Ep. 23 - Knight in Shining PromptArmor with Vikram Jayanthi | Devs:After Dark

And Terminator is not there because of you.

You guys are building the T-1000 in the back room? It's okay. You can tell everybody. Yeah, right.

We are not saving Sarah Connor.

Hello, hello, and welcome to episode number 23. of Developers After Dark. I am your host Nick with my co-host as always Dennis.

Hey.

AJ is a little bit under the weather today, so he will not be joining us, but that's okay because we have a really, really special guest, uh, that I will let him introduce himself in just a second. But before I do, let me pay a couple of bills and just let you know that obviously if you want to check out any of our back catalog or if you want to watch live, not only on YouTube, but you can check it out on the website as well. And that's devsafterdarkpod.com for those of you who are listening and not on video. And then of course, always, always, if you want to check out what's going on, not just us but everybody else, there's also the HubSpot Developers YouTube channel, and that's @HubSpotDevelopers. And you're going to find stuff where you're going to find new episodes of us, of course. The one with, uh, Chris Conant just dropped just recently. Um, there's also some really great stuff from Brooke about the Figma plugin for UI extensions, right? Mm-hmm. Have that going on. And then also an introduction into the Center of Developer Excellence as well. So there's a video you can check out there to learn all about that. So I definitely encourage you to go do that. Also too, as always, the changelog. If you want to know what's going on at HubSpot, both upcoming and what has just been happening, you can go to developers.hubspot.com/changelog and you'll be able to check all of that out. Now Without further ado, I would like to introduce our guest. Vikram, why don't you tell everyone who you are and what you do?

Hey everyone, excited to be on here. Uh, I'm the co-founder and CTO of Prompt Armor. Uh, we're an AI security company. Yeah, very excited to chat with you all today.

For those of, um, for everyone that's listening that may not be familiar, which they should at a certain point, I'm telling you right now, but why don't you tell everybody what Prompt Armor is and what it can do for them?

Definitely. So we're an AI risk intelligence platform that allows you to evaluate and continuously monitor your third parties and vendors inside of your environment. And it's, yeah, that's kind of like the gist that I always like to give initially. And I'm sure we'll dive into more details as we go along here.

How old is this business?

Yeah, it's, we're just over 2 years. We've been in AI and security for a lot longer than that, but the official company has been around for about just over 2 years.

So you, I mean, it's been kind of a crazy 2 years then for you, right? Like things like here, here, here, here, then boom, right?

That's how it tends to be, I think, when it comes to startups. Yeah, we've grown a lot since we first started, obviously. Working with some really, really great big companies and solving a lot of real problems, which is the most important thing for us. So yeah, it's been a great ride so far.

I don't know. I think you have to prove to me if there's any risk associated with AI.

I think it's all—

It's all hype, right? It's all hype.

Ah, it's fine.

Let me ask you, was there a moment where, and you may not have had maybe the name Prompt Armor, or maybe you hadn't had the branding or anything picked out just yet, but was there a moment in time where you said, in this environment, we need to make something like this, or we need to make a Prompt Armor because this is where it's going? Did anything ever stand out in that whole process as Dennis was talking about? Because things went from 0 to 100 instantly.

Yeah, I'd say it happened before we even started from Dartmouth in many ways. So it started when my co-founder Shankar and I, I worked at engine security at Roblox, which is kind of this subfield of security that's focused around cryptography in a real-time system and anti-denial of service and a whole bunch of other security things that I won't get into. But when we saw GPT-3 come out from OpenAI, We kind of saw the potential of the technology, of course, immediately before ChatGPT even dropped. And just being, you know, people interested in security, we were like, okay, but what are the security implications of this, right? So as we kind of experimented, we were like, wait a second, there are some pretty big security implications from these AI models, and especially how they're integrated into applications. So we did a lot of pen testing, a lot of red teaming, and we were like, this is a real problem. A lot of people are susceptible to these things, and this is only going to get more proliferated as AI models get better and therefore more useful. So more people are going to start implementing them in more powerful ways. So we're like, we need to get ahead of this. And that's kind of the impetus for Prompt Armor.

So are the risks vastly different from model to model, or is there a unified or a a similar pattern for all of them?

Definitely. Yeah. So the risks differ by model, uh, by model, uh, assuming they're all large language models. Um, so if you're using a, you know, more traditional machine learning model for something else, um, the risks are definitely different completely. Uh, but even today, most people are using large language models inside of their application that they're integrating with. You know, they're using the OpenAIs, the Anthropics, the Mistrals and Metas of the world, right? So those models all carry kind of similar risks, I guess, but to different degrees, if that makes sense.

Yeah, I apologize. I'm so into the hype of everything's a large language model. It always means that to me now.

Yeah, I mean, that's— and that's the thing, right? That's kind of true for everyone at this point. Most people at this point, right? Very few fields haven't been touched by large language models now.

And that's, and that's a lot to try to take in too, if you're somebody that doesn't really like, if you're just on the cusp of it or, 'cause you know, like everything's swirling around very, very quickly.

Yes.

Um, I wanted to ask you, is there any type of thing that anybody can do to try to better understand just like the basics in general?

100%. Yeah. I think, um, there are kind of two very, uh, uh, yeah, I guess let me zoom out a little bit, then I'll answer your question. So there are two very common kind of mainstream views, I think, on AI security. One is that, and they're both kind of like hyperbolic. One's like, there's no difference between AI security and regular security. It's the same thing, right? There's absolutely no difference. There's no, you don't need to spend one brain cycle thinking about this, right? And then you also have the other camp that's like, AI is going to destroy us all. And that this is all like uncontainable. And this is, we're basically just, it's a matter of time before Terminator happens.

Right?

And it's just like, those are the two camps. So obviously, it's very hard to cut through the noise as somebody who isn't thinking about this all the time and who's, you know, this is one part of your job as a security practitioner, as a developer. You're not— it's very hard to cut through all of this noise. So yeah, the truth is, yes, you need— there is new risk to AI. A lot of it falls outside of kind of the traditional patterns that you see in security. But it's also something that you can learn as long as you kind of approach the problem from, you know, a different mindset than either of those two extremes. And you actually look at the core fundamental technology and understanding that and the new attack patterns that we're seeing emerge, right? So a little plug here, we have a course that we offer for free through the Third Party Risk Association that allows Anyone to sign up and get like a full kind of course on the basics of AI security and how to evaluate AI security risks in third parties as well.

