Democratizing Security for the Agentic Web with CloudFlare CTO Dane Knecht

Cloudflare priorities and security

0:00AI has become the tool that's causing this kind of security apocalypse. It is also the tool that can help us to solve it faster as well. It went from how to get everyone just to using AI. Now all of a sudden everyone's racing to figure out what AI security means. I've heard serious technical people say things like, air gap, everything important, and we're like not going to be able to trust the internet for a while. And we just assume all the critical infrastructure and government services fall down at some point. Is that your expectation for what happens?

0:30Dane, I'm so excited to do this with you. Yeah, thank you. Thanks for coming here too. I'm sure I'm not the first person to make this joke, but your last name, Connect. That's pretty good for the Cloudflare value prop. Yeah, yeah. There's been some jokes about renaming the show next year. So with everything that Cloudflare is doing, what are your top few priorities as CTO right now? Well, I mean, this past year, it feels like 10 years compacted into one. So those priorities are constantly shifting. But, you know, it all goes back to our mission of helping build a better internet.

1:08And that really hasn't changed over the last 15 years, where we want to make sure that the internet is secure, that everyone has access to be able to get their content online easily, and scale it up. And just, you know, over the arc of the AI changes in the past year, you know, it went from, you know, how to get everyone just using AI, how do you make it easy for them to deploy and their agents deploy, to like most technical transitions, security is kind of an afterthought. And now all of a sudden, everyone's racing to figure out what AI security means. And it means things are different sides. I view it kind of differently. You know, well, one side is, you know, as a company is how do you keep your data safe from AI leaking the data out?

1:56But it's also how do you keep people from getting in as well, too. And, you know, over the last, I would say, three to six months, just the number of vulnerabilities that are getting reported in CBEs has just gone up exponentially. You know, previously on the internet, we would see these log4j moments, or these shell shock or type of incidents, maybe once a year. And it would be all hands on deck internally at Cloudflare to make sure how we protect not just, you know, our enterprise customers, but also all of our free customers, because we, you know, view it as a kind of just a public good and making sure that the internet stays safe.

2:35To these things are now happening weekly. Not all of them are publicly reported on. But there are things that, you know, are as serious as like the log4j type things, but just happening at a greater frequency. You know, and I expect that, you know, through the rest of this year, and in the next year, by the next 18 months, majority of teams' time is going to be spent on security. You know, I think there's a stat that was put up earlier today that during one of our keynotes, where it was showing that I think over 50% of engineering time is going to start to be spent on security.

3:12And I don't think that will last forever. I think that will be a short transition. You know, at some point, the AI will have surveyed the majority of the code and found most of the bugs or found most of the shortcuts. You know, there's one that's kind of coming out today and has been started to be blogged about and tweeted about, where one of the keys on the internet is that protects all TLS and WebPKI, which just secures all your connections, was secured by the number four.

3:45Literally, they basically used, you know, about cryptography. It's all about randomness, right? You know, that's why Cloudflare has our lava lamps is so that you can get good randomness. And when a key out there is they use the seed, they use the initial thing to kind of create it with a single number four, it's going to be reverse engineered. You know, and AI can just do all these things, you know, that doesn't sleep.

4:17It's not like the one engineer you had that was red teaming things. You know, last week, I think OpenAI found the seeds for the NIST curves that were back in 2000 that were released. So just, you know, these things are just moving so fast and the bar is going up and the models are just getting so good at, you know, cybersecurity. You know, Mythos was just kind of the tip of the iceberg there, where, you know, and since then, it's not just been the models getting better, it's the harnesses.

4:51It's how people know how to, how humans know how to use them and use those frontier models in order to find those exploits.

The changing attacker landscape

4:59Given your, you know, visibility, what do you know about the humans behind, you know, these attacks and harnessing these models and taking the volume of vulnerability discovery up so quickly? Like, are they, you know, nation state actors? Are they script kitties? Like, what can you say about how the, how the attacker landscape has changed? Well, I actually think for some of these, some of these larger vulnerabilities that have come out more recently, actually, I haven't been nation states.

5:33They've been, you know, high school kids even that are... We're going to call them agent kitties now. Yeah, that are, that are just spending their time, you know, like they used to do, kind of capture the flag security contest. They're pointing their agents at an area and doing that. You know, there's also, you know, and there's just financial reward for them. There's bug bounties that they get paid out of, you know, sizable amounts. But it's, it's given the tools that honestly the nation states have had in some forms for much longer, either through agents or just through, you know, sure number of people that were working on the problems, given it to the masses.

