Nick Reva: [00:00:00] If an incident happens, and it will happen, I promise you, if you can't shut it down quickly, you haven't won. The way that they were attacked was done in a way that a human would normally not do.

Ashish Rajan: They are the only ones asking the safety question in AI, so they become the bad guys and gals.

Nick Reva: The, the agent is overzealous.

The vibe coder is unfamiliar and unaware because they're not computer science people. It's like a double whammy of the forest fire that's impossible to contain once it starts burning.

Ashish Rajan: All these people are usually non-technical, like absolutely non-technical. Like, it's like Bob from accounting and Susie from legal.

Nick Reva: We wanna be the In-N-Out-

Ashish Rajan: Yeah ...

Nick Reva: for a vibe coder.

Ashish Rajan: AI makes it possible for anyone to be an engineer. It just said whether you have the will to be or not.

Nick Reva: We were noticing that agents inadvertently, without the human really understanding it, were in some cases pushing code to non-enterprise remotes.

Ashish Rajan: Fundamental truth.

Nick Reva: We're not gonna debate they're truth or not. They, they are true. You're creating, like, the pretend belief of security in governments, but you're not affecting the, uh, technical outcome. If you're not affecting a technical outcome, what are you doing?

Ashish Rajan: If AI security is top of mind and you wanna understand how the likes of DoorDash and forward-thinking companies are doing, I had a great conversation with Nick Reva.

[00:01:00] He's the director for security engineering at DoorDash, and we spoke about the different archetypes that exist in an organization today thanks to AI. Over-enthusiast AI champion, uh, archetype, the engineers who are adopting AI, but maybe adopting it as, based on the paved path you have created, and then finally, the vibe coders that you have in your organization who are adopting every AI tool that they can have, uh, at least to improve the productivity of it.

Now, none of these is to block them, but to understand how can we create a paved path for them to move forward in each of these archetypes, and which one, as a CISO or as a leader in security, you are able to utilize on having a paved path? What are some of the steps you can take for security for AI or AI for security to have incident response?

So we spoke about incident response. We spoke about how do you manage vibe coding as, at scale within your organization? How do you do security for AI, especially on the coding side, on coding agents and all the code being [00:02:00] produced? All that and a lot more in this episode with Nick. If you know someone who's working on these problems, definitely share this episode with them as well.

I'm sure they'll find this valuable. And if you are watching or listening an episode of the podcast for a second or third time, I would really appreciate if you hit the subscribe and follow button, whichever platform you follow us on. We are on Apple, Spotify, YouTube, and LinkedIn. I hope you enjoy this episode with Nick, and I'll talk to you soon.

Hey, man. Thanks for coming on the show.

Nick Reva: Pleasure to be here, Ashish. Thank you so much, and blistering Vegas.

Ashish Rajan: Oh. So you and I have had a conversation before, but this is-- it was time for us to have a dedicated conversation about this particular topic.

But to set the scene, if you could share a bit about yourself, your professional background as well for the audience.

Nick Reva: Yeah, of course. So I'm Nick. I've been in the security engineering space for about 19 years. Uh, last year or so, I've been leading security for DoorDash, uh, globally across, um, both DoorDash and our acquired companies.

Before that, I led security for Snapchat for about eight years, and before that, SpaceX. Uh, ear-earlier career was in Chicago, some smaller Fortune 500 companies. Pleasure to be [00:03:00] here, and I'm really happy that we can have a deeper conversation on these topics today.

Ashish Rajan: I'm excited also because obviously you and I've been talking for a while, and something that still keeps coming up in all my conversations and every strategic conversation that I'm a part of with AI security, it always comes down to we already have established security practices, and now we have the remit of enabling an AI organization.

But security people want to do it safely, and a lot of people are either feeling lost or are at that junction where they're the only ones asking the safety question in AI- Mm-hmm ... so they become the bad guys and gals, for, for lack of a better word.

Nick Reva: Yeah.

Ashish Rajan: In your experience, because you've obviously, you guys, you guys have been doing great work, uh, and talking about it publicly as well, how do you describe the, the delta, for lack of a better word, in what we have traditionally done with security programs, work for cloud, on premise?

What's the difference that you see now that you are trying to apply it to an AI world?

Nick Reva: Yeah. I think the [00:04:00] primary difference is that pre-previously, a lot of the security controls that we designed were being, uh, designed and applied to patterns that are l-largely deterministic.

There's a deterministic behavior of a security defect, vulnerability, misconfiguration that we can profile, and we can say, "Ah, if you misconfigure this S3 bucket, it's gonna be exposed to the internet, and you'll have data leakage."

Yeah. "If you misconfigure this, this, this, this policy on a server, the, the SSH may be, may be permitted overly permissively," right? If we give people too many too many permissions to do certain things- Yeah ... when their account is compromised, the blast radius is high. All, all those three examples are, are deterministic.

You can profile the, the bad- Yeah ... the so-called, uh, attack surface or exposure, and then you can apply security controls to protect it.

Ashish Rajan: Yeah.

Nick Reva: The big difference with, with agentic security and AI security is a lot of this context is probabilistic. Agents are being given broad-scoped authorization grants to go do [00:05:00] things, and because they're overzealous and they wanna be helpful and the mo- and the models powering the agents are highly trained and, and very capable, they're finding paths to do things that they shouldn't be doing, right?

And so now the way we think about- The problem space needs to change because we can't think about patterns that A- that AI workloads and agents are running using purely deterministic mentality.

Cause their behavior is probabilistic.

Ashish Rajan: Yeah.

Nick Reva: If we look at the Hugging Face incident report from about, from just a c- couple of days ago, one of the big themes in the report is that the way that they were attacked by OpenAI was done in a way that a human would normally not do.

So how do we constrain and apply controls to a surface that's not deterministic, that's highly probabilistic? Yeah. Like, the art of possible is a lot broader.

Ashish Rajan: Yeah. Yeah.

Nick Reva: So that's the... I think that's, like, the biggest mentality shift. The other th- big mentality shift is we're putting tools into the, into the hands of folks who have never ever seen such technical tools.

We're giving non-technical people access to highly technical [00:06:00] things, e.g., the vibe coder era.

Ashish Rajan: Yeah.

Nick Reva: And now we're asking them to do software engineering, but they've never even seen a terminal in their life. They don't know what SSH is. Mm. They don't know what a configuration file is. They don't know what an IDE is.

Ashish Rajan: Yeah.

Nick Reva: And now we're telling them to vibe code.

Ashish Rajan: Yeah.

Nick Reva: So the, the way we have to approach that problem is very, very different because we have to be a lot more empathetic to the real- realization that they've never taken a single computer science class in their life probably.

