Manoj Nair: Everyone wants to become an agentic AI company, not a software company. So, you know, as AI eats software, they're like, "Do we know what we're, you know, having in our stack?" This whole notion of, you know, the fox guarding the henhouse as a security principle. Architecturally, it means the generator cannot be the validator. No one's ever brought that up before, even as a question. In the AI era, it's become a question. "Hey, you know, I can use AI to secure AI, and so do I need a separate security offering?" Can we build a system that allows this AI security engineer to operate the security of this complex agentic, multifaceted pain points and very fast-moving ability to make decisions on the fly.

Allie Howe: Hi. Welcome to another episode of the Insecure Agents podcast. I'm your host, Allie Howe, and today I'm super excited to be here at Snyk headquarters, NSF, on the backdrop of AI Engineer. I have with me today Manoj Nair, the CTO of Snyk and also the chief innovation officer. Manoj is actually speaking and giving the opening keynote on the security track which Snyk is heavily involved with and helping put on at AI Engineer this week. So super excited to dive in and understand more about how, as a CTO, Manoj sees this world changing from application security to more of agentic security, and also to get more information about his talk that he'll be giving here at AI Engineer.

Manoj, would you like to introduce yourself?

Manoj Nair: Sure. I think you got it. Hello, everyone, and I'm the CTO and chief innovation officer at Snyk. We're doing a bunch of cool stuff, but happy to have this conversation.

Allie Howe: I'd love to start with your keynote that you'll be giving at AI Engineer. I actually just came from AI Engineer myself, super excited. Big week ahead for that. Your talk is titled Through the AI Fog. What's the fog that you're seeing, and what's the key architectural decision that you think teams need to be making?

Manoj Nair: So really three things on the fog. What I, I, you know, I spend a lot of time with our customers and our customer base. We have about almost five thousand customers, but half of the Fortune two fifty, so most of my conversations are with our larger customers. And they're really stuck in between, you know, autonomous attacks being real, yet, you know, so AI is being used for that at the same time as hardly also, you know, claiming to be the salvation and the fix. And at the same time, they're all adopting agents. They're not entirely sure of what the agents do, what they produce, and how they behave.

And then everyone wants to become an agentic AI company, not a software company. So, you know, as AI eats software, they're like, "Do we know what, what we're, you know, having in our stack?" And so if you put all of that together, how do you actually cut through it? And, and, and part of the architectural premise, you know, I've been through so many different generations of, I would say, technology eras. This whole notion of, you know, maybe, maybe said more simply, the fox guarding the henhouse as a security principle. Architecturally, it means the generator cannot be the validator. No one's ever brought that up before, even as a question.

In the AI era, it's become a question. "Hey, you know, I can use AI to secure AI, and so do I need a separate security offering?" And so there's a lot of time trying to disambiguate what that means for security professionals.

Allie Howe: That makes sense. Yeah, I, I feel like that, kind of touches on the notion of, like, software factories and the verification that is behind enabling a software factory. 'cause if you can't verify the work and tell, like, either this work was done correctly or if this work is even done, if a stop condition has been hit, then you'll end up with infinite loops and, you know, token spend that's, that's unproductive. So yes, like verification, I feel like is a huge part of that, for sure. Yeah. And one thing I noticed when I was doing some research on this, and people were saying the model that's doing the loop shouldn't be able to decide when the work is done or when- Yeah... it's finished.

You should have some sort of external party be the validator. So that kind of vibes with that. Yeah.

Manoj Nair: I mean, look, historically it's the human-- Even if you did automation, the human was the validator. It doesn't scale in the agentic era. So what do you do? Do you just have a different model, or do you need more than that? And our research shows, we actually today just released this benchmark from r- report from Snyk along with the benchmark. It's called WangBench. And what it showed is, you know, just the fact that a combination of, of you have to use models, you have to use different models potentially than the one that produced it, but you also have to combine it with deterministic data. Otherwise, I mean, I think one of the points in the research was it took five, five runs with the model to find what we knew was already there in the software.

Now, is it five? Is it two? Is it 50? How do you know? How do you know that you actually did everything? So it's that combination, you know, it's like the power of and, right? Like, you have to use models because models are really good now at finding some of the things that they might be producing. They're good at finding it. Contextual analysis and knowing the full context. Yeah. Combine it with determinism, combine it with security research. As you know, one of my customers told me last week, "Look, it comes down to the harness, the context, and the operator." And maybe the operator can be allowed to scale and, and, and have a minimal role if you have the best harness and context that combines- models and, and determinism.

