Ashish Rajan : [00:00:00] AI agents have deleted entire production databases

Prahathess Rengasamy: Oftentimes, like the security team has like all the admin access in some cases also. So probably like the most high impact credentials that you can steal or like an agent can impersonate to cause like a real, real harm to the business. Almost anyone can build today.

Prahathess Rengasamy: Like, you don't have to be technical to build, you just need to have an idea.

Ashish Rajan : Traditional methods are kind of out of the window already. Pull request is too late to even think about in this world of where just code is just coming left, right, and center.

Prahathess Rengasamy: A machine cannot be held accountable, therefore it should not be making a management decision.

Prahathess Rengasamy: There's a back and forth between agents, and I'm just like grabbing popcorn and watching.

Ashish Rajan : I mean, they're smarter than all of us combined.

Prahathess Rengasamy: This is the worst they'll ever be.

Ashish Rajan : Let's talk about building AI platforms. Yes, you heard that right. How do you scale security for AI across a large organization? It's by building a platform that security team has worked with the broader engineering team to create.

Ashish Rajan : If that idea seems very forward-thinking, then this conversation with Prahatish, who is a senior security engineer at SpaceX AI, would be really interesting for you to understand, how can you approach security of [00:01:00]agents, standardize it across the organization? What does it mean when different teams, including within security, like AppSec, CloudSec, start creating agents in different ways?

Ashish Rajan : When you have non-technical people start pushing code into SDLC, and what does the SDLC look like? All that and a lot more in this episode with Prahatish Rangaswamy. As always, if you have been listening or watching the episode of the podcast and have been finding it valuable, I would really appreciate if you take a quick second to hit the subscribe or follow button, whichever podcast platform you watch or listen to us on.

Ashish Rajan : We are on Apple, Spotify, LinkedIn, YouTube, and anywhere else you consume your podcast from. I hope you enjoy this conversation with Prahathess, and I'll see you soon. Peace. Hello, and welcome to another episode of AI Security Podcast. I've got Prahatish with me. Hey man, thanks for coming on the show again.

Prahathess Rengasamy: Hey, Ashish, happy to be back.

Ashish Rajan : I know you've been on my Cloud Security Podcast, so I'm glad to have you on the AI Security Podcast as well. And maybe for this audience, if you don't mind giving a little introduction about yourself and where you are and what's your professional background.

Prahathess Rengasamy: Yeah. I'm Prahathess, uh, [00:02:00] Rangaswamy.

Prahathess Rengasamy: I currently work at SpaceX AI. As a security engineer. And prior to this I was at Block and Apple and a few other places, primarily focused on product and info security. Now I'm at a frontier lab, obviously, so a lot of how to deal with agents and security around building for AI is a very top of mind for me.

Ashish Rajan : Awesome. And, uh, maybe to start off this, probably, uh, something that you've seen across all the entire career that you may have had where you've worked with very forward-thinking companies, very engineering-heavy companies. And the last time we spoke about it, I'll definitely recommend people check out the episode as well, that we did together on Cloud Security Podcast.

Ashish Rajan : We were talking about how much the SDLC has changed with or the entire ecosystem has changed with cloud. Now we're back again talking about how the ecosystem has changed with AI. So maybe to set things off, if you don't mind starting off with a quick 30 second on software development life cycle and the impact that agent [00:03:00] ha- agents and AI has had on that, at least the way you have seen this.

Prahathess Rengasamy: Yeah. Uh, I have a few spicy takes. I wanna-

Ashish Rajan : Yeah, yeah. Go

Prahathess Rengasamy: for it, man ... make it clear that all opinions are my own, does not reflect my employers, and I don't represent SpaceXAI, uh- Yeah ... talking about this. I'm just sharing my experience being, uh- Sure ... the tip of the spear. So yeah. Obviously I've seen like different software development life cycles throughout my career, right?

Prahathess Rengasamy: Pretty much everyone has. And it started with the Waterfall model, and like there was Agile, and you had like a full, uh, build and deployment workflow where you code, you push PR, you get approvals, bunch of tests run, then you deploy to like a lower environment like staging, and then you promote it to prod if everything's good.

Prahathess Rengasamy: There's a QA process depending on your level of maturity at like the staging level to make sure that everything's good, and that's what like folks are very used to doing. And there was-- this was very common up until like a year and a half ago, right? Even like- Yeah ... uh, if I'm being... Might be a little aggressive, but like a year and a half or two years [00:04:00]ago.

Prahathess Rengasamy: And then suddenly like we ha- we are in this, uh, dawn of a new era where LLMs are a thing. People are copy-pasting code into like chat interfaces to- Mm-hmm ... uh, get more code back and like to get fixed code or whatever, and like, drop them in and like they just work. Then people realize that LLMs are kind of good at coding.

Prahathess Rengasamy: And the labs caught on to it and like we have dedicated models that are like pretty good at, pretty insane at coding right now, and very fast. And like you can run five of these at the same time while you're working on something else also. So how the SDLC has changed in my opinion, is that like it's a lot more compressed than it was before.

Prahathess Rengasamy: So you basically had like, product requirement documents, uh, design documents and all of that that get made on like how you wanna build something. And engineers or a team of enginee- any single engineer or a team of engineers worked on it to build it up. And now it's like you have an idea, boom, you have a POC, you deploy it to your lower end environment.

Prahathess Rengasamy: It's like, is everything looking good? [00:05:00] Even optionally sometimes. And it's in prod within like a week or maximum two to- Wow ... see like, hey, this small feature that I built is currently rolled out to millions of people. Like maybe they like it, maybe they don't. If they don't like it, it's scrapped, but it's already there.

Prahathess Rengasamy: The time between idea to something shipped has compressed A whole lot, and across multiple surfaces. Uh, so- In,

Ashish Rajan : in what way? So as in like to your point, like it's changed because now we have newer threats? Or has it changed because we are looking at a whole different world? Like why do you feel it's changed, out of curiosity?

Prahathess Rengasamy: Yeah. Uh, because like, engineer- we were building things as people and like we had to communicate between like a whole number of different orgs. And also the folks who can build technical stuff like backend and backends and frontends were limited to like the frontend engineers or full stack engineers or like specific technical group of people within a company.

Prahathess Rengasamy: Yeah. Now it's more like, uh, almost anyone can build today. Like you don't have to be technical to build, you just need to have an idea. [00:06:00] And guess what? Everyone in the company has ideas for new things for their own, uh, job function, right? And- Yeah ... everyone is building that now. So you see a lot more people building.

