and has a very notable long security career, was Chief Security Officer at Facebook. Super excited to chat with Alex today about how AI is eating security. Alex, do you want to introduce? Yourself.

Alex Stamos: Yeah. So I'm Alex Stamos. I've been doing security for a long time. For the length, basically the age of all my coworkers, I started with a Commodore 64 as a teenager doing not so legal things. Got to go to Berkeley, work on actually software security and system security there and then work for a couple of companies, start a couple companies, started iSEC Partners back then, was one of the first application security consultancies. And then since then I've been a CSO as a CSO at Yahoo, Facebook, and a most recently central one in the middle there. I took a break and I, I taught full time at Stanford and did a bunch of research work, which is how I actually met the founders of our company because they both worked on my research team.

And you know, I was one of their first checks and super excited what they're doing. So I got to join them last summer. And so now I'm Chief Product Officer of Corridor and still teach at Stanford. Just don't get paid for it anymore.

Allie Howe: Amazing. Yeah, super cool. What's Corridor do?

Alex Stamos: Corridor is a We're trying to make AI coding safe for enterprises and companies that really care about security. So we will build guardrails based upon your code base that are both prevent security flaws, but then also help coding agents build code that is specific to your security needs. One of the things we find is, you know, LLMs are actually better than humans at writing secure code for the most part, but they're really optimized for, you know, the the 49 square miles of San Francisco, right? Where if you're using Claude Code, you're starting with like Node 24 TypeScript on a blank sheet of paper. And what that's not how the real world is like.

In the real world, you've got people at Midwest hospital chains that have a million lines of old C sharpasp. net or of AG2E, and you apply a Cursor Claude Code to that. And while it speaks the language really well, what's problematic is it will have trouble understanding the security context for the 20 years of development that came before. So we index code bases, we build security guard rails, and then we plug in directly to Claude Code, Cursor, Codex, Factory, all the major coding agents, and we give it advice in real time. So as it's building things, we tell it, this is how you can build things more securely.

And then we scan the code that's being created to make sure there's no vulnerabilities before it even gets committed.

Allie Howe: Amazing. Yeah. So I met you a couple weeks ago at Reddit's new SEC event where you gave a talk called AI is Eating Security. Super interesting conversation there that I want to expand on here today. But I think you also just mentioned another point that AI is not only eating security, but it's seeing software coding agents are like people are now targeting software factories where AI agents are now writing all of their code, reviewing it. And eventually maybe the human will be completely out of the loop. Like I don't I don't know what the world looks like then in terms of the security. Also like how do we secure code?

Alex Stamos: I mean, this is a, we're just surfing this wave. If anybody tells you they know what the world's going to be like in two years, they're just lying or they're fooling themselves or they're trying to sell you something or probably all three, which you see a lot of people at RSA who are very confident about their predictions. And I'm not like, you know, we just plan it finished like a product planning cycle and we're planning 60 days out because in 60 days there's going to be something else revolutionary happening. I mean, we have obviously a vision beyond 60 days, but you have to stay flexible if you want.

And like you talk about software factories, this is like a word people started using like 6 months ago, right? And we have a number of customers who are now at the place where each engineer supervising 5 or 6 different agents. Those agents might be pulling bugs directly off of Linear or Jira, working on them autonomously generating the PR. And then human beings are, you know, doing the final merge, but in some cases without changing a single byte. And how do you do any kind of security in that model is crazy. So it's one thing again, if you're a little start up here in San Francisco, which is a lot of these folks are even if you're like a success successful one, you're a private company.

You don't have to sign, you don't have a CISO has to sign a Sarbanes-Oxley letter. You don't have to get a SOC 2 Type 2. You don't have to live up to ISO 27001. But the rest of the world has rules and public companies has rules and, and you have this crazy situation where CSO's are being held responsible. They're being told put AI into every part of our enterprise, including AI coding. By the way, we don't relieve you of any of your obligations, right? And that's an extremely difficult place to be.