Ashish Rajan: Yeah.

Nick Reva: Right? And we have to solve the security principles for them, and w- using a common thing I speak about, we have to give them a paved path and, and how to interact with the infrastructure.

And if we don't, the blast radius to SSH is massive. They're gonna make mistakes.

Ashish Rajan: Yeah.

Nick Reva: The agents are gonna act on their behalf. They're not gonna know the difference of what's good or ba- good or bad- Yeah ... 'cause they don't have the context.

Ashish Rajan: Yeah.

Nick Reva: So the, the, the agent is overzealous. The vibe coder is unfamiliar and unaware because they're not computer science people.

It's like a double whammy of, of a forest fire that's impossible to contain on- once it starts burning, right?

Ashish Rajan: Yeah.

Nick Reva: Yeah. So that's ano- another big, big important aspect. I think the third aspect I'll talk about, and then I'll pause, [00:07:00] is you have to really apply first principles reasoning to the space and understand what are we actually trying to affect the security of?

Governance is great. Committees are great. Process and policy is great. But if you're not actually affecting the attack surface, if you're not actually affecting what can go wrong, we're not solving it.

Ashish Rajan: Mm.

Nick Reva: Right? A lot of companies have a lot of paper policies around this space where they believe that they're doing something useful because it says that they should do something useful in a paper policy.

But unless you're proactively applying s- security controls, and I can give lots of examples and as we move through this discussion today, you're not actually affecting anything. Like, you're, you're cr- you're creating, like, the pretend belief of security-

Ashish Rajan: Yeah ...

Nick Reva: and governance, but you're not, you're not affecting the, a technical outcome.

If you're not teching a technical, affecting a technical outcome, then what are you doing?

Ashish Rajan: Mm. I, I-

Nick Reva: I think that's a big difference in it, in how... Like, those three things are unique to the AI space-

Ashish Rajan: Yeah ...

Nick Reva: that I think aren't the same for cloud, cloud and other, uh, emerging [00:08:00] technologies that- Yeah

we've had to protect as operators. '

Ashish Rajan: Cause I think as you said those three things as well, I thought of three different profiles in an organization most people come across. There is the AI champion, the, in, in the engineering space who are, every new update comes out, they wanna use it. Every new model that comes out, they wanna use it.

Then there is your, um- People who follow along in that journey, that makes sense. There is a standardized paved path to what you said. They try and go down that path. Uh, then third one, the vibe coders, as you said, who are being asked by the organization to become software engineers. Yeah. Maybe if we were to just start clicking on each one of them one by one.

I'll start with the, probably the advanced one first, where- Yeah ... . soft-software engineers using coding agents to deploy massive amount of deployments across- Yes ... the organization. What is an example of a paved path for that, and what are some of the examples that people can apply in their organization as maybe they already have existing controls for it, uh, they just don't see it as, "Oh, I can use that while I try to figure out what my AI security posture is"?

Or- Yeah ... maybe there's no answer there.

Nick Reva: Yeah, exactly. [00:09:00] Okay. So let, let's, let's look at the professional software engineer archetype as- Yeah ... the first co-cohort that we- Yeah ... we think about.

Ashish Rajan: Yeah.

Nick Reva: Okay. So what are they doing? They're configured coding, coding assistance and agents locally on their machines- Yeah

to execute tasks to improve their productivity. They're auto-generating PRs using Frontier Lab models, right? They're configuring workflows locally to, um, to make their work more effective. They're having agents w-write documents for them. Mm-hmm. They're having agents review PRs for them. So what do we do there?

We need to start observing and understanding th-their, their environments. Where is their environment? Their environment is on, um, on a local laptop, typically a MacBook or a Windows device. Mm-hmm. We need to place some kind of observ-observe-observability control on that device in order to then, uh, understand what they're actually doing on that device from, from an a- from an agent perspective.

What MCPs are they connecting to? What a- what authorization grants are those MCPs, uh, being configured with in order to do things on their behalf? Are they impersonating their identity? Are they using a separate identity? Are they using service accounts, or are they d- doing impersonation of their- Hmm ... of their identity?[00:10:00]

Okay. Then how can we configure, um, rules into the IDE, for example, where they're developing, where we can have c- MD files, like Cloud MD files, that basically say we have to constrain the way their coding activities work in a way that will, will follow our, our principles of every PR generated needs to, needs to go through these following checks to look for, for defects, um, as a, as a kind of a SAS-like scanner.

Ashish Rajan: Yeah.

Nick Reva: We have to make sure we're enforcing the uses of, um, of secure distribution of, of artifacts-

Ashish Rajan: Mm-hmm ...

Nick Reva: um, s-such as Artifactory or the other s-sources of, of libraries that are trustworthy. We don't want them downloading libraries from the internet that are tampered with and, and may be affected by Shai Hulud.

We have to constrain this. We have to say, "Okay, in your IDE, you can only fetch dependencies from this s- this, this trusted source."

Ashish Rajan: Yeah.

Nick Reva: Again, that's a paved path. When you're committing g- when, when you're committing code locally and then you push that PR to GitHub we run an, an agent that we built at DoorDash that runs [00:11:00] various unit tests and, and sanity checks and also there's now security checks that we've implemented.

There are literally run security checks on that PR- Yeah ... to determine if, if there's any s- uh, any defects in that PR and applies, and, and applies that feedback directly to the PR, posted on the PR.

Ashish Rajan: Oh. But is this before the PR gets submitted or is it, um-

Nick Reva: It's a- as the PR is being submitted.

Ashish Rajan: Wow.

Nick Reva: It's an agent that is reviewing each PR- Yeah ... and giving both structural and contextual feedback, like correctness feedback, but also giving security feedback.

Ashish Rajan: Yeah.

Nick Reva: Okay? So those are just, just a couple of examples.

Ashish Rajan: Yeah.

Nick Reva: But then if we move further and we say, okay, let's see, let's say a team is developing agentic workflows-

Ashish Rajan: Yeah

Nick Reva: with agents and sub-agents that are customer facing for our dasher, merchant or, or customer ecosystem.

Ashish Rajan: Mm-hmm.

Nick Reva: We wanna give that team a way of handling authorization for agents and sub-agents in, in a consistent way. We don't want those teams of engineers to figure this out on their own 'cause they're, they're not gonna do it consistently.

So what do we do? We build a decorator function, it's basically a class, that we say, "Okay, please when you're developing in these agentic repos, [00:12:00] please use this, this decorator function class to do authorization checks on your agents and sub-agents." To make sure that they're, they're, they're, they're not being l- allowed wild, broad scope authorization to perform activities, 'cause that's dangerous.

Ashish Rajan: Yeah. Right?