Allie Howe: Yes, very interesting. And I feel like you get a unique perspective with the type of customers that you have, being large enterprise customers you've had for, for quite a while, and those companies can't, you know, go fully AI native overnight. Yeah. So how... What's your advice for a large company like that, that might be listening of how do you start inventorying the agents that you have, getting a handle on, you know, code generation where code generation is now produced faster than humans can review it? I mean, what's the, what's the first step there?

Manoj Nair: I, I wanna separate like, you know, a couple of different things because it does, you know, this is part of the fog. Yes. All of it together gets super complicated. So, you know, it's really three conversations I end up having. Almost everyone, 100% of the customers worried about autonomous attacks and AI being used for those, right? So all three frontier labs have been leveraged by nation-states and other attackers. You see a lot more supply chain attacks. In our customer base, one of the data points I'm gonna use in the talk tomorrow, we've seen like basically quarter over quarter, the hockey stick of, of vulnerabilities that are not remediated.

It's like two X in a year. That's real. That's in the enterprise. And previously you could say, "You know what? I'm gonna fix the critical vulnerabilities and the high dep..." It doesn't matter what risk scoring you use, even if it's a more complicated one, no one fixed everything. One of the things that has changed now is autonomous attackers. An agent never sleeps, so you're able to chain low vulnerabilities and, and actually penetrate into these organizations. And so that's one big topic, and there's probably multiple things we can talk about there, and we can unpack that. The second one, as you said, is, is coding with agents and, and, you know, obviously citizen developers are now there.

And so it's not just your, your devs. Devs are now orchestrators of agents. Citizen devs are producing code. What is the agent actually producing in terms of the artifact? What is it doing in terms of behavior, and what is it consuming in terms of the environment, things like Skills MCP server? So that is kind of second bucket. And the third bucket is obviously everyone producing software now is producing an agentic application. Very few people are saying, "I'm gonna build a traditional SaaS app." So what is in that? How do I know that that's secure? How do I know what is the risk? And, and those are three separate conversations.

They're all connect-- intertwined-... but they end up being, you know... There's a layered risk understanding. A CISO or security team will understand. Everyone understands the first one. I feel like there's more education required on the second and a lot more re-required on the third.

Allie Howe: You know, it's amazing that you're seeing that like the 2X hockey stick growth- Yeah on the amount of vu- vulnerabilities. And you think now we have all this technology of like, a lot of people are just like, "Well, what if I just, you know, point Opus at my code base and figure out like, you know, what vulnerabilities exist with the..." You know, everyone's rolling their own security harness now it looks like- Yeah with Sentry did it, Vercel did it. But there's so much more beyond just like finding it, the like getting rid of the false positives, connecting that to your system. And I feel like at Snyk you all probably are very, you know, well positioned for that in your, you know, latest offering, like Evo.

How do you stitch together all that context to figure out like what's worth investigating?

Manoj Nair: Yeah. I, I think it's Maybe just taking the first problem, right? Finding... Now we, we had this partnership with Anthropic, and I think I like Jason Quentin's quote in there, like finding was never the problem. It's really how do you actually fix these issues right in the loop that software is being produced. That is the difference we're bringing, right? And so just take the first autonomous attack problem. You have to remediate all vulnerabilities. You need a zero backlog. If I go to any enterprise of any, any kind and size, they'll go, "That is impossible." Some will even say, "I don't have enough compute in this country that, to do that.

That's the number of vulnerabilities we're sitting on." And so you have to think about these are apps that were built, but the people who wrote them are not even around. And that's the state of most enterprises. So you have to be careful. Is this change going to break the app? What is the layer of fix I can do that is going to give me much more assurance that I'm making it safely? Because security teams are not the ones fixing it, it's the devs who are fixing, so no one's around who's doing the fix. We have agents who can do a fix. We have skills that can provide agent decoding tools, the details for the fix.

It's that level of thoughtfulness that is required on how do you carefully fix. So we have been able to take companies to zero backlog. Like LabelBox is one of those. They're a data labeling provider that customers are Anthropic Open AI and all of that. For, for obvious reasons, they couldn't have any vulnerabilities in their supply chain, so they had to go to zero backlog. So how do you safely do that is one part of the problem. The second part is how do you prevent new things from entering? Because if, if it's two X and this hockey stick continues, and it's mostly agents producing code in most places now, you're gonna have to figure out how those agents don't produce, you know, like fifty percent of the code cannot be insecure.