6:11This is the first time in 15 years I've heard serious technical people say things like, well, we should just like air gap everything important. And we're like, you know, not going to be able to trust the internet for a while. And we just assume all the critical infrastructure and government services fall down at some point. Um, is that your expectation for what happens? Humans, we are pretty adaptable and we can move fast when we need to. Um, uh, and, uh, you know, I, I've seen the industry, uh, uh, kind of partnered together.

6:45Things like this happen, uh, uh, people that you usually think of competitors just are no longer competitors. We're just literally protecting critical infrastructure, as you said. Um, and, uh, I, I think when those kind of critical moments happen, uh, uh, uh, people and, uh, will rise to that challenge. Uh, um, so on a little less doomsday, I, I do think that, uh, a lot of the things that we've done over the past, you know, five or 10 years, uh, moving away from a kind of a castle moat infrastructure for security to moving to more of a zero trust, uh, does put a lot of companies in a better position where, uh, you know, you're not saying this office is completely air gapped.

7:18You're saying, you know, these devices, these, these flows are, uh, secured in a different way, um, uh, and, and everything's going to be tightened. What is it going to take for organizations to do what you're describing? Like 50% of engineers do not work on security right now. I had, uh, uh, Greg Brockman from OpenAI on the, um, No Priors podcast last week. And he said that he thought in 2027, people were going to spend as much money on tokens for security as engineering.

7:52Like you're saying, very related idea, uh, what is going to drive that shift? Just emergency, right? So you're going to move forward all your security spent, uh, over the next 18 months, uh, both from, uh, uh, the red team side, uh, which is, uh, more of the offensive, uh, uh, trying to actively try to exploit things as well as, uh, the defensive side, uh, uh, uh, how you prepare. Things, um, but I, I, I don't think that's going to be last forever. Uh, you know, I, I see a world in like 18 months, uh, where, uh, you know, uh, new software productivity goes way up because, you know, all those resources are back, uh, focused on that.

8:28Uh, but there's, there's definitely the same in this period, uh, uh, uh, where, uh, security is, is, needs to be on everybody's mind.

Fixing software development and surface area

8:35What do you, what are some of the key elements of getting to, you know, a better place in terms of overall software and internet security? Um, uh, I think people discover, of course, like that there are, uh, libraries and services everyone uses, use that, uh, had vulnerabilities that took effort to discover and now do not. And I think we'll hit some of those. What, what else is important there? Because part of the concern that I have is the rate of software production is also going up a great deal, right?

9:05So to some degree, we got to go like, patch everything that we have already made and then keep up and get ahead of the pace of delivery. Yeah. Um, well, so, I mean, for one, we're, we're right now, we're patching 70 years of, of, of software, uh, out there. So, so, so it is just catch up. Uh, and then on a go forward basis, you know, uh, uh, I think this, you know, the software development lifecycle, the agent development lifecycle is going to need to change. Uh, uh, uh, and, you know, uh, uh, luckily the same way that we can use security right now, uh, for red team and things like that, it'll just be built into the process every step of the way.

9:41Um, uh, and I think, you know, software will just get more secure over time. What have you learned about building secure production software internally already that you think people can learn from? Like, what does that mean? Like shift left and like, can we, and there, there, there are many theories of how to do this. Including, you know, broader use of formal verification, using agents for security in the development process. Like what, what do you think is going to, uh, create better software from, uh, first delivery?

10:15I kind of go back to first principles of there is you want to reduce your, uh, uh, attack surface area. The easiest thing you can do is to give, uh, uh, less, uh, places for there to be vulnerabilities. So, you know, looking at all your software and saying, how can I simplify this? How can I, uh, uh, reduce, uh, this, you know, the, the, the footprint, the code, um, uh, and then, you know, beyond that, I mean, things like formal verification, like, and, uh, I think things that, uh, you know, safer programming languages and things that are kind of built into the runtimes that, uh, make everything safer and come.

10:46Um, but, you know, I think it just starts with, uh, uh, uh, and, you know, AI, at least, you know, uh, flow, uh, the early AI is, is, uh, very verbose. It likes to create complexity. So, you know, uh, AI in a sense of, uh, what we've been dealing with is actually, uh, uh, not been kind of, uh, helping build, uh, uh, a more secure stuff right now, but I, I think it will get there. And I think, uh, uh, the, you know, that, that's where humans still come in and human judgment comes in and, uh, making sure that we design the software in a way that, uh, uh, can stand on, you know, its own securely.

11:16Uh, that was actually going to be my reaction when you say, um, we want to reduce the surface area. I'm like, oh yes, of course, in principle, and that's not the natural inclination of today's, uh, models, right? And like, you know, I asked him to do something and I'm like, well, like with one 10th of complexity, please try again. Um, is, is that the role of engineering and security engineering today? Is that something that's going to be solved at the model level? The way that humans did before agents, it needs to be solved kind of at all levels.

