Democratizing Security for the Agentic Web with CloudFlare CTO Dane Knecht

1. 0:00 – 0:55

   Trailer

   1. DKDane Knecht0:00

      AI has become the tool that's causing this kind of security apocalypse. It is also the tool that can help us solve it faster as well. It went from having to get everyone just using AI, now all of a sudden everyone's racing to figure out what AI security means.

   2. SGSarah Guo0:11

      I've heard serious technical people say things like, "Air gap everything important," and we're, like, not gonna be able to trust the internet for a while, and we should assume all the critical infrastructure and government services fall down at some point. Is that your expectation of what happens? [upbeat music] Dane, I'm so excited to do this with you.

   3. DKDane Knecht0:36

      Yeah. Thank you. Thanks for coming here too.

   4. SGSarah Guo0:38

      I'm sure I'm not the first person to make this joke, but your last name, Knecht, that's pretty good, um, for the Cloudflare value prop.

   5. DKDane Knecht0:47

      Yeah, yeah. Uh, there's been some jokes about, uh, renaming the show next year, so...

   6. SGSarah Guo0:51

      Uh, so, uh, with everything that Cloudflare is doing,

2. 0:55 – 5:03

   Cloudflare CTO Top Priorities

   1. SGSarah Guo0:55

      what are your top few priorities as CTO right now?

   2. DKDane Knecht0:58

      Well, I mean, this past year, uh, it, it, it feels like 10 years compacted into one. Uh, so th- those priorities are, uh, constantly shifting, but, you know, it all goes back to our mission of helping build a better internet. And, uh, that really hasn't changed over the last 15 years, uh, where we wanna make sure that, uh, uh, the internet's secure, uh, that everyone has access to, uh, be able to, uh, get their content online easily and, uh, s- scale it up. Uh, and, uh, just, you know, over the arc of, uh, the AI, um, changes in the past year, you know, it, it went from, you know, how do you get everyone just using AI, how do you make it easy for them to deploy and their agents deploy, uh, to, like most technical transitions, uh, security is kind of an afterthought. And, uh, now all of a sudden, uh, everyone's racing to figure out what AI security means. And, uh, it means, uh, things are, you know, different sides, uh, uh, view it kind of differently. Uh, you know, uh, one side is, you know, as a, as a company is h- how do you keep your data safe from, uh, uh, AI leaking the data out? Uh, but it's also how do you keep people from getting in as well too? And, you know, o- over the last, uh, I would say three to six months, uh, just the number of vulnerabilities, uh, that, uh, uh, are getting reported and CDEs, uh, has, has just gone up exponentially. Um, you know, previously on the internet, we would see these Log4j moments, uh, or these Shellshock or, uh, uh, type of, uh, incidents maybe once a year, and it would be all hands on deck internally at Cloudflare to make sure how we protect not just, uh, um, you know, uh, our enterprise customers, but also all of our free customers, 'cause we, you know, view it as, uh, kind of as a, a public good and making sure that the internet stays safe, uh, to these things are now happening weekly. Uh, not all of them are publicly reported on, uh, but there are things that, uh, uh, uh, you know, are as serious as the, like, the Log4j-type things, but, uh, uh, just happening at a, a greater frequency. Um, you know, and I, I expect that, you know, through the rest of this year, uh, and into next year, probably the next 18 months, uh, majority of, uh, uh, teams' time is gonna be spent on security. You know, uh, you... I think there was a stat that was put up, uh, earlier today that, uh, during one of our keynotes, uh, uh, where it was showing that, I think, uh, over 50% of, uh, um, uh, engineering time is gonna be start to be spent, uh, on, uh, security. And I don't think that'll last forever. I think that'll be a, uh, a short transition. Uh, you know, uh, at some point the AI will have, uh, surveyed the majority of the code and found most of the bugs, uh, or found most of the shortcuts. Um, you know, there, there's a, uh, a one that's kind of, uh, coming out today and has been started to, uh, be, uh, blogged about and tweeted about, uh, where, uh, one of the keys, uh, on the internet, uh, is, uh, uh, that protects, uh, all TLS and Web PK- Web, WebPKI, uh, which just secures all your connections, uh, was, uh, um, was secured by the number four. Uh, literally, uh, the num- they basically, uh, used, uh, uh... Y- you know about cryptography. Uh, uh, I mean, uh, it's all about randomness, right? Uh, you know, that's why Cloudflare has our lava lamps is so that, uh, uh, you can get good randomness. Uh, and when, uh, uh, a key out there is, uh, they use the seed, they use the initial, uh, uh, thing to, uh, uh, kind of create it, uh, with a single number four, uh, uh, it's, it's gonna be, uh, uh, reverse engineered. Um, you know, uh, and AI can just do all these things, uh, you know, that doesn't sleep. It's not like the one engineer you had that was, uh, red teaming things. Um, you know, uh, last week I, uh, I think OpenAI, uh, found the seeds, uh, for, uh, the NIS- the, the NIS curves, uh, that were, uh, back in 2000, uh, that were released. Um, so just, you know, these things are just moving so fast, uh, and, uh, the bar is going up and, uh, the models are just getting so good at, uh, you know, uh, uh, uh, cybersecurity. You know, MidSource was just kind of the, uh, tip of the iceberg there, uh, where, you know, i- and, and since then, it's, uh, not just been the, the models getting better, it's the harnesses. It's, uh, how people know how to, how humans know how to use them and use those frontier models, uh, in order to, uh, find those exploits.