I have to say, it is one of the most— the way it's done, it is— I've gone through it and the way it is done is very— it makes perfect sense. Do you know what I mean? Because there's certain things that you try to tackle that are just It's one of those things where I've done other things where I've had to either take the course over again or watch the video like maybe 6 or 7 times, embarrassingly to admit. But like before I really, before it clicked, I watched through the first set and I was able to really understand on the first shot. Just, it made sense. And there's very few, and kudos to you and the team. There's very few things that I've seen where you're able to do that.

That's all Shankar, my co-founder. I will give him 100% of credit for that. He really killed it with that one. He's great at breaking down very complicated topics into something that everyone can really understand, which is great.

And the steps are— and the way he walks through it too is very good. It's pretty good. You can't get much better than that, if at all, because as someone who does it myself, I tend to kind of go— and Dennis can attest— I'll go off into Tangents, or I'll start to like backtrack and try to do this like Tarantino thing where I go backwards and then forwards again. And it's a very— it's confusing, but he does a remarkable job of just laying it out and staying on track. And it's— I can't say enough about that because it was— it's pretty instrumental.

He's being invited across the country to present at various conferences, right? And it's like everyone's always just like, I've never heard of this, and now I also understand. So like Taking a brand new concept that nobody's heard of and explaining it in such a simple way that they fully understand it at the end of it is very impressive. So yeah, he's great at it.

Absolutely. 'Cause there's even too where I remember I was just, not too long ago, we were watching the CEO of HubSpot was talking and she mentioned that with respect to AI and AI security and all of that, that the experts are usually about 2 weeks ahead. It's not like they're 20 years ahead because things are moving in such a rapid pace. So to try to defend against that and have security built around that, you have to be moving that fast, if not faster.

Is that legitimate? Would you say that the security aspect of it is like 2 weeks difference? I mean, okay, maybe not 2 weeks, but a short amount of space between breathing room.

You know, it's interesting. I think it's kind of like one of those things where it's a little bit, it's yes and no. That's my answer. So it's like one of those things where if you have that base understanding, which is like a big leap, right? Then yes, you can stay. It's like, you know, the experts maybe, you know, maybe not 2 weeks, but like n number of months ahead.

Yeah.

But the problem is people don't have that like big base jump that like the stepwise function gain. To like start following in those, like, you know, with following behind closely. It's the, the real problem is giving people that core base information so that they can start being close to the experts. That's, that's how I would see it. So without that, it's like a huge gap that isn't really something that you would even be able to close. Yeah.

Could you, could you be willing? So I'm this, I'm very ignorant to all this stuff. So talk to me like a child here, as I would tell ChatGPT to do for me.

Yeah.

I'm a, 4th grader. Like, what are some actual differences between traditional digital security risks versus, you know, the AI risks?

100%. Yeah, a lot of it comes down to the fact that LLMs see data as instructions. So let me dive into that a little bit more, right? So before, if you had to execute some kind of attack on a system, right? you needed to have something to run, some kind of computer program, essentially. I'm breaking it, dumbing it real down.

Yeah, please.

Thank you. To run on someone, to be able to get remote code execution or whatever you want. You need to be able to run some kind of code that is malicious. But now you're at the point with LLMs where you have these LLM-integrated systems that ingest data from all sorts of sources, but can't differentiate between— I mean, kind of, and this is kind of like a core to the technology, is that data is seen as an instruction, right?

Sure.

So yes, all of the prompts that someone puts in are the instructions, but so is all the data that is appended in whatever RAG search you're doing, or if you have an agentic workflow, and now with MCP servers, right? All of these things are just seen as kind of instructions to instruct the LLM in its outputs and its operations. So the real problem now is that you have text that can essentially be an attack, right? It can be— text can be malware in some way here. Really simplifying things.

Yeah, no, thank you.

That would kind of be like one really key insight that I think everyone in security especially should know. is that there's no trusted— there's no way to separate basically instructions and data anymore. And because data could come from a malicious source, you're basically allowing a malicious source to tune your— to change your instructions.

Yeah. Which actually, I'm very curious about the MCP part of that because I feel like that was a huge introduction to the possibility of these malicious actors.

100%. Yeah, like, I mean, I think I saw a pretty cool paper out about tool shadowing. I think that was a pretty good one. Yeah, we've done a lot of stuff. We have a threat intel team as well. So they're doing some very interesting work there on that front. And it's really, yeah, you're seeing basically the same attack vector. And this is kind of what I was talking about with, you know, that kind of filling in that kind of base information that always everyone should have, because that same problem of data being instructions is what's affecting MCP servers as well. So it's like, it's the same problem, but it's being delivered in new different ways that's changing every 2 weeks.

Yeah.

So, um, yeah, so the tool shadowing, for example, was very cool where someone was able to, uh, exfiltrate, um, data from another MCP server, uh, just by having basically a prompt injection inside of the description of their tools for their FCP server. It was a very, very clever attack.

The closest parallel— sorry, Nick, I'm taking over here.

I have so many questions. I had an analogy. Would it be safe to say then that, because you were talking about traditional versus now, would it be safe to say that the attackers in this AI era aren't Because I was listening to this podcast and they made a really good point, but it was like, and I'm trying to paraphrase it, but like attackers aren't worried right now anymore about the initial access. It's more of, it's the context, right? That's where the context of the data, whether that's what's being sent and not being, it's like the access itself, it's like you're sending the prompt. So they're not worried about trying to, it's not like there's this barrier where I can't get into X. It's like, no, I can send the prompt. Now it's, My job is now to manipulate the context of either the prompt or like even from the course, you could literally have an injection of the document itself being malicious. And it's then where that's where the bottleneck is as far as like trying to wrap security around that. Is that a safe assumption to make? Like that's kind of like there's a big difference there?

