Cyberattacks Used to Take Months. AI Can Do It in Minutes.

Zane Lackey 0:00 We're going back to the '90s and 2000s again. We're gonna see breaches popping out all the time again now. It's gonna look very different than the last 15 years of security.

Ami Luttwak 0:08 AI attackers that are actually going after companies, startups in scale and speed that we've never seen.

Sarah Wang 0:13 Elon Musk tweeted that recently, "Every day is zero day." What is AI doing to make this happen?

Ami Luttwak 0:19 Models are good enough now-

Sarah Wang 0:20 Yeah

Ami Luttwak 0:20 ... to find and exploit complex vulnerabilities, and the other is that the open-source models, that's the scary bit. A few months ago we said we have a few months until open-source models catch up.

Sarah Wang 0:31 Yeah.

Ami Luttwak 0:31 So now they're catching up.

Zane Lackey 0:32 The security game has just changed. You need to be thinking about how you can automate so much of both the blue side and the red side right now.

Ami Luttwak 0:39 Most of what security teams do is not security. We should stop doing most of what we do-

Sarah Wang 0:43 Yeah

Ami Luttwak 0:43 ... and focus on finding critical risk, figuring out how we mitigate it, or at least put detections in and also response readiness for it.

Zane Lackey 0:51 What do you think the next several years looks like?

Ami Luttwak 0:53 AI attacks are prevalent, easy, but also better than any human. That's the problem. The only companies that will be able to survive are companies that are-

Sarah Wang 1:04 Ami, thank you so much for joining us. Security professionals are calling October Black October, and, um, it's clear that we're entering a new era of agentic attacks. Um, can you, just to start off, walk us through what the heck is going on right now, and how do we get through this critical moment?

Ami Luttwak 1:27 Yes. So, uh, first of all, great to be here. Um, uh, we are calling this Black October, eh, since, uh, it's, uh, in my view like a black swan event. Uh, we've never seen, never ever seen so many, um, security incidents happen in a single month. Um, and we are talking about multiple different types of security incidents, uh, both, uh, the number of vulnerabilities that has been found in October and the severity of those vulnerabilities, um, including the PHP vulnerability, probably the most severe vulnerability ever found by AI, right? So vulnerabilities coming in a rate that we've never seen. But on the other hand, even worse, we're seeing the, the rise of AI attacks, right? So AI attackers that are using completely new speed expertise, uh, that we've never seen before, actually going after, um, um, companies, startups, uh, refrigerators i- in, in scale and speed that we've never seen.

Sarah Wang 2:31 Yeah. Uh, I, I mean, the, the scary thing about that, uh, to your point is, um, and you guys cover some of this in your, in your blog as well, the, the speed and, um, you know, I think you've even said definitely to us privately, but probably publicly as well, that every day is zero day, right? Um, Elon Musk tweeted that recently. Um, uh, just say more, what is AI doing to make this happen? Like, w- what is the mechanism that, um, it's able to speed, um, writing exploits? Uh, I think you guys actually did some work around this, um, where you found it collapsed the timing from months to weeks. Um, say more about how that works and, um, you know, I think your point on, uh, the, the audience for, for this podcast, right? What, what should founders be thinking about and doing?

Ami Luttwak 3:20 So if we think how we got here, right? So there, uh, two major moments until Black October. One was the, the Mythos moment, uh, where Mythos came out and said, "Oh my God, we can find vulnerabilities." Okay? Eh, that was one moment. Eh, but a- again, nothing happened. You know, like we said, "Oh my God, it's coming," but we still at a f- like, like-

Sarah Wang 3:41 Right. Totally

Ami Luttwak 3:41 ... people say, "Okay, eh, okay, what? Still the world, you know, the sun is still, uh, rising."

Sarah Wang 3:46 [laughs]

Ami Luttwak 3:46 The other big moment that we had was, um, uh, the HackingFace incident with OpenAI, right?

Zane Lackey 3:52 Yeah.

Sarah Wang 3:53 Yep.

Ami Luttwak 3:53 So these are... That was another major incident where we saw the risk of AI attacks, but again, it was accidental attacks.

Sarah Wang 4:00 Yep.

Ami Luttwak 4:00 Uh, what happened now in Black October is that all of those potential theories, the, the things that we said are coming, they all came and crashed upon us, and it's happening right now, right? So o- one is that the, uh, models are good enough now-

Sarah Wang 4:16 Yeah

Ami Luttwak 4:16 ... to find and exploit complex vulnerabilities, right? So, and that means that this is not a theory anymore. It's, it's happening. It's an explosion of vulnerabilities. And the other is that the open-source models, right? That's the scary bit. And we said it when we spoke about Mythos, um, a few months ago, we said we have a few months, a few months until open-source models catch up. Okay?

Sarah Wang 4:40 Yeah. Yeah.

Ami Luttwak 4:40 So now they're catching up. [laughs] They're catching up. It means that now it's not just about vulnerabilities. They're able to find ways to run code on your environment. Doesn't have to be a complex PHP vulnerability. It can be just a mistake in your API, right? Uh, uh, they can find and utilize those zero days in your code, right? And basically run an entire attack that usually took, for the best attackers, weeks or months, in again, around 20 minutes. That's what we're seeing now. So-

Zane Lackey 5:13 Yeah

Ami Luttwak 5:13 ... um, you, your entire-

Zane Lackey 5:14 How, how far behind are we seeing the, uh, the open source models? I mean, like when we're chatting with folks on the, on like the offensive capability side, it tends to be about like six to nine months or so, but that's close enough, uh, now at this point. But I'm, I'm curious what you've seen.

Ami Luttwak 5:28 So, uh, there's two different questions. One is, um, okay, on the offensive side, right? To find a vulnerability is, uh, are, are we better than the open source models? Yeah, maybe we have like three months of, uh... It's not more than three months, right?

Sarah Wang 5:41 Yeah. Mm.

Ami Luttwak 5:42 Uh, the problem is that the, the, is the offensive side on attacking, okay? Because-

Zane Lackey 5:46 Yeah

Ami Luttwak 5:47 ... I, I'm a company, it doesn't matter. Let's say it's a startup, okay? And, and again, we are talking about a wave of attacks. If we just look at AI development providers, right? We had a blog about like we've seen initially the blog had nine companies attacked in October, and the list is growing every day. Like we're now on 15.

Sarah Wang 6:06 Wow.