   3. SGSarah Guo4:59

      Given your, you know, visibility, what do you

3. 5:03 – 6:16

   Today’s Attacker Landscape

   1. SGSarah Guo5:03

      know about the humans behind, you know, these attacks and harnessing it, these models a- and taking the volume of vulnerability discovery up so quickly? Like, are they, you know, nation state actors? Are they script kiddies? Like, what, what can you say about, um, uh, how the, uh, how the attacker landscape has changed?

   2. DKDane Knecht5:25

      Uh, well, I actually think for some of these, uh, um, it's, some of these large vulnerabilities that have come out re- more recently actually, uh, haven't been nation states. They've, they've been, uh, um, you know, high school kids even, uh, that are, uh-

   3. SGSarah Guo5:38

      We're gonna call them agent kiddies now.

   4. DKDane Knecht5:40

      Yeah, yeah.

   5. SGSarah Guo5:40

      Yeah.

   6. DKDane Knecht5:40

      That, that are, that are just, uh, spending their time, you know, like they used to do kind of capture the flag security contests. Uh, they're, uh, pointing their agents at a, uh, an area and, uh, uh, doing that. Uh, you know, uh, there's also, you know, and there's just financial reward for them. There's, uh, bug bounties that, uh, they get paid, uh, out, uh, you know, sizable amounts. Um, yeah, but, uh, it's, it's given the tools that honestly the nation states have had in some form, uh, for much longer. Uh, um, either through agents or just through, you know, sheer number of people that were working on the problems, uh, giving it to the masses.

   7. SGSarah Guo6:12

      This is the first time in 15 years I've heard

4. 6:16 – 7:31

   State of Internet Infrastructure

   1. SGSarah Guo6:16

      serious technical people say things like, "Well, we should just, like, air-gap everything important, and we're, like, you know, not gonna be able to trust the internet for a while, and we should assume all the critical infrastructure and, and, and government services fall down at some point." Um, is that your expectation for what happens?

   2. DKDane Knecht6:35

      Humans, uh, we, we're pretty adaptable, and we, uh, can move fast when we need to. Um, uh, and, uh, you know, I, I've seen the industry, uh, uh, kind of partner together. And when things like this happen, uh, uh, people that you usually think of competitors just are no longer competitors. We're just literally protecting critical infrastructure, as you said. Um, and, uh, a- and I think when those kind of critical moments happen, uh, uh, uh, people and, uh, will, will rise to, to that challenge. Uh, um, so I'm a little less doomsday. I, I do think that, uh, a lot of the things that we've done over the past, you know, 5 to 10 years, uh, moving away from a kind of a castle-and-moat infrastructure for security to moving to more of a zero trust, uh, does put a lot of companies in a better position, where, uh, you know, you, you're not saying, "This office is completely air-gapped." You're saying, you know, "These devices, these, these, these flows are, uh, secured in a, in a different way. Um, uh, and, and everything's gonna be tightened."