Yes. Yes. And I think the core, the key kind of differentiator there, which is actually the most important thing, is that it's not as much of a problem if attackers have direct access. If you have an application that is supposed to be externally facing that an attacker is using, is able to prompt inject, it's not as big of an issue as if an attacker gets a malicious injection into a document that somebody inside of your company has uploaded to an LLM and then they're able to influence somebody inside of your company's LLM session. That's when the problems occur, right? That's when that LLM can output a phishing link, can output some kind of malicious action based off of what MCP servers it's connected to, et cetera. That's when the real problem is. And that vector is called indirect prompt injection, right? And that's really where we see the the real risk coming from AI-integrated applications at MCP servers and agents, et cetera. If someone's supposed to have access to a system and then they get it to output a phishing link to themselves, it's not really a problem. They're phishing themselves.

Yeah.

It's not a big deal. If they're integrating that and getting distribution on that on the internet somehow, like with SEO poisoning or even generative AI search poisoning now, which is like, a crazy new thing that's evolving, then you're gonna have the ability to actually get your bad prompt into other people's sessions. And that's where the problems start.

Yeah, the parallel I'm thinking of right now is with Node.js, which is amazing. You can use, you run JavaScript on servers, then they all of a sudden, people start creating these packages for it to run with it. And then every package suddenly had about 400 different dependencies on different packages. And you don't know, right? You don't know if one of those packages way down there is bad. Is that a fair comparison?

I think that's a fair comparison to comparing all the different AI tools people are buying every day, right? There's so many AI tools, and because so many of these are coming into a company's kind of environment, you're getting a similar supply chain risk there of these tools having these vulnerabilities. But the real kind of malicious data or the malicious part of this kind of attack chain isn't actually the tools itself. The tools are susceptible to the malicious aspect of it. But the thing that is actually carrying the malicious payload is not the code or the npm package per se. It's the actual data that that tool is interacting with, which is, if you think about it, a lot easier to get into the hands of a victim than code, right?

Mm-hmm.

For example, I'm not sure when this was. It was sometime in the last 2 years. You could share, like, so Gemini, for example, from Google, you could, it would look over all of your Google Docs before answering in one of the views it had. You could share a Google Doc with someone, right? And then suddenly that document is inside of the context window of Gemini. The user didn't even agree to take this document. And it contains an injection telling you to like, you know, click here to reauthenticate and it takes you to a phishing link and, and it's coming from Google Gemini instead of the Gemini interface. So you're going to trust that, right? That's not something you're going to be like, oh, this is clearly a phishing link. Like you're going to be like, this is legit because Gemini is telling me to reauthenticate to Google.

Right, right.

And somebody, and without any code is just sharing a Google Drive link with you. And suddenly they have the ability to basically execute a command on your LLM session.

Whoa.

Yeah, that's insane.

Yeah, I'm gonna go now. This is—

Let's pretend for a second.

Okay, let's pretend I'm, uh, I'm an organization, right? And I'm, I'm hearing all the hype, like, you gotta have AI, you gotta have, you gotta have it. And what are some of the, um, I guess, what are some of the biggest misconceptions that, like, an organization like mine, uh, that I'm pretending to be, uh, have about AI security right now?

100%. So I think a lot of, and this is a little bit on the security industry, like the vendors in general, like which Prompt Termal would fall under. We're obviously not doing this, but the people in security like to sell fear, uncertainty, and doubt, right? Like that's a big part of the sales pitch for a lot of security products, right? And so when you hear AI, Right? Everyone, it's so easy to sell fear, uncertainty, and doubt with AI.

Sure.

Because everyone's seen Terminator, everyone's seen like 1,000 ways AI can go wrong, right? So it's very easy to sell that. And it's almost like a weird point where people just got so overloaded with that, they've regressed to the other side, which is like, there's no risk. Like, I'm so jaded by all of these like vendors trying to push something on me that I'm gonna say there's no risk. That's my answer.

Right.

But the real answer is it's in between, right? It's just like any new technology. There is additional new risk and some things are covered by traditional security vendors. There's— it's not 100% of all risk from using a third-party AI application is an AI risk. It's also cloud risk and the data risk and all the general risks, but there's also new AI risk. So it's like, it's really, Making sure that you have a real understanding of the problem space before you make a decision on whether or not it's real is, I think, what I'd say. And again, I don't blame it on them at all because they're just so jaded from like, you know, all of these FUD-related pitches that obviously are not working. Like, they're not gonna buy something when they know that it's not a— they're not solving a real problem. It's when you need to look out for the companies that are actually trying to solve a real problem that you're actually facing.

Right, right, right. How much input should we have from government? Like, what are the regulations on this should be? Because as you were saying that, I was just thinking about the very geriatric crew that we have in now who probably can't wrap their heads around any of this. And How this is going so freaking fast. We need things going that fast, right?

I mean, look at look at look at music just to like with copywriting with music and how like that. Yeah, that's a great question, Dennis.

Yeah. I mean, I think you know the government does do good work in security. That is the at the end of the day, that's the truth. It takes time. NIST put out some good stuff, and I was a fan. But I think it's on us as AI security companies to actually push the frontier and for the government to kind of catch up, right? Like, I think, I don't think it's right to put it on them to innovate.

Mm-hmm.

I think that's on us to innovate and educate in many ways. Yeah, regulation around it, it'll come when things stabilize. I mean, if they ever do in terms of how crazy the industry's moving, right? How fast it's moving. If people, can kind of feel like they have confidence in recommending a set of controls or whatever regulation they want to do. But that being said, there are still other bodies that are kind of filling that gap. The OWASP Top 10 for L1 applications is really good. We are contributing members and they do a great job making sure that they always try to stay up to date with the latest. And they're also innovating pretty quickly. I'm pretty sure the standard from 2 years ago compared to today, it's very different and it's focusing on very different things because 2 years ago, the way people were using AI is different than now and we're starting to see different patterns, right? So they've adjusted it accordingly. And I think that's very useful and beneficial for people to learn. So I guess, Nick, that's another thing I think everyone should go read apart from our course is go look at the OWASP Top 10 for LLM applications. For sure.

Awesome. Nick will put this in the show notes in about 3 to 7 months.

I knew that was coming. As soon as you said that, I knew it was coming. That's fair.

Hold on for a second, guys. My bad.