Ami Luttwak 6:06 So it's-

Sarah Wang 6:07 Jesus

Ami Luttwak 6:07 ... uh, like a- It's just an example of one market, right? Like, AI development platforms, okay, these are k- getting targeted specifically now because they have AI keys, right? Uh, the fact that an attacker, it doesn't have to be a sophisticated attacker, can use AI, open-source models are good enough to find problems in your code and, and the big problem is to also use them in a matter of 20 minutes. So think about which startup is ready for detecting those attacks, I don't know, and then actually finding them and responding them, like, in time, right? Like, it's, uh, you need a 24/7, uh, SOC in, in every small startup.

Zane Lackey 6:50 Yeah.

Sarah Wang 6:50 Right.

Zane Lackey 6:51 But why don't we talk for a second on PHP to Shell as a, as an example of just a case study of one of the many that came out during, uh, Black October here. Um, can you talk a little bit about just how prevalent you saw this across your customer base? But then now that we're actually a couple weeks out, uh, really curious your take on how has patching actually been across a customer case, uh, across a customer base, excuse me, and what are kind of the state of things a few weeks out now that we've had a few weeks of seeing, uh, it be out there?

Ami Luttwak 7:20 So PHP is, uh, maybe one of the most prevalent technologies, uh-

Zane Lackey 7:26 [laughs]

Ami Luttwak 7:26 ... as an external-facing technology, right?

Zane Lackey 7:29 Oh, yeah.

Ami Luttwak 7:29 The-

Zane Lackey 7:30 As a former CISO of a PHP-

Sarah Wang 7:32 [laughs]

Zane Lackey 7:32 ... uh, e-commerce company, yes, I-

Sarah Wang 7:34 What did I see? It's, like, 70% of the internet or something.

Zane Lackey 7:36 Yeah.

Sarah Wang 7:36 Yeah.

Zane Lackey 7:36 Yeah, exactly.

Ami Luttwak 7:38 E- exactly. So, you know, you know, the, uh, the impact is basically almost 100% of our customers ha- had, uh, some, some PHP running, right? Um, uh, we... So we saw a major drop very quickly. So customers are now, um, I, I wouldn't say they have automated patching yet, but they're very, very, uh, a- aware of the, uh, importance of, of, um, uh, of patching. So I'm talking about 50% patching w- within the first two, three days, right?

Zane Lackey 8:08 Mm-hmm.

Ami Luttwak 8:08 So, like-

Sarah Wang 8:08 Wow.

Zane Lackey 8:08 Mm-hmm

Ami Luttwak 8:08 ... almost immediate reduction, but still, the problem is that this is 70% of the internet.

Zane Lackey 8:14 Yeah, exactly.

Ami Luttwak 8:14 So this, even just this single vulnerability is gonna take years-

Zane Lackey 8:19 Yeah

Ami Luttwak 8:19 ... okay, until it's resolved, and there is many, many, many cases that we see both on the internet and also the customer environments that they don't have any way to patch, okay?

Zane Lackey 8:28 Yeah.

Ami Luttwak 8:28 Um, uh, because older versions of PHP are not even getting a patch.

Zane Lackey 8:34 Yeah.

Sarah Wang 8:36 Um, can I ask a, just a, a meta question here? Um, and, uh, one of our, two of our partners wrote this great piece on, um, time for writing exploits versus patching. Um, and-

Zane Lackey 8:47 Yeah

Sarah Wang 8:47 ... there's a lot of dialogue out there about how AI has made it just cheaper, easier to turn a patch diff, um, you know, into a working exploit. Um, and there's sort of some data on just sort of that time falling. Um, on the other hand, it seems actually that the data is showing, um, time to patch actually hasn't gone down. Um, in fact, it's gone up if you look at the data over the last 20, 25 years. Um, can AI help with that side as well, Ami, or is it still early

Sarah Wang 9:19 days?

Ami Luttwak 9:20 So first of all, you're right. The, the time to, uh, uh, to, to get a, an exploit, uh, dramatically went down. It's even worse, um, because many times the information leaks before the CVE even is out, okay?

Zane Lackey 9:35 Right, yep.

Ami Luttwak 9:35 Many times even the CVE is out, the patch is not out, okay?

Zane Lackey 9:39 Yep.

Sarah Wang 9:39 Mm.

Ami Luttwak 9:39 Uh, in the PHP case, we worked for m- months with PHP to get the entire industry ready, and i- it leaked before time, right? So the customer doesn't have anything to do. Uh, the patch is not ready. I- in Linux right now, even if there is a vulnerability reported to k- Linux kernel, it might takes weeks or even months until it reaches all of the, uh, distros, right?

Sarah Wang 10:02 Right.

Ami Luttwak 10:02 So, uh, the i- industry in general is not ready for, like, there... Even if you can patch internally quickly, sometimes until a patch gets to your distribution, okay, it's not ready for [laughs] for AI, right?

Zane Lackey 10:15 Right.

Ami Luttwak 10:15 AI can e- exploit things in, in, in minutes. So the answer is that the world i- is not ready. The world is not ready for this. Like, it's a, it's a problem. In terms of patching, you're right. Like, uh, we don't yet exactly know how to automatically patch, and I honestly, um, I don't see a path towards that. Uh, it's easy to say, "Yes, let's automate everything." In reality, if you are building now a new company, you can do it, right? If you're building a new company and you have automated engineering and auto- automated CI/CD and automated testing, right, you can basically be at a position where y- I tell you, uh, patch this, and your entire system can automatically do it. And I think for new companies, you should design your system to be able to auto-patch, right?

Sarah Wang 10:58 Mm.

Ami Luttwak 10:58 Um, but in order to do that, you need an entire, an agentic, uh, uh, um, pipeline for everything, right? You have automated dev, so you need the ability to take a ticket and have an automated dev to create the patch. Fine. Then you need automated testing, automated CI/CD, and, and automated DevOps. There's not a lot of legacy companies that have all of that, and it's not even realistic for most of their code. But for startups, maybe it's possible, and I would consider this a, an, a, um, a task for startups.

Sarah Wang 11:29 Yeah.

Ami Luttwak 11:29 If you start, well, plan this, you know?

Zane Lackey 11:32 Yeah, absolutely. I, I'm curious to just dive in real quick on the, a little bit deeper on the offensive side. Um, so going through kind of the discovery of this, it, it was funny, a, a little bit of a footnote here, but, um, this was a vulnerability that was independently discovered by two groups, Wiz and Caliph, uh, ar- around kinda the details of the, the PHP2Shell vuln, which is a thing that used to happen a, a bunch back in the day. I'm curious-

Ami Luttwak 11:59 Yeah

Zane Lackey 11:59 ... though, for your research team, how were they really leveraging AI in terms of discovering this and, and just going a little bit deeper on how it's really unlocking vulnerability research teams?