Prahathess Rengasamy: That, that's that scale. And also like, from zero to a prototype does not take that long at all locally. Yeah. And a lot of, uh, the companies I've seen, like the companies, uh, my friends work at have reorganized to support this. It's like how can you get an idea from zero to production really quickly in the land of agents is what everybody's thinking about right now.

Ashish Rajan : Wait, but because is it also, to your point about, is it because now the non-technical people are also doing SDLC? 'Cause that seems to, seem to be a theme as well.

Prahathess Rengasamy: Uh, they're not... That's exactly my point. They're not doing SDLC. They are building it and, uh, figuring out ways to, uh, get it hosted for their own purpose.

Prahathess Rengasamy: Like you see a lot of new internal tools where there were none or like where you had to go talk to an engineering team to get a tool built for your own like purpose, like say recruiting, right?

Ashish Rajan : Yeah.

Prahathess Rengasamy: Uh, now, uh, have cases where like non-technical folks have deployed stuff for their own things internally, [00:07:00] and I'm pretty sure I'm not the

Ashish Rajan : only one. That's scary, man. Yeah, yeah. I mean, uh, dude, like I'm with you. Like I think I'm not surprised by it, but what's fascinating for me is the fact that it goes without saying that, uh, the autonomous nature of AI agents definitely makes it a bit more scary. Uh, so I'm curious, in the things that you're seeing, how does anyone even approach this, out of curiosity, bro?

Ashish Rajan : Yeah.

Prahathess Rengasamy: Yeah. So there are multiple ways to approach this. Obviously like banning the use of agents is not gonna help anyone. Uh- Yeah ... so you wanna, as a security team, your prime operating procedure does not change. You wanna f- figure out how you meet the new developers where they are. Yeah. I could say new developers because it's not, uh, just engineers and developers, it's also like pretty much every job function right now.

Prahathess Rengasamy: Mm-hmm. So you wanna make sure you meet them where they are and communicate your policies in a way that makes sense without slowing them down. If businesses are moving, like it's a pretty normal thing in the security industry, right? Uh, the number of security engineers to number of engineers, the ratio is has always been bad.

Prahathess Rengasamy: [00:08:00] Like it's like one is to 100 or something, uh- Yeah ... per surveys. So now it's like- It's the same one is to 100 engineers who are using agents and 1,000... Pretty much the entire population of the c- uh, company, uh, they're also using agents to build. So scaling here is gonna be... Scaling here with conventional approaches is gonna be very, very hard to do.

Prahathess Rengasamy: So the approach I generally think of is like, and that was what my, uh, talk at fwd:cloudsec was also about was basically like how can you like pre-AI agent era, like security spent a lot of time building paved roads, creating secure patterns for people to use. How to request exceptions, like how to do X, Y, and Z.

Prahathess Rengasamy: And bundling that context in a way which makes sense to expose to the AI agent itself that while it's doing its task that's declared by developer, like pretty much any user within the company your security policies are front and center in its context. Yeah. And there are multiple ways to do this.

Prahathess Rengasamy: The... Can use hooks in like, more recent agents Cursor supports it, [00:09:00] and you could also do model context protocol service that your security team builds and maintains-

Ashish Rajan : Yeah ...

Prahathess Rengasamy: that the agent can call out to and understand like, "Hey, I'm building this serverless infrastructure. Uh, what are all the security things that I need to keep in mind?"

Prahathess Rengasamy: And that context directly gets injected into your, uh, model's context window. Yeah. And every request after that happens with that in the back of its mind. And the neat thing about this is like it's a server that serves security policies to any number of agents can query it, any number of users can query it.

Prahathess Rengasamy: And it helps you communicate all these policies to the destination really quickly.

Ashish Rajan : Do you find that it's, isn't that like an organizational change? Or 'cause in terms of, I guess to what you-- maybe it's the same thing as like, uh, what happened with, you know, when cloud was first being formed, a lot of people were talking about, "Hey, we need transformation.

Ashish Rajan : Don't do lift and shift." What's the anti-pattern for cl- for AI agent? I'm curious. What people should not do, 'cause I [00:10:00] mean, obviously it's a, it's a-- what I feel like in what we have spoken about so far, we have the non-technical people putting out code, technical people putting out code, security is putting out code.

Ashish Rajan : I mean, I'm running a cla- Claude code back in the background as well while we're doing this interview. What's the anti-pattern that you're seeing? 'Cause you obviously have seen a multiple set and you've seen... You kind of like me, you've been in that cloud space as well, so you kind of have seen, "Uh, actually, that's not the right way."

Ashish Rajan : Are you seeing in your ecosystem of people that you talk to, just generally at, at for CloudSec as well, did you find people or are you seeing people have anti-patterns to how they use cl- uh, agents or in the software development- Yeah ... lifecycle that they should not do?

Prahathess Rengasamy: Yeah. One of the things that, that kind of come up quite often for me, like, in talking to people also is that a lot of the attention has shifted to doing AI security particularly.

Prahathess Rengasamy: Mm-hmm. But the definition of what AI security is still a bit blurry. Like, I ask 10 people and I get 10 different answers. Uh, Yeah.

Ashish Rajan : Yeah.

Prahathess Rengasamy: So I think s- in some cases, I've seen fundamentals being [00:11:00] script. Fundamentals in the sense like preventative controls, right?

Ashish Rajan : Right.

Prahathess Rengasamy: Uh, in speaking in cloud lingo, h- this could be service control policies or resource control policies.

Prahathess Rengasamy: In GCP, it's organization policies and any preventative controls that is being not focused on, like, because maybe the companies knew they didn't have preventative controls to begin with, but the agents came along and they are focusing on agents. So I see a trade-off being made in many places with foundational controls around data security.

Prahathess Rengasamy: And preventative controls in general, I find that as a bigger anti-pattern, because at the end of the day, you, you can have co- security context within agents. Uh, you can sandbox your agents also in multiple network ways operating system level, isolation ways and whatnot. But- Yeah ... uh, when they are accessing real-time systems, the preventative controls are what save you.

Prahathess Rengasamy: So I would not compromise on any of the preventative controls at all. Like, anything that we were doing before the agents took over, we should still continue to do as far as preventative controls go. Yeah. And on the detection side, I also see a lot more [00:12:00] confusion on, like, how identity works. Who do we hold accountable?

