Through the AI Fog: The Architectural Decision Agentic Security Depends On — Manoj Nair, Snyk

AI Engineer · 23 min · 291 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:01[music]
00:12What's up, everyone?
00:14Good to see you all here in the very first ever security track at the World's Fair.
00:18Um pretty exciting day, honestly, because uh like all of you, I genuinely love this stuff, and having looked through the agenda for the speakers we have today, um it's going to be absolutely mind-blowingly
00:31useful and fun information.
00:33So, hopefully if you stick around all day, by the end of the day, you'll be able to leave here, go back to your hotel rooms, and build some genuinely cool software, hopefully without humans in the loop, because that's the ultimate goal, right?
00:45Like, how do we build truly safe autonomous software at scale?
00:49And it's not something easy to do.
00:52So, with that being said, I'm very excited to welcome my my good friend and colleague, Manoj Nair.
00:57He is Sneak's Chief Innovation Officer and CTO.
01:01Um before Sneak, he was the Chief Cloud Officer at Convo IT.
01:06He founded and ran HyperGrid.
01:08He did product and security leadership at HPE, Dell, and RSA.
01:12And he's got something like a dozen patents to his name.
01:15So, he's kind of a legend in the space.
01:18Uh he also personally had a hand in curating this entire track.
01:21So, if you like the talks today, please go up and say thank you to him after, but if not, then just don't blame me, basically.
01:27Um but yeah, welcome to the stage, Manoj.
01:30Woo!
01:31[applause]
01:33Thank Thank you, Randall.
01:36I was not expecting a bio.
01:37Hi, everyone.
01:38Um really appreciate uh you all joining here um right after those great keynotes up front.
01:45Uh I'm Manoj Nair, and uh I have the uh pleasure of leading an amazing team that is helping secure about, you know, 5,000 enterprise customers around the globe.
01:57Uh so, I get to look good about all of that, but some of what I'm going to show is real data from those customers.
02:03Half of Fortune 2 Fortune 500 runs on Sneak, and some of the data is, you know, from those learnings.
02:11But before that, I I also want to like talk about this, you know, the title of the talk was cutting through the AI fog, I think.
02:17But the way we do that is by having tracks like this.
02:21So last year we stood here, there were 3,000 people at the AI Engineer was there, and you know, it really felt like security was missing in the room.
02:30And thanks to Swig and amazing partnership with the AI Engineer organization, we created the AI Security Summit in partnership with them.
02:37And we're creating this track, so it is really good to see this and all the great speakers who are going to, you know, talk um here today with some fantastic knowledge.
02:46But that is in our mind, like that's how we cut to the fog, right?
02:50Security needs to be very much part of the room.
02:53We're very passionate about it not slowing things down, but really that's how you build trusted systems.
02:59So, one thing you're going to hear from from me quite a bit of, you know, in this like, you know, what if you take one thing, it's this notion of
03:08our learning from this real-life data and working with the biggest frontier labs in the world and the biggest companies in the world is this concept that has really been, you know, not questioned in security
03:20before, but it is being asked now, right?
03:23Can, you know, the generator and the validator be the same?
03:27And our point is, you know, in some of the data you'll show for all kinds of reasons why not, right?
03:31And and almost like if you know Sneak, don't think about the supply chain security company that shifted left.
03:37Like a lot of what you'll see is the last 18 months of what we have been doing with some of these very large enterprises in in adopting, you know, these complex
03:46uh systems that are we're all in joy and we love, and what What are we learning from that?
03:52Um, there are three problems that, you know, we hear when we talk to these customers.
03:57And I want to share those and I want to like kind of show some of the data behind that.
04:01Um, but, you know, fundamentally, it's it's really looking at this as um you think about this room and everyone that you support, you know, you're building fast at the frontier.
04:12The question nobody is answering is, can you trust what your agents just shipped and how they did it, right?
04:19And so if you'd like really take, you know, the gist of and I I have the joy of talking to all of these customers a lot, this is pretty much every like one, two, or three
04:30or all of them.
04:32It's really the con- conversation that happens.