Ami Luttwak 12:10 Uh, so- A few things. First of all, I, I think this will actually happen much, much, much more now.

Zane Lackey 12:16 Okay.

Sarah Wang 12:16 Mm.

Ami Luttwak 12:16 Um, uh, 'cause e- every time there is a new model, there's new capabilities.

Zane Lackey 12:21 Yeah.

Ami Luttwak 12:22 Uh, a- again, I, I look at it like Bitcoin mining, okay?

Sarah Wang 12:24 [laughs]

Ami Luttwak 12:25 So, like, there's, yeah. Number of vulnerabilities, uh, will go down, but because it's like Bitcoin, there's always more. Uh, and the new models can uncover, uh, more, uh, vulnerabilities, right? So it's not surprising that there is a, uh, there's a new model, okay, and then multiple teams find new vulnerabilities, right?

Zane Lackey 12:46 Exactly, yeah.

Ami Luttwak 12:46 Because... A- a- and, and by the way, right now we are getting ready for ZDC, the, the Zero Day conf- uh, competition of Wiz, and, and we're, we're seeing, we, we're getting multiple, multiple reports on a very, very critical vulnerability that is also, uh, I, I believe, is gonna be a major, uh, impact on the internet, and this vulnerability is being reported by multiple teams.

Zane Lackey 13:09 Yeah. [laughs]

Sarah Wang 13:09 Wow. Yeah. Mm.

Ami Luttwak 13:12 It's, uh, never-

Zane Lackey 13:12 It's amazing how it brings everything old is kinda new again in the security industry right now. [laughs]

Ami Luttwak 13:17 Yes, you're right. Internally, our vulnerability team, w- we built basically also for the Wiz product, we built a, what we call Atlas, which is a harness for vulnerability detection, right? Uh, so we're using that with different models all the time, 'cause every model has its own, uh, unique, uh, capabilities, uh, from, from, uh, from OpenAI or, or, uh, Google or Carbon. Like, each of them has its own capabilities. So you... We are trying to use all of them and, and find whatever we can. Um, but the point is that everyone are doing it, so you would expect a lot of teams to find vulnerabilities at the same time, and we... And that's the important thing. We have to focus on infrastructure that is critical using the models of the frontier AI that have a few months, right, uh, uh, uh, of, uh, advantage, and we have to continuously doing that, do that on those areas to make sure that we find them before attackers. But there's so much code in the world that it doesn't help, 'cause there will still be vulnerabilities that attackers find on, on a model that we, you know, an area that we didn't look into.

Sarah Wang 14:19 I don't wanna take us down a, a frontier model rabbit hole too, too much, but, um, just to probe a little bit on what you said about, um, using multiple models and, um, each one being good at different things. Um, to the extent you can share, Ami, I'm curious, um, about two points there. O- one is, um, what are different [laughs] models better at, um, at a high level? And then two, how do you see... I mean, you know, obviously, uh, Wiz, um, is a part of the Google family now, um, and so you have, uh, the DeepMind team and, and their models at your fingertips, but it sounds like you are using multiple models. Um, how do you think about the sort of relationship between frontier labs and independent cyber companies, um, i- in this day and age?

Ami Luttwak 15:02 So, uh, I, I think that every model, and also every version of every model, right? And now it's getting complicated because you have the frontier models, and you have the cyber versions of those models-

Zane Lackey 15:14 Right. [laughs]

Sarah Wang 15:14 Right

Ami Luttwak 15:14 ... and each of them has, so. It, it's a complicated matrix, right?

Sarah Wang 15:19 Yeah.

Ami Luttwak 15:19 But the point is that, uh, each of them does behave differently, and it has-

Sarah Wang 15:23 Mm

Ami Luttwak 15:23 ... a different, um, speed and cost, right? So there is no single answer. That, like, that's my point. Like, if you wanna, um, do a task, it's for cyber, but it's true for other stuff as well.

Sarah Wang 15:35 Mm-hmm.

Ami Luttwak 15:35 The only thing you can do as an independent company is to try all the models all the time and to find the best combination, right?

Sarah Wang 15:42 Yeah.

Ami Luttwak 15:43 And, uh, the way I see it is that, you know, people say, "Oh, now it's easy to develop using AI." It's not true. For most founders right now, the, the key is gonna be, uh, the cost or the cost of the service.

Sarah Wang 15:56 Yes.

Ami Luttwak 15:56 Right?

Sarah Wang 15:56 Absolutely.

Ami Luttwak 15:57 And the only way to create a scalable service is by creating a very, very intelligent pipeline there, where you do some of the tasks with specific models and some of the more complicated tasks with other models, and you mesh all of them together in a very, very efficient way. Um, uh, otherwise, you're, you're, you're gonna lose money on, on your sales, right?

Sarah Wang 16:16 Mm-hmm.

Ami Luttwak 16:16 So as an example, right? On the... We have what we call the Blue Agent, which, uh, investigates attacks, right? I cannot run the most a- a, a- advanced, expensive model on every event, right? But I can create a pipeline where you start from a deterministic detection, then you go through a, a cheap model detection, then you go through a more advanced model.

Zane Lackey 16:37 That's right.

Ami Luttwak 16:38 And if I, if I, if all of them think it's malicious, I will send it to the most advanced model to determine is it really malicious before I tell the customer, you see?

Zane Lackey 16:45 Yeah.

Ami Luttwak 16:45 Like-

Sarah Wang 16:45 Yep

Ami Luttwak 16:46 ... uh, so you need multiple models, multiple types of models a- and you have to design pipelines, and I think that is really the new engineering, um, challenge for, for, for founders, for companies building AI systems at scale.

Sarah Wang 16:59 Yeah.

Zane Lackey 16:59 Absolutely.

Sarah Wang 16:59 Absolutely. And, and just, um, on this cost point, you talk about in, uh, a, I think a blog post that you guys wrote, but maybe summarize a little bit here, this paradigm shift that needs to happen around continuous testing, right? Sort- sort of the, the focus being on the word continuous versus, um, static. Uh, and cost obviously plays a big role in, um, you know, sort of the democratization [laughs] of, uh, every company being able to do that, not just the sort of most profitable and sophisticated. Um, how far are we from getting there on a cost, uh, from a cost perspective? And what, what else, I guess, needs to happen? Maybe it's also cultural shift, et cetera, like, you know, tooling shift, um, but how, how far are we from, I think... I guess, where do we, where do you think companies need to go, and how far are we today?