Allie Howe: Oh, 100% for sure. Yeah. It's very difficult place to be a developer right now that's trying to ship fast but also securely. How is AI changing the way kill chains work? Because bugs are so much easier now to find that the models are getting so much better. So what? How is that changing?

Alex Stamos: Yeah. So we really are facing over the next at least two years, a kind of bug apocalypse in all of the existing code. You know our lives here in San Francisco, right? Like what we're doing today. If you think about it, there are probably over a billion lines of open source that our lives depend upon, right? The Linux kernel, everything in the GNU Linux stack of all the different services, that is what's keeping the power on. That's what allowing these bus to move buses to move behind us in this very dynamic background that we have for this podcast. That's, you know, all of these systems, a lot of them are running on 20 year old, 30 year old code.

In some cases. That's also certainly true for the commercial vendors, right? The the Microsoft, the apples parts of what Google has done, like the, the people who aren't build everything open source and our our shipping. And for all of that vulnerability discovery is becoming much, much, much easier. So what we've seen the last couple of months, and this is something that we've been warned about, right? So Heather Atkins, a friend of mine at Google has been warning about this for, for since, you know, I think most of last year, Dave, I tell it opened the eye. And now Nick Carlini at Anthropic gave a really good talk that I recommend for any of your listeners for security at the unprompting conference, which they just released the video.

So you can you can find, I think this morning, so you can find his video, but he talked about how Opus has now reached super intelligence in a specific circumstance in that it's better than him at finding bugs, which if you know anything about him is a terrifying statement, right? And so what's happened over the last couple of months is because Opus Forsaic, because, you know, GPT 52, the latest foundation models have hit a click above people, right? So we're now one step above the best bug hunters. And as a result, higher swaths of issues in code that has been looked at by hundreds of people is now we're finding all these bugs in Carlini's example was a bug that Anthropic found in the Linux kernel.

That's 23 years old, right? So don't tell me what you were doing 23 years ago. I was, I was professional. You were having fun in first grade or something?

Allie Howe: Yeah, it's probably like eating ice cream and being a kid.

Alex Stamos: Yeah, great. So yes, so you have no blame for this, but I do in that, you know, our industry, we've been for these last couple decades, we've been writing code still in memory and type unsafe languages in C and C++. We have been using a kind of formal verification. We just thought like, oh, we'll find the bugs and fix them. And So what we're finding now is LLMS are one step above humans and there's a whole swath of bugs that they're finding and that comes from the foundation lab company. So Anthropic apparently has thousands and thousands of bugs that they have yet verify and send to open source.

OpenAI's got the same, Google's got the same. All of them have are trying to grind and find these bugs, but it's very hard for open source developers to fix them fast enough, right? So they actually have to, if you're one of these companies, you have to ship the patches as well as as the bugs itself. And but you see this also like if you read on X or Bluesky or Reddit like security engineers and researchers are now just with Claude Code and a couple of skills are as good as the best vulnerability finders were 2-3 years. Ago.

Allie Howe: That's terrifying.

Alex Stamos: It's terrifying, yeah. And so this is going to be a big deal. And I think people are actually underestimating how big of a deal it's going to be outside of the handful of people who really work on this. Because the uncomfortable truth is that, like, I've done a lot of incident response in my career. I've done a lot of work responding to attacks from really high end state actors, right? So like the Ministry of State Security of the People's Republic of China, the SVR and the FSB and the GRU of Russia. That's the the main Russian intelligence agencies, the IRGC, the Iranian, Iran, the Islamic Revolutionary Guard Corps, They run most of Iran's hacking, the Lazarus Group from North Korea.