04:34So, autonomous attacks, like, you know, it's not mythos, it's not, you know, I know I said the M word, but sorry.
04:41Uh, you know, it's it's not, you know, uh, GPT 55 Cybers.
04:45Like, we're seeing that you can have these attacks.
04:47All the frontier labs have been used in automated attacks.
04:51You can do that even without having frontier models.
04:54We have shown it, so have the attackers, unfortunately.
04:57With good context and good harness, now you have an attacker that never sleeps.
05:02What does it do?
05:02The fundamentals of things like application security that was already something we tried to disrupt for 10 years have completely, you know, gone away.
05:10Like, oh, you cannot have contextual risk management and say, I fixed my criticals and I fixed my highs and I'm pretty good because everything else is too hard.
05:17No, you can string low vulnerabilities and and, you know, create exploits.
05:22You can do it without a lot of a harness with the mythos class model, as we've seen.
05:26And and but with a little bit of, you know, effort, you can do it with everything else.
05:29So, so that's a big big, you know, sea change in how, you know, we are seeing our customers actually react real time.
05:39And then you go, wow, a thousand enterprises spend over a million dollars for, you know, a cloud code roll out.
05:46So, this is the answer, right?
05:47Well, mhm maybe.
05:50Let's let's let's pull that string a little bit.
05:52The There are existing classes of problems that are getting worse.
05:57The quality of code is unfortunately worse than human-generated code.
06:01It's not like humans we I'm an engineer like I don't think I wrote perfect code, none of us do.
06:06So, but it is actually a little worse.
06:08And so, well, if that was the only problem, that's okay.
06:11But what about the environment?
06:12All the things that we find as magical are based on skills and MCP servers and all these things that we want to share and use.
06:21And those are intentionally or unintentionally both, you know, being poisoned and, you know, malware's injected in there and we'll show some of the research on that.
06:30And then the behavior of the agent, right?
06:32And so, so we're having these these, you know, new patterns of problems compounding on top.
06:39And then who here doesn't want to become a an AI company or in any room in the world, right?
06:44Every company every board's like we're going to transform our business, our workflows, or you're starting brand new, you are fully agentic.
06:51And when you build with agents and models, that's an entirely new threat surface that was not part of the prior one.
06:57And so, these are really the fundamental problems, right?
06:59And And this is, you know, I want to share some of the real data.
07:03This is 4,800 plus customers in the last year.
07:07Their actual backlog quarter over quarter is like 108% more backlog.
07:14So, remember that what I said about attackers?
07:17It's not just the existing vulnerabilities.
07:20And unfortunately, there's millions of them if you're an enterprise of any size.
07:24It's the fact that we are growing them despite the best agents, despite things that we have done and the industry has done.
07:32This trend is real and it's it's not good.
07:35And, you know, you have novel exploits, but they're not novel.
07:40Like the light LLM exploit, you think about like it's really taking existing vulnerabilities in the new surface and and chaining them together.
07:48And so, they create a much bigger blast radius right now at the pace at which work's being done.
07:53And yes, speed is a big part of this, but it's not just speed.
07:57And you know, just this um last week we had the Five Eyes uh you know, uh these are the the the Western world's uh intelligence leaders talking about AI will bypass cyber security systems
08:10in months, not years.
08:11Now, I don't share you know, share this I hate to have the scare tactic.
08:15It's just a fact.
08:17It's getting ready for you know, whatever is coming and we have already seen what's coming.
08:23It's just not widespread enough.
08:25And so, trying to like you know, chase systems and like the specific model will be the cure for all this is not the way is our point.
08:33The data on the second pain point, the untrusted output environment and behavior of agents.
08:40And these are again facts.
08:41These are benchmark data facts.
08:44All of them the QR codes at the top are are if you want to like go check out the studies and the research behind it.
08:50This is you know, the amount of vulnerable code coming from the latest models.
08:55Plus the skills, there's toxic skills.
08:58We found the research the seminal research around how skills a third of them or more than third of them in all of the skills, not just you know, open claw,
09:08clawed, code acts, these skills actually have malware and they have vulnerabilities that are being Three lines of English are able to now bring a system down.