So that's the prevent loop where I could tell a dev, "Here's something that's a SQL injection" or, "Don't use this package." They may or may not have actually followed the advice. Turns out, if you actually tell the agents properly at the right checkpoint, they do follow the advice. So there is light at the end of this tunnel. For the first time, I feel like you can secure at inception. You can secure the output. But if you're not careful, agents are pulling, let's say the Axios package. Got it. They're pulling that package right at the moment, even if it's six minutes to find the vulnerability. They can pull the package in those six minutes.

So, so how do you prevent? How do you make sure they're only pulling down known healthy packages? And then their own supply chain, right? It's, it's... We showed in our research that skills and MCP servers were all, all had their own architectural issues that are different from typical software issues. You had these toxic flows, toxic skills- How do you make sure that the supply chain of the agents is secure? 'Cause without that supply chain, they're not powerful. Agents can do work because they have access to MCP servers, to the enterprise data. Because they have skills they can execute. So it's really that has to be secure.

And then lastly, behaviors. I mean, no one wants a Pocket OS attack. No one can actually tell you what will prevent that. Yeah. So you have to constantly see what is the agent actually doing that could be risky, and steer it. So it's complex, but it's really unpacking that. And you asked about Evo, it's really helping people, the, the security engineers, to become like the AI engineers we're gonna see at the event that we're talking about. The reason we sponsored this tab... track is you need AI security engineers who can be 10X, just like the AI engineers are 10X engineers.

Allie Howe: Amazing. Yeah, no, that makes total sense, and I, I think what we touched on earlier, like the software factory needs verification. Yeah. Having those AI engineers present in the rooms where the loops are being constructed or the software factory is getting constructed, and being able to add things into your pipelines where code can actually be patched at inception is huge. Otherwise, you end up with code that is getting generated faster than you can review it, like you mentioned.

Manoj Nair: Yeah. I think that this is the, this is the difference between the prior eras, right? We-... we disrupted AppSec with dev security, so we've shifted it left. I think now it's like even that's not good enough. You have to shift it way into the generation loop, and then you have to use models to protect, but you can't only use models. So-... it, it's a denser conversation than people have had. But when you really break it down- There's really, you know, if you, you can follow this and you follow the right architectural principles, then you can move fast. Yeah. Then you're able to actually get trusted output and speed without compromising on, on security.

Allie Howe: But there's just, there's so much to think about- Yeah... now in terms of like, you know, the supply chain security, the, you know, putting the fixes now at code inception. But also, you talked about behavior as well, which is, you know, runtime security. That's a huge-... like landscape. Yes. And I know a lot of people are used to and have been using Snyk for so long, just as like an AppSec security provider. But now you all have expanded so much with Evo, and I'm sure that maybe some people haven't caught up or don't realize. Like-... what is Evo and what is the shift that you all made from AppSec to agentic security?

Manoj Nair: So a-as we were talking about this problem, you can see there's a lot of dimensions of this. And so our realization was to really be the, you know, like the separation of the validator and generator at the scale of the set of problems, and to enable this persona, you're gonna need a different architectural principle. So we looked for where in our day-to-day lives do you have very complex systems, and the operator has to be trained in principles that are, you know, being able to operate those complex systems. And so you think about fighter pilots, and they're running, you know, a fi- a fifth generation, you know, plane.

And how do, how are they trained? They're trained with the OODA loop principle. So you got observe, orient, decide, act. That was the core behind Evo. Can we build a system that allows this AI security engineer to really be that very powerful operator to operate the security of, this complex agentic, multifaceted pain points and very fast-moving ability to make decisions on the fly? Technically be-- the layer below that is, hey, you're gonna have agents doing security. That's a given. You cannot have, you know, the normal systems that were just rules-based. They do not scale anymore. So you need, you need agentic systems. You need to be careful for all the reasons we talked about.