Nick Reva: Yeah. There has to be an enforced authorization check.

So th- th- those are a couple examples that we do for the professional software engineers.

Ashish Rajan: Yeah.

Nick Reva: But we're all then also taking these, these kind of concepts and we're saying, "Why don't we build harnesses to audit code bases for systematic vulnerabilities that we kn- we know may exist in our, in our infrastructure, and actually find those vulnerabilities, cut the PRs, assign them to the engineering teams- Yeah

right, and then use different agents to review the PRs, and then ultimately somebody needs to sanity check that the PR is, is whole and mergeable and deployable.

Ashish Rajan: Yeah.

Nick Reva: But up until, like, the last, last, last step, a, a lot of this can be done with ag- agents now. This was never possible. This wasn't even possible, like, 10 months ago.

Ashish Rajan: I love what you said. Oh, I also love the fact that you've kind of separated that into just [00:13:00] how... I wa- I don't, I mean, obviously make, you make it sound simple, c- but you've spent so much time on this, building all these agents to check the PR, building the agents to make sure there's a sanity check on it, security check on it as well.

For people who probably have not done this and, uh, and you and I have in this conversation earlier, who probably have been on the fence of I'm not an engineer and maybe hesitant to go on their engineering journey, what I want to, what I want to kind of highlight here is that I think it's AI makes it possible for anyone to be an engineer.

It's just that whether you have the will to be or not. Yeah. So everything you called out, the agents which are for PR or agents that are being used as part of the IDE or before a pull request goes in or... 'Cause you also mentioned, uh, the last example you had was for the backlog. Like, all this backlog that we have collected for years.

Nick Reva: I- the, the backlog that exists or even the backlog that doesn't exist, 'cause there has never been a way of auditing for this across the code base.

Ashish Rajan: That's right.

Nick Reva: Right? Like, [00:14:00] we, we know we have this type of vulnerability in our infrastructure probably, but we haven't been able to systematically audit it- Mm

and find it and fix it, right? And so now, now, now we have the ability to do that.

Ashish Rajan: Yeah.

Nick Reva: And we can do much of that using AI and automation. Mm. That was never solvable in the past. The last thing we can't really do with AI quite yet is we can't do a safe deployment quite yet-

Ashish Rajan: Okay,

Nick Reva: right ... and make sure the traffic is safe and scale the traffic from 5, 10, 15, 20%.

So most, most, like, serious companies like, like DoorDash, other serious software companies, they always scale their releases using a, using a blue-green, , canary style deployment. That last step is still done, being done by humans. We call this dialing up the traffic-

Ashish Rajan: Yeah ...

Nick Reva: basically, but everything kinda leading up to that can largely be done by agents now.

Ashish Rajan: Interesting. And to double down on this as well, so we spoke about software engineering, we spoke about the backlogs, we spoke about the existing ecosystem of agentic workflow versus people who are using coding agents as well. [00:15:00] I was in a conversation and we were trying to talk about the volume of code that just could be-- gets created, right?

And that probably could be a good segway to get into vibe coding people after this as well.

Just the software engineers at the moment who are just producing such a huge volume of code now, how does a security team prepare for this? Is it that am I adding more manpower or am I using AI agent?

What's the way you have found that-- I mean, obviously you guys are a large company as well.

Nick Reva: Yeah.

Ashish Rajan: So it scales 10 times, 20 times to what an average company may have seen otherwise, which is not in that similar space. What's the approach you've had with the volume of new code being produced which-- to-- and to be checked for sanity?

The agent does that job for at scale as well, and how do you kind of scale that out across the organization?

Nick Reva: There's a couple elements to it. So there's, there's AI threat modeling where, where folks are still writing design documents even before the code is created. So we should s- we should shift far left, is what I like to say- Yeah

where we look at the origination of [00:16:00] the RFC, the RFC, the request for comment or the design document. You can use agents to audit and provide feedback on the design document itself, even before a single line of code is written. Now, some teams are no longer really writing design documents or writing Claude plans where they actually plan out what they wanna do, and then they, they st- they start to plan and they start to codify it.

In that context, in order to scale with the teams, you have to enable AI, AI-driven re- reviews.

Ashish Rajan: Yeah.

Nick Reva: And so before it used to be, here's the design document, a human looks at it, here's, here's a set of PRs, a human may review them if they're really consequential to the business. We can't do that anymore because the velocity and speed is so high.

Ashish Rajan: Yeah.

Nick Reva: So what do we do? We use AI to do AI-assisted threat modeling.

Ashish Rajan: Mm.

Nick Reva: We use AI to do AI either assisted or AI led PR review, right? We use AI to look for systematic vulnerabilities. You ,have to start to lean into this in, in, in each of these surfaces. I think the last thing you, you... that is left really where [00:17:00] humans are, are mo- mostly involved is the deployments.

Ashish Rajan: Mm.

Nick Reva: We're not-- I haven't really seen teams use AI to, to manage deployments in terms of like metrics, health and roll-outs. Haven't seen that yet. But to get started, let's say you're not a software engineering company like DoorDash where you have a, a lot of capability. You should pick s- You could, you should pick a part of this and start to chip away at it.

So maybe you say, "Okay, I am a more traditional company- Mm ... and I still do design docs for everything, and I imagine I'm gonna continue doing design docs for everything." Why not start to look at your design docs and start to use either the Frontier Lab models or some of the startups in this space that help with AI-assisted threat modeling, and start to threat model what i- what is about to be created?

Mm ... is this a dangerous proposition based on how the design document's written?

Ashish Rajan: Mm.

Nick Reva: That's the far, far left. Then you move a little bit like closer, closer to the right, then you say, "Okay, now code's being written, code's landing in, in repos. We can run agents on each PR and give feedback."

Okay now code's been deployed, now let's say it's running. We, we, we dialed it up ourselves. Let's... But maybe this was an agentic [00:18:00] deployment and it's, it's running in, in at runtime.

Ashish Rajan: Yeah.

Nick Reva: Now we have to observe what it's doing. This is where we use techniques like eBPF to observe what it's doing and determine is it acting in a nefarious.

Is it doing something that shouldn't be happening? Mm. Is there all of a sudden a weird, a weird egress call for weird IPs in a country that we shouldn't be doing business with, right? We can also use agentic techniques to profile the traffic and determine is this traffic that we should, we should allow or this we should curtail and choke point, right?

Ashish Rajan: I think it's an interesting one, right?

Nick Reva: There are different layers of this issue.

Ashish Rajan: Yeah, and I think I love the examples. Also, uh, I wanna add some people may hear that and would ask, "But Nick- It's known for hallucination. How do I build that trust between what the AI produces and, and what I, what I mean by that, I'll just say the PR example, right?

