Episode 23- Developers:After Dark with Vikram J

Foreign.

Hello. Hello and welcome to episode number 23 of developers after Dark. I am your host Nick with my co host and as always, Dennis AJ is a little bit under the weather today, so he will not be joining us, but that's okay because we have a really, really special guest that I will let him introduce himself in just a second. But before I do, let me pay a couple of bills and just let you know that obviously if you want to check out any of our back catalog or if you want to watch live not only on YouTube but you can check it out on the website as well. And that's devs after darkpod.com for those of you who are listening and not on the video. And then of course, always, always, if you want to check out what's going on, not just us, but everybody else, there's also the HubSpot Developers YouTube channel and that's @HubSpot Developers. And you're going to find stuff where you're going to find new episodes of us. Of course, the one with Chris Conant just dropped just recently. There's also some really great stuff from Brooke about the Figma plugin for UI extensions.

Right.

So you're going to have that going on and then also an introduction into the center of developer excellence as well. So there's a video you can check out there to learn all about that. So I definitely encourage you to go do that also too. As always, the changelog. If you want to know what's going on at HubSpot, both upcoming and what has just been happening, you can go to developers.HubSpot.com changelog and you'll be able to check all of that out. Now, without further ado, I would like to introduce our guest. Vikram, why don't you tell everyone who you are and what you do.

Hey everyone, excited to be on here? I'm the co founder and CTO of Prompt Armor. We're an AI security company. Yeah, very excited to chat with you all today.

For those of everyone that's listening that may not be familiar, which they should at a certain point, I'm telling you right now. But why don't you tell everybody what Prompt Armor is and what it can do for them.

Them, definitely. So we're an AI risk intelligence platform that allows you to evaluate and continuously monitor your third parties and vendors inside of your environment. And it's. Yeah, that's, that's kind of like the, the gist that I always like to give initially and I'm sure we'll dive into more details as we, as we.

Go along here, how, how old is this business?

Yeah, it's, we're just over two years. We've been in AI and security for a lot longer than that. But the official company has been around for about just over two years.

So you, I mean, it's been a, kind of a crazy two years then for you, right? Like things like here, here, here, here, then boom.

That's how it tends to be, I think, when it, when it comes to startups. Yeah, it's, yeah, it's, we've, we've grown a lot since we first, first started, obviously working with some really, really great big companies and solving a lot of real problems, which is the most important thing for us. So, yeah, it's, it's been, it's, it's been a great ride so far.

I don't know, I think you have to prove to me if there's any risk associated with AI.

I think it's all, it's all hype, right? It's all hype. Ah, let me ask you, was there a moment where, and you may not have had maybe the name Prompt Armor and maybe you hadn't had, you know, the, the branding or anything picked out just yet, but was there a moment in time where you said, you know, in this environment we need to make something like this, or we need to make a Prompt Armor because this is where it's going. It was, did, did anything ever stand out in that whole kind of process as Dennis was talking about? Because things went kind of like from 0 to, you know, 100 instantly.

Yeah, I'd say it kind of happened before we even started Prompt Armor in many ways. Right. So it started when my co founder Shankar and I worked at Engine Security at Roblox, which is kind of this kind of subfield of security that's focused around cryptography and like a real time system and like anti denial service and a whole bunch of other security things that I won't get into. But, but when we saw kind of GPT3 come out from OpenAI, we kind of saw the potential of the technology, of course, immediately before ChatGPT even dropped. And just being people interested in security, we were like, okay, but what are the security implications of this? Right? So as we kind of experimented, we were like, wait a second, there are some pretty big security implications from these, these AI models and especially how they're integrated into applications. So we did a lot of pen testing, a lot of red teaming, and we were like, this is a real problem. Like a lot of people are susceptible to these things. And this is only going to get more kind of proliferated as AI models get better and therefore more useful. So more people are going to start implementing them in more powerful ways. So we're like, we need to get ahead of this. And that's kind of the impetus for.

So are the risks vastly different from model to model, or is there like a unified or like a similar pattern for all of them?

Definitely, yeah. So the risks differ by model, by model, assuming they're all large language models. So if you are using a, you know, more traditional machine learning model for something else, the risks are definitely different completely. But even today, most people are using large language models inside of their applications that they're integrating with. You know, they're using the OpenAI's, the anthropics, the mistrals and metas of the world. Right. So those models all carry kind of similar risks, I guess, but to different degrees, if that makes sense.

Yeah, I apologize. I'm so into the hype of everything's a large language model. Always means that to me. Now.

No, I mean, that's. And that's the thing, right? That's kind of true for everyone at this point. Most people at this point. Right. Very few fields haven't been touched by large language models now.

And that's. And that's a lot to try to take in too, if you're somebody that doesn't really like, if you're just on the cusp of it or because, you know, like everything's swirling around very, very quickly. I wanted to ask you, is there any type of thing that anybody can do to try to better understand just like the basics in general, 100%?