The truth is, is that the vast majority of companies and organizations in the world have never had to deal with the true zero day threat. They've never actually faced an adversary who had a undiscovered flaw with brand new exploit code that's never been seen before that can't be patched. Maybe out of the Fortune 500 you got fifty 6070 companies like that. If you oil and gas, big banks, big big tech companies, utility, couple other people in the defense industrial base. These are the companies where the Ministry of State Security might do a huge amount of research, find a brand new flaw and exploit, write brand new malware and then use it against you.

Outside of those organizations, people have not had to face this threat. And now we are moving to a situation where the first couple steps of the kill chain, right? So the kill chain's the term we use that we stole from the military in cyber to talk about the things that attacker has to do to break in and to be successful in a, in a breach. First couple steps are usually finding flaws and then weaponizing those flaws. Those are getting exponentially easier because of AI for attackers. So the first step, we're already at the place for the first step of the finding the bugs. The next step is you, you find, you take that bug and you write working shell code, you write working malware, you write brand new exploits that have never been seen before.

That is still quite hard, but AI is making it a lot easier. One of the reasons it's it is hard for people is that the foundation lab, the cutting edge models will not do that work for you, right? So they will find bugs in software. They have to, you know, open AI and Anthropic and Google have to allow that capability so that defenders can find the bugs, but they don't have to let you build weapons with it, right? So you cannot ask Claude Code, build me shell code. But we have these open weight models the, you know, the Qwens, the DeepSeeks, they are really 6-8 months behind here.

And so if we get to the point where the open weight models are as good at both finding and then writing exploit code. And you can go and Hugging Face right now and you can find versions of like Qwen 35 that have been jail broken and then have been retrained on all the shell code that's sort of been seen. It is not perfect, but if in six, 8-9 months it's good enough, then we're going to be seeing this huge wave of adversary groups who are not the top tier state actors, who are both lower level governments, but also financially motivated actors and some more. Guys who have used to always have to use off the shelf.

Exploits are used, misconfigurations are used. Stealing credentials are now going to have the kind of cyber weapons that only the US and Israel and Russia and China and a couple other countries of that category used to have five years ago. That is not good.

Allie Howe: No, that's. We're not ready as a industry to protect against that. Yeah, that's wild. It's wild to me that like so many companies have never faced a zero day or never had to worry about this threat, now do. And they've got very, maybe they go through their incident response like exercise once a year as part of like a compliance exercise and they're gonna be super underprepared to be able to deal with this. How do we or how does the average company like go about dealing with this? Like what's like the first couple things they should do?

Alex Stamos: Writing their own software. So the first thing is don't make new bugs. And that is this is one of the good things with AI era is that LLMs are reasonably good at writing secure code that corridor we build a product to make it better at writing to your code, but like they're still usually better than your your your average human developer. And so the first thing is for the stuff that you build yourself, don't create new vulns because those will be much easier for for people to find an attack, even black box, even if they don't have your source code. There's a lot of people automating the, you know, we already have a bunch of commercial providers, but the capability for that to be done by adversaries is just a little bit behind of them automatically finding vulnerabilities and explaining to them, especially web apps, line of business apps, apps where are specific to companies that they're building in house.

So first, don't make it worse, right? Bend the curve and that's totally doable. The second thing is we talk about the kill chain, those first steps, the discovery vulnerabilities and then eventually writing the exploits and the writing the rest of the malware, those are going exponential for attackers. The rest of the kill chain, a bunch of those steps do get better with AI, but just like geometric, right? And So what you're going to have to do, and this has always been true for if you're one of those 50 companies, like I was the CISO of Facebook and we actually face that. Like we had 0day used against us by APT 17, which is a Chinese group.

We had a number of fascinating issues with, with big governments who are attacking us. And so we had to build lines of defense that assumed that our front end systems were able to be compromised, right? That is a very different way of doing security. Because the the truth is, is most companies believe that vulnerability management is going to work for them. They believe that if I patch really fast, if I fix things, then as long as that system is totally configured correctly, totally patched, it's probably impenetrable. And we're going to have to invert that to assume that every system you have can be penetrated by an attacker.