11:46You need to train, uh, the, uh, engineers that are writing the code, the product engineers. Uh, you need to, the security teams still need to be involved in making sure that, uh, they're getting, uh, you know, checks and balances, second set of eyes on things, you need to build in processes, uh, we've gone to, uh, uh, um, uh, defining things a lot more internally on, on how we build a Cloudflare, uh, writing down our principles. Uh, we have a, uh, a document called the codex, which is kind of like, uh, uh, uh, uh, you know, a buildup of a lot of RFCs that the teams have built for it.

12:17Here's how you build secure software, Cloudflare, here's how you build available software, Cloudflare, here's our best practices. And then it kind of gets boiled up into some 10 commandments that, uh, the, uh, agents know how to follow and, uh, uh, use it every part of the review process, uh, that can help enforce those things. So, you know, you have agents out there that are, you know, just writing a lot of the slop and then you have deeper down in the factory, you have, uh, uh, people that are, you know, doing the performance runs and the secure work security runs. And then just like how the company operated before you, I think you need those adversarial, uh, uh, reviews. Uh, when you zoom out a little bit and just look at overall traffic on the internet and

The human web and the agent web

12:56how much of it has become, uh, agent driven over the last year, um, I think it's outpaced most people's expectations. What has updated in your worldview of like what the web a year from now looks like either from an economic model perspective or a, um, security or requisite infrastructure perspective? Yeah. Um, I mean, I kind of think of it as we're in the messy middle right now where, uh, humans and agents are, uh, uh, riding the same rails, uh, uh, on the internet, uh, where, you know,

13:27uh, agents are trying to, uh, parse a human web, uh, when that's just, you know, when it's just inefficient, uh, you know, and, uh, was designed for humans that could do things at different speeds, uh, you know, going to a website and be able to, uh, read and, uh, uh, you know, uh, see the ads and, uh, participate in the, more of the economic, full economic model versus an agent that now can go to a thousand web pages in the same period of time, uh, which is, which is, which is great. It just, you need to find a new economic model, uh, to support that parallel webs.

13:58Is there like a human web and a machine web, like everybody's trying to do, uh, what's it called, uh, AEO now, you know? Yeah. Uh, I mean, yes, I, I, I think we do. I think, I think, uh, um, we find ways to deliver the content, uh, and, and meet, and meet agents and humans where they are, as opposed to trying to meet them in the same place. Um, and, uh, uh, uh, right now there's like translation layers, you know, there's a lot of companies that like, you know, help you, uh, uh, uh, uh, you know, an agent view a webpage, uh,

14:29these are just all extra, you know, burning of tokens for things that probably don't need to be, need, need to happen. You know, the website usually knows what data and, and, and, you know, we've had things like this, you know, we've had APIs, uh, you know, ways that computers talk to each other for years, uh, it just, you know, API has only covered a small fraction of the information on the internet, uh, and, uh, agents, uh, have a thirst to, to, you know, understand everything. Uh, and so they're going out and trying to explore the human internet, um, and, you know, we need to make it, uh, easier for them. Uh, we need to make it, you know, less costly for the, the site owners and we need to find

15:01a way for, uh, um, uh, them to get compensated. You know, uh, you know, uh, I think, I think it's, in a world where you can get very simple, you know, uh, uh, you know, most likely it's a good content website, like a sub stack, but, you know, they know what their CPM, uh, is for how much money they should be making on ads, uh, uh, um, for that site. And so, uh, if, if an agent's reading the site, uh, I think there is a world where you get to the point where, uh, uh, an agent can decide whether or not they want to read the content and then they can decide, uh, if they want to pay the CPM rate, right?

15:33And, you know, that's where you need to then get new payment rails for the internet, uh, that, uh, can do, you know, millions of transactions a second, uh, for, uh, these, all these little micro payments, uh, all these things that we've been talking about for years, uh, you know, uh, micropayments, you know, always a two years, two years away. And, uh, um, uh, uh, you know, uh, I, I think agents will, will actually push that forward and actually, I think we will see a world where we're actually, there is a new economic model for content creators. What, who do you think the players are or what are the variations of that infrastructure?