Prahathess Rengasamy: Say an agent executed something and, like, deleted a resource or, like, accessed something it wasn't supposed to. Who do you hold accountable is- Yeah ... also like something that I feel like folks haven't necessarily gotten a handle on.

Ashish Rajan : Especially because you hear stories where AI agents have deleted entire production databases, which I guess, to be fair, I don't know who or why would you put yourself, uh- In a situation where your A- AI agent is able to put push code into production without review.

Ashish Rajan : I don't know, just is that also an anti-pattern from that analogy to what you said- It is ... if you don't have?

Prahathess Rengasamy: It is exactly, like, as I mentioned, like moving at blazing speeds is fine. Any critical environments, any critical data access and like any state changing thing, change, changing request, like update something, delete something, all of that needs an accountability to it.

Prahathess Rengasamy: Like you need a user to explicitly say, "Hey, I'm authorizing this thing to go and delete X, Y, and Z."

Ashish Rajan : Yeah. Yeah.

Prahathess Rengasamy: So, uh, that story comes stems from like having a good identity posture to begin with, right? Uh- Yeah ... yeah, there's [00:13:00]a the agents came so quick that all of, uh, like a lot of folks are just, uh, scrambling to keep up with them.

Ashish Rajan : But is there a respite? 'Cause you, you mentioned to me about the MCP references architecture as well 'cause... And the reason I'm going there is we've been told that, hey, AI, a, well, I'm gonna approach this from two parts. One is a problem of it's Ashish and Ashish's agent doing all kinds of things. And then the second part- Yeah

Ashish Rajan : is the agent that is in the SDLC. What are you seeing in both patterns? 'Cause ultimately my agent could be doing multiple things. They could checking my email and it's no longer SDLC, but in, as someone who works in security, we care about both sides, right? And 'cause your point, you don't want someone to just install a malware or open s- maybe not open source as well.

Ashish Rajan : I'm curious, uh, which one is harder you reckon to fix? Uh, obviously MCPs on both sides. I can have an MCP into AWS, but I can also have an MCP into my Slack [00:14:00] or somewhere. Because obviously you've been talking about the reference architecture for MCP. Can you talk about that from both these perspective and how would that be applied or is it not, is that not applicable?

Prahathess Rengasamy: Uh, the MCP reference architecture particularly s- uh, talks about how you- Bundle your own organization security policies and expose it to agents doing like different functions.

Ashish Rajan : Yeah.

Prahathess Rengasamy: You can have agents that, uh, use MCT like with you in the loop, like Ashish's sidekick that checks emails for you, responds to Slack for you and whatnot.

Ashish Rajan : Yeah.

Prahathess Rengasamy: And in which case, like the identity that it would be using would be yours. Like it actually impersonates you to do all of that stuff. So we know that worst case, like it's you who did the change at the end of the day, right? And if you think about like, more cloud unsupervised agents, right, then we are getting into a territory of who you hold accountable.

Prahathess Rengasamy: Hmm. And there's a, there's this famous quote from IBM, right? "A machine cannot be held accountable, therefore it should not be making a management decision."

Ashish Rajan : Really?

Prahathess Rengasamy: But... [00:15:00] No, it, it... For real, yeah. And so you wanna-- That principle is not in vain. Like that works. Like basically like for the function that you want the agent to do, defining what it needs to do and- Yeah

Prahathess Rengasamy: a list of things it can access or the identity and the network plan constraining that would be the right way to do it.

Ashish Rajan : Okay. And how-- Actually, maybe it's worthwhile calling out, right? Because a lot of people have a... I don't wanna say, it's like a, There's so much conversation about AI security and the different kind of vulnerabilities that exist.

Ashish Rajan : Sometimes it's hard to pinpoint, 'cause I may just say that, "Hey man, I already have SCA, SAST, and everything else in my SDLC." Why would that not work in this case? Like my Bob from accounting tries to push anything into code. I have, I don't know, GitHub, GitLab, G- Guardrails. I have SCA, SAST, and everything else.

Ashish Rajan : Even if my AI is producing code, it is going to go through that. Or is that also changing in terms of, oh wait, that, that param- that [00:16:00]the lines over there are also blurring now?

Prahathess Rengasamy: Say the lines there also are blurring because like if you think about it, right, like when you go and make a PR and like all these tools run, it adds like five, 10 minutes to your PR wait time.

Ashish Rajan : Unfortunately, yes. Like and

Prahathess Rengasamy: only then you get reviewed and like you have to fix whatever you need to review. Yeah. But I'm working with five agents at the same time, like I- each of them working on their individual tasks and- Oh, really? ... waiting 10 minutes. Yeah, right? Like across every single repo.

Prahathess Rengasamy: Like if I have like a list of things to do, very well-defined things to do, I can work on them- Yeah ... parallelly right now.

Ashish Rajan : Yep. Yeah.

Prahathess Rengasamy: And when they go make a PR, right, you can actually have the agents babysit PRs now. That's a recent Cursor feature, and even GroqBuild has that, and they respond to comments, fix it and push it in.

Prahathess Rengasamy: So it-- The lines are getting blurred because like the things that are responding to your SCA findings are not humans anymore either. So it's the agents that are responding to the SCA findings. Like, uh, there was this really funny thing where I have this personal repo where I've, I've been testing out BugBot.

Ashish Rajan : Yeah.

Prahathess Rengasamy: Of course, there's BugBot, like where it [00:17:00]the complaints on your PR saying like you have all these bugs, and I have, uh, something else babysit PRs also.

Ashish Rajan : Yeah.

Prahathess Rengasamy: So the bug bot complains on like a change that, uh, Groq build or OpenCode made, and this goes and fixes it again. And there's a back and forth between agents, and I'm just like grabbing popcorn and watching.

Prahathess Rengasamy: So

Ashish Rajan : uh- Wait, so they're actually having like almost like an AI governance council. They're going through

Prahathess Rengasamy: each other. It's, it's kind of like going in like loops between like, kind of like the PewDiePie AI council thingy.

Ashish Rajan : Yeah.

Prahathess Rengasamy: So it's, uh, it's li- it's a little bit funny to watch, but like I think the tools that we use for security need to get fast also, and I'd rather like not do it at the PR stage, right?

Prahathess Rengasamy: PR is something that you make midway through through the process. You are done with your local changes and then you make a PR and then you find out

Ashish Rajan : something's bad. Yeah.