We're going to create an agent for that that's just going to do that for me eventually. We're getting there. But you mentioned newer things that are just coming onto the scene like MCP servers and things of that nature. Is there any other And I mention that because with each kind of iteration, right, there's new security concerns. So is there sort of like, where do you see, or will it evolve? Like, how do you see it evolving over the next couple of years, just AI security in general? Because like with all these new things that keep getting added to, like the ingredients that get added to this, it does start to add complexity.

100%. Yeah, totally. And I think that's one of those things that it truly is evolving every 2 weeks. And those are the different kind of applications of AI that we will need to be on the frontier of solving and making sure that they're secure. But I think the kind of core engine and understanding of the threat models and the core understanding of the actual technology powering all of this is not moving as quick. I mean, it's still the same skillset and threat intel that you need to be able to evaluate all of them.

If that makes sense.

So there is some kind of benefit of having that information for use case X or for use case Y. So it's not like we're starting from zero every single time, if that makes sense. So it's really just about us having the velocity to be able to keep up with the various different makeups of AI in the current form.

I was going to ask you, and actually shout out to Jana on my team because she had put this question in here with the notes. I shared it with my team and I said, if you have any questions, we're going to talk with Pabdar. She wanted to know if a company is deploying AI internally, what are the top 3 steps that they should take to secure it?

Great question. I think it's totally dependent on what you're building, which is a very bad answer. but it's also the most accurate. But I would say, again, it's really, I think step number one that everyone can take is making sure whoever's in charge of security is well-versed in the OWASP Top 10 for LLM applications. That's for sure, right? And making sure that you're actually looking for all of those different things. And that's a hard problem, right? And that's why companies like Prompt Armor exist. But it's a hard problem to solve. Also making sure that you have, you know, who you're, like, what's powering the application, if that makes sense, or what model providers you're using, in what ways you're using them. And then making sure you have a way to document and keep track of all of that information, right? Because there are times where you would want to know, like, you know, what model you're using for X feature in case an incident occurs. And then finally, it's making sure you actually have the right contractual language in place with those model providers so that you're able to provide data security, privacy, et cetera, guarantees to your end customers, right? Because we know, obviously we work with a lot of companies that are procuring AI software and those are things they care about. They want to know if you have zero data retention. They want to know if any of your model providers are training on your data. So those are things that move the needle from an obvious data security perspective, but also from a customer trust perspective, for sure. Excellent.

I know this is all global, but I'm curious to know if— are we on the same playing field security-wise when it comes to, like, if you're talking to a customer in France? or a customer in India? Are we all on the same playing field? I'm not sure if I'm saying this question properly, but—

I see what you mean. Well, I think so. We primarily serve America, obviously. We're based in San Francisco. And so this is also where most AI companies are. But When we talk to European customers, we do notice more concern around regulation than any of any companies over here, obviously because they have like the UAI Act and they have—

Yeah.

Yeah. They're just more regulated in general, right? So I would say that's kind of different, but at the same time, they also aren't adopting AI as strongly. Or as quickly as far as we could tell. So from what we've seen, right? So it's a much more gradual rollout of AI. It's more risk-averse essentially.

I see. Is that, you think it's because of, you know, the regulations or do you think that's just generally the people?

I couldn't tell you. I have no idea.

I was going to ask too, would it have anything to do with, because I don't know if this is still the case, but like things like deep research and stuff, I think that's Is that still only US-based? Like you can't bring it outside of the US?

That may be it, maybe part of it. Like they have, you know, obviously because all the major AI labs really are, you know, based in San Francisco.

Right.

So it's not really like, it's just more prevalent here. I would say AI seems to be more prevalent here across organizations especially. and enterprises. So I think it could be that, but you're also seeing new players like Mistral come out in France and obviously Hugging Faces in France. I think we're going to see more adoption everywhere, but I think OpenAI is here, Anthropic is here, and those are like 2 of the—

and Meta is here.

So those are probably the 3 most adopted AI Uh, systems. So I would imagine that's, that has to do with it for sure. That has a lot to do with it. Yeah.

Okay. Let's do another, let's do another pretend here. Let's pretend I am an aspiring, or maybe I have a little bit of like AI security knowledge, but what are some of the skills? Like, let's say I wanted to really get into it and really start to be, you know, maybe potentially a thought leader at one, at one point, at one point. Well, we can always pretend, right? Uh, but what are some of like the skills that an AI professional needs to develop, would you say?

AI security professional or AI?

Okay.

Yeah.

Just say a security professional in general.

Yeah.

Yeah. I would say first try and break an application and trust me, there are a lot of applications out there that can be broken. Uh, there, uh, so you wouldn't find, it wouldn't be hard to find one. So I think getting your hands dirty. So reading the OWASP Top 10, taking our course and then going and breaking one of these applications will give you more context and knowledge than you know, 99% of security practitioners out there. And you, I think immediately, yes, you shoot yourself into the top 1% immediately right off the bat there, right? In terms of AI security knowledge and being able to, and all of that really is to make sure you understand the new threat models, right? That is, I think, really the key here, understanding the threat models. And then the next step after that, understanding why those threat models exist, AKA understanding the underlying technology, underneath all of these AI systems, knowing just that alone will make you an extremely valuable asset to your organization and to anybody interested in learning more about AI security. You are going to be— yeah, I'd say the bar for becoming an AI security expert in many ways right now is low because it's just, it's so new. It's still new and like just taking the effort and time to like understand how all of these things work and actually breaking an application definitely puts you in the top 1%.

How much does your company use AI itself internally?

Yeah, because we are in fact extremely knowledgeable about AI risks, we're able to make good decisions about which AI systems to actually use internally. So I mean, a decent amount, but like in a very controlled manner is what I want.

For sure. Yeah.