16:06Right. Like, I think obviously, um, Cloudflare has an important role to play here, but the, the rise of personal agents, like instinct and use have also made this like an immediate question from a transactional perspective. I don't think everyone knows on the, you know, on the other side, what the business outcome is going to look like. You know, everyone's been through these transformations where the internet, you know, if I was going to kill main street, it didn't kill main street. There's no small businesses are still, uh, uh, thriving. Um, uh, but, you know, there were people that were displaced and so there, there's always

16:38kind of some skepticism there. And so, you know, there's some natural, natural inclination, uh, to like just block them out. Right. Uh, you know, you saw Amazon just say, uh, no, no, no purchase, no personal shopping there, uh, from an agent. Um, uh, I mean, I think these are all people that, uh, are, are, are, are, you know, this, that messy middle, but they're trying to figure out, uh, what, what that path forward is and, uh, trying to keep some of the, you know, negotiation, uh, uh, leverage there, um, I think we will get to a place where, uh, uh, uh, use and, uh, dots and, uh, all

17:11those personal agents, uh, will be able to, uh, accomplish tasks, uh, seamlessly as you as a human could do even, even easier. But, uh, I don't know if the technology is quite, quite caught up to that yet. And the, uh, business models either. Is there anything you're personally excited about on the roadmap or just from a technical exploration, um, perspective on the cloud flare front that you like feel like is going to enable this ecosystem in the future? Um, well, yeah, I mean, absolutely on the, uh, uh, content side, you know, we've

17:42released, uh, uh, uh, a conference monetization gateway where we make it easy for people to put their sites behind us and, uh, uh, uh, take microtransactions, uh, uh, uh, for their content, uh, uh, uh, uh, including, uh, providing, uh, a wallets for agents to use, um, uh, uh, uh, uh, and, uh, and, uh, and a stable coin that's going to be able to help kind of, uh, facilitate that transaction as well. Um, you know, we're also doing things, uh, with OpenAI, uh, uh, uh, a project called signals where, uh, we're making it easier for, uh, um, agents to actually discover

18:15content instead of having to crawl the entire internet and, uh, continually go back to pages where making it easier for them to, uh, uh, uh, know what's new content and actually kind of more proactively do that. So, you know, it's, uh, it's a win for the, uh, AI labs as well as a win for, uh, uh, the site owners not having to get, uh, constantly crawled and pay for that infrastructure. Um, so that, you know, there's a whole set of, uh, kind of new laws of the internet, uh, that I think, uh, really excited to see, uh, all those, uh, uh, kind of grow to see, uh, you know, the, uh, you know, X402 from, uh, when Stripe came out with it, I loved it because

18:47it went back to, uh, the 402, uh, uh, uh, HTTP code, uh, uh, which was, uh, uh, uh, you know, uh, uh, uh, Tim Burns Lee created, uh, you know, 20 plus years ago, 30 plus years ago, uh, for payments. So like, you know, kind of always knew that you needed a payments, a better payments rail on the internet. Uh, but we haven't been able to, you know, kind of figure it out. And, uh, uh, I think agents will lead us to that as well. When you think about these, um, initial products that you've released, like, is there, what, what would success for a content creator or somebody who ostensibly had a website on the

19:23internet that they were monetizing with ads before, like, what's the, what's the killer success case you guys need to see or show the world where it just becomes like a default to do this? Uh, well, I mean, I think we're, instead of, uh, them paying us, we were paying them, right? You know, uh, uh, where it's, it's covering their infrastructure costs. It's providing, uh, uh, money that, uh, uh, uh, that, uh, uh, supports their livelihood. Um, uh, you know, uh, you know, we can actually increase the number of content creators out there, which, uh, you know, the, the last generation of the internet has done very well, like with

19:56YouTube and TikTok and, uh, X, uh, um, uh, I think it can actually make an exponentially larger.

Internal AI adoption and Cloudflare OS

20:02And when you look at the workspace, um, OS, like release and ecosystem work that you guys have been doing, what is, uh, what are you hoping are the like biggest use cases of it coming up? This is kind of transitioning a little to, uh, we released one called Cloudflare OS. Uh, and Cloudflare OS was, uh, is our internal, uh, platform for, uh, how our employees, uh, use AI every day, uh, where, uh, we, you know, and it actually goes back to security routes where, uh, you know, uh, uh, we were very worried about, uh, customer data, internal data

20:36leaking out. And we wanted to make sure that our employees, uh, could, you know, uh, use all the new AI, uh, tools and models, uh, but have a way to, uh, safely, uh, uh, deploy them internally, uh, to understand, uh, uh, how that data is being used and flowing, um, and, uh, uh, have, you know, kind of good governance over that. Uh, in addition, uh, the reason my company called Cloudflare OS is, uh, um, we started to, uh, realize that, uh, you know, as we have more and more agents, uh, you know, uh, we needed to be able to teach them, uh, what made Cloudflare special, how we build a Cloudflare.