Ami Luttwak 17:48 So, I mean, first of all, it's a, it's, it's, it's a, it's a big question. Like, let's take security, for example, um, go back to the Mitos moment, right? So people say, "Oh my God, there's Mitos. I have to scan all of my code." Okay?

Sarah Wang 18:01 Right. [laughs]

Ami Luttwak 18:01 Fine. You, let's say you did it, let's say you did it in, in April, okay? You might have wasted $5 million.

Zane Lackey 18:07 Yeah. [laughs]

Ami Luttwak 18:07 Okay? If you have a lot of code. And, a- these are real numbers that you could-

Zane Lackey 18:11 Yeah

Ami Luttwak 18:11 ... you've wasted a lot of m- It's very expensive. Now, okay, now there's Mitos 1.2. You do it again Like-

Zane Lackey 18:17 Right

Ami Luttwak 18:18 ... like, this is not, like, this is ... I'm not talking about small budgets. I'm talking about, uh, uh, um, some customers are spending now tens of millions of dollars on, like, scanning code. Like, uh, you, like, you have to think about a scalable system, right? Continuous system that scans, but is intelligent. You can't just ... So because there's gonna be new models, new capabilities, new code, right? So we see this as a major, um, challenge for the industry. We're trying to figure it out, and I'm not going to tell you that we solved it, right? But the challenge is, how do I use the budget wisely in, in a way that scans from the inside, from the outside? We have active attacks, we have passive attacks, we have code analysis. We can scan, we, on the, on the disk itself, we can look at the runtime. How do I use all of the budget in a, in the most efficient way for the customer, not as a single scan, but as a continuous scan, right?

Zane Lackey 19:08 Yeah.

Ami Luttwak 19:08 And that is the challenge of, uh, security scanning right now. Uh, if I tell you, "Oh, yeah, just run Metas on your code," great, you're right, you can do that. But does that, does that actually solve your problem continuously? No, it's just gonna get you, like, a big hole in the, in the budget.

Zane Lackey 19:23 I, I know it feels like a lifetime ago that we, uh, all used to talk about, uh, just cloud security, pre-AI security. But I'm curious, you know, look, for, for security teams and practitioners, CISOs, security engineers, all, all of this, just because new problems appear doesn't mean old problems go away. And so for a lot of, you know, Fortune 500, Global 2000, they're still dealing with a lot of cloud security challenges. I'm curious if we, for the first part of this question, let's just kind of set AI aside, and can you talk about kind of the state of cloud adoption and security in 2026? And then for the second part of the question, let's layer AI in there and talk about how, uh, how it's really changing cloud security specifically.

Ami Luttwak 20:05 Yeah. So, I mean, i- in my ... First of all, cloud security, um, uh, when we talk about, uh, I have an application that's running, it's always in the cloud, right?

Zane Lackey 20:13 Yeah. [laughs]

Ami Luttwak 20:14 When we talk about AI, AI attackers coming after my application, they will always start from the, the, the, the, the, the same, uh, uh, vulnerabilities and, and, and problems and mistakes that you could have done before, right? So, like, n- nothing changes in the fact that, uh, in, in cloud security, you have, you have to make sure that you're focused on critical risk and that you fixed it, right?

Zane Lackey 20:36 Yeah.

Ami Luttwak 20:36 If you have a, a, a PHP vulnerability you didn't fix, yeah, attackers are gonna come from there, right? So, like, we, we just added more vulnerabilities-

Zane Lackey 20:45 Exactly. [laughs]

Ami Luttwak 20:45 ... and more types of attacks. It doesn't mean you don't have to fix the old ways of attacks, right? So in terms of cloud security, what we're seeing is that, uh, first of all, everyone understand that the, you, you need this, uh, um, system of record that understands and gives you visibility into everything, right? Um, what we are ... So I, I would say what we are starting to see changes, of course, is companies are trying to create more, um, uh, uh, agentic workflows. And also expect more from Wiz, right?

Zane Lackey 21:15 Yeah.

Ami Luttwak 21:15 So for example, if before, uh, we would provide a, a, a vulnerability with prioritization, now they would expect us to go back to the code, find the code, create the fix, uh, create the pull request, you know. So basically help automate more of the processes that take time, and that's also true for detections, right? They don't want just a detection. They expect also to get a full investigation, a, a forensics, find the root cause, fi- tell me how the attacker got in, and push them out, you know?

Zane Lackey 21:45 [laughs]

Ami Luttwak 21:45 Um, so, uh, the way I see it is that what, what AI is doing right now is basically every step that we had that we didn't solve with Wiz automatically, companies are trying to do it. They're automatically on their own, and they also expect us to get better, right? So a- as an example, um, we are, we are not finding threats anymore. We have to do a full investigation. We also need to do forensics, and I f- I think the next step for us, now that we see AI attackers, we need to start thinking about automated response-

Zane Lackey 22:14 Yeah

Ami Luttwak 22:14 ... which is very scary.

Zane Lackey 22:15 Yeah.

Ami Luttwak 22:16 But I don't think we have any-

Zane Lackey 22:17 Yeah, absolutely. Yeah, yeah.

Zane Lackey 22:18 Completely agree. Yeah. Maybe on the topic of things that you guys are automating and just how Wiz has, has evolved, um, you talked about Blue Agent. Um, can you share a little bit more about Red Agent? Um, 'cause I think that's where, you know, you're really simulating an adversa- uh, adversarial point of view. Um, and, y- you know, h- is your response ... Is, is Wiz's response to AI shifting risk, um, y- you know, are, are, essentially, are you giving your customers, going back to this, um, sort of speed thing, like speed of the defender, speed of the attacker, um, are you, are you sort of thinking of ways to give machine speed to your customers, if you will?

Ami Luttwak 22:57 E- exactly. So, uh, there's eventually there's two forces here, the, the red and the blue. The, the blue tries to the, to find attacks a- and, and, and, and, and stop them. What the red is trying to say is, the best defense is attack, right? So you have to attack yourself with AI continuously because, uh, um, uh, unlike what we had before where the-

Zane Lackey 23:19 Yeah

Ami Luttwak 23:19 ... we had static defenses, now defenses has to be d- they have to be dynamic because every new model has new capabilities, right?

Zane Lackey 23:26 Yeah.