Yeah, I think there are kind of two very. Yeah, I guess. Let me zoom out a little bit, then I'll answer your question. So there are two very common kind of mainstream views, I think, on AI security. One is that. And they're both kind of like, you know, hyperbolic. They're ones like, there's no difference between AI security and regular security. It's the same thing. Right? There's absolutely no difference. There's no. You don't need to spend one brain cycle thinking about this. Right. And then you also have the other camp that's like, AI is going to destroy us all and that this is all like uncontainable. And this is. We're basically just, you know, it's a matter of time before Terminator happens.

Right.

And it's just like those are the two camps. So obviously it's very Hard to cut through the noise as a, as somebody who isn't thinking about this all the time and who's, you know, this is one part of your job as a security practitioner, as a developer. You're, you're not. It's very hard to cut through all of this noise. So, yeah, the truth is, yes, there is new risk to AI. A lot of it falls outside of the traditional patterns that you see in security. But it's also something that you can learn as long as you kind of approach the problem from a different mindset than either of those two extremes and you actually just kind of look at the core fundamental technology and understanding that and the new attack patterns that we're seeing emerge. So a little plug here. We have a course that we offer for free through the third party risk association that allows anyone to sign up and get a full kind of course on the basics of AI security and how to evaluate AI security risks in third parties as well.

I have to say, it is one of the most. The way it's done. I've gone through it and the way it is done is very, very. It, it makes perfect sense. Do you know what I mean? Because there's certain things that you try to tackle that are just. It's one of those things where I, I've done other things where I've had to either take the course over again or watch the video like maybe six or seven times, embarrassingly to admit. But like before I really, before it clicked, I watched through the first set and I was able to really understand on the first shot, just, it made sense. And there's very few. And kudos to you and the team. There was very few things that I've seen where you're able to do that.

That's all shocker. That's all Shankar, my co founder, I will give him 100 of credit for that. He, he really killed it with that one. He's, he's great at breaking down very complicated topics into, you know, something that everyone can really understand, which is great.

And the steps are. And the way he walks through it too, is very good. It's pretty good. Like you, you can't get much better than that, if at all. Because, like, as someone who does it myself, I tend to kind of go. And Dennis can attest I'll go off into like tangents or I'll start to like backtrack and try to do this like Tarantino thing where I go backwards and then forwards again. And it's very, it's confusing. But he does a Remarkable job of just laying it out and staying on track. And it's. I can't say enough about that because it was pretty instrumental.

He's being invited across the country to present at various conferences. Right. And it's like everyone's always just like, I've never heard of this and now I also understand. So like taking a brand new concept that nobody's heard of and like explaining it in such a simple way that they fully understand it at the end of it is like very impressive. So yeah, he's great at it.

Absolutely. Because there's even two where I remember I was just, just not too long ago, we were watching. The CEO of HubSpot was talking and she mentioned that the. For. With respect to like AI and AI security and all of that, that the experts are usually about two weeks ahead. It's not like they're 20 years ahead because things are moving in such a, you know, rapid pace. So to try to defend against that and have like security built around that, you have to be moving that fast, if not faster.

So like, is that legitimate? Like would you say that the security aspect of it is like two weeks difference? I mean, okay, maybe not two weeks, but like, you know, a short amount of space between breathing room.

You know, it's interesting. I think it's kind of like one of those things where it's a little bit. It's. It's yes and no. That's my answer. So it's like one of those things where if you have that base understanding which is like a big, a big leap. Right. Then yes, you can stay. It's like, you know, the experts maybe, you know, maybe not two weeks, but like n number of months ahead. Yeah, but the problem is people don't have that like big base jump that like the stepwise function gain to like start following in those like, you know, with following behind closely. It's the real problem is giving people that core base information so that they can start being close to the experts. That's, that's how I would see it. So without that, it's like a huge gap that isn't really something that you would even be able to close. Yeah.

Could you, could you be willing. So I'm this, I'm very ignorant to all this stuff. So talk to me like a child here. As I would tell Chad GPT to do for me. I'm a fourth grader. Some actual difference between traditional digital security risks versus, you know, the AI risks.

100%. Yeah. A lot of it comes down to the fact that LLMs see data as instructions. So let me dive into that a little bit more. Right. So before, if you had, if you to execute some kind of attack or command or attack on a system, right, you needed to have something, some kind of something to run something, some to some kind of computer program, essentially. I'm breaking, dumbing it real down.

Yeah, please. Thank you.

To run on someone, to be able to get remote code execution or whatever, you want to be able to run some kind of code that is malicious. But now you're at the point where, with LLMs, where you have these LLM integrated systems that ingest data from all sorts of sources, but can't differentiate between. I mean, but kind of. And this is kind of like, you know, core to the technology is that data is, is seen as an instruction, right? So yes, all of the, you know, prompts that someone puts in are the instructions, but soar is all the data that is appended, you know, in whatever rag search you're doing or if you have an agentic workflow. And now with MCP servers, right, all of these things are just seen as kind of instructions to instruct the LLM in its outputs and its operations. So the real problem now is that you have text that can essentially be an attack. Right. It can be text, can be malware in some way here. Really simplifying things.

Yeah, thank you.

That would kind of be like one really key insight that I think everyone in security especially should know is that there's no trusted. There's no way to separate basically instructions and data anymore. And because data could come from a malicious source, you're basically allowing a malicious source to tune your. To change your instructions.