21:07Um, you know, and for humans, we did that through like Cloudflare University and, uh, the onboarding process and, you know, meeting your colleagues and working with them. Uh, but we needed to kind of work really to find that and document that, uh, for agents. And so Cloudflare OS is both the platform where our employees can build anything that they want, uh, in a secure way without having, like, you know, security, it's not something they have to think about, um, you know, the BR that's trying to create a call list, uh, they don't have to worry about a security, um, it is just built in there, um, for them. Uh, but they also know that it's being done in a way that is, uh, consistent with, uh, the

21:40themes and values of, uh, how Cloudflare works. And, and why release, I think of this as like somewhat different from the other products that Cloudflare offers today in that it is not infrastructure. It's like an end user facing, um, uh, product for managing, um, AI use within, within the organization. Like why release it? Or do you think of it as a departure? Yeah. I mean, uh, um, for one, it was, uh, it's kind of a reference architecture, really. Uh, it's, uh, you know, we, over the past 10 years, we've built some, uh, uh, our developer

22:11platform where we started with just a simple, uh, serverless compute primitive, uh, and now, you know, over a hundred different, uh, uh, uh, developer platform tools, uh, from storage to databases, to durable objects. Um, uh, we wanted to show someone, show how you can build it completely on, on Cloudflare, um, and how we build things internally and kind of, uh, uh, uh, give people the option to, uh, you know, fork it and build, uh, their own, uh, version of, uh, their own company OS on top of it. Um, and, and what is a way in which it is helping your people and your organization that you think

22:46is like clear success? Uh, it's actually used more by, uh, uh, our go-to-market teams and our G&A teams, uh, uh, than it is even used by our engineering teams. Uh, you know, uh, uh, it is, you know, giving them a, a very fast, uh, you know, early on, I thought, you know, we, we saw training was the biggest gap for people using, uh, AI. And when you just kind of point them at, uh, a chat interface, um, or, uh, uh, uh, another by putting tool, uh, it's too much of a blank slate for them.

23:17Uh, and so, uh, you know, this is a platform that's designed, you know, you, you design everything for it, for how your business works and you immediately can go there and, you know, get access to all the data that they need. Uh, they can, uh, get guided and taken, taken through, uh, uh, uh, where they quickly realize, oh, this is not, you know, trying to replace me. This is trying to make me better at my job. Uh, and that's been really exciting to see, uh, just, uh, just all the different ways, uh, uh, people at the company have, uh, have done that. Uh, you know, a lot of the, uh, uh, how this conference got put together, uh, the marketing

23:50team, uh, I mean, built hundreds of internal tools where previously, you know, they would have, they would have to go out and, uh, uh, work with different agencies, but they can, you know, the speed that they can move with the smaller team now, it's just amazing. Assuming this is a continuation of, you know, starting in May, you guys did this restructuring to be an, uh, like a sort of AI first organization. Um, what, what else reflecting on, you know, the last number of months, uh, has worked or not work that you would recommend to others? Yeah. I mean, so, uh, you know, the, the, uh, the restructuring was hard, um, you know, saying

24:24goodbye to some more colleagues. Uh, it was the first time software ever did it. Um, you know, uh, we had, we had always been very, uh, careful not to overhire and, uh, um, uh, Oh, this was for different reasons. Uh, this is cause we, we saw the, uh, the, the way AI was transforming some teams and how they work. Um, and, you know, we kind of thought of it as like a factory floor where you needed to actually rebuild, rethink how things happen. You know, uh, uh, there, there were some processes or some, you know, the way a product manager would send an email forward to customers, it involved three teams, you know, it involved

24:55a team where, uh, you know, uh, you went to BI to go get a cohort of, uh, uh, the people that you wanted to send an email to. Uh, you went to the marketing team to help you design the email and get the voice right. Uh, you went to the marketing operations team to get the email out, uh, where, you know, it, you're never going to be able to, uh, actually redesign that process unless you kind of, kind of make some hard changes and, uh, uh, force people to kind of rethink. Saying, well, what actually is the right way to do that? Uh, and it, it might not involve those three teams at all, might just involve, uh, a new

25:27way of doing things. And, you know, so what came out of that was a tool where a product manager now goes in and describes the cohort, uh, they write an email, it rewrites it in conference voice, it sends it to their manager, uh, um, and the manager can click approve if they like it and it goes up. Uh, where, you know, we didn't go from three teams getting faster at, uh, doing that. We went to, you know, uh, one tool that can kind of, uh, uh, uh, let, uh, product manager now have a superpower that they didn't have before. When you think of all of the different workflows and tasks within an organization that's got

26:00about 5,000 people like cloud players, like how do you decide who the owner is of rethinking that process? And, and like, was it bottoms up from one of those teams in this case? Like, is it an organizational leader? Like when you have so many of these things that could change to be faster and make more sense as you described? Yeah. I mean, Cloud4 has always had a thousand more things that we could, we could ever do, uh, whether it was, you know, products and features or things like this. And so, uh, we, we, we, we always look for people that, uh, uh, are going to take initiative

26:31and ownership. Um, and so, you know, it doesn't really matter if you're ordering it, you know, one to a hundred and trying to prioritize it. Any one of those hundred things, uh, are, are probably, uh, safe if someone's passionate about it. You know, we, we, we, we kind of gave people at the end of last year, the, uh, the tools and started seeing how they were experimenting and, you know, uh, people quickly kind of, uh, broke out in different cohorts of people that were really leaning in and, uh, um, you know, just naturally doing those things and taking ownership of them. Uh, so, you know, I think it was very, uh, bottoms up from the, uh, how we're going to,

27:03uh, uh, do those things.