And that we have to pick up is the signs of that penetration, the signs of their exploration. And you have to react really quickly because while humans are still going to be in the loop for some attackers and some others, especially the financially motivated 1, they're just going to completely automate because they're, they're just in a, they're in the business of, of having 10,000 potential victims. And right now a ransomware group might only ransom 10 of them, right? Because like you have to exploit them. You have to do East West movement, you have to get on a bunch of machines that takes a bunch of human skills to go do.

If you can automate all those steps in the ransomware playbook, then you might go from 10,000 victims to 1000 victims. That's 100 times more money. That includes the negotiation. This is also a fascinating thing is that you now find people doing ransomware negotiations with bots because it used to be ransomware groups would have to find somebody with enough English skills to do a like a high stakes negotiation for hundreds of thousands or millions of dollars. And now you just have a bot do that for you. And so anyway, I think as a defender, you have to be, you have to have great visibility in your network.

You have to have all of your logs in one place. You have to be looking for signs of exploitation that are not tied to specific bugs or specific plates. And there's a variety of ways you do that, you know, with, with EDR and variety of other products. And then you, you have to have automated response if, if you have to wake up a person at 3:00 AM and they have to open their laptop and log in and go through and like figure out, oh, God, what's going on. OK, yes, I approve. My AI agent doing something radical like turning off an account or shutting down a container, that's too late, right?

Because if that malware is being driven by AI, it's only going to need a couple of minutes to do that kind of internal exploration to pick out an exploit to make the next jump. And you're already behind the ball. You're chasing them. And so the automated response is actually a really interesting but so a difficult thing as a CISO or CIO to feel at all comfortable with.

Allie Howe: Yes, really excited to dive into the autonomous like response and how we enable that to be able to defend against this. But also super to touch on, you mentioned that any new software that we write needs to be secure and we can use AI to make sure that it's more secure. So like using tools like Corridor or something else to make sure that when the new we write is bug free. And I feel like more companies are going to be like leaning to that route because I'm talking to other people that are developers and they were saying, I don't know that I'm going to use open source packages.

If I could just like write this quickly with an LLM, maybe I'll just use less open source over time. Is that one strategy? Also, maybe you know open source won't be as used as much anymore, so we should just write new code that can be scanned by AI.

Alex Stamos: Yeah, that's a great question. I mean, I mean, there's certain open source components that we're just going to have to live with. Like people are going their own kernels, they're not their own TLS stacks. They're not going to write like, you know, replace nginx they're not. So there's still base stuff. Now, fortunately, the the really important parts of open source generally have lots of maintainers. And to the extent that there's any collective action happening, which is not fast enough, but to the extent that there's any collective action happening, it's on those components, right? People are scanning OpenSSH, they're scanning OpenSSL, they're scanning nginx, they're scanning the Linux kernel.

And I think this becomes a really interesting question for this huge explosion of everything, basically an npm, right, of all the stuff you use, the open source you use. If you're building a web app, which is the standard thing has become, I bring in all these different components. I have this humongous dependency tree and that is becoming a huge security issue for a couple of reasons. One because you can have the flaws in it and they don't get fixed and if somebody finds a flaw in one of those they can hit thousands and thousands of victims. The other thing we keep on seeing is these supply and chain attacks through package managers again, npm, where one person's account gets taken over and that package gets updated and that package has an auto run script in it and then everybody who updates their accounts get taken over and then you have these like massive worms.

We just had a big emergency last night along these lines is like LLM, which, you know, kept a lot of us. It's it's always fun when these things happen during a security conference. Yeah. Because you, you're at dinner and like everybody's phone is exploding. It's like everybody is, is talking back to, you know, the less lucky people who are not allowed to come to that dinner to tell them what to do and then they go back. Yeah. Yeah, exactly. So open source, those kind of libraries do, are going to pose some interesting issues. And I think you're right. Like, people are going to possibly rebuild it, of course.