09:17So, you have to really understand the intent behind it.
09:20And the MCP servers, how do you connect to enterprise data?
09:23This is great protocol, very little security built in.
09:27It's getting better, but the foundations behind it is you know, this is the GitHub MCP server exploit that we highlighted to the year a year ago.
09:35And what did some of our customers do?
09:37Immediately shut down all MCP servers then they figured out that all of their dev screens and then how do you actually go back safely enabling things that are very powerful.
09:47And then on the behavior, everyone knows the pocket OS example, right?
09:51What I have is real data in our own environment in our Fortune 100 customers.
09:57These agents go and create copies of PII data.
10:01Why?
10:01Somebody shared the PII data and and was trying to solve a real customer problem.
10:06The agent thought that maybe I should create a squirrel away copy of this in a database just in case I needed it again.
10:11That database is untrusted.
10:13Great.
10:13You now have an unknown attack surface that is not part of any enterprise security, you know, um, coverage.
10:20This is happening.
10:21So, how do you not put gates on it?
10:24How do you steer them, right?
10:26And so, you start going into, you know, the last part problem is you can't govern what you don't know exists.
10:32This is when you start building with agents.
10:35Now, this is real data from 3,000 plus customers who have used our abilities to really find the intelligence of what's in their code bases, what they're building.
10:44And for every model that we find in a repo, you have three times more agentic components in there.
10:50You have agents in the tools and everything that they use.
10:52You have to figure out the full landscape because the risk is not just at one layer.
10:57And then once you find it, what do you how do you know how risky is it?
11:01What is your independent data verification?
11:03So, this is from this weekend from our risk BB that we have built our own attacks and red teaming capability.
11:09As new new models and new, uh, you know, components come out, we check them.
11:15The first two are your favorite frontier models.
11:18You can guess which ones those are.
11:19They did awesome on PI extraction like they didn't used to be so good on with our attacks.
11:25No PI extraction with our attacks.
11:27The third one is is your is is the hot new model in Silicon Valley especially or this you know last few weeks rhymes with LLM 100% 100% of the time our attacks were able to extract
11:40PI.
11:42But when you check a different test decision override the frontier models did worse.
11:49The open model 0% of the time you were able to override the decision at least with our attacks.
11:55Knowing this allows you to know what to use when to use that and how do you control and these things are changing dynamically.
12:04So again going back to the original point right if none of that convinces you like the generator validator separation this is fresh new research from just I think yesterday's when we went public
12:16with this.
12:17It's a benchmark that no no model has been trained so we can trust it for now and we'll have to keep updating the benchmarks.
12:24But this is you know just a very simple thing.
12:27You're we're asking the latest models and we have access to everything as you can imagine.
12:32We're asking them to find you know the same vulnerability run it five times and only 50% of those ones are found across those five tests.
12:43That's not how you can run an enterprise system if you just use the LLM without any anything else.
12:48This is the latest models.
12:50Only 75% of the issues were found versus a good old boring deterministic check.
12:58And you know 40% was the F1 score.
13:02So this whole like what did you actually miss?
13:05And we're talking about the latest models that are not even publicly available to people right?
13:10So what does this mean?
13:12It doesn't mean that they're not good.
13:14It just means they need to be you really need to use them for what they're really good at together and carefully to find the surface that your deterministic check cannot use not just think about probabilistic
13:27systems will solve everything.
13:29And so, you know, to net it out, what we've been working on, we don't have all the answers.
13:34And I'll share where we're going to.
13:36And but what we have answers for right now on the automated attacks that are working in some of these very large environments, just you know, how do I prevent new issues
13:48from coming into the agentic loop?
13:51To put put security context right there, that's studio.
13:54You can go check it out on our website.
13:56And we're you know, everyone's worried about packages that they download.
14:00Like how we have we know what the health of the packages are.
14:03We know the vulnerability information.
14:04We know it's malware.
14:06So, we're able to prevent the the agent from, you know, picking a package like that or writing code that, you know, inherently is a sequel injection.