Yeah, which actually I'm very curious about the MCP part of that because I feel like that was a huge introduction to the possibility of these malicious actors.

100. Yeah. Like, I mean, I think I saw, I saw a pretty cool paper out about tool shadowing. I think that was a pretty good one. Yeah, we've done a lot of stuff. We have a Threat intel team as well. So we, they're doing some very interesting work there on that front. And it's, it's, it's, it's, it's really. Yeah, you're seeing basically the same attack vector. And this is kind of what I was talking about with, you know, that kind of filling in that kind of base information everyone should have. Because that same problem of data being instructions is what's affecting MCP servers as well. So it's the same problem, but it's being delivered in new different ways. That's changing every two weeks. The tool shadowing, for example, was very cool, where someone was able to exfiltrate data from another MCP server just by having like, basically a prompt injection inside of the description of their tools for their MCP server. It was very, very clever.

Attack the closest parallel. Sorry, Nick, I'm taking over here because I have so many questions.

I just, I would, I had an analogy. I just. Would it be safe to say then that, like, because you were talking about traditional versus, like, now. Would it be safe to say that, like, the, like, attackers, like in this, like, AI era aren't as. Cause I was listening to this podcast and they made a really good point, but it was like, and I'm trying to paraphrase it, but like, attackers aren't worried right now anymore about the initial access. It's more of. It's the context, right? That's where the, the context of the data, whether that's what's being sent and not being. It's like the access itself. It's like you're. You're sending the prompt, so they're not worried about trying to. It's not like there's this barrier where I can't get into X. It's like, no, I can send the prompt now. It's my job is now to manipulate the context of either the prompt or like, even from the course, you could literally have an injection of the. The document itself being malicious. And it's then where. That's, that's where the bottleneck is as far as like trying to wrap security around that. Is that, is that a safe assumption to make? Like that. That's kind of like. There's a big difference there.

Yes. And I think the core, the key kind of differentiator there, which is actually the most important thing, is that if attack. It's not as much of a problem if attackers have direct access. If you have an application that is supposed to be externally facing, that attacker is using, is able to prompt inject. It's not as big of an issue as if an attacker gets a malicious injection into a document that, you know, somebody inside of your company has uploaded to an LLM and then they're able to influence your, like, you know, somebody inside of your company's LLM session. That's when the problems occur, right? That's when that LLM can output a phishing link, can output some kind of malicious action based off of what MCP servers it's connected to, et cetera. That's when the Real problem is. So that, that, and that vector is called indirect prompt injection, right? And that's really where we see the, the real risk coming from AI integrated applications and MCP servers and agents, etc. If, if someone's supposed to have access to a system and then they, you know, get it to output a phishing link to themselves, it's not really a problem. They're phishing themselves like it's, it's not a big deal. If they, if they're integrating that and getting distribution on that on the Internet somehow, like, you know, with SEO poisoning or even, you know, generative AI search poisoning now, which is like a crazy new thing that's evolving, then you're going to have the ability to actually get your bad prompt into other people's sessions. And that's where the problems start.

The parallel I'm thinking of right now is with Node JS, which is amazing. You can use, run JavaScript on servers. Then all of a sudden people start creating these packages for it to run with it. Then every package suddenly had about 400 different dependencies on different packages. And you don't know, right? You don't know if one of those packages way down there is, you know, bad. Is that a fair comparison?

I think that's a fair comparison to comparing all the different AI tools people are buying every day, right? Like there's so many AI tools and because so many of these are, you know, are coming into a company's kind of environment, you're getting like a similar supply chain risk there of these tools having these vulnerabilities. But the real kind of malicious data or the malicious part of this kind of attack chain isn't actually the tools itself. The tools are susceptible to the malicious aspect of it. The thing that is actually carrying a malicious payload is not the code or the NPM package per se, it's the actual data that the tool is interacting with, which is, if you think about it, a lot easier to get into the hands of a victim than code, right? Because, for example, I'm not sure when this was. It was sometime the last two years. You could share like so Gemini, for example, from Google. You could, it would, it would look over all of your Google Docs before answering in one of the views it had. You could share a Google Doc with someone, right? And then suddenly that document is in that inside of the context window of Gemini. The user didn't even agree to take this document and it contains an injection telling you to like, you know, click here to re authenticate and it takes you to a phishing link. And, and it's coming from Google Gemini instead of the Gemini interface. So you're gonna trust that, right? That's not something you're gonna be like, oh, this is clearly a phishing link. Like you're gonna be like, this is legit because Gemini is telling me to re authenticate to Google.

Right? Right.

And somebody, and without any code is just sharing a Google Drive link with you and suddenly they have the ability to basically execute a command on your LLM session.

Whoa.

Yeah.

That's insane. Yeah.

I'm gonna go now. This is.

Let'S pretend for a second, okay. Let's pretend I'm, I'm an organization, right. And I'm, I'm hearing all the hype like, you gotta have AI. You gotta have, you gotta have it. And what are some of the, I guess what are some of the biggest misconceptions that like an organization like mine that I'm pretending to be have about AI security right now?