I had that AI agent, um, because you have the engineering capability, you can build the agent. A lot of people may go for a third party to solve that problem- Yeah ... and that's totally fine as well. It's totally fine. Yeah, yeah.

Nick Reva: There's no problem.

Ashish Rajan: Yeah. It's

Nick Reva: fine.

Ashish Rajan: The question always comes down [00:19:00] to a lot of people saying, "Hey, I don't trust AI because I know it hallucinates."

I don't wanna miss a vulnerability from going into production because it hallucinated and false positive, whatever. Have you guys figured out a way to kind of find a balance between-- Obviously, it sounds like you have a balance between the human deployment piece, someone verifies it- Yeah ... before it goes into any kind of production pipeline.

Yeah. But is there a way for an organization that may have been skeptical about AI? 'Cause I-- There's definitely those even today for them to start building confidence on uh, the AI that they're building themselves, 'cause maybe that's also a hurdle that people have to cross for, can I trust this?

Nick Reva: Yeah.

Well, like it's, it's it is a little magical, but at the end of the day, there's, there's patterns and techniques that you can apply to to reason about correctness.

Ashish Rajan: Mm-hmm.

Nick Reva: So the best way of doing this is, this is gonna get a little technical for a second, but we have, we have to. You have to look at ground truth training data that is reflective of what good looks like.

And you have to then evaluate that data set and determine from that data set [00:20:00] of the feedback that the AI provided, can we sample the AI decisioning, and can we give, can we give a ground truth vote on thumbs up or thumbs down? What the AI did, is it correct or not? And a human can review that, and a human can label that data set.

Ashish Rajan: Yeah.

Nick Reva: And then the model that, that's, that can then infer that data set as, as a AI, as a ground truth kind of coach. You basically coach it to act a certain way as like an arbitrator, right?

Ashish Rajan: Yeah.

Nick Reva: If you're really worried about it, you have to take this, this sampling and data labeling approach, and then basically use, use that as the ground truth to then say, "Okay, this is how you should behave from a model perspective."

Or you can configure m- um, Claude MD and Cursor MD files to basically say, "I, I want you to never do this, and I want you to do this instead."

Ashish Rajan: Hmm.

Nick Reva: Right? This is kind of how you s- s- guardrail and like invoke what the behavior sh- should be expected, right?

Ashish Rajan: Yeah.

Nick Reva: [00:21:00] And you can actually as a, as a company, you can centrally deploy those to all of your engineers using MDM.

Ashish Rajan: Hmm.

Nick Reva: So you, you define the hardened MD files where the patterns are described-

Ashish Rajan: Yeah ...

Nick Reva: right? That you maybe learn through, through the, the, the sampling and, and la- labeling approach.

Ashish Rajan: Yeah.

Nick Reva: And then you set those as, as

secure defaults, basically. This is no different than how we talked about hardening laptops and desktops with like MDMs 20 years ago- Yeah,

Ashish Rajan: yeah

Nick Reva: when it was a sexy thing. No longer, it's no longer sexy. Yeah. This is just a different surface to harden.

Ashish Rajan: Yeah.

Nick Reva: Like at the end of the day, the only way you're gonna prevent something bad is if, if you apply a hardening control.

Ashish Rajan: Hmm. Yeah.

Nick Reva: And if you don't apply a hardening control, the only thing you have left , is really fast incident response and containment.

Ashish Rajan: Yeah.

Nick Reva: That's all you have left.

Ashish Rajan: Incident response is an interesting one which I'll at least like to touch on. Uh, but I wanna talk also about the vibe code as, as well.

Nick Reva: Yeah.

Ashish Rajan: Or, and I... Maybe to set the scene, a lot of people may look at vibe coding on the internet and think- Have versions in their mind.

[00:22:00] They might be a Vercel in the background, a Lovable in the background, or insert another agent framework, uh, that allows you to do X job.

What's an example of how you see the vibe coders?

Nick Reva: Yeah.

Ashish Rajan: And what's a good way to approach that problem considering all these people are usually non-technical? Yeah.

Like, absolutely non-technical. Like, it's like Bob from accounting and Susie from legal.

Nick Reva: I- I-- That's exactly right. Yeah. So you have to treat those deployment platforms that they're building on-

Ashish Rajan: Yeah ...

Nick Reva: as cloud platforms, just like you treat your AWS and GCP and Azure.

Ashish Rajan: Mm-hmm.

Nick Reva: Or your security teams have probably gone in and have probably hardened the usage of those platforms already.

If you haven't done that for your cloud, you should do that first probably. Mm-hmm. That's probably the more important. Yeah. You know, these are the things like where you set security defaults, where you ensure SSO, where you ensure your CloudTrail is enabled, where you ensure there's Wiz scanning. If you're a little more mature, you can do things like Chainguard for secure base images.

All those primitives of where the security team manage the defaults and the knobs-

Ashish Rajan: Yeah,

Nick Reva: yeah ... in [00:23:00] your AWS, GCP, Azure, you should apply the same exact principle to your Lovable, to your Vercel, to your FUBAR vibe coder deployment platform. Yeah. Why? 'Cause the vibe coders do not know computer science- Yeah

typically. They do not know how to securely configure it. They don't know what it means to, for, and for an endpoint to be gated behind a VPN versus not a VPN. They don't know how to configure VPCs. Mm. They don't know how to handle secrets. You have to give this to them, and this is a very hard thing to do because even the tools and ecosystem isn't really equipped quite yet.

But we recently ran a project where we, we literally went in, and we hardened the surfaces of, of how vibe coders deploy to Vercel.

Ashish Rajan: Okay.

Nick Reva: Okay?

Why did we do that? We did that 'cause we needed to protect and control and govern the exact knobs. Yeah. We don't want them touching the knobs. We only want them to be able to deploy to this environment, do their high-fidelity mock-ups, show their customers, show their partners, and give feedback.

And then typically what's happening is then those teams, they either [00:24:00] have some little application they built that runs or, in this context, this is more like product managers doing high-fidelity mock-ups- Yeah ... to then hand off to professional engineers to then actually productionize into, into a real service.

Ashish Rajan: Mm-hmm.

Nick Reva: Right? But if you don't treat it the same way you treat AWS and, and GCP and Azure, there's no way that it's, it's gonna be deterministic and secure because you're, you're, you're leaving this to, to circumstance and, and it's completely haphazard.

Ashish Rajan: Yeah.

Nick Reva: So every, like, dimension of, of the, of deployment platform like Vercel and- or global needs to be reasoned about and needs to be hardened.

Ashish Rajan: Mm-hmm.