Like if you ask Claude Code to rebuild that, if you ask Cursor to rebuild it, what are they building it on? It's probably on the trained open source. If you ask it to exactly replace some kind of existing library 1 to 1, the odds of it having a bunch of code from that library is actually quite high, right? Based upon like how these things are trained on all of GitHub, for example. But yeah, I mean, I do think both the dependency issue and people, you know, the fact that some of these things are not going to get fixed, they're not going to be maintained, is going to be a big deal.

Allie Howe: Yeah, makes sense. And it was at the Daytona's Compute conference recently. There's Sandbox conference and I got to have this conversation and basically one thing I learned was like the boxes are not created equal in terms of like partitioning between how much of the VM or virtual machine like do you actually like get to sit on like you own the whole thing? Because if there's these one relates in Linux from 2003 and you are sitting on that box with somebody else and they get compromised, then they can expand into you and compromise you. So you need to be choosy about how you're running your AI code these days too.

Alex Stamos: Yeah, absolutely. This is the interesting kind of like finding vulnerabilities and hypervisors or the kind of thing that literally only a couple dozen people were doing 10 years ago and it was big like when cloud first got big again. Now you're probably in junior high or something. When cloud first got big, there was all this discussion about the multi tenant security and there were a bunch of bugs found, right. But the really important open source hypervisors, the KVM and stuff got better, the hardware support got better, and we've all gotten kind of like used to the idea that we're finding out one, like you said, sandboxes are not all the same in that a lot of them poke holes intentionally for functionality.

And so a lot of people are running quote UN quote sandbox code that is not sandboxed at all. But the second is I think that's exactly kind of research reverse engineering ring 0 ring -1 like low level assembly code in a hypervisor that is interacting with the very complex virtualized memory management. You know, the mechanisms allow you to share PCI Express devices across versus these are things that are like one, have a bunch of rabbit in them from Intel and AMD. But that's the kind of research that you would not see from anybody but the top, top public researchers and the top nation states, right?

Like I'm sure US Cyber Command has some great hypervisor brakes. I'm sure the Ministry of State Security has great hypervisor brakes. But until recently, I don't think say India and Pakistan did right. And from a geopolitical perspective, this is also one of the interesting things that's going to happen is that we're very obviously US centric and we talk about breaches that involve the US, but there's all kinds of pairings of countries around the world with, you know, long conflicts that now play out in cyber. And so like Indian, Pakistan, Iran and Saudi Arabia. And these are the kinds of places where now their state actors have a whole nother suite of capabilities that used to be reserved for the big guys, for the Chinas and the Russias and the US and the Israel's.

And so the fact that all those people are now going to be finding these things is also interesting because those will both be used in attacks, but then also be found in the wild. And then so like we're right at the start of that. But I, I expect as of right now, because governments have money and they can pay for the the cutting edge models and they can pay for their own AI training internally that you're already probably seeing a significant upgrading capability by what used to be the second and third tier state actors.

Allie Howe: Interesting. Yeah. So what I've gotten out of this so far is like we should definitely be scanning all of the new code we're creating, making sure that we are also like scanning any code we've been using before, knowing what we're vulnerable to, but also assuming breach. So let me make sure our agents have the hard boundaries in place to make sure that they're not going to do the wrong things in the event of their compromise or their systems. And if they're compromised, responding

Alex Stamos: challenges here to to try to respond to that speed, you have to have AI agents doing it for you. And that is a very scary thing as a CISO, you know, you should not have any agent. We're just like, oh, here's my, you know, admin account to Google Workspace and here's an IAM account that can do everything on my production AWS, right? What you want to do is you want to build a, you know, Simsor agentic system that has deterministic levers that they pull right? Here are the 10/12/15 things that I tell you, my agent you're allowed to do. And then you want to train them on runbooks that have those levers.