100%. So I think a lot of, and this is a little bit on the security industry, like the vendors in general, like which prompt terminal would fall under. We're obviously not doing this. But people in security like to sell fear, uncertainty and doubt, right? Like that's a big part of the sales pitch for a lot of security products. Right? And so when you hear AI, right, everyone, it's so easy to sell fear, uncertainty and doubt with AI because everyone's seen Terminator, everyone, like thousand ways AI can go wrong, right? So it's very easy to sell that. And it's almost like a weird point where people just got so overloaded with that they've regressed to the other side, which is like, there's no risk. Like I'm, I'm so jaded by all of these like vendors trying to push something on me that I'm going to say there's no risk. That's my answer. But the real answer is it's in between. Right. It's just like any new technology, there is additional new risk and some things are covered by traditional, you know, security vendors. There's, it's not 100% of all risk from using a third party AI application is an AI risk. It's also, you know, cloud risk and you know, the data risk and all the general risks, but there's also new AI risk. So it's like you, it's, it's really making sure that you have a real understanding of the problem space before you make a decision on whether or not it's Real is, I think, what I'd say. And again, I don't blame it on them at all because they're just so jaded from like, you know, all of these FUD related pitches that, that are obviously are not working. Like people, they're not going to buy something when they, when, when they know that it's not, they're not solving a real problem. It's when you need to look out for the companies that are actually trying to solve a real problem that you're actually facing.

Right, right. How much input should we have from government where the regulations on this should be? Because as you were saying that, I was just thinking about the very geriatric crew that we have in now who probably can't wrap their heads around any of this, how this is going so freaking fast. We need things going that fast. Right?

I mean look at, look at, look at music. Just like with copywriting, with music and how. Like that. Yeah, that's a great question.

Yeah. I mean, I think, you know, the government does do good work and security. That is the, at the end of the day, that's the truth. It takes time. This put out some good stuff and I was a fan, but I think it's on us as AI security companies to actually push the frontier and for the government to kind of catch up. Right. Like, I think, I don't think it's right to put it on them to innovate. I think that's on us to innovate and educate in many ways. Yeah. Regulation around will come when things stabilize. I mean, if they ever do. In terms of how crazy the industry is moving. Right. How fast it's moving. If people can kind of feel like they have confidence in recommending a set of controls or whatever regulation they want to do. But that being said, there are still other bodies that are kind of filling that gap. OWASP, the OAS top 10 for LL applications is really good. We are contributing members and they do a great job making sure that they always try to stay up to date with the latest. And also they're also innovating pretty quickly. I'm pretty sure the standard from two years ago compared to today, it's very different. And it's like focusing on very different things because two years ago the way people were using AI is different than now and we're starting to see different patterns. Right. So they've adjusted it accordingly and I think that's very useful and beneficial for people to learn. So I guess, Nick, that's another thing I think everyone should go read Apart from our course is. Is. Is. Is go look at the OAuth top 10 for LLM applications for sure.

Nick will put this in the show notes in about three to seven months.

I knew that was coming. I knew that was coming. As soon as you said that, I knew it was coming. That's fair.

That's fair, guys, my bad.

We're going to create an agent for that. That's just going to do that for me eventually. We're getting there. But you mentioned things like, newer things that are just coming onto the scene, like MCP servers and things of that nature. Is there any other. And I mentioned that because with each kind of iteration, right, there's new security concerns. So is there sort of like, where do you see or will it evolve? Like, how do you see it evolving over the next couple of years? Just AI security in general? Because, like, with all these new things that keep getting added to, like the ingredients that get added to this, it does start to add complexity 100%.

Yeah, I totally. And I think that's one of those things that it truly is evolving every two weeks. And those are the different kind of applications of AI that we will need to be on the frontier of solving and making sure that they're secure. But I think the kind of core engine and understanding of the threat models and core understanding of the actual technology powering all of this is not moving as quick. I mean, it's still the same skill set and threat intel that you need to be able to evaluate all of them, if that makes sense. So there are, there is some kind of, you know, benefit of having that information for, you know, use case X or for use case Y. So it's not like we're starting from zero every single time, if that makes sense. So it's, it's, it's really just about us having the velocity to be able to keep up with the various different makeups of, of, of AI in, in the current form.

I was going to ask you and actually shout out to Jana on my team because she had put this question in here with the notes. I shared it with my team and I said, if you have any questions, we're going to be talking with Prompt Armor. She wanted to know if a company is deploying AI internally, what are the top three steps that they should take to secure it?

Great question. I think it's totally dependent on what you're building, which is a very kind of bad answer, but it's also the most accurate. But I would say again, it's really, I think step Number one that everyone can take is making sure whoever's in charge of security is well versed in the OWASP top 10 for LM applications. That's for sure. Right. And making sure that you're actually looking for all of those different things. And that's a hard problem. Right. And that's why companies like Prompt Armor exist. But it's, it's, it's, it's a hard problem to solve. Also making sure that you have, you know, who you're like, what's powering the application, if that makes sense of what model providers you're using, what ways, in what ways you're using them, and then making sure you have a way to document and keep track of all of that information. Right. Because there are times where you would want to know what model you're using for X feature in case an incident occurs. Then finally make sure you actually have the right contractual language in place with those model providers so that you're able to provide data security, privacy, et cetera, guarantees to your end customers. Because we know, obviously we work with a lot of companies that are procuring AI software and those are things they care about. They want to know if you have zero data retention. They want to know if any of your model providers are training on your data. Those are things that move the needle from obviously data security perspective, but also from a customer trust. And customer trust perspective, for sure.