Nick Reva: Right?

Ashish Rajan: Do you need to build relationship with those people as well? 'Cause I almost feel this is, to your point about AWS and GCP, I can use my own credit card to start my AWS, GCP, whatever environment j- even though it's not technically allowed for me to do that in the organization. Like, I can use my personal accounts.

How does one find a balance there? It's almost like that, what's it called? The- Ah ... digital risk protection that we-

Nick Reva: It's such a, it's such a good question. We actually dealt with this exact problem. So [00:25:00] you have to claim every single domain that your company , owns. So every single domain that the company has-

Ashish Rajan: Mm-hmm

Nick Reva: right? You probably know what those are. Y- if you don't, you can go talk to the teams that do. You have to make it so that- Every-- whatever vibe coder platform you allow, let's say it's, let's say it's Vercel for sake of the conversation. You have to domain cl- claim those domains and state that the only way to sign up and deploy a application to a doordash.star-

Ashish Rajan: Yeah

Nick Reva: domain is through use of an enterprise managed, an EMU account, Enterprise Managed user account with a, a Okta identity- Mm ... that's issued by the company.

Ashish Rajan: Yeah.

Nick Reva: And from there, all the paved path controls follow, and we do not allow administrative access to the f-f-for, for those Vercel accounts to the vibe coders.

Ashish Rajan: Mm.

Nick Reva: Do not, by intention. Right. Okay? We [00:26:00] do not want them b- twisting the knobs.

Ashish Rajan: Mm.

Nick Reva: You know, it's like sitting into a, an A380 and there's- Mm ... 300 knobs to turn, and you're not an, a skilled pilot.

Ashish Rajan: Yeah.

Nick Reva: You're not gonna know what the knobs do.

Ashish Rajan: Yeah.

Nick Reva: This is the same exact thing, Ashish. Yeah. Like, they just don't know, and it's okay.

They don't need to know.

Ashish Rajan: Yeah.

Nick Reva: This is what I'm paid to do.

Ashish Rajan: Yeah.

Nick Reva: This is what my team, my team exists to do is, is to, is to provide, provide the, the, the paved path literally-

Ashish Rajan: Yeah ...

Nick Reva: for them, right? They don't need to worry about this.

Ashish Rajan: What's a good way to approach this? 'Cause I think to what you said, I mean, we have all the security awareness training.

It almost feels it's, and harder also because to what you said, they're non-technical people, and you're trying to help them understand, uh, the risk of it. And by the way, I do wanna caveat, I don't think they intentionally want to put a company at risk.

Nick Reva: No, they just-

Ashish Rajan: It's just that they don't

Nick Reva: know ... they just, they just don't, they just don't know.

Okay. So we actually built a training at the company.

Ashish Rajan: Yeah.

Nick Reva: I ended up writing it mostly myself 'cause we needed to move fast. Yeah. I called it Vibe Check.

Ashish Rajan: All right.

Nick Reva: So before you can vibe code, you need to, you need to do a vibe check.

Ashish Rajan: Yeah.

Nick Reva: And vibe check [00:27:00] is, like, a 20-minute training that takes you through the primitives of software engineering at a, kind of at a higher level.

Ashish Rajan: Yeah.

Nick Reva: But it, but also then we layer on all these controls where they can't go provision their own, their own account. They're provisioned accounts. Mm. They can't go change the knobs on how a VPC works in in, in Vercel.

Ashish Rajan: Yeah.

Nick Reva: They can't go change the way how, how secrets are managed. Secrets can only be managed a certain secure way.

Ashish Rajan: Yeah.

Nick Reva: We simplify for them, right? And we give them a small menu of options. Yeah. It's like the difference of, of going to In-N-Out, where there's, like, four ways you can make a burger-

Ashish Rajan: Uh ...

Nick Reva: or a place that does, like, high customization of burgers.

Ashish Rajan: Yeah.

Nick Reva: Right? We wanna be the In-N-Out-

Ashish Rajan: Yeah ...

Nick Reva: for vibe coders.

Ashish Rajan: Yeah.

Nick Reva: We wanna give them the thing to do. understand where they're at, give them some basic training on it- Yeah ... right? And then wherever possible, we wanna create guardrails. I'll give you another example. We built something internally for GitHub interactions. We were noticing that agents, again, inadvertently without the human really understanding it, were in some cases pushing code to [00:28:00] non-enterprise remotes.

Ashish Rajan: Mm-hmm.

Nick Reva: Meaning GitHub, GitHub organizations that do not belong to the company.

Ashish Rajan: Mm-hmm.

Nick Reva: Okay? In order to constrain that, we built a mechanism called safety belts.

Ashish Rajan: Yeah. '

Nick Reva: Cause when you get into the car, you put on your safety belt to be safe.

Ashish Rajan: Yeah.

Nick Reva: And when you operate agents and you're interacting with GitHub, we wanna make sure the agent doesn't hallucinate and send code to a, Ashish's private- Yeah

uh, repo versus a, a company-managed repo, right? And to make sure that doesn't happen-

...

Nick Reva: We literally look at the GitHub push flow-

Ashish Rajan: Yeah ...

Nick Reva: and we invoke safety belts, and the safety belts checks to determine if it's an, a non-enterprise remote or an enterprise remote. Mm-hmm. And if it's a non-enterprise remote, it doesn't allow the push.

Ashish Rajan: Oh, wow.

Nick Reva: We built that. We're probably gonna open source it. We're gonna rewrite it into Golang to make it more durable.

Ashish Rajan: Yeah.

Nick Reva: And I wanna open source it-

Ashish Rajan: Yeah, that's a good idea ... for the,

Nick Reva: for the industry. 'Cause if I have this problem, I guarantee you other companies have the same problem.

Ashish Rajan: I also find that vibe coding is interesting because Um, the, it's, it's just not the, the two companies. [00:29:00] It's, it's like a, you can allow list or deny list to Vibe Code subscription for lack of a better word. Like, you know, and I think the challenge also becomes that how do you scale to do have programs which are ongoing, but the Vibe Check is like, is it a one-time thing, or does it like happen on- ongoingly?

Nick Reva: We're, we're iterating on it. So we launched it as a requirement for non-technical folks- Yeah ... to get access. Yeah. So before you can get access to Claude, before you can get access to GitHub, you must complete Vibe Check. It's an intern- It's built on internally, in an internally developed training platform.

Ashish Rajan: Right.

Nick Reva: There's a programmatic integration that doesn't allow you to, to apply for the access via Conductor One-

Ashish Rajan: Mm ...

Nick Reva: to these tools unless you complete a Vibe Check. Mm-hmm. Okay? That, that's like a, a step zero. Yeah. Then as you're, as you're u- as you're interacting with these tools, if, if there's concerns, like we'll t- we try to surface them to you.