Prahathess Rengasamy: I'd rather get it much early, like, where the agent's doing stuff also itself like, like, say that you're building a new web app that you wanna expose a certain way.

Prahathess Rengasamy: If the agent is kind of aware of, like, how to do this and what are all the libraries that I'm allowed to use, what are all the tools that I need to run locally, it can run it locally and fix it [00:18:00] itself. Like, while you're waiting for the task to get complete, agents can run these things in parallel and have these feedback in the loop while it's building, versus babysitting a PR.

Prahathess Rengasamy: There are some business and logical issues that you can run into that having the bug bot type stuff in GitHub repositories and pull requests still work. But I think like, from more you wanna support speed and like also getting security at that speed. Yeah. Moving this all the way to the agent and telling them what to look for, given the type of task you're doing from a security perspective, is completely worth it.

Ashish Rajan : Div, that, it's brings me so much questions, right? 'Cause it's almost... I always used to think that the only way we could do this earlier and the way that we were taught by AppSec as a whole was that shift left was a thing, DevSecOps was a thing. We were told that, hey, your IDE tells you, oh, well, I mean, that would've been the ultimate ecosystem thing where the IDE itself stops me from putting anything, Yeah

Ashish Rajan : security related. Is that still a [00:19:00] possibility? 'Cause I mean, it didn't really happen in the AppSec and I'm sure AppSec people will hate me for saying this. I'll tell you why.

Prahathess Rengasamy: No, I've been in the-- I've seen that also, right? Like, when, whenever you say like these are all the things that the IDE needs to do for you, the person who has to respond to it used to be a human person- Yeah

Prahathess Rengasamy: with limited context and limited energy, limited time to go address this.

Ashish Rajan : Yeah.

Prahathess Rengasamy: And, uh, that, that limitation is what the agents remove. So here, like, even if the... So, like, if you have like an-- There's good stuff for Terraform for this, right? Like, there's an IDE extension that will flag any bad Terraform changes that you do.

Prahathess Rengasamy: Say, like you're making a bucket public or like, uh, you don't have proper trust relationships configured. You can have your IDE linked to that. Right. And any linter errors, the agents automatically fix anyway. So the limitation of like the human attention span and like the list of things that you need to complete to move on to other things is what like the agents completely liberate you from.

Prahathess Rengasamy: So there's multiple ways you... Everything, at the end of the day, like if you think about it, boils down to like how in this new method of doing things- [00:20:00] How you would explain what's, uh, the ideal good state to an agent and make sure that every change it's making is compliant, if not like there's at least an exception for it.

Ashish Rajan : So does that mean lines are blurring between cloudsec and appsec as well? 'Cause we almost feel like to, to your point about like, I know obviously, uh, we- we've been focusing on... If I, if I take a step back, we spoke about SDLC, we spoke about MCP, we also spoke about how we have non-engineers creating code.

Ashish Rajan : So our traditional methods are kind of out of the window already. Pull request is too late to even think about, uh, in this world of where just code is just coming left, right, and center. With that said, in the way organizations have usually worked, you-- I was part of a team where we had separate cloudsec, separate appsec.

Ashish Rajan : We all focus on different things. And where I'm going with this is that are we-- I- is AI making us challenge the norm where one person with one specific skill set is good [00:21:00] enough for cloud only, or I can do cloud, I can do appsec because I'm also the one producing the code. I'm also the one who is, to your point, you're running five agents in the background.

Ashish Rajan : I am k- doing all of that as a, as, as a non-coder, I'm doing it myself. So to me it's like Are you seeing the world of how security is done in organizations change, and what is that change you're seeing which people who are listening or watching this would go... they may not have seen it. They may not have been, I, I guess, probably working with Frontier Model and anywhere else, or they're probably still at that be- initial stage of, "I have ChatGPT."

Ashish Rajan : Like, you start the conversation by saying people are using chats to kind of have conversation with AI. I can tell my AI, "Hey, I want to build a, I don't know, a sales proposal," and it builds a beautiful application and gives me the feeling I've built a single page app. And like, "Oh, I wanna give this to every- everyone else."

Ashish Rajan : Does the definition of how we do security also need to evolve at an organization level? And, [00:22:00] and bec- And going back to your previous experiences, obviously you're in a Frontier lab at the moment, which is probably not the norm. It's like an extreme at that point in time. If you were to kind of go back to m- any of your previous cu- companies, and it doesn't have to be specifically those, but those kind of companies, that, that model of doing security, does that still work if AI was to scale it as it is scaling everywhere?

Prahathess Rengasamy: Yeah. As I mentioned, uh, the, uh, foundational preventative controls that you have, like across the org, those still save you.

Ashish Rajan : Yeah. Okay.

Prahathess Rengasamy: Those things are not passable. Like having a good security policy and defining what known good looks like with your own organization-specific threat model in mind, there's no way around that.

Prahathess Rengasamy: Uh, you need to have that as a foundation for you to enable the, uh, safe AI option, right? Yeah. And one interesting thing, one really emergent interesting thing out of this is that where you had limited... So the build and buy decisions completely change, right?

Ashish Rajan : Yeah.

Prahathess Rengasamy: Like usually like it was very, uh, when you think about like whether I buy a tool for this or do I build a [00:23:00] tool, uh, internally and pay forward maintaining it and how, change how I operate f- based on like this tool.

Ashish Rajan : Yeah.

Prahathess Rengasamy: Now that you think about it like the security teams are also equally enabled to build a lot more paved roads a lot faster. Uh, if you have the threat model and like known good defined, say that your company is not running infrastructure as code and it's all click ops. Or, uh, say that you need a g- good way to do container security, like base images and stuff.

Ashish Rajan : Yeah. It

Prahathess Rengasamy: used to be a lot of time and like, a lot of individual people's effort to go do this. Almost the entire technical aspect of the problem is pretty much solved or like it's automatable And the actual problem that you'd be focusing on is like, how do I communicate it out? How do I ensure that people are using it?

Prahathess Rengasamy: Uh, how do I make sure that, uh, if there's a payroll that absolutely you must follow, like having an internal artifact registry or something like that, how do you force people into using this? Communicate it, give the deadline, enforce it, and make sure that people feel supported or what you'll plan today.

Prahathess Rengasamy: Like, the [00:24:00] actual part of building it out is taken care of. So you can do a lot more of this, right?