   3. SGSarah Guo7:28

      What is it going to take for organizations

5. 7:31 – 8:39

   Shift Towards Security Spend

   1. SGSarah Guo7:31

      to do what you're describing? Like 50% of engineers do not work on security right now. I had, uh, uh, Greg Brockman from OpenAI on the, um, No Priors podcast last week, and he said that he thought in 2027 people were gonna spend as much money on tokens for security as engineering, like you're saying, very s- re- related idea. Uh, what is gonna drive that shift?

   2. DKDane Knecht7:58

      Just emergency, right? So you're gonna move forward all your security spend, uh, over the next 18 months, uh, both from, uh, uh, the red team side, uh, which is, uh, more the offensive, uh, uh, trying to actively try to exploit things, as well as, uh, the defensive side, u- uh, uh, h- how you prepare things. Um, but I, I, I don't think that's gonna be... Last forever. Uh, you know, I, I see a world in like 18 months, uh, where, uh, you know, uh, new software productivity goes way up 'cause, you know, all those resources are back, uh, focused on that. Uh, but there's, there's definitely this, gonna be this period, uh, uh, where, uh, security is, is, needs to be on everybody's mind.

   3. SGSarah Guo8:35

      What do you... What are some of the key elements of getting to, you know, a

6. 8:39 – 9:50

   Road to Better Software and Internet Security

   1. SGSarah Guo8:39

      better place in terms of overall software and internet security? Um, uh, I think people discover, of course, like, that there are, uh, libraries and services everyone uses, use that, uh, had vulnerabilities that took effort to discover and now do not, and I think we'll hit some of those. What, what else is important there? Because part of the concern that I have is the rate of software production is also going up a great deal, right? So to some degree, we gotta go, like, patch everything that we have already made and then keep up and get ahead of the pace of delivery.

   2. DKDane Knecht9:13

      Yeah. Um, well, so I mean, for one, w- we're, right now we're patching 70 years of, of, uh, s- software, uh, out, out there, so, so some of it, it is just catch-up. Uh, and then on, on a go-forward basis, you know, uh, uh, I think this, you know, the software development lifecycle, the agent development lifecycle is gonna need to change. Uh, uh, and, you know, s- uh, luckily the s- the same way that we can use security right now, uh, for red team and things like that, it'll just be built into the process every step of the way. Um, uh, and I think, you know, software will just get more secure o- over time.

   3. SGSarah Guo9:46

      What have you learned about building secure

7. 9:50 – 11:41

   Building Secure Production Software

   1. SGSarah Guo9:50

      production software internally already that you think people can learn from? Like, what does that mean? Like shift left and like can we... A- and there, there, there are many theories of how to do this, including, you know, broader use of formal verification, using agents for security in the development process. Like what, what do you think is gonna, uh, create better software from, uh, first delivery?

   2. DKDane Knecht10:15

      I kinda go back to first principles there is you wanna reduce your, uh, uh, s- attack surface area. The easiest thing you can do is to give, uh, a less, uh, places for there to be vulnerabilities. So, you know, looking at all your software and saying, "How can I simplify this? How can I, uh, uh, re- reduce, uh, this, you know, the, the footprint, the code?" Um, uh, a- and, and then, you know, beyond that, I mean, things like formal verification, like, and, uh, I think things that, uh, you know, safer programming languages and just things that are kind of built into the runtimes that, uh, make everything safer will come. But, you know, I think it just starts with, uh, uh... And, you know, AI, at least, you know, uh, for the, uh, the early AI is, it's, uh, very verbose. It likes to create complexity. So, you know, uh, A- AI in a sense of what we've been dealing with has actually, uh, uh, not been kind of, uh, helping build a, a, a more secure stuff right now. But I, I think it will get there, and I think, uh, uh, the, you know, that, that's where humans still come in and human judgment comes in in, uh, making sure that we design the software in, in a way that, uh, uh, it can stand on, you know, its own securely.

   3. SGSarah Guo11:16

      Uh, uh, that was actually gonna be my reaction when you say, um, we wanna reduce the surface area. I'm like, oh, yes, of course, in principle, and that's not the natural inclination of today's, uh, models.

   4. DKDane Knecht11:28

      Mm-hmm.