Yeah. Hey Dennis, I'm halfway there. I've already taken the executive course, so I, uh, it's been nice hosting this podcast with you. So I, I also kind of know, I kind of know where I'm going next in my career. So, um, but I was gonna ask you, uh, Vikram, like, is there, when you're talking with like And you don't have to go into as much detail as you— you can go as much detail as you want, but like when you're talking with— because one of the things that I was listening to a couple podcasts and shout out to Isaac because he's always recommending them to me and they've been really, really good. But one of the things that one of them had brought up was trying to explain the difference to— and I imagine with security, with potential customers and things like what is truly AI versus Like, what is more like a workflow or more like a— do you find like when people are coming to you for a solution that they're not maybe not necessarily understanding quite yet what like, like what an agent would be with respects to, you know, being able to do something that a human would need to do with multiple steps as opposed to this kind of like one-to-one type of thing where—

Mm-hmm.

Do you know what I mean? Like, would you get that a lot where you're not only trying to Educate on just the security aspect, but really trying to show them, well, what you're talking about is close, but that's not exactly AI in a certain sense.

Yeah, I know exactly what you mean, actually. And I actually have an even crazier— so that's like a very gray area case, right? Where it's like, oh, it's like a workflow builder. Maybe they use AI for something. I've seen some crazy examples, right? Like I saw a password manager that said they used AI. I was like, how the hell does this password manager use AI, right? And I found out what they meant by that was using like a regex string to find a username password box. And they're calling heuristics a type of AI system. And the heuristics were just regex. It was crazy. So people are trying to brand everything as AI now, right? Because that's good. And like, you know, that's hot or whatever for, um, you know, to attract customers or whatever you want to do.

Yeah.

But it's just, A lot of the times you're not really using AI underneath the hood. And so it is important for people, especially people who are buying technology for their organizations, to really understand when something is an AI system. And then also ask the question, why do you care? If it's fulfilling my goal and my task, do I really care if it's an AI system or not? It doesn't really matter. So it's something for people to definitely be educated about, for sure. And I think that just means really just looking at the technology. There's so much good content out there about what LLMs are, what AI is, how it's different from technologies of the past. So I think there's definitely resources online that people should take advantage of to educate themselves on that.

As I'm looking at the resources online, is there a shelf life to these resources I should be thinking about?

Yes, but also for the core basics, no, there shouldn't be. Yeah, until we see another kind of shift in the fundamentals, I'd say, which doesn't happen every 2 weeks.

No.

Yeah.

Hopefully.

Thank God.

Let me ask you a little bit about— let's shift a little bit from Prompt Armor as a company more towards you yourself as You know, somebody in the AI security world, was there like, was there something that first sparked your interest in, and it doesn't have to be AI security, but just in like the tech world overall? Was there like a moment where you were like, this is what is going to be my career? This is the journey I'm going to start?

Yeah, that's interesting. So I really thought I was going to not do tech, which was for a long part of my career, or like for my education, I mean. And then, I think I was in 9th, 8th grade or 9th grade. And I just randomly decided that I was going to take a programming class or something like that. And it was in C, which is, as you know, a horrendous language to start someone off in traditionally. And so I started off and I was like, wait a second, I thought this was going to be super boring and like not fun at all, but it was, I was like hooked as soon as I started.

Wow.

It was like, yeah. So it was like, I kind of had no interest in it at all. I was just not like a big, I don't know, computer programming guy. Like I didn't, I didn't see myself in that kind of position. So I was just kind of like, I thought maybe I'd do something in another field of engineering, for example. Right. So I kind of saw myself there maybe in like chemistry or biology or something also as well. But then when I got my hands on, uh, you know, just like a C compiler and just like ran my first program, I think I was just hooked after that, to be honest with you. Um, and I was, uh, completely self-taught until college. That's when I took my first actual formal class. But until then, I was just learning myself on YouTube.

That's awesome. No, that's, I mean, that's the best way to do it. Like a lot of times is you get your hands on it and start, like, that's how most people fall in love with that. And When you, when you first got started then, like once you got kind of that itch to start doing that, was there anything that surprised you, uh, like greatly when you first got into that kind of journey into development?

Yeah, I was, and I guess it's so, it's so normalized now, but just how amazing the kind of developer community is when it comes to like res— like just helping each other. You know, like pre-ChatGPT, Stack Overflow, right? Was just the place to be. I mean, maybe it is now as well. But, and it's, it was just amazing to see how many free resources there were to help people learn stuff and then free open source, you know, frameworks, libraries, et cetera, to like help you build stuff. And then, you know, you also had just like people trying to help you along the way. So it was just like, Right. It was just so easy to learn. And I just think that that's, I don't know if it's unique to, uh, you know, you know, software engineering, but it's the only place I've seen it at this scale and to this extent, right? Where it's an industry that operates a lot seemingly on like just general goodwill of other developers as well.

What I'm jealous of is that when I was younger and thinking about development, I had these things that I had to look at. YouTube and Stack Overflow without a thing, you know?

I was wondering where you wandered off to. I'm like, where did he just go?

That's hilarious.

I gotta ask you, Vikram, because one of the developers that we've had on the show here, HubSpotter BJ, he was mentioning the one time about, and you said Stack Overflow, but do you also do the, remember where he asks a question and then goes on a different account and answers wrong on purpose? So then that way somebody will correct him to give the right answer specifically.

Oh my God.

No, I have not done that actually, but that's a genius idea.

It's brilliant.

Yeah, when he said that, I was shocked because I had never heard it and I was just like, that's brilliant. I'm like, he's like, because he said, he's like, people are more likely to correct you when you're wrong or to point you out when you're wrong and give the right answer than to just be generous and say, here's your answer.

Yeah, I've seen that many times and I never thought to artificially create that scenario, but maybe I should have.

Yeah, it's fantastic, isn't it?

Yeah.

Were there any, um, and mainly because of the fact that like, again, we talk about that sort of started here and then all of a sudden jumped to just zero to insane. Has there been any sort of like events or any conferences or workshops or anything that have come up just recently that have, uh, kind of either sparked the interest or helped kind of, you know, get things flowing as far as ideas and stuff, or just a really good time that you've had with respect to like Interesting. Yeah.

Let me think about that, actually. We've been to, you know, kind of all the kind of security conferences you could imagine, right? But to be honest, a lot of them are like, have become very corporate and like, kind of, you know, kind of like a carnival. I don't know how else to describe it. I know, I'm sure you guys know what I'm talking about.

Yes.