Ashish Rajan : Yeah.

Prahathess Rengasamy: Uh, where I say like, building like an internal security platform type page, kind of like a security hub used to be a hard thing to do because like you have to have security engineers who knew how to build and host, maintain it.

Ashish Rajan : Almost software engineers almost at that point, right? Yeah. Software engineers, yeah.

Prahathess Rengasamy: Yeah. Now it's like if you have that idea, you can just do it and get it deployed because you know what good looks like for internal apps and whatnot, right? So-

Ashish Rajan : Yeah ...

Prahathess Rengasamy: I think like folks should catch up on like if they're not already doing it I would strongly rethink...

Prahathess Rengasamy: Ha- ask this question, right? Like what are all the tools I wish I had internally? That I could build right now. I guess,

Ashish Rajan : I think you've hit on something really interesting there, right? Even with general, like let's just say pre-AI cybersecurity thing, there used to be a whole conversation about you can buy the tools in the industry, any third party vendor, but we still had to add a layer on top every single time, which used to be that, hey, highest, high, low, [00:25:00] medium, whatever, this is not really high for me and this...

Ashish Rajan : But then you had to, as a leader, you had to sum that up even more and go, "Okay, my cloud security posture is this. This is the accurate information," which you would have to talk, manually go through all of that. Now I feel like that, to what you said, can be done with AI agents and AI. Same goes for cloud sa-- oh, sorry, AppSec as well.

Ashish Rajan : If my ecosystem of all the applications that I used to look out for and now I can know, hey, what is the one vulnerability that if I solve, I can have an... Oh, sorry. One, what is that one vulnerability class that I can solve? If I resolve that, 80% of my issues are gone. Like those kind of questions, which used to be like, "Oh, I can't use a tool for that.

Ashish Rajan : I have to build something, so I'm limited. I have to go to an Excel sheet." You reckon that's basically like a solvable problem today?

Prahathess Rengasamy: Yeah. This might even kill Excel sheets in cybersecurity.

Ashish Rajan : For sure.

Prahathess Rengasamy: Uh, so yeah, like I'll give you one very good example, right? Like it is, [00:26:00] uh, to your point, I'm pretty sure it is.

Prahathess Rengasamy: One good example is like say that you're blocked by a preventative control today. Like can be Kube admission control or SCPs or organization policy, and it gives you a 403, "Hey, this policy is blocking you."

Ashish Rajan : Yeah. "

Prahathess Rengasamy: You're not supposed to do this," right? Like before, like you would take, grab a screenshot or like copy the error out, drop it into Slack or like wherever, and like ping a security engineer or a channel asking, "Hey, hey, why was I blocked for this?"

Prahathess Rengasamy: And there is no vendor today that kind of... It's not profitable to build a company around telling people why they were blocked. Uh- Yeah ... so these are all tools that won't get built by someone else that you can just buy. But it's a very f- from a user experience wise, this is a very cool, fun tool to have for a security engineer, right?

Prahathess Rengasamy: Like this can even be a Slack bot that just says, "Oh, you're being blocked by this policy because you probably deployed with this misconfiguration in place and was blocked by it. Like you probably have to change this value or, uh, go and file for an exception. Here I'll lo-loop in a human," right?

Prahathess Rengasamy: So these are all things that you can just build right now, [00:27:00] and nobody's gonna build it for you. But like from a user experience and like a developer experience perspective, this adds a ton of value. Like they know why they are blocked, they know what the fix is. If not, they know, uh, who to talk to. And- Yeah

Prahathess Rengasamy: that'll, in most companies I've been at, that'll kill like- At least 25 to 30% of like the frequent requests that you get via Slack and like, things that will make you context switch, right? So that's just one example. I'm mostly just speaking from my experience, but like if you take this and apply it to like different industries and like compliance, for example.

Prahathess Rengasamy: If you have to go through HIPAA, if you have to have PCA compliance requirements, and you take the compliance requirements and the environment context and feed it to agents, like it wouldn't do anything that's not compliant to, uh, the requirements that you have, right? So if you can just take this approach and then apply it to like multiple different domains, and it would pretty much still work.

Ashish Rajan : Are there any examples that come to mind? I did a post recently on LinkedIn, which seems to have gotten a lot of attention, at least in the circle that I have, which is more along the lines of how do I even approach [00:28:00]using AI for security? 'Cause a lot of people would d- they'll hear what you are saying, and they'll go, "Man, I'm not technical.

Ashish Rajan : Prateekh sounds like a really smart guy." I'm like, "I'm just someone who has always used a tool for this or a product for this." Whatever, insert whatever product sec- pro-product ecosystem product you want to pick, right? I'm just one of those people who just prefers to have that as a tickable thing.

Ashish Rajan : The reason why I, I bring that up is because the argument on the other side by the vendor ecosystem is that, "Hey there's no way you can build this because you have to maintain this, you have to like water the plant and do a lot of things with it." That to me, in my, in my mind, that is true to an extent that you clearly have to...

Ashish Rajan : If you make any tool inside, you have to build it and maintain it. What's your thoughts on the whole where-- how should people approach the build versus buy specifically for these things which they, you know that vendors would never create 'cause there's no money in there. But you have the power of AI with you, and do I need to be technical to do it?

Ashish Rajan : And any real workflows to [00:29:00] what you said was one of the great examples as well for, "Hey, who... Why am I blocked?" kind of policy as well. Uh, any other example that come to mind in this conversation with build versus buy to kind of have people have the confidence that, hey, they don't need to be as smart as Prathish to, uh, do-- build, build an AI agent?

Prahathess Rengasamy: Hey, one thing I'll tell you, pretty much all the frontier models these days are smarter than Prathish.

Ashish Rajan : They're smarter than all of us combined.

Prahathess Rengasamy: Yeah. That's the goal that we are going towards, and this is the worst they'll ever be. So- Yeah ... that's there. So one f- one, you don't have to be technical at all.

Prahathess Rengasamy: You just need to understand, like what good looks like and have an idea. Uh, one thing that I would recommend, I've done this to even my parents are like very non-technical, uh, type folks also, right? Like first step is to use it as a copilot.

Ashish Rajan : Yeah.

Prahathess Rengasamy: Just use it for your day-to-day and ask it to ask it to see like how it would solve a problem that you are solving day-to-day.