   5. SGSarah Guo11:29

      Right? And like, you know, I ask it to do something, and I'm like, well, like with one-tenth the complexity, please try again. Um, i- is, is that the role of engineering and security engineering today? Is

8. 11:41 – 12:54

   Reducing Surface Area

   1. SGSarah Guo11:41

      that something that's gonna be solved at the model level?

   2. DKDane Knecht11:43

      The, the way that humans did it before agents, uh, it, it needs to be solved kind of a- at all levels. You need to train, uh, the, uh, engineers that are writing the, the code, the product engineers. Uh, you need the security teams still need to be involved in making sure that, uh, they're getting, uh, you know, checks and balances, second set of eyes on things. You need to build in processes. Uh, we've gone to, uh, uh, um, uh, defining things a lot more internally on, on how we build at Cloudflare, uh, writing down our principles. Uh, we have a, a document called the Codex, which is kind of like, uh- Uh, uh, uh, you know, a build-up of a lot of RFCs that the teams have built for, here's how you build secure software at Cloudflare, here's how you build available software at Cloudflare, here's our best practices, and then it kind of gets boiled up into some Ten Commandments that, uh, the, uh, agents know how to follow, and, uh, uh, g- use at every part of the review process, uh, that can help in- en- enforce those things. So, you know, you, you have agents out there that are, you know, just writing a lot of the, the slop, and then you have, deeper down in the factory, you have, uh, uh, people that are, you know, doing the performance runs and the secure work- security runs, and just like how the company operated before, you, you need those ad- adversarial, uh, uh, uh, r- reviews.

   3. SGSarah Guo12:49

      Uh, when you zoom out a little bit and just look at overall

9. 12:54 – 17:27

   Near Future of the Web

   1. SGSarah Guo12:54

      traffic on the internet and how much of it has become, uh, agent-driven over the last year, um, it... I, I think it's outpaced most people's expectations. What has updated in your worldview of, like, what the web a year from now looks like, either from an economic model perspective or a, um, security or re- requisite infrastructure perspective?

   2. DKDane Knecht13:18

      Yeah. Um, I mean, uh, I kinda think of it as we're in the messy middle right now, where, uh, humans and agents are, uh, uh, riding the same rails, uh, uh, on the internet, uh, where, you know, uh, agents are trying to, uh, parse a, uh, a human web, uh, when that's just, you know, one, it's just inefficient, uh, you know, and, uh, was d- designed for humans, like, to do things at different speeds. Uh, you know, going to a website and being able to, uh, read and, uh, uh, you know, uh, see the ads and, uh, participate in more of the econo- full economic model, versus an agent that now can go to 1,000 web pages i- in the same period of time. Uh, which is, which is, which is great, it's just you need to find a, a new economic model, uh, to support that. Uh-

   3. SGSarah Guo13:57

      Do we get parallel webs? Is there, like, a human web and a machine web, like everybody's trying to do, uh, what's it called? Uh, AEO now? No.

   4. DKDane Knecht14:06

      Yeah. Uh, I mean, yes. I, I, I, I think we do. I think, I think, uh, um, we find ways to deliver the content, uh, and, and, and meet, and meet agents and humans where they are, as opposed to trying to meet them in the same place. Um, and, uh, uh, uh, right now, there's, like, translation layers. You know, there's a lot of companies that, like, you know, help you, uh, uh, uh, you know, an agent view a web page. Uh, these are just all extra, you know, burning of tokens for things that probably don't need to be... need, need to happen. You know, the, the website usually knows what data... And, and, you know, we've had things like this call- you know, we've had APIs, uh-