Um, this is all f- fairly new. This is several months old.

Ashish Rajan: Yeah.

Nick Reva: Um, the next iteration of it will probably be more technical.

Ashish Rajan: Yeah.

Nick Reva: The way I'm imagining it is it might even be more of like a range, kinda like a [00:30:00] cyber range where we kinda give you like some scenarios and tell you like what should you do in this scenario.

Ashish Rajan: Mm.

Nick Reva: But, but really, I don't believe that you can like truly train non-technical people to like really deeply understand this infrastructure. What you'd need to do is based on the exposures and incidents that you experience as a company, you need to take those back, put them into the, put them into the, the loop-

Ashish Rajan: Yeah

Nick Reva: and solve for them with progr- with programmatic proactive controls, right? Oh. Like, how did we end up building, building safety belts? Because we saw what was happening with agents, right? Mm-hmm. How did we end up hardening the Claude MD files? 'Cause we saw, we saw some i- some issues with hallucination, right?

Yeah, yeah. , How did we end up going and hardening Vercel and making it impossible for a Vibe Coder to solve for all of Vercel account and constraining it only to domains that the company owns, making it only possible to d- to use if you're an enterprise managed user? We went and hardened it and created a proactive control.

Ashish Rajan: Mm.

Nick Reva: All of these things are only possible like this, so you have to have the resilience and grit and leadership to [00:31:00] go and do this. Mm. And like, you know what? We did take away access to people who had access in Vercel, and some of them were like power users, and they were a little upset.

Ashish Rajan: Yeah.

Nick Reva: But we did it for a reason, 'cause the security team needs to control the outcome.

Ashish Rajan: Yeah.

Nick Reva: And if we're not controlling the outcome, and we're allowing others to, to get into the A380 and twist, twist the knobs- That's not the right way. We, we just we should not operate like that.

Ashish Rajan: Is it w- so I think very well said as well, 'cause I almost want to bring another angle to this. So we spoke about the three archetypes with the software engineering, the advanced people, and the vibe coders as well.

If you take a step back I've been talking obviously to a lot of regulated industries who have taken down the path and there's a ge- the, the general consensus coming on the whole instant response side of things as well. Like, a lot of the and what you have called out 100% agree to everything.

How are you finding the incident response space as it evolves for the AI security? Yeah. Especially because there's not much training for incident response, there's not a lot of people who are- Yeah. Even cloud security for [00:32:00] that matter, even years of it, we still don't have proper training for incident response- Yeah

people for cloud security 'cause it's so specific to the organization. Well,

Nick Reva: here, here's what's happening. So we're, we've mostly talked about securing AI.

Ashish Rajan: Yeah.

Nick Reva: And now we're gonna talk about AI for security.

Ashish Rajan: Yeah.

Nick Reva: So we're applying AI for security to our incident response workflows. Mm-hmm. Where each stage of the re- respond, contain, remediate, closeout cycle has elements that are now AI assisted.

Ashish Rajan: Mm-hmm.

Nick Reva: Okay? The way we collate and look at logs in an incident is AI assisted. Yeah. The way we summarize and write incident reports is AI assisted. The way we assign tickets and repair items to teams to go fix it is AI assisted.

All of these elements are becoming AI assisted. We're not even talking about SOC, we're just talking about incident response.

Yeah. Right? That's right. This is, this is kinda like po- post, post SOC. This is when we're actually in, in the thick of the incident.

Ashish Rajan: Yeah, yeah.

Nick Reva: Why? Because there's, [00:33:00] now it's possible.

Ashish Rajan: Yeah.

Nick Reva: And also this, the surfaces have broadened. Like, before it used to be professional software engineers touching infrastructure.

Ashish Rajan: Mm-hmm.

Nick Reva: It's not the case anymore, right? It's, it's vibe coders.

Ashish Rajan: Yeah.

Nick Reva: And we ha- we have to then manage these kind of incidents, and w- I think what's very, very important from incident response perspective is you have to ask yourself- We've been talking about this idea of assume breach, assume breach as the industry for like 10, 12 years.

But now, because agents act non-deterministically, they're probabilistic creations in a deterministic world-

Ashish Rajan: Yeah ...

Nick Reva: we have to be able to constrain and contain their activity o- on the infrastructure. And so if we can't contain the activi- the, the activity on an infrastructure, then how can we stop the incident quickly?

We need a way to shut down and contain the endpoint, a laptop. We need a way to shut down and contain a cloud instance, uh, a, a, a Kubernetes pod, an EC2 instance, a [00:34:00] GC instance. And then very importantly, and a lot of people are not really talking about this, I, I'm a firm believer this is, this is the way forward, is we need to be able to con- contain egress traffic.

Because if an if a bad actor has a foothold or if an agent has a, has a mothership that they're reporting back to the, to the model, then their context window, right? The context window elapses, and the next, the next command, c- command and control needs to come from a new context window, and the model is hosted somewhere else, else out of your infrastructure.

If they can't reach that infrastructure on egress, they're not gonna get a command and control.

Ashish Rajan: Yeah.

Nick Reva: And we shut them down.

Ashish Rajan: Yeah.

Nick Reva: So we have to be able to choke point at each of those, uh, in s- so segments: laptop, cloud infrastructure workload, and network egress. And if we can do that, this is somewhat sophisticated- Mm-hmm

but the kinda companies I work for we're, we're getting close to this. Then we can really have a high, high confidence that during an incident, no matter if it's a human or an agent, we can constrain it at each, at each of those [00:35:00] surfaces.

Ashish Rajan: It's funny, uh, where we started the conversation about, um, MDM, the traditional MDM is still relevant in pushing out controls to the endpoints, and now we're talking about networks, how the network security as we have done...

Uh, 'cause this was used to be, at least in the on-premise days, a lot of it was about, hey, cut, cut the for lack of a better word, cut the cord- Yeah ... to the mothership. And, it's funny 'cause as you said that, I don't know how many people actually thought that's possible in how AI interacts, especially if they look at the...

I'm gonna use the Hugging Face example. But if there was a way, and obviously the details of it are very let's just say spread out, and people can assume what they want- If you were to cut the connection and so that it never leaves the environment-

Nick Reva: Yeah ...

Ashish Rajan: that itself is like, wait, if that was to happen, that would...

Because there's no data leaving.

Nick Reva: That would stop the incident.

Ashish Rajan: Yeah, that would stop the incident right there.

Nick Reva: That, that would literally, that literally stop the incident. There, there's a reason that we've been containing laptops as an industry for 10 years. Like, this is not a new concept.