Prahathess Rengasamy: And if you ha- if you do that for like a week or two, you'd have like a generalization of like what it's good at and what probably you'd need to step in to course [00:30:00] correct what probably you'd need to do fully. Like three spectrums, like things that you can just delegate to it. Things that you can delegate to it, but have to keep an eye.

Prahathess Rengasamy: Yeah. Things that you have to do with some limited help from the copilot, right? So use it as a copilot and look for patterns that emerge as to like the same thing that you're solving over and over again. And those things can just be automated away. Like this can be a workflow or this can just be a tool somewhere And depending on the platform maturity at where you are at, you probably can figure out a way to deploy this internally so that like other folks can use it also.

Prahathess Rengasamy: Say like if you're working in appsec and like you're getting bombed with like bug bounty alerts, right? Like the first level of triage can be an AI agent, to be honest, that has the context of like the specific code base where the vulnerability is. And, uh, I think even like the bug bounty platform should need to re-architect around AIs finding bug, uh, LLMs, uh, triaging bugs also.

Prahathess Rengasamy: But yeah, generally speaking, like use it as a copilot, figure out workflows that you have that you do pretty much on a regular basis, and identify what it's good at [00:31:00] and, uh, what it's not, given your context, and automate away everything that's, that it's completely good at and that you can delegate, and make that a pattern that others can use.

Prahathess Rengasamy: That would pretty much work. So pre- pretty generally, that's what I've been having my patterns do. Yeah.

Ashish Rajan : Interesting. 'Cause, and I'll come back to this because that made me think of something else as well. The, the pattern thing is an interesting one because throughout the ecosystem of building cloud infrastructure and we've built the whole paved road concept, and the idea there was that, hey we'll...

Ashish Rajan : We started with EC2's virtual machines, went on to containers, Kubernetes. Now it feels like Kub- Kubernetes is still the norm, even with AI workloads as well. How do you deal with like, you know, there's a lot of AI ecosystem being created outside the paved road. And I'm not gonna name companies, but there's a lot of companies that are allow you to host the AI, uh, application you're w- using as well.

Ashish Rajan : So it gives you the illusion you're running an AI agent, but technically it's not your infrastructure, it's not production, for lack of a better word. How should people approach the net new [00:32:00] or complex infrastructures where you have combination of Kubernetes talking to an A- LLM, talking to, I don't know, what other pe- things people would add.

Ashish Rajan : How do you recommend people approach securing that or looking at security for that?

Prahathess Rengasamy: Yeah. Paved roads still work for the most part, right? Uh, paved roads where like kind of documents like, do this, do that. Here's some module

Ashish Rajan : for you. Yeah. Policy document in a way, yeah.

Prahathess Rengasamy: Or like, here's a pattern for you, right?

Ashish Rajan : Yeah.

Prahathess Rengasamy: Uh, now they look more like a- Or

Ashish Rajan : here's my template. Just deploy the template and you'll be fine.

Prahathess Rengasamy: Yeah. And now they look like an API. That's it.

Ashish Rajan : Y-

Prahathess Rengasamy: yeah. Uh, meaning like you can function call to get that information to an agent, and the agent follows that. So as far as pay road goes, like the existing pay roads work, just wrap them around in an API and expose them page and so that they can also understand and use your pay roads.

Prahathess Rengasamy: And as far as like having them work in like complex queue, multi-cloud type environments go, the foundations always save you. Like having a good idea on like data and identity would go a [00:33:00] long way. By which I mean if you have like bunch of overprivileged users running agents to make changes, things are about to go bad for sure.

Prahathess Rengasamy: Because the users themselves are overprivileged and like the identity story is not sorted, and if they're running agents, agents impersonate them, so they get that identity. And on the data front, right, identity and data kind of go hand in hand. Like you want to have like an inventory of where the sensitive data, like where your crown jewels is.

Prahathess Rengasamy: Like say that you have a bucket that contains PI and you have retention requirements for compliance. Having that documented, like good data security baselines, right? Label them, annotate them, know where they reside, have like a catalog. And some companies have it, some companies don't, some company... Depends on like your maturity, right?

Ashish Rajan : Yeah.

Prahathess Rengasamy: And this catalog thing used to be like s- like a sp- I've seen spreadsheets, I've seen systems built around it, like websites where you can just put in a data set and it'll tell you what type of data is in it.

Prahathess Rengasamy: And what would work here is like you could pull that into the context of the agent also. Be like, "Hey, this catalog has an [00:34:00]API. Whenever you're doing stuff interacting with data, make sure that you don't interact with data resources with these specific annotations." Say like, has PI name, email and whatnot.

Prahathess Rengasamy: You're not supposed to interact with it. Boom. Done. But what it stems out of is that you have, like, a good identity and a data posture to begin with, and you're just ex- what you're doing in the last mile agent type environment is to expose to it. In kube, this can be just, uh, namespace labels or resource labels that say off limits to agents.

Prahathess Rengasamy: And these are all queryable by default because Kube has a fantastic API. And that's how I would approach it, is like make sure to annotate things and, like, the fundamentals are very hard to escape agents or otherwise. The only thing that might need a lot more thought to is, like, how do you isolate at the OS level?

Prahathess Rengasamy: How do you make sure that egress controls are preserved, right? Like agents make a lot of calls in and out. So that's, uh, that's kind of like my two cents about it.

Ashish Rajan : But what-- 'Cause how does this work at scale? [00:35:00]'Cause obviously security is, there's individual agents versus multi- you and I could be part of a team and I would have my set of agents, you would have your set of agents.

Ashish Rajan : I almost feel like the paved road, yes, I 100% agree that the cloud infrastructure that we had, uh, worked on that because we had templates that we give out. Now it's an API, but it's, uh, and maybe it goes back to what I was talking about the security in this ecosystem where we... Do we need to rethink moving forward on how paved roads should be created?

Ashish Rajan : To your point, should be APIs, and would that be also how would we scale that across a large organization to, to go, "Oh, yes, this is actually working. People actually care, uh, about doing this." And then I, that I use the difference to identify where is this not working and I should focus my attention on.

Ashish Rajan : What's your thinking there in terms of scaling this out across a large organization? 'Cause I mean, obviously most organizations I'm talking to or working with [00:36:00] these days, there's only one or two teams that are truly AI-enabled. They haven't really scaled it out to, like, hey, the entire organization. And I imagine at, at, at companies that are forward-thinking, they probably are trying to do this and some have already done this What's been your thinking over there to scale out these things at a organization level?