Ami Luttwak 23:26 So maybe your application was considered secure yesterday, but it's not secure today. Um, like, I think about it if I try to give you a, like a, an analogy. Think about you have a door, okay? And you put, you hide, maybe you, you hide your key un- under the mat, okay? And that's considered secure, right? But your attackers are getting superpowers every, every week, right?

Zane Lackey 23:50 Yeah.

Ami Luttwak 23:50 So maybe next week they're gonna be able to get into your door. So whatever was considered secure last week, if every AI model can get into the door, it's not secure anymore. So the watermark keeps going up, right? So the only way to, to know you have a problem is to continuously attack yourself with the latest models. So before the attackers can open the door, you figure it out-

Zane Lackey 24:11 Yep

Ami Luttwak 24:11 ... you fix it. And you don't have a lot of time, and that's the speed, where we talk about speed of defense, right? It's crucial. So the red agent tries to do that, tries to do an offensive AI attack against your applications, uh, uh, from the outside using the context we have from the inside to try to find the problems before the attackers actually use them.

Zane Lackey 24:30 Are you doing a similar pipeline on the, the red team side? So my, my question's coming from the angle of teams who this all makes sense to them. They wanna get started with it. Uh, let's help them avoid a bunch of the mistakes that everyone else has had to learn. On the blue team side, uh, you start this with kind of deterministic approaches, and then you layer in cheap models and, and the ti-

Ami Luttwak 24:51 Yeah

Zane Lackey 24:51 ... the pipeline that you talked about of progressively getting more expensive. Are you doing similar approaches on the red team side as well, where it's you're starting deterministic and then you're layering cheap models? Or are you layering just a whole bunch of different models all starting from scratch and all running simultaneously?

Ami Luttwak 25:06 And-

Zane Lackey 25:06 Or all of the above? [laughs]

Ami Luttwak 25:07 So [laughs] everything.

Zane Lackey 25:09 Yeah, exactly.

Sarah Wang 25:09 [laughs]

Ami Luttwak 25:12 So, so yes. I mean, first of all, let, let's compare this to, uh, like if you have a budget, uh, you can just, uh, gi- give it to Mitos and run on code. That's not very efficient.

Zane Lackey 25:21 Yeah.

Ami Luttwak 25:21 So more efficient is that you analyze all the exposure, right? That's what we do it deterministically in Wiz, right?

Zane Lackey 25:27 Yep.

Ami Luttwak 25:27 Then we layer on top of that what we call the exposure red agent that just looks at everything that is unauthenticated, exposed on the internet from your environment, right? So that's an immediate analysis for everything, every exposure you have. That is the most urgent thing to do. It's even more important than scanning your code, okay? Who cares about your code? Uh, I'm talking about the actual unauthenticated, exposed, uh, um, uh, attack surface that you have. More urgent, right? Next step is to start doing deeper pen test analysis and deeper code analysis, right? So there's definitely layers here, and also in terms of models and investigation time. The, from the outside, what we call exposure agent, maybe will take a few minutes for every endpoint because you have a million endpoints. When there's a critical application, um, I might take, uh, 10 hours to try and hack it, right? So it's, uh, it's all a pipeline. Everything is gonna be a pipeline now, right?

Zane Lackey 26:18 Yes.

Ami Luttwak 26:18 It's, uh, uh, you cannot throw money on code scanning and think it's, you're done. No. It's, it's all about managing the budget. This is the whole point, right?

Zane Lackey 26:26 Right.

Ami Luttwak 26:26 And they, they all connected because if I find a problem and the engineering says, "Oh my God, this is too expensive to fix," um, okay, you know what? Let me tell the blue agent to put some detections there.

Zane Lackey 26:37 Yeah, yeah.

Ami Luttwak 26:37 You see? Like they... This is all working together.

Sarah Wang 26:41 Right. Right. Um, I, I was gonna ask, uh, a- and it's, um, really interesting to hear your point of view on this 'cause we had an internal discussion, um, with work the other day about how it feels like state-of-the-art is essentially what Red Agent is doing. You know, you have agent swarms constantly attacking your own systems that... So, so, so you know how to protect against them, right? Um, you're, you're working with some of the top enterprise customers, right, over 50% of the Fortune 100, and then you also have leading-edge startups in your customer base. How many people are actually doing this?

Ami Luttwak 27:12 So i- in Wiz, a majority of customers are already using the, the Red Agent.

Sarah Wang 27:17 Okay. Wow.

Ami Luttwak 27:17 Um, I, I think across the industry, uh, not enough. I, I think everyone should do it right now. Like, there is nothing more important than to scan your environment continuously from the outside. Like, there's nothing more important than that. Like, uh, uh, uh, it's, uh, uh, the, the best defense is attack. When they come, it might be too late, okay? So the, really the, the, the best thing you can do is continuously attack your environments. And so in my view, like again, on the, on the Wiz customer side, it's, it's like we are getting very quickly to almost full coverage, right? Like, everyone understands it, and it's really one of the fastest-growing, uh, features that we've ever released. Um, uh, in the world, I don't think people understand. I think there's, uh, sometimes, you know, Mitos got a lot of PR. Good, okay? But, uh, the PR went to the wrong place. I, I actually don't think the scanning code is the most efficient thing you can do, okay? And it's important to understand that because people can say, "Oh yeah, I invested so much in scanning code." Really, that's not what you should do. You should focus on your, scanning your external exposure before because, uh, like we had a, there was a big incident just, uh, two days ago, um, um, uh, uh, a key hard-coded in a mobile application that exposed a lot of, uh, um, people's data, right? That's where attackers get their attacks. Unauthenticated surfaces, that's what you have to run scans for, uh, and you have to do it continuously. So that's, I think that's the, that's the gap, and the world needs to know

Ami Luttwak 28:43 that.

Sarah Wang 28:43 Yeah. M- maybe on this thread of, uh, what founders should be doing. Um, so Zane and our colleague Joel actually, um, wrote a note, uh, in the midst of [laughs] Black October, um, you know, to our founders talking about spending more on security, uh, potentially considering delaying product releases. Um, so I want, uh, this is a question for both of you, maybe Zane to, to say a little bit more about that. But say I'm a founder with a release coming up. I have a backlog of security issues. How should I think about what needs to happen before I ship? So question for both of you, I guess.

Zane Lackey 29:16 Yeah, sure. I mean, I'll, I can kick off. I, uh, I mean, I th- I think you and I are, are very aligned on this, which is the security game has just changed, right? And you need to be thinking about, uh, how you can automate so much of both the blue side and the red side right now, and really leveraging a variety of agents for those automations. And so I think historically in the, the old models, it was, you know, the, you had a release, and then you kinda delayed that for security and all of that. I think that the new model that you're thinking about is how can you be doing all these things in parallel?