Excellent.

I know this is all global, but I'm curious to know if it's. Are we on same playing field security wise when it comes, like if you're talking to a customer in France or a customer in India, you know, are we all on the same playing field? I'm not sure if I'm saying this.

Question properly, but I see what you mean. Well, I think so. We primarily serve, you know, America obviously, like, but you know, we're based in San Francisco, but. And so this is also where, you know, most AI companies are. Yeah. But when we talk to European customers, we do notice more concern around regulation than any of any companies over here, obviously, because they have like the UAI act and they have, they're just more regulated in general. Right. So I would say that's kind of different. But at the same time they also aren't adopting AI as strongly or as quickly as far as we can tell. So from what we've seen. Right. So it's, it's a much more gradual rollout of AI. It's more risk averse, essentially.

I see, is that you think it's because of you know, the regulations or you think that's just generally the people.

Ah, I, I couldn't tell you. I, I, I have no idea.

I was gonna ask too. Would it have anything to do with. Because I don't know if this is still the case, but like things like deep research and stuff, I think that's, Is that still only us based on, like, you can't do that.

That may be, it may be part of it. Like they have, you know, obviously, because all the major AI labs really are, you know, based in San Francisco. So it's not really like, it's, it's just, it's just more prevalent here. I would say AI seems to be more prevalent here across organizations especially so, and enterprises. So I think it could be that. But you're also seeing new players like, you know, Mistral come out in France and obviously hugging faces in France. So it's, you're, I think we're going to see more adoption everywhere. But I think, you know, like, OpenAI is here, anthropic is here, and those are like two of the metas here. So like, those are the three most, you know, probably the three most adopted, you know, AI systems. So I would imagine that that has to do with it for sure. That has a lot to do with it. Yeah.

Okay, let's do another, let's do another pretend here. Let's pretend I am a, an aspiring or maybe I have a little bit of like, AI security knowledge. But what are some of the skills? Like, let's say I wanted to really get into it and really start to be, you know, maybe potentially a thought leader at one, at one point. At one point. Well, we can always pretend. Right. But what are some of like the skills that an AI professional needs to develop?

You say AI security professional or AI. Okay, yeah.

AI security professional in general.

Yeah. I would say first try and break an application. And trust me, there are a lot of applications out there that can be broken, so you wouldn't, it wouldn't be hard to find one. So I think getting your hands dirty. So reading the OAS top 10, taking our course and then going and breaking one of these applications will give you more context and knowledge than, you know, 99% of security practitioners out there. And you, I think immediately, yes, you shoot yourself into the top 1% immediately right off the bat there. Right. In terms of AI security knowledge and being able to, and all of that really, is to make sure you understand the new threat models. Right. That is I think really the key here, understanding the tech, the threat models, and then the next step after that, understanding why those threat models exist and AKA understanding the underlying technology underneath all of these AI systems. Knowing just that alone will make you an extremely valuable asset to your organization and to anybody interested in learning more about AI security, you are going to be. Yeah, I'd say the bar for becoming an AI security expert in many ways right now is low because it's so new. It's so new and like, just taking the effort and time to like, understand how all of these things work and actually breaking an application definitely puts you in the top 1%.

How, how much does your company use AI itself internally?

Yeah, because we are in fact extremely, you know, knowledgeable about AI risks. We're able to make good decisions about which AI systems to actually use internally. So, I mean, a decent amount, but like in a very controlled manner is for sure. Yeah, yeah.

Hey, Dennis, I'm, I'm halfway there. I've already taken the executive course, so I, it's been nice hosting this podcast with you. So I, I kind of know, I kind of know where I'm going next in my career. So. But I was going to ask you, Vikram, like, is there when you're talking with like, and you don't have to go into as much detail as you can go as much detail as you want, but like, when you're talking with. Because one of the things that I was listening to a couple podcasts and shout out to Isaac because he's always recommending them to me and they've been really, really good. But one of the things that one of them had brought up was trying to explain the difference to. And I imagine with security, with potential customers and things like, what is truly AI versus like what is more like a workflow or more like a. Do you find like when people are coming to you for a solution that they're not maybe not necessarily understanding quite yet. What like, like what an agent would be with respects to, you know, being able to do something that a human would need to do with multiple steps as opposed to this kind of like one to one type of thing. Where do you know what I mean? Like would. Do you get that a lot? Where you're not only trying to educate on just the security aspect, but really trying to show them. Well, what you're talking about is close, but that's not exactly AI in a certain sense.