Token budgeting and hiring interns

27:05Uh, it's been a major topic of conversation for organizations as to how they should think about, um, token budgeting, right? Like, you know, what's a reasonable amount to spend? How do I think about this versus human capital? Who should get tokens even within our organization? Like, what is your philosophy on this now? It's definitely changed. Uh, you know, uh, uh, and each model kind of makes you rethink it as the, the, the cost dynamics change. But, uh, um, you know, in, in general, uh, um, uh, you know, I think it's kind of silly

27:37that we're actually asking humans to decide which model to do each task. Um, like it should be intelligently routed. Yeah, exactly. Like humans just aren't, aren't going to ever be good at that. Right. Like, uh, um, you know, uh, um, but, you know, early on you do it kind of, uh, brute force and you, you know, people, you get people to experiment and you say, Hey, well, you know, let's try for the planning part. Let's use the, uh, you know, the, uh, top frontier models for that. Um, and then, uh, you know, once the plan's written out and agreed upon and iterated on, then, you know, uh, potentially some more of the open source models, uh, can go

28:09do that. And then you go back and you have a, uh, one of the frontier models do the reviews and the red teaming and, and things like that. Um, now all of that today is, you know, fairly manual. Um, uh, but I think, you know, as we start to learn and experiment, I think it will become intelligent, uh, and, uh, you know, uh, uh, uh, and, and, you know, over time, there'll be more governance on that. You know, Cloudflare, um, it's been in a place where, uh, uh, you know, largely we let people, uh, use the models and tools that, uh, they, they, they see fit, um, for the job.

28:41Uh, you know, we, we don't have, we don't have a token, uh, leaderboard, uh, we don't encourage it, we encourage people to focus on the output. Um, the, uh, uh, uh, you know, they're not graded on, you know, if they used it, they're graded on, you know, what they've shipped and what they've built. Um, but then, uh, uh, you know, we do have some kind of, uh, we found like just kind of, like, giving people notices. Like, you know, if you happen to use $300 a day, you'll just get an email, right? Like it says, Hey, did you know? And because most of the time people didn't realize they were doing it. Mm-hmm and, uh, they're like, Oh, huh.

29:12Uh, and then I think if it gets to like 500, uh, it goes to your manager, if it goes to a thousand, it goes to a VP in a day, but it's, it's, uh, you know, it, those things rarely happen. And, and usually it's, it's, it's, uh, people are actually happy to get those notices. Where do you think you are in your overall evolution of like, take things just for the current level of capabilities of, of models, assume no new development of, you know, rethinking the way different things at Cloudflare are done from go to market to engineering to be tested? Oh, I think we're still so early.

29:43Uh, um, you know, uh, uh, conference is something, uh, you know, two years ago, we had about 200 interns and, uh, what we saw was those interns, uh, were, you know, uh, really the first, you know, fully kind of AI native, uh, you know, where you took AI away from them. I don't think they would be able to work, uh, and, uh, uh, is that good? I actually, I think it is. I, I think they know how to use the tools better than us. It's just like, you took Google away from me, you know, over the last 10 years, uh, you know, like, uh, like, you know, how would I learn anything? Right. Like, uh, uh, uh, that's, that's, that's, that's where they reached to first.

30:17Um, and, and, and we actually saw the managers that had interns that from that, uh, that that summer, uh, actually adopt AI faster. So then this past summer, uh, this past year, uh, we decided we were going to hire a thousand interns. So that's, you know, uh, for 5,000 person company. Yes. Wow. Yeah. Uh, over the course of the year. Yeah. And, uh, it's, it's just been amazing because, you know, uh, one, uh, uh, just the number of ideas that come from the interns, uh, you, you know, that's something that, you know, with AI lets people experiment faster. And so having more ideas, uh, getting more people in there, but also, uh, just seeing

30:49the, the way that they, uh, uh, use AI, like, uh, you know, um, it, they need to fill out a form, uh, they, they, they reach for AI. Um, and I, and I still find myself, you know, there's so many things where I'm like, oh, wait, I've just been doing this manually still. Uh, and then I'm like, yeah, wait, I should, I should be using AI. And, and I, I don't think that that's a natural, uh, um, uh, natural for most of us yet. Um, uh, and I think that will, that will take time. And, uh, so, yeah, I think we're still very early, uh, in our AI journey.