Prahathess Rengasamy: Yeah. So the companies that are in the forefront of this, right? Like, uh, one call out here that I think is absolutely worth making is like for example, Perplexity has been doing a lot of security focused agent work for their computer product. I've been absolutely loving it. And companies that are forefront of it are building infra specific to this.

Ashish Rajan : Right.

Prahathess Rengasamy: Oh. Where you can run cloud agents safely, which would mean egress controls proxies for filling in credentials and whatnot.

Ashish Rajan : Oh, so you don't run them on your machine, you run them on another cloud. Like a-

Prahathess Rengasamy: Yeah ...

Ashish Rajan : a SaaS provider in a way.

Prahathess Rengasamy: Yeah. Uh, so like as far as scaling conversation goes, right, like it's how we scale Kubernetes and like it's how we scaled for the cloud native world.

Prahathess Rengasamy: We build a platform around it.

Ashish Rajan : Yes.

Prahathess Rengasamy: And once you build a platform around it, it gives you kind of like a centralized [00:37:00] or a paved path, a meta paved path here to kind of, use these things. And we can bake in security principles into the platform and make sure that it's secure. So when like, even like a 10,000 person company uses it, and they follow this platform based approach, we know that it's secure.

Prahathess Rengasamy: Uh, and we'll have the visibility into things that are not or exempted, and we can at least reactively do stuff to that, to respond to like incidents or like any security issues that may be. So like this... Scaling it means just that like you need a little bit more thought around, instead of just saying like, "Hey, you can use whatever you want, use it however you want."

Prahathess Rengasamy: You say like, "Hey, here's a team that has thought through this working with security to build a platform for you to use it." And it's plugging, it's plugged into all our internal context. It's plugged into like all our internal systems or tools that we already have, and this is the platform now. So we would scale it pretty much any...

Prahathess Rengasamy: with the same way we scale for cloud. We build a platform around it.

Ashish Rajan : Interesting. And Jeev, would that still work with agents? 'Cause you [00:38:00] know how-- And I, I'm sorry for kind of bringing this again and again, 'cause I definitely find people have a misunderstanding about AI agent, because every time I, I'm pretty sure when I say AI agent, some people in my audience would be like, they're thinking Terminator.

Ashish Rajan : They're thinking this thing is autonomous, floating around. They would not even realize that there are ways that you can sandbox agents. There are ways that you can have, uh, limitations on what the agent can itself do, what paths it can take. And obviously I've spoken enough about it, but I'd love to hear from you as well, uh, that there is a way that if you were to build an AI security platform, uh, or AI...

Ashish Rajan : not AI security. Let's just say if you were to build an AI platform in your organization to deploy AI agent at scale across a business, it is possible to manage that and have security controls. It's not gonna be like autonomous agency, throw more AI buzzwords into it, and that's gonna be the e- then it's like a, it's like a farm of AI agents who they're doing their own thing in the organization.

Prahathess Rengasamy: Yeah. No, it, it would be, uh... If it's gonna be a platform, it's gonna be, [00:39:00] it's gonna come with like restrictions that make sense for the business, right?

Ashish Rajan : Yeah.

Prahathess Rengasamy: Uh, and also like I think it's worth calling out, uh, to your point, like, uh, what an AI agent means. There are two types in general. Very broadly oversimplifying it, one would be a coding type agent where it just primary function is to work with repositories, write code, build stuff for you, deploy stuff for you, work with engineering type systems to accomplish like a task.

Prahathess Rengasamy: Yeah. The other one is like Q&A type agents do. I still call them agents because like most of like, uh, UX for like the chatbots have become agentic also behind the scenes. They can query multiple data sources to give you an answer, and they're querying with your identity. The data sources might contain sensitive stuff, uh, that you don't-

Ashish Rajan : Mm-hmm

Prahathess Rengasamy: There are two types of agents.

Prahathess Rengasamy: Uh, the platform thing that I mentioned would fit in like the coding agent category. Agents that code interact with infrastructure applications and like internal systems. For like the other chatbot type agents, like they are not primarily autonomous, right? They exist to answer questions to you or like work as your [00:40:00] copilot.

Prahathess Rengasamy: Yeah. Uh, safeguarding them means that your identity is already solved. You know that it's you who are making requests, and then you can have hooks and other platform native features that MCPs work, security MCP still works, and platform native features like these tools expose like all of them have open telemetry metrics that basically tell you who accessed what, when.

Prahathess Rengasamy: And building around that as a tool to have like the preventative and det- detective controls in place. So yeah, like for open, uh, work, like the cowork type scenario where like they take actions on the user's behalf on the browser and like all of that, it's still up in the air. Like there's, ... It's relatively harder to secure.

Prahathess Rengasamy: Probably you would, if you can restrict the agent to a limited browser like Island or Chrome Enterprise where like it's all MDM'd and restricted to what you can and cannot do, uh, would be a good approach towards it. But that's generally how I think about it. Like there are two types, the Q&A type, coding type, and like the coding ones have like the broadest impact in general.

Prahathess Rengasamy: So building a platform would be [00:41:00] a true enabler for the company. The, uh, cowork style thing is still new. There's a lot of thought that needs to go into like how we would- Yeah ... build applications that cowork type agents even use, right?

Ashish Rajan : So you know how all these other agents are being created where like, I mean, obviously I've, I've

Ashish Rajan : I'll give an example of one that I did where I had one which was just to query AWS for, uh, "Hey, where's my S3 buck- what are, what S3 buckets are open to the internet?" I'm just, just over simplifying the example of what I had deployed. Would you put that in the coding agent category or would you put that in the chat category?

Ashish Rajan : Technically, I'm still talking to it. I'm like-

Prahathess Rengasamy: It can, uh, it can be either. Both of them can answer. It can be both.

Ashish Rajan : Oh, right, okay. Yeah, 'cause your point, it-- the, uh, the coding part is just the functionality of it. Like it may have written a code in the background. Yeah,

Prahathess Rengasamy: I'd, yeah, I'd measure it in terms of like non-read actions, right?

Prahathess Rengasamy: Uh, things that, uh, the agent is making a change versus just reading stuff for you.

Ashish Rajan : Right.

Prahathess Rengasamy: Reading stuff for you, both of them are equal. They can just read everything.

Ashish Rajan : Yeah, yeah, yeah. Fair. Yeah. So your point is like the update, delete, create, like those kind of like- Yeah ... [00:42:00] read only is like your, yeah, chat, do whatever.