   5. SGSarah Guo14:39

      Yeah

   6. DKDane Knecht14:39

      ... you know, ways that computers talk to each other for years. Uh, it's just, you know, API has only covered a small fraction of the information on the internet. Uh, and, uh, agents, uh, have a thirst to, to, you know, understand everything. Uh, and so they're going out and trying to explore the, the human internet. Um, and, you know, we need to make it, uh, easier for them. Uh, we need to make it, you know, less costly for the, the site owners, and we need to find a, a way for, uh, um, uh, them to get compensated. You know, uh, you know, uh, I think, I think it's, in a world where it can get very simple, you know, uh, uh, you know, most, like, since, like, a content website, like a Substack, you know, they know what their CPM, uh, is for how much money they should be making on ads, uh, uh, um, for that site. And so, uh, if a, if an agent's reading the site, uh, I, I think there is a world where you get to the point where, uh, uh, an agent can decide whether or not they want to read the content, and then they can decide, uh, if they want to pay the, the CPM rate, right? And, you know, that's where you need to then get new payment rails for the internet, uh, that, uh, can do, you know, millions of transactions a second, uh, for, uh, these, all these little micro payments. Uh, all these things that we've been talking about for years. Uh, you know, uh, micro payments, you know, always are two years, two years away. And, uh, um, uh, you know, uh, I- I- I think agents will, will actually push that forward, and actually, I think we will see a world where, where actually there is a new economic model for content creators.

   7. SGSarah Guo16:01

      What- who do you think the players are, or what are the variations of that infrastructure, right? Like, I, I think obviously, um, Cloudflare has an important role to play here, but the r- the rise of personal agents like Instinct and Muse have also made this, like, an immediate question-

   8. DKDane Knecht16:18

      Mm-hmm

   9. SGSarah Guo16:18

      ... from a transactional perspective.

   10. DKDane Knecht16:20

       I don't think, uh, everyone, uh, knows on the, you know, on the other side what that business outcome s- is gonna look like. You know, everyone's been through these transformations where the internet, you know, they thought was gonna kill Main Street. It, it didn't kill Main Street. There, you know, small businesses are, are still, uh, uh, thriving. Um, uh, but, you know, there were people that were displaced, and so there, there's always kind of some skepticism there. And so, you know, there's some nat- natural inclination, uh, to, like, just block them out, right? Uh, you know, you saw Amazon just say, uh, "No, no personal, no personal shopping there, uh, from an agent." Um, uh, I, I mean, I think these are all people that, uh, are, are, are, are, are, you know, this, that messy middle where they're trying to figure out, uh, what, what that path forward is, and, uh, trying to keep some of their n- n- you know, negotiation, uh, uh, leverage there. Um, I, I think we will get to a place where, uh, uh, uh, Muse and, uh, Dots and, uh, all those personal agents, uh, will be able to, uh, accomplish tasks, uh, seamlessly as you as a human could do, even, even easier. But, uh, I, I don't know if the technology's quite, quite caught up to that yet, and the, uh, business model is either.

   11. SGSarah Guo17:23

       Is there anything you're personally excited about on the roadmap,

10. 17:27 – 19:13

    Monetization and Signals

    1. SGSarah Guo17:27

       or just from a techno exploration, um, perspective on the Cloudflare front that you, like, feel like is gonna enable this ecosystem in the future?

    2. DKDane Knecht17:37

       Um, well, yeah, I mean, absolutely. On, on the, uh, uh, content side, you know, we've, we've released, uh, uh, uh, a conference monetization gateway, where we make it easy for people to put their sites behind us and, uh, uh, uh, take micro transactions, uh, uh, uh, for their content. Uh, we, uh, um, including, uh, providing, uh, wallets for agents to use, um, uh, with, uh, and, uh, and, and a stable coin that's gonna be able to help kind of, uh, facilitate that transaction as well. Um, you know, we're also doing things, uh, with OpenAI, uh, uh, a project called Signals, where, uh, we're making it easier for, uh, um, agents to actually discover content. Instead of having to crawl the entire internet and, uh, continually go back to pages, we're making it easier for them to, uh- Uh, know what's new content and actually kind of more proactively do that. So, you know, it, it's a, it's a win for the, uh, AI labs as w- as well as a win for, uh, uh, the site owners not having to get, uh, constantly crawled and pay, pay for that infrastructure. Um, so th- you know, there's a whole set of, uh, kind of new laws of the internet, uh, that I, I think, uh, really excited to see, uh, all those, uh, uh, kind of grow to see, uh, you know, the, uh, you know, X.402 from, uh, when Stripe came out with it, I loved it because, uh, it went back to, uh, the 402, uh, uh, error, uh, HTTP code, uh, which was, uh, uh, you know, um, uh, Tim Berners Lee created, uh, you know, 20-plus years ago, or 30-plus years ago, uh, for payments. So, like, you know, kind of always knew that you needed a payments, a better payments rail on the internet, uh, but we haven't been able to f- you know, kind of figure it out. And, uh, uh, I, I think agents will lead us to that as well.