Now the good thing for most large companies is if you have a SoC, you've already done that. Because those are the same levers you give to your tier one SoC people. You don't take a tier one SOC hire and then say like here's, you know, global admin on my tenant or you know, here's full control my AWS instance. You create specific security responses that they're allowed to pull those levers. And so you start with providing those levers to the AI systems. But where we're going to end up is much more in like a open clawed kind of model where these agents have the ability to write code on demand and to create new capabilities on demand.

And I think that's going to be necessary because you're going to have attackers being innovative and you're going to have an AI agent that's doing defense. Say, I see this attacker moving from machine to machine. You have not given me the proper lever. I will now within some kind of boundaries, create a new lever. And so figuring out that is both a security issue, but it's also a significant alignment problem of how do you align these AI agents to do security response in a way that would be innately knowable to a human responder. A human responder knows don't create more damage. You know, I'm not going to shut down the entire company.

I'm not going to leak data. I'm not going to make things worse. I'm going to try to only make things better. And they also know when to ask their boss, right. But an agent doesn't know those things unless you train it in that. And I think we're going to have both, you know, really great stories of AI agents saving people and we're going to have some crazy stories of them completely blowing companies away. And that's the other thing, like both from the bug apocalypse and from AI response is resilience is going to be a huge deal is the ability to recover and to survive both attacks and the possibility of your response response spots going nuts.

Allie Howe: And that makes sense. We need AI agent defenders to help us out and especially like respond at speed. Your humans are not awake at 3:00 AM, but your agent can be and ready to go

Alex Stamos: I. Mean we're going to be in a couple of years is going to be normal for human defenders are supervising AI agents are doing defense and the attackers are supervising the AI agents are doing offense, right. The humans will just be the executives say no, try this, try that. These are the kinds of targets I want on the attacker side, on the defender side will be saying this is what I want you to do from a defense side. These are the tools I'm giving you. These are the parameters you can operate in. Here's some new intelligence that we were able to get, but it's all the work should be being done by the bots and we'll just be their bosses.

Allie Howe: Yeah. No, that totally makes sense. But I wonder like how many companies are doing that today or how far away we are from that? Because what I'm seeing is that a lot of agents are stuck in POC mode where they're maybe they're doing, they're connected to one thing, maybe it's their Google Workspace account, but maybe it's not the real Google Workspace account. It's like we don't actually trust our agent to be connected to the things that matter. But they have to be like you were saying, to be able to do meaningful work, to be able to respond at speed. They need to be able to maybe rotate credentials or be connected to high risk systems, have all that context so they can actually take meaningful action.

But that's super scary from like an authentication perspective to have that like that power. So how do we give our agents the autonomy and the capability to actually do that meaningful work, but still have security in place so they don't do the wrong thing, they don't create more damage like you were saying,

Alex Stamos: I. Mean there's no perfect way to do it right. So if you're, if you're a vendor who's building these tools, So my recommendation is one, I think modern security or any enterprise software has to be modular. People do not want to be product managed too much anymore. What they want is they want your product to do what it does really well. And then don't spend all your time on like this is exactly how the flow has to go. This is exactly what our dashboard looks like, all that stuff because they can find code all that right. What they want is like, what is the core thing you are good at?

And then the second is if you do anything agentic, you have to design your system to build, to be able to build trust, right? So where I could slowly turn this up, where I can test it, where I can simulate, where I can say, hey, how would you act in this circumstance? And so like last year, I was at 7:01, we automated our entire SOC. And one of the good things about, you know, security operations being something you automate is that at any reasonably sized company, you will have thousands of examples of tickets that have been handled by humans that you can use as your training set.