Yeah, yeah, I know exactly what you mean actually. And I actually have an even. So that's like a very, you know, gray area case, right. Where it's like, oh, it's like a workflow builder. Maybe they use AI for something. I've seen some crazy examples, right? Like I saw a password manager that said they used AI, and I was like, how the hell does this password manager use AI? Right? And I found out what they meant by that, was using like a regex string to find username password box. And they're calling heuristics a type of AI system. And the heuristics were just regex. It was crazy. So people are trying to brand everything as AI now, right? Because that's good and like, you know, that's hot or whatever for, you know, to attract customers or whatever they want to do. But it's just a lot of the times you're not really using AI underneath the hood. And so it is important for people, especially people who are buying technology for their organizations, to really understand when something is an AI system and then also ask the question, why do you care? Right. If it's fulfilling my goal and my task, do I really care if it's an AI system or not? Like, it doesn't really matter. Right. So it's something for people to definitely be educated about for sure. Sure. So, and I think that just means, like, really just looking at the. At the technology. There's so much good content out there, right. About what LLMs are, what AI is, and how it's different, you know, technologies of the past. So I think there's definitely resources online that people should take advantage of to. To educate themselves on that.

As I'm looking at the resources online, how is. Is there a shelf life to these resources I should be thinking about?

Yes. But also for the core basics. No, there shouldn't be. Yeah. Until we see another kind of shift in the fundamentals, I'd say, which doesn't happen every two weeks. So. Yeah.

Let me ask you a little bit about. Let's shift a little bit from prompt armor as a company more towards you yourself, as, you know, somebody in the AI security world. Was there, like, was there something that first sparked your interest in. And it doesn't have to be AI security, but just in, like, the tech world overall. Was there like a moment where you were like, this is what is going to be my career. This is the journey I'm going to start.

Yeah. That's interesting. So I really thought I was going to not do tech, which was for a long part of my career, or like for my education, I mean, and then I think I was in eighth grade or ninth grade, and I just like, randomly decided that I was going to take like a programming class or something like that. And it was in C, which is like as you know, a horrendous language to start someone off in traditionally. And so I started off and I was like, wait a second, I thought this, this was going to be super boring and like not fun at all. But it was, I was like hooked as soon as I started it was like, yeah, so it was like I kind of had no interest in it at all. I was just not like a big, I don't know, computer programming guy. Like I didn't, I didn't see myself in that kind of position. So I was just kind of like, I thought maybe I'd do something in another field of engineering, for example. Right. So I kind of saw myself there maybe in like chemistry or biology or something also as well. But then when I got my hands on you know, just like a C compiler and just like ran my first program, I think I was just hooked after that, to be honest with you. And I was completely self taught until college. That's when I took my first actual formal class. But until then I was just learning myself on YouTube.

That's awesome. No, that's, I mean that's the best way to do it like a lot of times is you get your hands on it and start like that's how most people fall in love with that. And when you, when you first got started then like once you got kind of that itch to start doing that, was there anything that surprised you like greatly when you first got into that kind of journey into development?

Yeah, I was and I guess it's so, it's so normalized now but just how amazing the kind of developer community is when it comes to like Reese, like just helping each other, you know, like pre chat, GPT, stack overflow. Right. Was just the place to be. I mean maybe it is now as well but, and it's, it was just amazing to see how many free resources there were to help people learn stuff and then free open source, you know, frameworks, libraries, etc. To like help you build stuff. And then you know, you also had just like people trying to help you along the way. So it was just like it was just so easy to learn. And I just think that that's, I don't know if it's unique to you know, software engineering, but it's the only place I've seen it at this scale, to this extent. Right. Where it's an industry that operates a lot. It's seemingly on like just general goodwill of Other developers as well.

What I am jealous of is that when I was younger and thinking about development, I had these things that I had to look at. YouTube and Stack Overflow.

I was wondering where you wandered off to. I'm like, where did it just go?

That's hilarious.

I gotta ask you, Vikram, because one of the developers that we've had on the show here, HubSpotter BJ, he was mentioning the one time about. And you said Stack Overflow. But do you, do you also do the. Remember where he asks a question and then goes on a different account and answers wrong on purpose so then that somebody will correct him to give the right answer specifically?

Oh my God, no, I have not done that actually. But that's a genius idea.

Yeah. When he said that, I was shocked because I had never heard it and I was just like, that's brilliant. I'm like, he's like. Because he said, he's like. People are more likely to correct you when you're wrong or to point you out when you're wrong and give the right answer than to just be generous and say, oh, here, here's your answer.

Yeah, I've seen that many times and I never thought to artificially create that scenario, but maybe I should have.

Yeah, it's fantastic, isn't it? Yeah. Were there any. And mainly because of the fact that like again, we talk about that sort of started here and then all of a sudden jumped to just zero to insane. Has there been any sort of like events or any conferences or workshops or anything that have come up just recently that have kind of either sparked the interest or helped kind of, you know, get things flowing as far as ideas and stuff, or just a really good time that you've had with respect to, to like the AI security world.

Interesting. Yeah, let me think about that. Actually, we, we've been to, you know, kind of all the kind of security conferences you could imagine. Right. But to be honest, a lot of them are like, have become very corporate and like, kind of, you know, kind of like a carnival. I don't know how else to describe it. And I'm sure you guys know what I'm talking about. And so we like to go to like the high value kind of conferences where people are really talking about very tactical things, very real problems they're having. And it's mostly like practitioners talking to their peers. We went to grf, which was a great one last year. It was, funnily enough, it was hosted in Disney World in Orlando, which was.