Sarah Wang 29:47 Mm.

Zane Lackey 29:47 How can you be really leveraging a variety of agents to be continuously testing? And if you're building a new company today, really doing patching from the beginning and building in so much automation into your, uh, your software development and your infrastructure development.

Sarah Wang 30:03 Mm-hmm.

Ami Luttwak 30:04 Yes, yes. And, and again, I wanna, I don't wanna scare, but I, uh, let's, let's just, uh, I work with the CEOs of startups that are getting attacked. Let's just be in their shoes, okay?

Sarah Wang 30:13 Yeah.

Ami Luttwak 30:14 You wake up, and your security team says Something bad happened overnight. Uh, we tried to stop it, but, um, they got in. Uh, we woke up, uh, um, after an hour, and that's in the good t- like situation where-

Zane Lackey 30:30 [laughs] Yeah, you're, you're being very nice there of, of an hour. Yeah. [laughs]

Ami Luttwak 30:33 They, they even have a security team, okay-

Zane Lackey 30:35 Yeah

Ami Luttwak 30:35 ... after like a, a, a round.

Zane Lackey 30:38 Yeah.

Ami Luttwak 30:38 I don't even know if they have someone that is dedicated, right?

Zane Lackey 30:41 Yeah.

Ami Luttwak 30:41 And, and the attacker, yeah, and we found out that the attacker, uh, got in, and they, the entire attack, again, takes 20 minutes until, from the time they get in until they take all of the secrets, all of the AI keys of all of the customers, right? And now you have to figure out what are you gonna say to all of the customers, and what you're gonna do. And, and this is what is going through companies right now is like, and esp- So the point is that AI attacks have- we've never seen that before. We have to understand it's a new threat, right?

Zane Lackey 31:10 Yeah.

Ami Luttwak 31:10 It's, it's a threat to everyone. But if I'm a startup, especially if I have anything attackers want, again, especially like if I have AI keys or anything related to, um, uh, um, uh, something they can use, right? I am on their target. It doesn't have to be a big company, okay? Uh, startups are actually the key target now for, for LLM jacking, right? What do you need to do? Uh, if you have AI keys, probably better to put a limit on them, because if they, uh, steal them, uh, you don't wanna get a lot of charges, which we see happen a lot, and it's really, really sad. But also make sure that if you have a target on your back, you do need to put a lot of focus on security. This was never the case, but it's now true that if they wanna get in, they, they, it will happen faster. You do have to invest in this. Uh, that's, there's just-

Zane Lackey 31:59 Yeah

Ami Luttwak 31:59 ... there's no other way to put it.

Zane Lackey 32:02 Yeah, I think that's exactly correct. The, the level of security investment, whether that is dollars, time, uh, any of these things, just needs to go up the next several years as we're going into this new era of security.

Sarah Wang 32:15 Yeah. Uh, uh, so on that topic, um, a CISO recently told, um, one, you know, one of the partners at our team that he expects his security budget to go up 80% next year.

Zane Lackey 32:25 Yeah.

Sarah Wang 32:25 Which is-

Zane Lackey 32:26 Yeah.

Sarah Wang 32:26 You know, we, we, we all anticipated that it would go up, but that, that's probably on the higher end. Um, I, I'm curious, what, uh, you know, what are you seeing folks spend more money on? Um, and on the flip side, what should CISOs be spending less money on, right? And, um, you know, you've, you've kinda written publicly about a class of security products that may become somewhat obsolete. Um, but maybe-

Zane Lackey 32:49 Mm-hmm

Sarah Wang 32:49 ... talk through that, uh, in terms of what, you know, where budgets should go up, but also where they should come down.

Ami Luttwak 32:54 Okay. So first of all, a- again, I, let's assume you have a, a house, okay? And you know that a, an elite group of, uh, the most trained, uh, uh, hackers are gonna hack your house, okay? Uh, they might not come through the door. They might come through the window or the roof, right?

Sarah Wang 33:11 Right.

Ami Luttwak 33:12 Honestly, how many houses are even ready for that? Like, most houses would say, "Fine, they [laughs] I, I'm not gonna secure the roof. Obviously, there's no way for me to... I mean, it's impossible," right?

Sarah Wang 33:21 Right. Right.

Ami Luttwak 33:22 So, um, my, uh, the point is that, like, we are really, most of the companies are not ready for attackers that have the, the speed and expertise, uh, of the best attackers in the world. And, and this is why it's a hard problem. So even before we talk about budgets, I don't even know if budgets are gonna solve the problem, okay?

Sarah Wang 33:40 Mm-hmm.

Ami Luttwak 33:40 Like, uh, it's not about security budgets.

Sarah Wang 33:42 Yeah.

Ami Luttwak 33:42 It's, it's, it is about focus, but, uh, uh, uh, to be honest, like, it's about security architecture, security design. Like, it's, a budget is not even going to solve anything.

Sarah Wang 33:50 Yeah.

Ami Luttwak 33:50 To, like, it's, [laughs] it's like, it's not like you, there is a security tool in the world you can buy and everything is fine, okay? [laughs]

Sarah Wang 33:56 [laughs]

Zane Lackey 33:56 [laughs]

Sarah Wang 33:57 Dang it. [laughs]

Ami Luttwak 33:59 So I, I'm not just, you know-

Zane Lackey 34:00 Would've made a lot of our jobs a lot easier-

Ami Luttwak 34:02 Been there

Zane Lackey 34:02 ... if that was true.

Sarah Wang 34:03 I know. [laughs]

Zane Lackey 34:03 But yeah, yeah. [laughs]

Ami Luttwak 34:04 Yeah, exactly. I'm, I'm not, I don't think it's true.

Zane Lackey 34:07 Yeah, exactly.

Ami Luttwak 34:07 Obviously, most of the latest security tools are not even relevant anymore, okay?

Sarah Wang 34:11 Yeah.

Zane Lackey 34:11 Yep.

Ami Luttwak 34:11 But that's like, that's, but even if you get security tools, this AI native that understands how to, uh, attack, attacks in the AI world work and cloud attacks and so on, even then, uh, uh, to be honest, it's about security design even more than just security budget, okay? So is-

Sarah Wang 34:29 Yep

Ami Luttwak 34:29 ... security budget going up? Maybe. Uh, is, should we review their, ex- existing stack that we have? Yes.

Zane Lackey 34:36 Yeah.

Ami Luttwak 34:36 Okay?