Ashish Rajan : Yeah. I mean, you read, as long as you're not reading something sensitive, but anything which is modify, create kind of action should be the ones where like you're really paying attention to that point, yeah.

Prahathess Rengasamy: Exactly. And this kind of has an underlying assumption that you don't give access to folks that easily to stuff that they're not supposed to read,

Ashish Rajan : ah. That's just a good point- Uh- ... because to... And I think it's worthwhile calling out as well, 'cause, uh, it goes back to the MCP point you had earlier where, I mean, I have access to so many MCPs, I can create my own MCP if I want to. Uh, you almost want-- Is there-- H- can you restrict that? Can you restrict what MCPs can I access?

Prahathess Rengasamy: It,

Ashish Rajan : I don't think you- Would that be like an MDM thing?

Prahathess Rengasamy: So MCPs are just like wrappers around the API, right? You can- Yeah ... have just blocks on what APIs you can access. Yes.

Ashish Rajan : Y- okay, to your point, so maybe to what you said, it's more like if it's a block... If I say M-Meta as an example is a blocked API, then MCP for a, MCP for a Meta [00:43:00] would not work because it's still gonna talk, try and talk, find data on the internet. Yeah.

Prahathess Rengasamy: It's gonna get blocked by the network level and it wouldn't still work.

Ashish Rajan : Yeah, okay, cool. That's a good one to clarify there, man

Prahathess Rengasamy: One of the things that would be really fun to think about is like how different functions in security would use, uh, different agents.

Prahathess Rengasamy: Like what would an appsec person build? What would an infrasec person build? What would a detection and response person build, right?

Ashish Rajan : I'm actually curious. Actually, tell me, how would you approach when a security team is building cloud security specific agents, appsec agents, this detection response agents, bug bounty agents.

Ashish Rajan : I mean, the list goes on. CISO has their own agent as well. What's your thought on those ones and managing those?

Prahathess Rengasamy: Yeah. Uh, sometimes like, not sometimes, like oftentimes, like the security team has like all the admin access-

Ashish Rajan : Yeah ...

Prahathess Rengasamy: in some cases also. So probably like the most high impact, uh, credential that you can steal or like an agent can impersonate to cause like a real harm to the business.

Prahathess Rengasamy: So yeah, like whatever policies that you apply has to come from inward. Basically like you need to apply those policies to yourself-

Ashish Rajan : [00:44:00] Yeah ...

Prahathess Rengasamy: uh, and how you are building these agents out for you. And in my experience, like once you have this agent built right, like you can share it with others saying that, "Hey, this is how I built the bot that completes on your peers."

Prahathess Rengasamy: And it's compliant with all of the stuff. So you can use this as an example or like POC for like anything else that you build. So whenever we are building these agents and we are putting in security controls, right? One thought that's always worth, uh, thinking through is that how can I generalize it and let engineering use it or like let other folks in the company use it.

Prahathess Rengasamy: So-

Ashish Rajan : Oh ...

Prahathess Rengasamy: that, that gives you a lot of saves you a lot of time. For example, like if we're figuring out how to give credentials to an agent without it actually sending the credential to the LLM, right? That's not a you problem. Yeah. That's an everyone who's using an LLM problem.

Ashish Rajan : That's right.

Ashish Rajan : Uh, yeah.

Ashish Rajan : And to your point, building those once means that you can actually... And to your point, that could be part of your AI platform as well.

Prahathess Rengasamy: Exactly. '

Ashish Rajan : Cause then

Prahathess Rengasamy: those are

Ashish Rajan : just-

Prahathess Rengasamy: So any requirement that you have is what everyone else has also, is the kind of the world we are living in. So like, if you're solving some problem for you, like making it a little bit more general and figuring out [00:45:00] how you can expose others to use it would be very helpful.

Prahathess Rengasamy: For example, for detection and response type thing, like we're passing logs all day, like SRE or like the PagerDuty bot would find it useful, right? Yeah. So building, holding yourself accountable for the policies that you write first, and then like generalizing the principles behind it as frameworks for the company and to use in their agents will go a long way.

Ashish Rajan : Interesting. That also makes me think that agent sprawl is gonna be very common across the entire organization, and a sign of a mature AI company would be people who have built an AI platform With standardized way for agents. Hey, these are our agents for security. And I, I probably to make it even more easier, these are the same thing that we issued for microservices back in the cloud days.

Ashish Rajan : Exactly. We were building microservices for the exact same thing. Yeah. Now we're just calling them agents.

Prahathess Rengasamy: Yeah.

Ashish Rajan : Kind of. So is, is that the right way to look at it? Like, I mean, obviously, uh, I'm just sharing this as, as I'm talking about it, but...

Prahathess Rengasamy: As a general example, [00:46:00] yes. And yeah, bec- agents are a little bit more autonomous than microservices are, right?

Prahathess Rengasamy: But apart from that, generally, yes. Like, we secure microservices with platforms. We can secure agents with dedicated platforms built for them. Yeah. In this case, I mean coding agents, yeah.

Ashish Rajan : Wow, man. That... Dude, there's just so much to I feel like this should be a part two conversation for this as well.

Ashish Rajan : But, uh, that's all that the time we had on this episode, man. But I definitely wanna unpack some of this. I think, uh, you're now gonna do a live stream as well for some of the open source projects that you have been talking about as well. So I look forward to that. But where can people find you and connect with you and learn more about all the exciting AI security things you've been working on?

Prahathess Rengasamy: Absolutely. I'm on X @prathish, pretty much @prathish pretty anywhere on the internet. So LinkedIn and X would be the best place to find me. And @prathish, tell me what you think about agents and security.

Ashish Rajan : I look forward. I'll put the links to your socials in there as well, and look forward to this, man.

Ashish Rajan : Thanks so much for your time and thank you for doing this.

Prahathess Rengasamy: Thank you so much for having me. Uh, I had fun.

Ashish Rajan : Thank you for watching or listening to that episode [00:47:00]of AI Security Podcast. This was brought to you by Techriot.io. If you wanna hear or watch more episodes of AI Security, check that out on aisecuritypodcast.com.

Ashish Rajan : And in case you are interested in learning more about cloud security, you should check out our sister podcast called Cloud Security Podcast, which is available on cloudsecuritypodcast.tv. Thank you for tuning in, and I'll see you in the next episode. Peace.

‍