14:14But great, so prevention will prevent that hockey stick, which we all want to prevent.
14:18Well, what happens with, you know, um the fact that, you know, you have this this mountain of vulnerability.
14:25We've been able to take organizations like Labelbox to zero once, zero backlog.
14:30Which is very hard in security due to because it breaks applications.
14:33So, you need to know concepts like breakability.
14:36And that data is super important that we're able to get from our base to know this is a safe upgrade.
14:41And so, that, you know, just last week a max seven company remediated 16,000 critical issues using this remediation agent.
14:49Again, something you can go try out.
14:51So, you know, this is how, you know, I talked about, you know, kind of from the untrusted agentic development.
14:56We just GA'd our agentic dev security offering yesterday.
14:59It's looking at the environment, the output, the skills, the MCP servers, and the behavior of coding agents like Cursor Cloud, um Codex, and others.
15:10And when you're building ungoverned AI apps, that AI governance cannot live in a confluence page or PDF.
15:17So, how do you real-time look at everything that is happening in a very fast moving complex code repositories and understand risk and have policies enforced in the loops that the agents and the devs are.
15:30So, seeing is believing.
15:31I would love to bring Ezra up here to do a quick demo.
15:35Um and uh you know, Ezra's going to show you a couple things and you can come by to our booth and uh share a few more later.
15:42Thanks, Manoj.
15:44Let's flip over to the CLI here.
15:46I'm going to do a few rapid-fire demos.
15:48Don't have time to do everything Manoj just talked about here, but we'd love for you to come and and talk to us.
15:52Stop by Stop by the booth.
15:54Find us after this talk here.
15:56Uh the first thing that I'm going to do here is I'm going to ask Claude to generate a tool a CLI tool that can create a QR code image from uh from a prompt.
16:06Start Codex or Claude.
16:07Uh there we go.
16:08Please start Claude.
16:09Thank you.
16:11Live demos.
16:13Let's try that one more time.
16:18All right.
16:19Uh try number two here.
16:20We are uh going to try to get Claude to generate a CLI tool um to ultimately create that that QR code image.
16:28I'm asking it to use an open source dependency and if you notice this fourth uh fourth line that I have here um I'm being pretty verbose.
16:36I'm telling it to use the Snyk package health check tool.
16:39Um and so we're going to be able to see that here in the demo, but if you use this in practice, we really encourage you to leverage a uh a skill or a hook to make this just a deterministic automated part of your workflow.
16:49So, the first thing that it's going to do is going to see, you know, ultimately what what does the project look like and what are some dependencies some open source packages that I might be able to use.
16:59And let's see if we can expand this.
17:02I don't know if conference Wi-Fi is going to play nice with us.
17:06Now, we can switch to a recorded demo here, but was really hoping to to do this live.
17:13Is that a little better?
17:15That even more?
17:17All right.
17:20Great.
17:21Uh so, we can see now that it is calling this uh package health tool uh for two different open source dependencies.
17:27It's looking at a QR code package and a QR image package.
17:31Both viable packages that can help accomplish this task.
17:35Uh results are returning.
17:42Now, it looks like conference Wi-Fi is really really not playing in our favor here.
17:45Uh so, I'm going to quickly jump over to recorded demo.
17:48Apologies.
17:48Come find us after.
17:49We can go to hopefully a space where there's not as much of this happening.
17:52Uh if we can get this live here.
17:58There we are.
17:59So, same prompt.
18:01Maybe I can fast forward a bit so you don't need to hear me me banter on this a little bit.
18:07Uh but, ultimately uh we see here that the two images Excuse me, the two the two packages returned.
18:13Both are actually uh vulnerability free.
18:15There's no active CVEs that could be exploited in these versions.
18:19Uh but, the first one, QR code, is healthy, meaning it's actively being maintained.
18:23Um and there's a ton of a ton of active usage downloads of this.
18:27Whereas, QR image, no CVEs today, but it's not actively being maintained.
18:31It was really released 10 years ago for the first time.