Sarah Wang 34:36 Mm-hmm.

Ami Luttwak 34:36 But more than that, it's about having a dev team that is focused on scanning the code and applications all the time. It's about thinking about, um, sandboxes and isolation and, like, uh, secure design and, and, and, and, and network lockdown and process lockdown and image lockdown. Like, it, it's just, [laughs] like, if you're building stuff now, r- get ready for a nation state attacker, you see? Like-

Sarah Wang 34:58 Mm-hmm.

Zane Lackey 34:58 Exactly.

Sarah Wang 34:59 Yep

Ami Luttwak 34:59 ... get, get ready for that. Imagine there's gonna be a vulnerability. Like, don't assume, ah, let's run everything in a Kubernetes cluster. No, like it's, there's zero day vulnerabilities in, in the Linux kernel all the time. Anyone can get out of a container. So you see, like, secure design is much more than just the budget. Obviously, security budgets, that's great-

Sarah Wang 35:19 [laughs]

Ami Luttwak 35:19 ... but it's not gonna solve the problem.

Zane Lackey 35:21 Yeah.

Sarah Wang 35:21 Yeah.

Zane Lackey 35:22 I, I mean-

Sarah Wang 35:22 That's a great point

Zane Lackey 35:23 ... to, to that point, it definitely feels a lot like cloud in the sense of this is a real stairstep where I'm seeing so many CISOs take a look at their existing vendor stack and really reboot that to see-

Sarah Wang 35:36 Mm

Zane Lackey 35:36 ... what are the AI native ones. Because you need AI native technologies as you are really focused on secure architecture, is exactly what you're talking about, Ami, of like really thinking about the problem through and understanding there are vulnerabilities at every stage of the stack there simultaneously. This is the, the old, uh, s- you know, CISO saying of like, "Don't let a good crisis go to waste," uh, which is absolutely happening here of rebooting so much of your-

Sarah Wang 36:03 Mm

Zane Lackey 36:03 ... security product landscape to actually be AI native, to help you go into this new era that you already are, are in, whether you

Zane Lackey 36:10 wanna be or not.

Sarah Wang 36:10 Yeah. Well, maybe just to get explicit, not, not to dunk on any particular company, but what's a type of, you know, software, secure- let's say, um, security software that you have in place, that CISOs have in place now that they just don't, no longer need?

Ami Luttwak 36:27 Um, [laughs] so if, if I view, uh, okay, most, uh, I've always been against, um, again, it might be a, a hard sentence, okay? Most of what security teams do is not security.

Zane Lackey 36:39 Mm.

Ami Luttwak 36:39 Okay? They're, uh, maybe small, small subset of their time is actually security. Uh, and the way to check it is this, and that's why I always believe in, uh, uh, um, uh, just attack yourself. Like, well, how much time are you spending with red teams, and how much time are you spending with compliance and, and, and creating reports, right?

Zane Lackey 36:57 Yeah.

Ami Luttwak 36:57 Uh, uh, to be honest, most of the security teams are not focused on security.

Zane Lackey 37:00 Mm.

Ami Luttwak 37:00 And security in my view is getting either... What, what you're doing is either getting ready for the attacker, attacking yourself, or putting guardrails for the attack when it comes, okay? So, uh, the point is that we do have to be much more, much more efficient now in security teams. We should stop doing most of what we do-

Zane Lackey 37:16 Yeah

Ami Luttwak 37:16 ... and focus on finding critical risk, figuring out how we mitigate it, or at least put detections in, and, and, and also response readiness for it. We have to be good, so we don't have time to spend on, on, on, on, on, on, on everything that is not focused on that.

Zane Lackey 37:31 Mm.

Ami Luttwak 37:31 So, if you do a task and you say, "Is this report really helping us?" You know? Uh, and that was always my point against, like, classic, what we call CSPM in cloud, which was just, uh, the way you did cloud security before. Just a list of-

Zane Lackey 37:44 Yeah. Yep. [laughs]

Ami Luttwak 37:44 ... configuration checks. I, I don't care about that. You have to care about where is the attacker gonna come from? Am I doing everything I can to, to stop them? Can I, can I... If there's a, a, a strategic barrier I can build, let's build it, you know? Like-

Zane Lackey 37:58 Yeah

Ami Luttwak 37:58 ... focus on, on understanding the, uh, actual real risk in the environment-

Zane Lackey 38:05 Mm

Ami Luttwak 38:05 ... creating a sustainable long-term isolation strategy. These are [laughs] the things-

Zane Lackey 38:11 Yeah

Ami Luttwak 38:11 ... you should do.

Zane Lackey 38:12 Yeah.

Ami Luttwak 38:12 Yeah.

Zane Lackey 38:13 And, and actually on this point of ti- time management, um, and, and maybe flipping a little bit to how AI's actually helping security teams, right? So as, as agents maybe take on more of the routine investigations and testing, how do you think... And you- you've answered this a little bit, but maybe deep dive into it, um, some of the most experienced security professionals should be spending their time.

Ami Luttwak 38:36 Much easier for a security team starting from now from scratch, okay?

Zane Lackey 38:41 Mm. Yep.

Ami Luttwak 38:41 Like, obviously if you're building a company right now, you're lucky, and you should try to build everything fully automated.

Zane Lackey 38:46 Yeah.

Ami Luttwak 38:46 Security view is automated, patch process automated, investigation automated. Uh, if you have enough context and knowledge base about your environment, uh, there is a, there is definitely a, a way for you to build everything completely automated. The problem is that for most security teams, it's just not the case, okay? Not the case. You have a lot of legacy software, thousands of developers. You don't even know who owns what. It's like, it's, it's li- it's not like everything is changing in a, because there's an AI agent, okay? Um, it's, goes, still goes back to find the context of who actually owns every resource, who, uh, how do I get them to patch stuff. It's, it's complicated. So it's gonna take time for most of the security team in the industry to figure out how to start really, really getting to efficiency. It's not, it's not as easy and simple as it sounds because a lot of the knowledge of the organization is a bit, uh, you know, obscure. It's, it's not anywhere that is actually, uh, uh, written. Uh, uh, but it is the challenge of all security teams. If I cannot respond in minutes-

Zane Lackey 39:47 Yeah. [laughs]

Ami Luttwak 39:47 [laughs] What can I, what-

Zane Lackey 39:49 Exactly

Ami Luttwak 39:49 ... am I relevant,

Ami Luttwak 39:50 right?

Zane Lackey 39:50 Yeah.

Ami Luttwak 39:51 Yeah.