And you go into Disney.

Okay, it's just like a very interesting venue. But also obviously the conversations were really amazing and the, the level of depth people got to. Because there weren't that many people there. Right. There was just like, like, you know, tens of people in a room instead of hundreds. You were able to have, excuse me, you were able to have very kind of high quality tactical discussions. And I think I learned a lot. People learned a lot from, you know, Shankar gave his classic talk there's. And talked about AI risk and people learned a lot and had great follow up questions and it was just like a great experience overall. For sure. We went to TPRA recently as well, which is a third party risk Association's conference in South Carolina. That was a great one. A lot of people talking about AI risk and how to manage AI risk. Because in this new world of infinite AI adoption, third party risk teams are really kind of having their moment. Or any team that's kind of interacting with, evaluating third party software. Right. Because all of these AI systems people are adopting are third parties. Nobody's training a foundation model from scratch internally. Right. Like it's a very interesting time where third party risk and security is just really getting highlighted because yeah, all AI risk is third party risk. So it's just one of those interesting times. Yeah.

What was Deepseek or something like that? Wasn't there a LLM that was open sourced? Do you see forks of that that you have to deal with that are not as nice?

I mean the interesting fork was Perplexity has a fork that they post trained to basically remove all censorship filters that they had on there. So that was interesting. I mean the really, the craziest thing about Deep SEQ that I saw was the fact that they had all of their user session conversations just open to the public Internet. Yeah. And so I think Wiz found that vulnerability, something like that. I could be like slightly off there, but basically a ton of customer data was available on the Internet and I was like, God damn. Wow. Yeah.

On the idea of open source, what are your thoughts? Like? Do you, do you think that's a good thing to have these things kind of out in the light or do you like the more proprietary version of it?

I, I think it's one of those. I, Well, I. First of all, I think they're not truly open source. Right. So they're like open weight. They're not. You can't reproduce it yourself, right? Yeah, nothing. And build it yourself. Right. Because data centers on data centers.

This is going to hold it. All right.

Exactly. So open weight is cool. And I think it's obviously great for things like if you have an air gap deployment or you have some other kind of strict security thing concern, obviously it's great. It reduces the. I mean, unless you have a great kind of engineering talent internally, it reduces your kind of velocity on the ability to iterate on new models. Right. It's not as simple as changing a little string in your OpenAI call anymore to the new model. It's like you have to get that model and deploy it inside of your. Whatever system you have. So I don't know. I think it really depends on your use case. Does everyone need Claude4 to really look over some little thing that they need AI for? Maybe not, right? Maybe you can increase accuracy and reduce cost and, and increase, you know, I'm.

Always coming with a tank. I'm always coming with a tank.

That's really bringing a tank to like a knife fight. If you classify like a dog or not dog with, with CLAUDE for, you.

Know, no such thing as overdoing it. No such thing. Not at all. Let me ask you with, with respect to the AI security, because I know we've, we've talked with other people in other fields and, you know, there's always that one thing that's like a, that's a common myth, right? With respect to what they do, Is there one that stands out to you when you tell people what you do, that they just have this like, misconception about it?

Yes, I think so. I guess there's. There's three different points on that. One is a misconception about what we do at all, which is like, oh, so you guys are using AI for security is always. Is the way people mainly think about this when you say those words, right? So they're like, oh, so you're using an LLM system to pen test some traditional web app or something. So that's number one. The second bucket, I think for people who are kind of outside of technology is always like, oh, so that means you're going to protect me from Terminator, right? Like, that's like the kind of common. You're gonna stop a Terminator like event from happening. And I'm always like, I guess, yes, you can think about us that way. I personally think we're not doing something that cool.

Oh, come on. You should always take credit. Just take credit for that. When Terminator is not there, it's because of you.

Like, you guys are building the T1000 in the back room. It's okay. You can tell everybody that's Fine.

Yeah. We are not saving Sarah Connor. You know, we're not doing that. But yeah, and then I guess those are the two main ones then for developers and more technical. A more technical audience. Something that they kind of usually misunderstand about AI security is they always think we're trying to stop just pure direct jailbreaks and prompt injection, you know, trying to bypass a content filter on, like, a model. And they're like, why is that a big deal? And like. And we're always just like, that's not what we're concerned about. You know, like, we're not concerned. If you get the LLM to say something funny like, that's, like, that's cool. But, like, that's. That's not a security problem. It's. It's fine. You can do that to yourself. Right. The problem is when somebody sends. Is able to get somebody else's LM to send them a phishing link, that's when I. That's what we're here, we care about. And so it's. It's. It's kind of. Yeah, those are some of the misunderstandings we're always trying to. To get over for sure.

Have you dealt with a lot? I mean, you know, phishing links is one thing, but what about, like, you know, voice, you know, and video now? Are you. Are you dealing more and more with that?