And so that both allowed us to teach agents what we want to do, but then also test them because we were able to replay real incidents and say, how would it have acted? And when it does something wrong, we're like, no, that's not how you handle this, right? When this happens, you shut down an account, you do not shut down the data center, like things like that. And so that's part of if you're doing it yourself, it's a bunch of work. If, if a company's doing it, they need, they need to fundamentally think about how people are going to build trust and to have a mechanism that allows you to slowly turn up and to simulate and to, you know, to do these things so that you can get to a place where you trust turning over that power.

Because right now there's a bunch of companies here at RSA where it's like, oh, just give me full control of all your stuff on day one, no problem. It'll be fine. And that's just not going to happen.

Allie Howe: That makes sense. Yeah. We need to creep up that autonomy curve like it early. We're not just going to jump from static POC to a Waymo and overnight. So that makes sense. Yeah.

Alex Stamos: And you just have, I mean, again, it's the pressure, you have this cross pressure on CIOs and Cisos of boards are telling public companies, CIOs and Cisos, we want to get rid of 20% of our employees. We're going to use AI to do it right. And so I want you to do everything possible to enable our people have AI. By the way, we, we want 0 breaches and 0 violations of trust. We never want an intellectual property leak and, but just make that all happen, right? And so, you know, it is a tough time to be like a public company, CIO, CISO. It is very hard for them to say no to like all these crappy AI enabled products that are out there.

It's hard for them to say no to giving a huge amount of autonomy to their employees. On the flip side, they still have to sign the same letters. They still have the same compliance requirements. Nothing has been loosened, and none of the standards take into account the fact that you're doing these things with AI. So if you want to help those folks, then you need to help by one. We need to build capabilities for people to have safe, fun experiences. So all the major CIOs are dealing with shadow IT problems because at home you get to build your, you know, you're open claw, you get to build stuff with Claude Code.

Like this is fun. And then you're going to work and it's like you're in the Flintstones, right? Like, Oh my God, I have to type every line of code. This is insane. Why, why do I want to do this? And so if if you as a company, you're not providing people with kind of delightful AI experiences, you end up with a huge shadow IT problem. But there's not enough vendors who are making it easy to provide those delightful experiences in a way that's controlled in which you can build trust. And I think that's, that's going to be a real opening for all that, you know, non security companies as well going forward.

Allie Howe: Yes, definitely. That's a lot of like really great takeaways in terms of what we should be focused on, like the apocalypse is coming. You should be reviewing and scanning all of the code that you're writing. We need to enable autonomous defenders to actually help us and have they need the capability, autonomy and security be able to do that. What else is on your mind in terms of forward-looking for this year? What's exciting right now for you,

Alex Stamos: I mean. The exciting thing with with AI coding and what, you know, one things we're trying to enable with Corridor is also for the first time ever, we have the ability to refactor major parts of code to get security flaws, right. So sometimes when you're a security consultant or a CISO, you look at a piece of code and you're like, there's just no way to bug fix our way out of this. We should totally rewrite it. And that used to be completely impractical for almost everything. And now, like if you've got millions of lines of C++, turning that into Rust, which used to maybe cost you $10 million is now 10s of thousands of dollars perhaps right, of at least tokens.

And then depending on how much autonomy you're able to give these things, not a ton of time for your developers to oversee it. That is incredibly powerful that now companies can make that decision. And I think that's that is something that's exciting me over the next couple of years as the software factory model becomes adapted and the agents are able to run longer term on these long, long projects that we're able to find ways that companies can massively up with their security by completely replacing or refactoring their code to get rid of entire classes of issues.

Allie Howe: Saying no. Thank you so much for taking the time to come out today.

Alex Stamos: Yeah. Thanks, Allie.

Allie Howe: In the middle of RSA, yeah, no.

Alex Stamos: Happy to do it, yeah.

Allie Howe: And then people want to connect with you or corridor, where can they find you?

Alex Stamos: Our websites corridor dot dev. You can e-mail me, Alex at Corridor Dev if you want, or find me on LinkedIn.

Allie Howe: Awesome. Thanks, Alex.

Alex Stamos: Thank you.