Zane Lackey 39:52 So to, to that point, I'll kind of, uh, round us out with a, a, a question here on kind of connecting the through line of what we've talked about, which is what do you think the next several years looks like? Like, our next two to three years. Like, I'll, I'll, I'll, I'll start you off with my own prediction, which is that we're going back to the '90s and 2000s again. This is-

Ami Luttwak 40:11 [laughs]

Zane Lackey 40:11 There's gonna be full remotes, uh, unauthenticated, full 0days popping out all the time now. We're gonna see breaches popping out all the time again now. It's gonna look very different than the last 15 years of security. I think we are going back to a, a era that looked very different in security, and I'll even throw one wild one out there that, like, I w- I wouldn't be surprised if we end up seeing worms again on the internet, uh, like we did in the-

Ami Luttwak 40:38 [laughs]

Zane Lackey 40:38 ... Windows XP days. Uh, we were chatting internally on this on the, the infra team, and, uh, Martine brought up a, uh, a funny point of there was, for all of us who were kind of in broader tech and IT at the time, there was a window of time where you couldn't install and update Windows XP fast enough because from when you installed it, when you started the update, a worm would hit your system and infect it during the time it took to actually update the system. And so you literally had to install all of this offline because if you installed it online, it would get compromised faster than you could patch it. And I think so much of this that feels so new with AI in a lot of ways is something plenty of us experienced 20, 25 years ago in the kind of Wild West days of the internet.

Ami Luttwak 41:23 Mm.

Zane Lackey 41:23 And so building off of that, I'm curious what you think the, the next few years look like.

Ami Luttwak 41:28 Uh, Ami, just to add a quick k- uh, question to tag onto Zane's. You, you wrote, um, this great blog post in April that there was a Y2K moment coming in 12 to 18 months. Um, to Zane's point on the next two to three years, would you pull up that moment now given everything-

Zane Lackey 41:43 [laughs]

Ami Luttwak 41:43 ... that's happened in the last six months? Yeah. [laughs] Yeah, I mean, so f- first of all, I, I, I think Black October might be the, the beginning.

Zane Lackey 41:51 Yeah.

Ami Luttwak 41:51 Like, I, I-

Zane Lackey 41:52 Yeah, yeah

Ami Luttwak 41:52 ... again, this, uh, we didn't want to scare too much, and we were hoping there's more time, but the open-source models are, uh, catching much quicker than y- we thought.

Zane Lackey 42:01 Yeah.

Ami Luttwak 42:01 Okay?

Zane Lackey 42:01 Yeah.

Ami Luttwak 42:01 Like, the, the hope w- was that open-source models are a year, a year behind, but they're not. [laughs]

Zane Lackey 42:06 Yeah.

Ami Luttwak 42:06 So, uh, yeah, it's, I, I think it's happening. Like, we've never seen this level of attacks across customers. Like, it's happening. And if you wanna compare to the '90s, the, our dependency on technology is much, much, much higher than the '90s.

Zane Lackey 42:19 Oh, absolutely. Yeah.

Ami Luttwak 42:20 [laughs] Uh, and also what happened, and it's important to understand, this is almost the only area in humankind right now that AI is better than humans, okay? That's the problem. It's, it's not, and that it was not the problem in '90s. Like, AI attacks now are- Prevalent, easy, but also better than any human, okay? Like, that's the problem, okay? I, I'm talking about attacks that are very, very complex using zero days. We had today an attack using a zero day on, on a kernel driver. My God, like, that's very-

Sarah Wang 42:49 Yeah

Ami Luttwak 42:49 ... should be very rare. It's happening every day now. Human attackers cannot do it. So you see, like, we're at an era where AI is better than humans, and if I need to, I cannot foresee two years ahead from now. I, I think the only companies that will be able to survive are companies that are building now, not just security automation, security design, security reviews. They're designing their systems that are exposed to the internet in a new way. And whatever is not ready should take it, take off the internet, okay? Quickly, right? So on the internet, you need to be ready with everything that is, like, uh, ready for the crazy attackers. Um, and you have to design for this, right? Like, I think that's the, the, that's the only way.

Sarah Wang 43:35 A lot of this podcast was, um, focused on, you know, enterprises, tech companies, et cetera. Um, I, I wanna bring up Scan for Good, which is an initiative you guys launched, um, recently. Um, but I wanna talk about it in the context of some of the attacks, uh, you know, we're talking about, um, AI infrastructure companies and things like that. Um, but, you know, if we look at the recent attacks on, uh, refrigeration units in Europe-

Ami Luttwak 44:00 [laughs]

Sarah Wang 44:00 ... um, which, you know, if you think about the, the supply, the food supply chain, et cetera, right? Like, this at a mass scale has dire consequences for humanity. Um, and I, I, I don't want to s- I don't wanna fearmonger, um, but you know, I think there's also this appropriate line that you're walking, Ami, of making sure people are prepared [laughs] and are taking things seriously. Um, so I, I guess two, two questions. O- one is, um, how worried should we be about what's happening to public infrastructure and maybe these entities that don't have huge c- cyber budgets, et cetera? Um, and two, maybe talk a little bit about Scan for Good and why you guys are doing that, how you're, you know, helping nonprofits, public services, et cetera, get really prepared for what is already hap-

Ami Luttwak 44:48 So I, I, I mean, yeah, I, I am worried. Um, uh, I mean, those exactly... I mean, the legacy, uh, software, it can be refrigerators, uh, I mean, that are actually in the real world. Uh, it can be, um, uh, traffic. I mean, it can be anything. [laughs] It can be really anything that we know that is connected to the internet is at risk. That, that's exactly the reason we started Scan for Good. Scan for Good is trying to help any, any public service that wants help, and we try to scan them and try to find problems. It's not gonna solve all of their issues, but we're trying to give them a bit of a push. Our hope that if we find stuff, then they will understand it's a bigger project, then they will start doing r- red scanning on their own, right? So it's, um, like this is more of getting them to push into that.

Sarah Wang 45:34 S- this is awesome. Thank you so much.

Ami Luttwak 45:36 This was super fun, man.

Sarah Wang 45:37 This was incredible.

Ami Luttwak 45:38 Really great to see you both, and, uh, yeah, I mean, this is a crazy time. [laughs]

Sarah Wang 45:43 It's a crazy time. Thank you for- ... what you're doing right now. Good to see you.

Ami Luttwak 45:49 Yes, yes. I remember.

Sarah Wang 45:50 [laughs]

Ami Luttwak 45:51 It was in Vienna.