    3. SGSarah Guo19:09

       When you think about these,

11. 19:13 – 20:07

    Success for Content Creators

    1. SGSarah Guo19:13

       um, initial products that you've released, like, is there... W- what would success for a content creator or somebody who ostensibly had a website on the internet that they were monetizing with ads before, like, what's the, what's the killer success case you guys need to see or show the world where it just becomes, like, a default to do this?

    2. DKDane Knecht19:33

       Uh, well, I mean, I think we're, instead of, uh, them paying us, we're, we're paying them, right?

    3. SGSarah Guo19:38

       Mm-hmm.

    4. DKDane Knecht19:38

       You know, uh, uh, where it's, it's covering their infrastructure costs, it's providing, uh, uh, money that, uh, uh, uh, that, uh, uh, supports their livelihood. Um, uh, you know, if, you know, we can actually increase the number of content creators out there, which, uh, you know, the l- the, the last generation of, of the internet has done very well, like with YouTube and TikTok and, uh, X, uh, um, uh, I, I think we can actually make it even exponentially larger.

    5. SGSarah Guo20:03

       And when you look at the Workspace, um,

12. 20:07 – 24:07

    Workplace OS and Use Cases

    1. SGSarah Guo20:07

       OS, like, release and ecosystem work that you guys have been doing, what is, uh, w- what are you hoping are the, like, biggest use cases of it coming up?

    2. DKDane Knecht20:17

       It was kind of transitioning a little to, uh, we released something called Cloudflare OS. Uh, and Cloudflare OS was, uh, is our internal, uh, um, platform for, uh, how our employees, uh, use AI every day, uh, where, uh, we, you know... And it, it actually goes back to security roots where, uh, you know, uh, uh, we were very worried about, uh, customer data, internal data leaking out, and we wanted to make sure that our employees, uh, could, you know, uh, use all the new AI, uh, tools and models, uh, but have a way to, uh, safely, uh, uh, deploy them internally, uh, to understand, uh, uh, how that data is being used and flowing, um, and, uh, uh, have, have, you know, kind of good governance o-over that. Uh, in addition, uh, the reason we company called Cloudflare OS is, uh, um, we, we started to, uh, realize that, uh, you know, as we have more and more agents, uh, you know, uh, we needed to be able to teach them, uh, what made Cloudflare special, how we build at Cloudflare. Um, you know, and for humans, we did that through, like, Cloudflare University and, uh, the onboarding process and, you know, meeting your colleagues and working with them. Uh, but we needed to kind of more clearly define that and document that, uh, for agents. And so Cloudflare OS is both the s- the platform where our employees can build anything that they want, uh, in a secure way without having, like, you know, security stuff they have to think about. Um, you know, the b- the BR that's trying to create a call list, uh, they don't have to worry about, uh, security, um, it is just built in there, um, for them. Uh, but they also know that it's being done in a way that is, uh, consistent with the, the themes and values of, uh, how Cloudflare works.

    3. SGSarah Guo21:43

       And, and why release? I think of this as, like, somewhat different from the other products that Cloudflare offers today, uh, in that it is not infrastructure. It's like an end user facing-

    4. DKDane Knecht21:52

       Of course

    5. SGSarah Guo21:52

       ... um, uh, product for managing, um, AI use within, within the organization. Like, why release it? Or do you think of it as a departure?

    6. DKDane Knecht22:01

       Yeah, I mean, uh, um, for one it was, uh, it, it's kind of reference architecture really. Uh, it's, uh, you know, we, over the past 10 years, we've built some, uh, uh, our developer platform where we started with just a simple, uh, serverless compute primitive, uh, and, and now, you know, over 100 different, uh, uh, uh, developer platform tools, uh, from storage to databases to durable objects. Um, uh, we wanted to show someone, show how you can build it completely on, on Cloudflare, um, how and how we build things internally and kind of, uh, uh, uh, give people the option to, uh, you know, fork it and build, uh, their own, uh, version of, uh, their own company OS on top of it.

    7. SGSarah Guo22:40

       Um, and, and what is a way in which it is helping your people and your organization that you think is, like, clear success?