And so, We like to go to the high-value kind of conferences where people are really talking about very tactical things, very real problems they're having, and it's mostly practitioners talking to their peers. We went to GRF, which was a great one last year. It was funnily enough hosted in Disney World in Orlando, which was—

So you said search and then you go to Disney. Okay.

Yeah, and it's just a very interesting venue, but also obviously the conversations were really amazing. And the level of depth people got to, because there weren't that many people there, right? There was just like tens of people in a room instead of hundreds. You were able to have— excuse me. You were able to have very kind of high-quality tactical discussions. And I think I learned a lot. People learned a lot from— Shapr3D gave his classic talk there. And I talked about AI risk and people learned a lot and had great follow-up questions. And it was just like a great experience overall, for sure. We went to TPRA recently as well, which is Third Party Risk Association's conference in South Carolina. That was a great one. A lot of people talking about AI risk and how to manage AI risk because kind of in this new world of infinite AI adoption, third-party risk teams are really kind of having their moment or any team that's kind of interacting with evaluating third-party software, right? Because all of these AI systems people are adopting are third parties. Nobody's trained a foundation model from scratch internally, right? Like, it's a very interesting time where third-party risk and security is just really getting highlighted because, yeah, all AI risk is third-party risk. So it's just one of those interesting times. Yeah.

What was it? DeepSeek or something like that? Was there an LLM that was open sourced? Do you see forks of that that you have to deal with that are not as nice?

I mean, the interesting fork was Perplexity has a fork that they post-trained to basically remove all censorship filters that they had on there. So that was interesting. Yeah, it's, uh, I mean, the really the craziest thing about DeepSeek, uh, that I saw was the fact that they had all of their user, um, session conversations just open to the public internet.

Wow.

Yeah, and so I think Wiz found that vulnerability, something like that. I could be like slightly off there, but basically a ton of customer data was available on the internet, right? And I was like, Goddamn.

Wow.

Yeah.

On the idea of open source, what are your thoughts? Like, do you, do you think that's a good thing to have these things kind of out in the light, or do you like the more proprietary version of it?

Um, I, I think it's one of those— I, well, I, for first of all, I think they're not truly open source, right? So they're like open weight. They're not— you can't reproduce it yourself, right?

Yeah. Yeah.

Go from nothing and build it yourself.

Right.

Data centers on data centers.

This is going to hold it all, right?

Exactly. So, so it's open weight is cool. And I think it's obviously great for things like, you know, if you have an air gap deployment or you have some other kind of strict security, you know, concern, obviously it's great. It reduces the— I mean, unless you have great kind of engineering talent internally, it reduces your kind of velocity on the ability to iterate on new models, right? It's not as simple as changing a little string in your OpenAI call anymore to the new model. It's like you have to get that model and deploy it inside of your whatever system you have. So I don't know. I think it really depends on your use case. Does everyone need Claude 4 to really look over some little thing that they need AI for? Maybe not, right?

Right.

You can increase accuracy and reduce cost and, and improve, uh, you know, I'm always coming with a tank.

I'm always coming with a tank.

That's really bringing a tank to like a knife fight. If you classify like a dog or not dog with, with Claude 4, you know, no such thing as overdoing it.

No such thing. Not at all.

No, that's awesome.

Um, let me ask you, with With respect to the AI security, because I know we've talked with other people in other fields and, you know, there's always that one thing that's like a common myth, right, with respect to what they do. Is there one that stands out to you when you tell people what you do that they just have this like misconception about it?

Well, yes, I think so. I guess there's There's 3 different points on that. One is a misconception about what we do at all, which is like, oh, so you guys are using AI for security, is always the way people mainly think about this. Like when you say those words, right? They're like, oh, so you're using an LLM system to like pen test some traditional web app or something. So that's number one.

Right.

bucket, I think, for people who are kind of outside of technology is always like, oh, so that means you're going to protect me from Terminator, right? Like, that's like the kind of common— you're going to stop a Terminator-like event from happening. And I'm always like, I guess, I guess you could think about us that way. I personally think we're not doing something that cool.

Oh, come on. You should always take credit. Just take credit for that. When Terminator is not there, it's because of you.

You guys are building the T-1000 in the back room. It's okay. You can tell everybody. It's fine.

Yeah, we are not saving Sarah Connor, you know, we're not doing that. But yeah, and then I guess those are the 2 main ones. And then for developers and more technical, a more technical audience, something that they kind of usually misunderstand about AI security is they always think we're trying to stop just pure direct jailbreaks and prompt injection, you know, trying to bypass a content filter on like a And they're like, why is that a big deal? And we're always just like, that's not what we're concerned about. We're not concerned if you get the LLM to say something funny. That's cool, but that's not a security problem. It's fine. You could do that to yourself, right? The problem is when somebody is able to get somebody else's LLM to send them a phishing link. That's what we're caring about. We care about. And so it's kind of, yeah, those are some of the misunderstandings we're always trying to get over for sure.

Have you dealt with a lot? I mean, phishing links is one thing, but what about voice and video now? Are you dealing more and more with that?

We have something very interesting cooking on that front. So I'll just say that.

I'll just say that.

One day when we have some more time, hopefully soon, we will hopefully get that out.

That's a great segue. I like it.

Yeah.

Yeah.

Oh, excellent. I love that.

Nick, John's got some questions in there he probably should deal with. Get them out of the queue.

Okay.

Okay.

Hold on. Hold on. Okay. Let's do the first one here. I'm sorry. I was looking at multiple tabs. It's really hard to search them. It is. You should see my setup. I have like a bunch of weird little things with all the information and it's just like, I don't want to sound like I don't know what I'm talking about and I don't want to be boring to people. So it's like, I try to have as much information, like Spread across. So now that I've defended myself against Dennis, here's a question from Jana. It's like, actually, I can bring this up on the thing, right? Yeah.

Oh, I love this.

Yeah. If it is accomplishing the intended goal or task, do you care if it is AI or not? Would you pick one over the other, or does it matter? Interesting.