18:33And so, if I were to deploy software with this right now, I may not get exploited today if I use either package, but if there was a new vulnerability identified in the future,
18:43um there's a much higher likelihood that if I'm using this QR code package here, that a patch would be released sooner, within a day or two, and I would be able to continue
18:51uh building on this right now.
18:55Uh the second demo that I wanted to show here was exploring that uh assessment of risk from skills uh or MCP servers that a my agent might be using here.
19:05And so, somebody shared with me a skill uh called Do we have it here?
19:10Um a competitive analysis skill.
19:14Um and I ran the skill assessment against Excuse me, the risk assessment against the skill here, and we saw there were four findings returned.
19:21And some of these are fairly problematic.
19:23We can see in the actual skill itself, it's asking me to echo the authorization header, which is a big no-no.
19:31That's That's not something that we want a skill ultimately to be doing.
19:34We also see that in some cases, it's going to be pulling from live content from Reddit, from Twitter.
19:40That may be totally fine, but you really want to go into that eyes wide open and making make sure that you know that it's pulling in this information, the way you're using the skill is going to be appropriate.
19:50For competitive analysis, that's probably probably reasonable.
19:53Um but what's especially problematic, if we see in this line here, is that it's actually looking to pull from a YAML file that's hosted on the internet, instructions on how to monitor these targets and some of the classification
20:04rules.
20:05So, it's really giving it the logic to actually execute the skill from a third-party website.
20:11And if that gets changed, even if my skill file doesn't change at all, that is a a chance for an exploit to occur.
20:18It's worth noting that we've been refining the logic associated with the findings that we return here, addressing the signal-to-noise ratio and kind of giving some policy configuration capabilities as part of our Evo product.
20:32And we're going to see the gap kind of get closed here with this open-source tool as well in the future.
20:37We encourage you to check these out.
20:38Go to sneak.io, come talk to us in the booth.
20:41Find Find me in the hallway.
20:42We can actually do this live instead of looking at a recording if you want.
20:48But I think given the time, we probably should wrap the demo.
20:51Cool.
20:53[applause]
20:55Live demos are always fun, but Murphy's striking always, but you had a plan B, so that's awesome.
21:00So, look, just to wrap it up, right?
21:03This is just the beginning.
21:05Yes, we have built some very interesting agents for some specific sets of those problems.
21:11In the end, it's a you know, a system that we talked about that really like it's it's rooms like this that we're building with in our customer base and and we would love to partner with the rest of the industry while we're doing this track.
21:24And we learned, you know, this as I mentioned Evo, what is Evo?
21:29Evo is the system that we we brought to the world late last year in terms of a concept and we've constantly built these different agents.
21:37We learned from other systems, you know, you have fighter pilots with 5G fighters and how are they trained?
21:43It is this notion of you need to really observe, orient, decide and act and that's how you go and in the constant learning from that kind of loop is how you become, you know, a super pilot.
21:56And so we want to enable this room and other rooms.
21:59We had a workshop yesterday training hundreds of AI security engineers.
22:03We want to enable AI security engineers to be able to have their own powerful system and tools and yes, there are problems that are not solved yet fully in terms of coordinating
22:14multiple agents with systems like this.
22:16Yes, we all know how, you know, the harnesses and and and shared memory and and we're working these problems.
22:22This is how we're building Evo.
22:23We're building it with the community and we want this to be an open vision.
22:28That's really empowering AI security engineers.
22:31You know, from from these rooms the AI engineers became 10x engineers.
22:35Our goal here is to have that 10x superpower in the hands of AI security engineers so we can build trusted systems together.
22:43So let's continue to do that and you know, come by, talk to us or if you guys are, you know, have have I think there was like 50 plus events around AI engineer but we're we're having this rooftop fan zone.
22:57We're going to do some some more things together with the community.
23:00So this is down the road in our office here in SF.
23:03Uh community jam.
23:04Come join us uh if you if you have time this evening.
23:06We'll continue the conversation.
23:08Thank you all.
23:09Let's continue building.
23:10[applause]
23:25[music]