Ashish Rajan: Yeah, yeah,

Nick Reva: yeah.

When I worked at [00:36:00] SpaceX, we had FireEye, we were doing this 12 years ago. What is a new, newer concept is doing this for cloud infrastructure workloads.

Ashish Rajan: Yeah.

Nick Reva: And I, I say, and I'll say it isn't a new concept, but is, it has like a renewed importance. It is containing it on egress.

Ashish Rajan: Mm.

Nick Reva: Network egress.

'Cause if you can shut down the command and control traffic, like the OSI model hasn't changed, Ashish.

Ashish Rajan: Yeah.

Nick Reva: Many years have passed since I learned the OSI model, you know. Yeah. Old people seem to need data processing. Yeah, yeah, yeah. You got the seven layers, right?

Ashish Rajan: Still works.

Nick Reva: It still works. Like, it's still the network.

If you can constrain the network and kill it, then you stop the incident.

Ashish Rajan: Yeah, 'cause it can't, the packet can't leave.

Nick Reva: Packet can't leave.

Ashish Rajan: Where is the packet going to go? But I, I guess maybe to, to what you said another thing that a lot of people have been talking about is that the, the... If you were to look at the time series of how quickly an action happens- I almost feel to what you said, you need to have an AI picking up the incident, picking up the recon, picking up parts of it.

'Cause most people use an example of one incident, but traditionally, in a [00:37:00] large organization, it's never just one incident.

Nick Reva: There's never... Th- th- there's paralyzing it, and we're, we're, we're constrained by human labor. Like, we have, you know, we have a handful, handful of people on call per region.

Ashish Rajan: Yeah, yeah.

Nick Reva: Something like this.

Ashish Rajan: Yeah.

Nick Reva: Right? And when they're tapped out, they're tapped out, then what happens?

Ashish Rajan: Yeah. I mean, it's, at the end of the day, it's a human has to-

Nick Reva: Like, it's not, it's not an unlimited resource pool. There's never an unlimited resource pool. So what, what if we say, "Okay, like, let's study the anatomy of an incident.

Like, let's, let's see where people are spending their time." Okay, they're spending their time on log collection. Every single incident has log collection analysis, like undeniably true.

Ashish Rajan: Yeah.

Nick Reva: Right? They're spending the time summarizing and explaining to leadership, like to people like me and, like, my manager, you know, what's happening, right?

100% true. Like, always true. Okay, let's have agents do the summarization.

Ashish Rajan: Yeah.

Nick Reva: Then they're spending time, uh, wr- writing repair items and tickets in Jira and assigning them to to those teams. Always gonna be true. So why don't we take, like, those, just those three examples.

Ashish Rajan: Fundamental truths.

Nick Reva: Yeah. Fu- those fundamental truths, like they're not, they're like irrefutable truths.

Yeah,

Ashish Rajan: yeah.

Nick Reva: Right? They're, we're not gonna debate they're truth or not. They, they are true.

Ashish Rajan: Yeah.

Nick Reva: And we apply AI to those surfaces. Then the humans can go do the, the higher judgment, like, like unique aspects of this, like talking to [00:38:00] legal. Mm. Determining how, like, what are, like, I don't know, legal exposure is.

Sometimes you gotta talk to attorneys general kind of people. Like, it just depends on the context, right? So the humans can do the stuff that's more unique and, and kinda creative.

Ashish Rajan: Yeah.

Nick Reva: Right? 'Cause the, these three things I said, like they're part of every single incident, right? Log analysis, summarization and, and f- and repair items.

Ashish Rajan: Yeah.

Nick Reva: Every single incident has, has elements of those three things.

Ashish Rajan: Undeniable, yeah. It's always... And we've done, we've done this for decades as well. So it's, so you're, you're not denying any of this. So to kind of bring the whole circle, we spoke about the, I guess the, the layer where we have the three archetypes.

How do you introduce AI to them safely? The vibe coders. We also spoke about the incident response plan as well. So if we're to just take a step back, and a lot of people may not be having the engineering horsepower that you guys have.

Nick Reva: Yeah.

Ashish Rajan: A lot of people may be in the regulated space. A lot of people that I work with, Fortune 500, they have the resources, but a lot of people still feel, "I don't know where the right point to start is."

Like we are at Black Hat today, and [00:39:00] a lot of conversation's gonna be around, "I already have a security program I'm gonna uplift that for AI. And obviously we can, we can make a lot of assumptions here. In terms of what's a good place to start in an organization, whether it's security for AI or AI for security is debatable.

But let's just say if you were to book- pick security for AI as a, as a thing that, "Hey, that's my priority today because I'm a small team," whatever, what are some of the easy wins or a good place to start applying some of the things that you spoke about? 'Cause obviously you've, you've gone through the iteration, and a lot of people are like, "Hey, I just want like a, something that I can show on the board as an ROI to the organization.

Hey, this is worthwhile doing. We should continue down this path." Anything that comes to mind as some-

Nick Reva: So, so you're asking about security for AI? Yeah. Okay. Uh, I think minimally you need to be able to profile what's happening on every single laptop and device in your organization, Windows, Linux, Mac, Chromebook.

You need to be able to profile the activity there. There's vendors that do this. Mm. We, we did not [00:40:00] engineer this ourselves. We have a vendor that we chose.

Ashish Rajan: Yeah.

Nick Reva: Um, I think you need to be able to do that.

Ashish Rajan: Yeah.

Nick Reva: Then if you as a company have a product experience where people interact with your company's product via an, an agentic experience, whether it's some kind of a portal, whether it's a bot, whatever it is, you need to find a way to threat model the activity of that, of that surface.

Ashish Rajan: Yeah.

Nick Reva: You need to look to see how it's authorizing itself to data sets. An agent in that context is always going to look at a data set organizationally, and they're gonna then go take an action. Like just let's use a simple example. Imagine you're an airline and you're talking to the United Airline agent to, to change a seat, right?

What, what does it need to do? Like what are the truths of that, about that interaction? It needs to pull up your reservation, it needs to see what seat you have now, and it needs, it needs to... And let's say you wanna move seats from 32E to 30, third, to, to a different row, right?

Ashish Rajan: Yeah.

Nick Reva: And it needs, it needs authorization to those systems to do it, right?

So you have to constrain it in a way that it's only authorized to do the things that it should be doing and, and it isn't able [00:41:00] to like put you in business class for free, right?

Ashish Rajan: Mm.

Nick Reva: Even though that's nice and convenient, like you don't wanna do that.

Ashish Rajan: Yeah, yeah.

Nick Reva: Like you have to constrain it. And if it's not constrained and people can tamper with it, prompt inject it, and I think there was a case around, you know, these kind of upgrades happening because the, because the agent wasn't properly constrained.