So what is it? You're building a harness, you're giving it enough context. We have data that, you know, it's very carefully modeled to be able to, you know, provide these agents the context required. You can use multiple models. We have access to frontier models, OnGuardRail models, all, all of these open-weight models, tuned models. So harness multiple models, context, what else? So that agent can do something very specific. But this agent, this, this complex agent needs to interact with some other agent. You almost need the one plus one equals three. Yes. Hey, I found something here. I did a threat model, and then around here I found something else, and being able to correlate that.

Let's say I did a adversarial attack agent, those two working with each other, you need an orchestrator. That's Evo. So Evo is basically this agentic security orchestrator that is able to orchestrate multiple different agents taking care of these different pain points so that the operator is a 10X AI security engineer who can actually keep up with the speed and sprawl and the breadth of the attacks. And then it doesn't have to be just our agents, it can be somebody else is building a great identity agent. How do you tell it I found something here that is miss-- is over-permissioned, let's make sure that it gets the right permission.

So it's not just about... Like, security is a team sport. We built it, so this can be open.

Allie Howe: Wow, yeah, that's amazing. That's like, that's really cool. And I feel like there's so many people I know are building security harnesses and building their own security tools, finding all of this context that they weren't able to before. But I've seen no one do the orchestrator pattern yet, where you can bring your own agent and the agents that you have as well under one umbrella and be able to discern new, new patterns, new holistic, like, risk across the entire organization you might not have been able to see before. That's a, that's incredible.

Manoj Nair: Yeah. And that's the, that's the vision. Now, obviously it's a very, you know, we, we laid out a pretty long-range vision. We're slowly-- We did this last October. We felt that the security conversation was not even being had in the AI realm, so we created this AI security summit with the folks at AI Engineer, Worlds Fair, and companies like Keycard and many others. And so that's come a long way since that vision. We now have multiple, multiple modules, or call it agents of Evo for various use cases. The orchestrator itself is also progressing, but, but yeah, this, this North Star is, is appealing. This is why we've had a lot of enterprises rapidly adopting it.

It's probably the fastest product I've ever had a, you know, part of being. And, and it's because working with customers through these pain points-... and solving them without it being just, "Hey, this is just our proprietary way. It's just, you know, we're not gonna be using models. We're not gonna..." No. We're very much about let's bring the community along, and let's bring the ecosystem along, and build it with it.

Allie Howe: Amazing. I mean, I feel like that's all, a rising tide lifts all ships and all of us working together. And so I'm excited for, like, AI Engineer as well, and some of the events that are happening around AI Engineer this week. You know, lots of people in the same room, and I feel like that's really, like, the power of, like, these events and what's happening currently in the industry of, like, we're getting security and developers in the same room now more so than ever because you really, you can't develop software anymore without including security in the loop.

Manoj Nair: Yeah. I think, I think in the, literally in the roo- loop and in the room, right? Yeah. And so that, that's, for us, it's ten plus years of vision and, and the, you know, the premise behind why Snyk exists coming to reality. And, as somebody said, like, you know, we're, we're literally in ground zero of the blast radius. And, and a lot of people said, "Oh, you know, all these things are gonna go away and, and they're gonna get, you know, disrupted." W-we see a full, like, turnaround in there, like in this, in this post-Metas-... and cyber model world that our customers are living in.

They're like, "No, the original premise is even more important," and they're big... You know, you had to do everything there. That was a debate in the past. Security didn't have the permission to go and say, "I need to shift left. I need to go do this. I need to fix all these vulnerabilities." They were considered the party of no, and now suddenly, nope, we gotta do it. Then there's new risks. And slowly getting people to understand the way you move faster is to build, you know, the guardrail right within the agentic loop, not after the fact. It's not a guardrail, it's a steer. It's allowing you to go faster.

We're not the brake, we're the throttle. So that's, you know, how do you move fast? You need to be able to throttle. And so that's the, this change in perception is how, how I think they're becoming much better of a partner. Also, most, mo-most, I mean, they don't, not even like, I would say modern age post-AI native companies. These are enterprises who have been around for a long time. They've embraced the power of, of AI. They're like, "Yes, we will also use AI. We will use agents to secure agents." How do you do it best versus pos- you know, them trying to build everything themselves.

That's the partnership we have, yeah.

Allie Howe: What's something that you're looking forward to or, like, do you think the industry needs to evolve into to continue this momentum?