31:19I love it though. The mass intern strategy, uh, I run a very small, um, partnership and we always have a, uh, you know, an intern or two floating around a team of about a dozen for, you know, ideas and intern energy and all that. But, but we just converted one of our, um, you know, in college interns to full-time and, uh, and Jed and had him drop out and everything. And I, I, I think that you're right where maybe like the dial should be turned up on the amount of DNA that is really, really native to these tools.

31:51Yeah. I think it's great for them as well too. I mean, you see these schools like Waterloo and Northeastern, like with these, uh, these co-op programs, uh, um, and, and, you know, from what we've seen is, uh, uh, people that get that type of real work experience, uh, uh, just, you know, uh, are some of our best employees, uh, uh, many years in and go on to do, you know, uh, great things. It is interesting or encouraging though, that instead of it being like, Hey, here's a master plan, we're going to map out every department and sub department at Cloudflare and be like,

32:23here are the key workflows. We're going to try to re-engineer the workflows. It is instead of strategy of like, assume people are rational about their tokens, if given information about their usage, hire a bunch of interns and assume high agency people we have here are going to go like, you know, shift, shift those workflows to something more intelligent over time. Yeah. And then, and then brute force and just try things that, you know, early on, uh, um, uh, we, uh, had an email, uh, alias called agents at Cloudflare where we, uh, this is back in January of last, uh, of this year where we, uh, just told people to, uh, uh, uh, you know,

32:56you curious, can I use AI for this, you know, email in your jobs to be done, you know, uh, and, uh, uh, uh, that email would, this would apply back to the skill file. Um, uh, and for a while people thought it was actually, you know, thought it was all AI and automated. It was actually, uh, a bunch of interns that were, uh, uh, uh, uh, uh, helping people write skill files. Uh, uh, but that led us kind of get to see, uh, uh, uh, you know, in a way that's not going out and like, you know, uh, hiring a consulting firm to come out and like catalog every single thing to be done is, you know, people that, uh, are

33:29recognizing, Hey, this seems harder than it needs to be. I wonder if an agent can help me here. Is there anything else about the last year that's changed, um, uh, beyond the intern level, like your hiring philosophy, once you look for people to bring on? Um, well, I mean, one of the biggest things we've always looked for is curiosity. And so, you know, if, if people aren't using AI at home in their personal life and all that, I mean, that's a pretty big red flag. Like, Hey, just, uh, how can you not, uh, uh, uh, be embracing AI if you have, you know,

34:01a level of curiosity out there. So, uh, um, you know, uh, I think just double down, double down on some of those, uh, uh, kind of, uh, key characteristics of, you know, drive and curiosity and empathy, uh, um, uh, play even better for, uh, uh, this next set of people. Uh, well, I, I'm, I mean, I, uh, uh, I am a, uh, alpha user of all products and technology forever. So, but I, I think the answer is like fear and skepticism, right? Um, and, and so I, I, I guess implicit in this, um, claim about like curiosity, including

34:37an experimentation with, uh, with frontier tools is, uh, like that needs to, uh, that needs to be a core principle for people who work at Flair. Yeah. I mean, I mean, a lot of things that we're doing, we're not, you know, uh, uh, we're, we're, we're inventing new ways of doing things. I mean, the scale that we operate at, uh, uh, for the, uh, number of sites behind us, uh, um, and the, the amount of, uh, free, uh, services we give away, it's just not possible with off the shelf technology. Uh, um, so you, you need people that can come in and literally invent new things.

35:08And, and, uh, that, I mean, that, that starts with curiosity.

Expanding red teams and open models

35:10I have a couple of questions for you to, to close out and, uh, mainly about security both, uh, and how to do that in a new way, both at, um, at Cloudflare and then how you think it's going to work in the, in the broader ecosystem. Um, what do you think is the like process by which if, if half the engineering team is going to go work on security and just like fix 70 years of vulnerability, um, how do you attack that problem internally, assuming that not all software is perfect, even amazing production, internet scale software, and then, you know, we'll talk about the ecosystem.

35:42Yeah. I mean, I, I think largely, uh, you know, we're, you know, today we have one red team. I think by the end of the, you know, the end of the year, next year, we will probably have four or five red teams. Uh, so, uh, you know, break people out into, uh, groups that are actually, um, uh, you know, being more adversarial and actually like, uh, going out and actively trying to find, uh, vulnerabilities. Uh, why is that the approach when instead of like, oh, we're finally going to get like our patching systems, right. Our processes, right. I mean, processes and those things can always be better.