Ashish Rajan: Yeah.

Nick Reva: So you gotta look at that surface.

Ashish Rajan: Yeah.

Nick Reva: Right? You gotta look at that surface. And then I think like the third thing I would focus on if I'm just getting started is then how to apply it to the runtime containment context. 'Cause if you can't, if you can't shut down bad egress-

Ashish Rajan: Yeah ...

Nick Reva: and you can't affect potentially compromised workloads quickly, much more quickly than in the past- Yeah

you're not gonna, you're not gonna win. Like those other things don't, like they matter from a proactive perspective, right? The laptop agent observability, the pro- product agentic experience. But if an incident happens, and it will happen, I promise you, if you can't shut it down quickly, you haven't won.

Ashish Rajan: Yeah.

Nick Reva: And some of the regulatory requirements that [00:42:00] I operate with-

Ashish Rajan: Yeah ...

Nick Reva: they require a 48, 72-hour turnaround time And if you can't even c- affect the incident that quickly, how can you report on it? Mm. It's like, like there's, like, an order of operations here that n- that is true, right? So I think those are the three areas I would focus on.

Ashish Rajan: Yeah. Awesome. What about the flipping that for security, sorry, AI for security?

Nick Reva: AI for security, okay. All the analytical kind of work of threat modeling, you can use AI to, for that today. Like let's say you're a more traditional company, you have Google Docs or, or, or Office docs that you still write out w- what you're going to, what you're going to build, and then, then you build it.

You can 100% set u- use, uh, use Claude Code or even Claude Work to analyze those documents and give feedback. You can also connect Claude similar ways to repos and have it analyze the repo code that the person wrote and give feedback. Like these are not hard things to do- Yeah ... anymore. This used to be hard, no longer hard.

You can definitely do that. Next I think the PR flow review, agentic security reviewer of the PRs, [00:43:00] there's vendors who do this. You can do this yourself.

Ashish Rajan: Yeah.

Nick Reva: I- that's also not super hard to do.

Ashish Rajan: Mm-hmm.

Nick Reva: Okay? Second one. The third and last one is the incident response scenario. Yeah. Every incident, like as I said earlier, has a couple truths.

There's always gonna be a log analysis piece. There's always gonna be a, a, a data analysis and explanation and reporting piece, and there's going to be a repair item ticketing follow-up postmortem piece.

Ashish Rajan: Mm.

Nick Reva: You can apply AI to those surfaces to sh- save your incident response team and h- and have them focus on, on, on the higher judgment, more creative things.

Those are three examples for each one, AI for security and security for AI.

Ashish Rajan: Awesome. Well, that's all the technical questions I had.

Nick Reva: Yeah.

Ashish Rajan: I don't know if you remember the joke part. Joke part? We had, we, we, we're doing a, a you laugh you lose challenge.

Nick Reva: Okay. Okay.

Ashish Rajan: And do you have a joke in mind?

Nick Reva: I have a joke in mind.

Ashish Rajan: Awesome. All right. Uh, so the, the, the way it would work is I have a joke, you have a joke, and I say my joke first, and hopefully it's funny enough that you laugh, uh, otherwise I lose. So let me just bring up my... All right, okay, [00:44:00] 'cause we were talking about incident response.

So you ready?

Nick Reva: Yeah. All

Ashish Rajan: right, I was looking at these, uh, dating profiles, right? I think I was- Dating

Nick Reva: profiles?

Ashish Rajan: Yeah, just out of curiosity, and, uh, what do people talk about these days, especially if you're a threat hunter? Yeah. Like how, how do you kind of, uh, what, what's a good pickup line to go for?

Nick Reva: Oh, a pickup line, uh- As

Ashish Rajan: a threat hunter

Nick Reva: as a threat hunter?

Ashish Rajan: Yeah. Oh, okay. So here you go. So the pickup line was... You ready?

Nick Reva: Yeah.

Ashish Rajan: Are you an anomaly? Because everyone else ignored you, and now I can't stop thinking about you.

Nick Reva: Pretty good. Pretty good.

Ashish Rajan: Yeah. Well, what- Really good ... like let's hear yours.

Nick Reva: Really good. Okay. Uh, what do you call a script kitty using Claude?

Ashish Rajan: What do you call it?

Nick Reva: Claude kitty.

Ashish Rajan: Well, okay. Fair. I think you, you and I gotta get, get a draw there. Do you have more jokes?

Nick Reva: No.

Ashish Rajan: Oh. No jokes. Okay, fair. All right. That's a good one. I think we still owe you a Script Kitty T-shirt as well. We

Nick Reva: still, you still owe me a s- ... I coined that, like, six months ago, so.

Ashish Rajan: Yeah, yeah. You... But I still owe you a T-shirt for it. Yeah. Where can people f- connect with you and learn more about [00:45:00] the work you guys- Yeah ...

Nick Reva: are

Ashish Rajan: doing at DoorDash and stuff?

Nick Reva: So, absolutely. We, we have some, some blogs that we're publishing this year-

Ashish Rajan: Yeah ...

Nick Reva: on our, uh, DoorDash engineering bl- blog website, uh, in the vein of sharing with the industry, but also in the vein of, of hiring excellent talent.

So-

Ashish Rajan: Yeah ...

Nick Reva: if you're interested in that, you know, please check that out. Um, I'm pretty active on LinkedIn, so you can find me there. And then I'm becoming more active on X. Uh, my handle is ipsec.

Ashish Rajan: Um- That's a good handle. You've found ipsec as a handle?

Nick Reva: I've had it for 20 years.

Ashish Rajan: Oh, right. Okay. I'm like, dude, like, that would be some gold handle to have that.

Yes. That's pretty cool.

Nick Reva: I... A lot of people have tried to ATO it. I- And take, take it away. Yes.

Ashish Rajan: Yeah, yeah. I, I can, I can see that. That's a very cool one to have. All right.

Nick Reva: Yeah.

Ashish Rajan: And I'll put that in the shorts as well. But dude, thanks so much for coming in and- Absolutely ... sharing all this.

Nick Reva: Thank you, Ashish. My pleasure.

Ashish Rajan: Thank you. Thanks everyone tuning in as well. Thank you for watching or listening to that episode of AI Security Podcast. This was brought to you by Techriot.io. If you wanna hear or watch more episodes of AI Security, check that out on aisecuritypodcast.com. And in case you are interested in learning more about cloud security, you should check out our sister [00:46:00] podcast called Cloud Security Podcast, which is available on cloudsecuritypodcast.tv.

Thank you for tuning in, and I'll see you in the next episode. Peace.

‍