Manoj Nair: I think there, there's a few things, right? One of the things that, you know, I, I, I said earlier, but having been through nation state attacks and all that, like the biggest, you know, power is when the community comes together, when companies work together, industry and, and the government. And I think there's a lot of noise about this. Again, as somebody who, you know, was at RSA, ran the encryption business, I understand, you know, export controls and all that. I think we just need both corporations and, and, and, you know, the AI model companies are doing a lot in front of security now. I think knowing that it's a partnership is the biggest thing, and that is happening.

So that I'm, I'm really looking forward to what I would say is a good start, where it's not the frontier labs thinking they can do it all on themselves. It's not a fight between the existing companies and the labs and nation states. It's, you know, the, the Five Eyes just released a report, the the, you know, all of these intelligence community leaders in the US, UK, Canada These attacks are coming faster than people thought it would. So now is the time that collaboration becomes super important. And I think that the more you are open about it, and the more open systems are there, and the more open source is actually thought of and cared for versus forking open source, you know, just because a few companies know about vulnerabilities.

Like, there are bad patterns happening right in front of us-... and then there are good patterns. And it's like the more people understand that it's a team sport, that working together we can go much fast- further and those green shoots really coming fully to life means we can tackle some problems we've not been able to tackle for entire generations. So that's the positive side of it, and the negative side is, you know, the winner-take-all and-... you know, we're gonna do everything, and we're gonna hold on to certain things for certain people. Like, that's the failing pattern. So more, more community, more partnerships, more, you know, collaboration, more understanding that it's gonna take all of us together to solve these problems, that's what I'm really looking forward to.

Allie Howe: Yes. No, me too, and that definitely really resonates 'cause I've been following, like, the identity community very closely, and there's all these advancements with ID Jack to improve, like, some of the problems with, like, OAuth islands and all of that. But there's new protocols like AAuth that are coming out and new standards around, like, runtime, agentic runtime solutions, and it really takes all of these same people, like, in a room to push the industry forward. And we're seeing that across not just identity, but all aspects of security- Yeah... like, like you were mentioning. So yeah, super excited for the work that's continued to be done, and I feel like it's super urgent and needed work too.

Just what, what you were saying, like all of these companies that whether you're accustomed to having to worry about zero days or not, like- Yeah there's, there-- Some, all these AI-enabled attacks are something that every company needs to worry about now, and we can no longer react at human speed. We have to react at machine speed. Yeah. So we have to give agents the security, autonomy, and capability needed to actually be able to take action. Yeah. But you can't do that without an AI security posture in place.

Manoj Nair: 100%. Very well said.

Allie Howe: Is there anything else you'd love to share with us today? Anything exciting going on this week?

Manoj Nair: There's a lot. I mean, the thing I'm most excited about in addition to having the first security track at the AI engineering-. I mean, this was a... We came out of last year's eng- event saying, "This was so great. Three thousand plus people.". Amazing conversations. No security conversations. So the fact that that's happening-

Allie Howe: But in 12 months everyone's like, "Yeah, of course that's happening."

Manoj Nair: 12 months ago, no one even thought that that was missing in the room. And so that partnership and the moment, super excited about that. We have already start-- done, I think to date, I don't know how many, like hundreds of people have gone through like AI cer-security engineer certifications. So it's not just AI engineers, it's the specialized AI security engineers are getting certified. Super excited about that. And, and the kind of conversations we're having, you know, tomorrow and in the track, I think, you know, that is so good to see it come to true, right? We created this AI security summit and community, so I almost think of it as that was a partnership with the AI engineer.

Here we're bringing that tent into this tent so that it, the much broader AI engineering community- is able to see how important having security in the room is.

Allie Howe: Yes. And I feel like that's something that's very unique about AI engineering. It really excites me also, 'cause it's not just like RSA where it's just- Yeah... just security people, or it's just a developer conference. Like it's everyone in the same room.

Manoj Nair: Yeah. I think we believe everyone's a builder in this era. And really our, from our vision perspective, it's like, you know, unleashing innovators to build securely. That's our, that's ultimately the vision for us.

Allie Howe: Yes. Amazing. Well, super cool. I'm super excited to continue to follow all of the advancements that you put out there, and really interested to hear more about how you're helping some of these larger customers that are, you know, trying to adopt AI right now, and really helping them actually, you know, be the reason they're able to do that. So super exciting.

Manoj Nair: It's sup-super exciting to be in this moment.

Allie Howe: Awesome. Thank you so much for coming on, Manoj. I appreciate it.