36:14Uh, uh, we have a volume process, we have a patching process, uh, really perfect. No, uh, but, uh, uh, you know, the best way I found for those sorts of things to get better is to out of, out of crisis kind of comes, uh, uh, uh, uh, that, that, that, that has, that's how you get those things fixed. You know, when the volumes get too big for, uh, the engineering team to just do them on using their normal processes, you know, uh, engine, you know, engineers are inherently lazy in a good way. Uh, and so they, they will, they will automate, uh, away those, those things as they, as they,

36:46as they need to, as they kind of realize that there's no other way, way, way to do that. Um, so, you know, uh, you know, I think the focus needs to be on the discovery side, uh, and, uh, uh, uh, you know, people will do the right thing and figure out how to patch it in a scalable way over time. Do you express a philosophy on just prioritization of this versus like shipping new features? Uh, because I guess my understanding of it's, it's not as if we didn't have a backlog of like vulnerabilities and every large piece of software to go fix.

37:17It was just like whether or not that was a priority for engineering teams previously as one common state. Uh, I mean, I, I think, uh, you need to figure out how to do both. Um, you know, it, it might come at the expense of, uh, cost optimization or other things, but I mean, uh, companies, uh, if you're not shipping, you're dying is how we think about it. So, uh, So it's not going to be freeze in order to do this. Oh, no, absolutely not. You know, uh, you need to be, you need to be able to continue, uh, um, building and shipping

37:48new things. Um, but you need to be able to, uh, uh, make sure that you're doing it, you know, uh, securely and patching and, and fixing bugs. And, uh, um, uh, I, I, I think if we do it right, we'll actually be able to do them both faster, uh, with AI, I mean, while AI has become the, uh, the tool that's causing this kind of security apocalypse, uh, uh, one apocalypse, uh, to happen, uh, it, it is also the tool that, uh, can help us, uh, solve it faster as well, right? So, so, so it's, so it's on both sides of it.

38:18Oh, where do you fall on this debate of, um, the role, uh, like good and bad of open and closed models on the cyber front, right? Um, because the, the, the argument, the broad argument is, well, having defensive and offensive cyber vulnerable, um, uh, cyber capabilities, you know, they're parallel in the same model, um, uh, despite, uh, safety and guardrails being, being built into them. And so you can't have open defensive models without them also being offensive.

38:51And then the argument, um, sort of, uh, that were the concern around only having security capabilities in, um, a, a set of frontier closed models as well. How are you going to release them? And you can't possibly get them out to the distributed set of actors that need to defend. Like what, what do you think? Or did I characterize that correctly? Yeah, I mean, uh, I think every, over time, it all has to be open because everyone's going to get access to it anyways. And, uh, um, uh, you know, that's how open source tends to work. Yes. The bad guys, the bad guys are going to find a way to get it.

39:22Um, so all you are, uh, and the, you know, the, the top companies will have a way of getting it as well. So, uh, I think you're, you're just, uh, excluding, uh, a mass population that just doesn't have the access that, that probably needs it. Mm-hmm. And, um, and then, so, so final question, just because, you know, Cloudflare, uh, very mission oriented, does carry, uh, the weight of some, you know, uh, internet, uh, resilience on, on its back. What about all of the people who can't afford to have four red teams or like never had a

39:53red team to begin with that run important systems? Yeah. How do they, how do they protect themselves? Also, uh, you know, uh, uh, I would say put your sites behind Cloudflare, uh, put your infrastructure behind Cloudflare, build on Cloudflare, uh, you know, uh, when these major vulnerabilities come out, uh, like the React one, uh, uh, last year, uh, we don't just give it to our paid customers, uh, who have like the advanced firewall and WAF capabilities. We, we give it to everyone, uh, we view those kinds of things as, uh, um, uh, part of the utility that we offer, um, and, uh, you know, uh, uh, um, uh, we want to provide that just

40:27like, you know, uh, we want to provide performance for everyone. You know, before Cloudflare started, uh, you know, uh, there were probably 3,000 sites in the world that had a large scale CDN, uh, to cache their stuff at the edge. You know, now there's, uh, uh, hundreds of millions of sites that do, uh, so, uh, you know, Cloudflare has always viewed our, uh, our, our goal is providing, uh, democratizing the security of performance for everyone. Awesome. Thanks so much for doing this, Dane. And, and you guys heard it first. Uh, we have the, the agent kitties and the volpocalypse, am I pronouncing that right?

40:57Yeah. Yeah. Uh, but, but it's resolvable. All right. Thanks so much, guys. Thanks.

41:05Find us on Twitter at NoPriorsPod. Subscribe to our YouTube channel if you want to see our faces, follow the show on Apple Podcasts, Spotify, or wherever you listen. That way you get a new episode every week and sign up for emails or find transcripts for every episode at no-priors.com.