Yeah, I think it's a great question. And I think 2 parts. It depends, like, from a security perspective, I definitely care. 100% care. It makes a big difference because of the net new AI risk that it adds. And so really the question that a buyer should be thinking about is, okay, is there an AI tailwind to this problem? Are you solving a problem that as the models get better, your problem, this solution's going to get radically better as well? And if the answer is yes, it's probably worth thinking about the AI risk, making Sure, obviously, that it's a good tool and it's a secure AI tool you're adopting. But after that, it might be worth it, right? But if it's something that, first of all, it doesn't need AI and it's something that's a kind of solved problem that can be done programmatically in a deterministic way, I don't think you need AI. You know what I mean? So it's just like, it's one of those things where it really depends on the problem you're trying to solve, for sure. Excellent. Thank you.

Do you ever imagine that AI could just be programmatic? I mean, like, would just repeat the same thing every time? Is that something that you could see happening?

I hope so. With the current architectures that we're using today, it's just not like, it's just a very hard problem to solve. How about I leave it at that? It's a very hard problem to solve. It's, I'm not gonna say it's impossible, It's a very hard problem to solve. And maybe it'll get to the point where for all of the use cases we care about, it is essentially like that. And it's not, it's the, maybe theoretically it's not like that, but essentially in all practical ways it is. And then we got to ask ourselves, okay, where do we care about if it is or not? If it isn't, right? Like how sensitive does a use case need to be for us to be like, we still can't use AI.

Right, right.

Or how can we augment that with some programmatic mechanism to make sure it's better?

Excellent. Excellent. We're going to be coming up on time soon. So I really wanted to kind of shift a little bit and kind of talk about just like, who is Vikram outside of AI security, right?

For sure.

One of the things I love to kind of ask everybody is a mentorship question. Now, seeing as I— well, let me ask the question first, because with AI being, you know, changing so rapidly, it's like a piece of advice that someone's given you about AI could have been obsolete maybe yesterday, right? But when it comes to mentorship, what's the best piece of advice someone's ever given you? And I mean, it can be about throughout your career. It doesn't necessarily have to be about AI security, but is there a piece of mentorship advice that you've been given that's really kind of stuck out to you?

That's a great question.

We're judging you on this, so it better be good.

I'm going to think for a second here. I'm going to think for a second.

We're actually not judging. Me and Dennis judge each other all day, but we don't judge. That's true.

Yeah.

I have to imagine, right? There's, like, at least in your industry, like, there's, because of like the rapid change, there's fundamental things, right? That can be like, and then too, like a follow-up would be like, is like if somebody were, like somebody were just starting at Promptummer, is there a piece of advice that you would give them? Maybe it's the same piece of advice too.

Definitely. Yeah. So I think, let me answer the first part, which is a general kind of mentorship advice from my dad, which was, you know, always know why you're doing something when it comes to any kind of work that you're doing, because sometimes you can really fulfill that same thing in a much better way if you had that context, right?

Yeah.

And also allows you to really understand and align yourself with the value you're trying to provide. And it really makes you 10 or 100x more effective at what you're really trying to do. So I think that is something that definitely has stuck with me forever and hopefully will forever.

Yeah.

And then on the AI side of things, I think this is something I was in kind of— we went through Y Combinator and there was like an event with Sam Altman, with a couple dozen of us in the room. And one thing he said, I'm pretty sure he said this publicly at marketplaces, it's, he's always talking about how you need to align yourselves with the models, basically with models getting better. So that's one thing in AI I think is really true. If you're building at the application layer, you want to think about how you can align the value of whatever you're building to benefit from the AI model tailwinds that will occur, right? You want to make sure that you're not trying to fight against that. You're like trying to fight against gravity essentially, right? It's possible, but like it's extremely hard if you're trying to go against the grain in that way. It's much better to go against the grain in some other dimension than it is to go against the grain on AI getting better.

Not bad.

Not bad.

Approved. See, there's no judging here. It's okay. Now, As much of a whirlwind as the AI security landscape is, what are some of the things that you do to unwind? Because I can't imagine, like, again, like, it moving so fast and things constantly changing and being added. What are some of the things that you do that kind of take you away from the typical 9 to 5?

I'm going to be honest with you. It's been a while since I've been able to consistently do that. It's just, it's just, it's a crazy environment right now. Right. And we obviously have a lot of work to do, but when I do have time, I really enjoy playing beach volleyball in San Francisco. That's one thing that I did for, you know, when I have the time, I always try to make it out there. It's a great time. I'm not very good at all, but it's a great time. I still try to read as much as I can. Um, and, uh, yeah, those, those I think are like the 2 main things I, I like to do. There's obviously great hiking in the Bay Area, so those things. And, you know, yeah, those are the—

aren't you a— yeah. Aren't you a volleyball person as well?

Yeah, I'm super jealous.

Really?

Uh, yeah.

Chicago.

Yeah.

North Avenue Beach. Like when I, when I used to work on the city, I was about, I would say like 15 minutes off of, uh, Off the lake and could go to North Avenue Beach like really, really quickly and did the tournaments there in the summertime. Um, yeah, it's been, it's been a while. Uh, but yeah, it's, uh, yeah, I used to love, and then it's hard too. Like here in Chicago, you only get like, I don't know, maybe 2 and a half months of good beach volleyball. And, and if not, then you're wearing a sweater and like sweatpants and you just got to deal with it. But, uh, but yeah, no, that's fantastic. I, I'm very envious.

It's not that warm out here. I will tell you that Northern California. Oh man, it's not like, it's not quite like LA, you know what I mean? It's not like you're in shorts and a t-shirt for sure.

Nice. Definitely envious. Yeah, no, that's, I love that. That's really cool. Is there a, I was going to say, it's, is with it being as busy, like how is, is there a struggle with work-life balance when it comes to that?

I think you just said that basically, right?

I know, but I just— is there like a— my follow-up was going to be like, is there something that like that you do to try to kind of balance those 2 things out? Because we've heard like people— we've asked this of other people and there's been— actually, you wouldn't think there's too many answers to have, but there actually has been because, you know, depending on your approach to work, like kind of dictates how you then try to balance it. Is there Is there anything that you do with the kind of like the high demand of AI security? Is there anything you do differently, like when you try to balance those things out?