We have a. We have something very interesting cooking on that front. So I will. I will say. I'll just say that. I'll just say that one day when we have some more time, hopefully soon we will hopefully get that out.

That's.

That's a great. I like it.

Yeah, yeah.

Oh, excellent. I love that.

Nick. John, it's got some questions in there he probably should deal with. Get them out of the queue.

Okay, okay, hold on, hold on. Okay, let's do the first one here. I'm sorry, I was looking at multiple tabs. It's really hard. It is. You should see my setup. I have, like, a bunch of weird little things with all information, and it's just like, I don't want to sound like I don't know what I'm talking about. And I don't want to be boring to people. So it's like, I try to have as much information, like, spread across. So now that I've defended myself against Dennis, here's question from Johnna. If, like, actually I can bring this up on the thing, right? Yeah.

Oh, I love this.

Yeah. If it is accomplishing the intended goal or task, do you care if it is AI or not, Would you pick one over the other or does it matter? Interesting.

Yeah, that's a great question. And I think two parts, it depends. Like, from a security perspective, I definitely care. Care. 100% care. It makes a big difference because of the net new AI risk that it adds. Right. And so really, the question that a buyer should be thinking about is, okay, is there an AI tailwind to this problem? Right. Like, is this. Are you solving a problem that as the models get better, your problem, your. This solution is going to get radically better as well. Right. And if it. If it. The answer is yes, it's probably worth thinking about the AI risk. Right? Making. Making sure obviously that. That it's a good tool and it's a secure AI tool you're adopting, but after that, it might be worth it. Right? But if it's something that first of all doesn't need AI and it's something that's a kind of solved problem that can be done programmatically in a deterministic way, I don't think you need AI. You know what I mean? So it's just like, it's. It's one of those things where it really depends on the problem you're trying to solve, for sure. Excellent. Thank you.

Do you ever imagine that AI could just be programmatic? I mean, like, would just repeat the same thing every time. Is that. Is that something that you could see happening?

I hope so. With the current architectures that we're using today. It's just not like, it's just. It's just. It's just a very hard problem to solve. How about I leave it at that? It's a very hard problem to solve. It's. It's. I'm not going to say it's impossible. It's a very hard problem to solve. And maybe it'll get to the point where for all of the use cases we care about, it is essentially like that, and maybe theoretically it's not like that, but essentially, in all practical ways, it is. And then we got to ask ourselves, okay, where do we care about if it is or not, if it isn't? Right. Like, how sensitive does a use case need to be for us to be like, we still can't use AI.

Right, right.

Or how can we augment that with some programmatic mechanism to make sure it's better? Excellent. Excellent.

We're going to be coming up on time soon, so I really wanted. I want to kind of just shift a little bit and kind of talk about just like, who is Vikram outside of AI Security. Right. And one of the things I love to kind of ask everybody is a mentorship question. Now, seeing as I. Well, let's. Let me ask the question first because with AI being changing so rapidly, it's like a piece of advice that someone's given you about AI could have in obsolete, maybe yesterday. Right. But when it comes to like mentorship is what's the best piece of advice someone's ever given you? And I mean, it can be about like throughout your career. It doesn't necessarily have to be about AI security, but like, is there a piece of mentorship advice that you've been given that's really kind of stuck out to you?

That's a great question.

We're judging you on this, so it better be.

For a second here, I'm going to.

Think for a second here, not judging me and me and Dennis judge each other all day, but we don't judge.

That's true. Yeah.

Right. There's like, at least in your industry, like there's. Because of like the rapid change there, there's. There's fundamental things. Right. That can be like. And then too, like a follow up would be like, is like if somebody were like somebody, we're just starting at promptomer, is there a piece of advice that you would give them? Maybe it's the same piece of advice too.

Definitely. Yeah. So I think. Let me answer the first part, which is a general kind of mentorship advice from my dad, which was, you know, always know why you're doing something when it comes to any kind of work that you're doing. Because sometimes you can really fulfill that same thing in a much better way if you had that context. Right. And also allows you to really understand and align yourselves with the value you're trying to provide. And it really makes you ten or a hundred x more effective of what you're really trying to do. So I think that is something that definitely has stuck with me forever and hopefully will forever. And then on the AI side of things, I think this is something I was in our kind of. We went through Y Combinator and there was like an event with, with Sam Altman, you know, with like, you know, a couple dozen of us in the room. And one thing he said, I'm pretty sure he said this publicly at a bunch of places. It's. He's always talking about how you need to align yourselves with the models, basically with models getting better. So that's one thing in AI I think is really true. If you're building at the application layer, you want to think about how you can align the value of whatever you're building to benefit from the AI model tailwinds that, that will occur, right? So you want to make sure that you're not trying, you're not, you're not trying to fight against that. You're like trying to fight against gravity, essentially, right? You're. It's possible, but, like, it's, it's extremely hard if you, if you're trying to not go against the grain in that way. It's much better to go against the grain in some other, in some other dimension than it is to go against the grain on, on AI. Getting better.

Not bad.

Approved.

See, there's no judging here. It's okay. Now, as much of a whirlwind as the AI security landscape is, what are some of the things that you do to unwind? Because I can't imagine, again, it moving so fast and.