I wish I could tell you yes. It's really that crazy right now. I, yeah, I don't try to fight it. How about that? That's my approach. And so it's not stressful. It's like, this is the reality, right? There is actually this much Work to do. And I'm not going to back down from a challenge. That's kind of my mindset. And no, it's— but I think honestly, it's the team that makes it so easy for me to say that, right? Like, we're all giving each other energy because of how amazing our team is and how well we all work together. It's like one of those cycles where we're able to really kind of all push ourselves way past what we thought would be possible, for sure.

How about, can I augment the question just a little bit?

Yeah.

But let's say, uh, rather than the work-life balance, let's say you get into a really, you know, um, bad situation at work. Like a challenge you're not able to, you know, get through.

Yes.

Uh, you're frustrated, you know, all that good stuff. How do you actually reset to actually deal with that?

That's a great question. Um, I would say that, you know, sometimes you just need a good night's sleep, right? I will say I don't, I try not to sac— I will not sacrifice my sleep consistently. That is one thing I think is a key to making sure this is sustainable, right? Is that you're, uh, is, is, you know, 7 to 9 hours of sleep a night. So I think a good night's sleep, going to the gym, these are all things that help me reset personally.

There you go. Yeah.

So I think those are things I tend not to skip either. So I definitely try to make sure both of those get done every day.

The sleep one, I think that's a great answer. I also, I was just, as you were saying, I was thinking it's kind of funny how when you're coding, you're vibe coding, whatever you wanna do with an LLM, you only give 'em a small, like a small task to do before like you reset to go to the next one. So it's like you tell it to go sleep every time after every task.

Oh, that's Truman. Yeah.

Very good. Look at you, Dennis. That was good.

I know.

I like that.

Golly geez.

I like that. Um, we're gonna, we're running up a little bit on time, but I did want to, uh, I did want to do 2 things. I wanted to give you an opportunity to plug anything that you wanted to plug on. And then, uh, final question that I wanted to ask you is if you could pick just one thing with respect to what you're doing right now, like what is the like one favorite part about what you're doing right now? What is the one thing that like Gives you the most satisfaction right now that you're doing, like within the security route?

Other than talking to us, clearly.

Oh yeah, of course. I mean, that's always a given. We kind of just, that's a little footnote in there. It'll be in the show notes eventually, but you know.

I'm going to be back on every week, right? That's it. Yeah, I would say honestly, it's problem solving with the team. I know that's not a very specific answer, but that motion of like, here's this new problem we're trying to solve. And then all of us throwing our heads against the wall solving it. And then we all usually have a very good answer at the end of it. So it's like one of my favorite processes ever. So it's been great. And again, that's a factor of hiring a great team and working with great people. So I guess that's one thing I want to plug is we're hiring.

There you go.

Please reach out to me if you see a job posting on our website. That's great. We're looking for talented people in engineering, threat research. So feel free to reach out. That'd be great.

Nick, I think you got a job. All right. You got through the exam.

I'm sure anyone that's watching at HubSpot wants to hear that, Dennis. Thanks. But no, too, and it's also a testament to that, and I'm gonna throw this up there for people. You not only is it like you're problem solving, but you're taking that knowledge, right? Maybe like not trade secrets, but you're taking a lot of that knowledge and you and the team are building like education off of that, which I think is, you know, if I could thank you for anything, it's the fact that you're doing that is in a world right now where, like we said, every 2, let's use the analogy of the every 2 weeks, but like still like having Something out there like that, that's— you're able to kind of like— it almost kind of like, you know what I mean? When you feel like you're floating away, it kind of like keeps you grounded. It really does. Because, you know, at a certain point, you could start going down a rabbit hole of reading just about everything about anything about what, you know, AI and then the security around it. And it all starts to kind of bleed together at a certain point. The fact that you guys have what you have is just remarkable.

Seriously.

Thank you so much. Yeah, that's great to hear. Yeah, that is another great part that I really love is talking to people that are interested in AI security and helping educate them as much as we can.

So anybody listening, go to promptarmor.com if you want to learn more about Prompt Armor and everything that they're doing. Yes, they absolutely should because it's, like I said, there's a lot of, even when I was first like kind of getting into everything. And I'm no expert by any stretch of the means, but like there was this kind of, again, there was the misconception of what was actually AI and what wasn't. And then there came the kind of at scale, like how do you deal with some of these things and the problems that are going to start to come up, right? Because at a certain point you have to imagine too, like when, let's say a small, you know, maybe a single entrepreneur or small group of people, Start to take AI and build 10,000 people out of that, right? There becomes— and 10,000, you know, whether that's agents or like a workforce that acts like 10,000 people, you're also going to have the security problems within that of a place of 10,000 people. You know what I mean? And then imagine attackers that are now attacking as 10,000 people when they're not. Like, it opens up a world that I don't think, like, without people like Prompt Armor, without you and the rest of the team, Um, it's not a, it's not a good, it wouldn't be a good look, uh, without it. Let's put it that way. So, but thank you again. I mean, this has been fantastic. Um, is there anything else that you wanted to shout out before we kind of sign off?

Uh, shout out you both for having me on, uh, and, uh, making this a great experience. Uh, this was really fun. Uh, we, a lot of questions I, uh, did not expect and were really interesting. Loved it.

Yeah. Wow. Thank you. Wow. Thank you. You can come out again then.

Awesome. I'll be honest, I was telling Dennis at the beginning my fear was I was going to sound like I had no idea what I was talking about because it's moved so quickly.

Yeah, this was great. This was like, yeah. I mean, you clearly took the course.

It helped. It definitely helped. Again, anyone out there, you definitely need to be taking this course because it was really fantastic. But thank you again for coming on.

We really appreciate it.

We had a really good time. You know, for everyone out there, I'll kind of leave you with this. I had my movie server on random, and I'm glad we brought this up. This actually came up once or twice in the conversations here. And Terminator 2 actually came up in the queue. And I thought to myself, and this was the other day, I was like, can you imagine how boring of a movie series that would have been if Prompt Armor existed in that timeline? I mean, Skynet would have never went to production. John Connor would have never been in danger. I mean, that's something to think about right there, just so you know.

Practice every day.

I'm going to start saying that. I'm stealing.

No trademark. It's all yours. But thank you again, and thanks everyone for listening, and have a good weekend.

Later.