    8. DKDane Knecht22:48

       Uh, it's actually used more by, uh, uh, our go-to-market teams and our GNA teams, uh, uh, than it is even used by our engineering teams. Uh, you know, uh, uh, it, it, it's, you know, giving them a, a, a very fast, uh, you know... Early on I thought, you know, we, we saw training was the biggest gap for people using, uh, AI. And when you just kind of point them at a, a chat interface, um, or, uh, uh, ano- another vibe putting tool, uh, it's too much of a blank slate for them. Uh, and so, uh, you know, this is a platform that's desi- you know, you, you design everything for it for how your business works, and you, they immediately can go there and, you know, get access to all the data that they need. Uh, they can, uh, get guided and taken, taken through, uh, uh, where they quickly realize, "Oh, this is not, you know, trying to replace me. This is trying to make me better at my job." Uh, and, and that's been really exciting to see, uh, just, uh, just all the different ways, uh, uh, people at the company have, uh, have done that. Uh, you know, a lot of the, the, uh, uh, how this conference got put together, uh, the marketing team, uh, I mean, built hundreds of internal tools where previously, you know, they would have, they would have to go out and, uh, uh, work with different agencies, but they can, you know, the speed that they can move with a smaller team now is just amazing.

    9. SGSarah Guo24:01

       Assuming this is a continuation of, you know, starting in May, you guys did this restructuring to be an, uh, like, a

13. 24:07 – 27:11

    Restructuring for AI-First

    1. SGSarah Guo24:07

       sort of AI-first organization. Um, what, what else reflecting on, you know, the last number of months, uh, has worked or not worked that you would recommend to others?

    2. DKDane Knecht24:19

       Yeah, I mean, so, uh, you know, the, the, the, the, the, uh, the restructuring was hard. Um, you know, saying goodbye to some of our colleagues, uh, it was the first time Cloudflare ever did it. Um, you know, uh, we had, we had always been very, uh, careful not to over-hire and, uh, um, uh, well, this was for different reasons. Uh, this was 'cause we, we saw the, uh, the, the way AI was transforming some teams and how they work. Um, and, you know, we, we kind of thought of it as, like, a factory floor where you needed to re- actually rebuild, rethink how things happen. You know, uh, the, the- there were some processes or some, you know, the way a product manager would send an email before to customers, it involved three teams. You know, it involved a team where, uh, you know, uh, you, you went to B- BI to go get a cohort of, uh, uh, the people that you wanted to send an email to. You went to the marketing team to help you design the email and, and get the voice right. Uh, you went to the marketing operations team to get the email out. Uh, where, you know, it- you're never going to be able to, uh, actually redesign that process unless you kind of, kind of make some hard changes and, uh, uh, force people to kind of rethink, well, what actually is the right way to do that? Uh, and it might not involve those three teams at all. It might just involve, uh, a, a new way of doing things. And, you know, so what came out of that was, uh, a tool where a product manager now goes in and describes the cohort. Uh, they write an email. It rewrites it in Cloudflare's voice. It sends it to their manager. Uh, um, and the manager can click Approve if they like it, and it, it goes out. Uh, where, you know, we didn't go from three teams getting faster at, uh, doing that. We went to, you know, uh, one tool that can kind of, uh, uh, let a product, product manager now have a superpower they didn't have before.

    3. SGSarah Guo25:56

       When you think of all of the different workflows and tasks within an organization that's got about 5,000 people, like Cloudflare's, like, how do you decide who the owner is of rethinking that process? And, and, like, was it bottoms up from one of those teams in this case? Like, is it an organizational leader? Like, when you have so many of these things that could change to be faster and make more sense, as you describe.

    4. DKDane Knecht26:20

       Yeah, I mean, Cloudflare's always had 1,000 more things that we could, we could ever do, uh, whether it was, you know, products and features or things like this. And so, uh, we, we, we, we always look for people that, uh, uh, are gonna take initiative and ownership. Um, and so, you know, it doesn't really matter if you're ordering it, you know, one to 100 and trying to prioritize it. Any one of those 100 things, uh, are, are probably, uh, safe if someone's passionate about it. So, you know, w- we, we, we, we kind of gave people at the beginning of last year the, uh, the tools and started seeing how they were experimenting. And, you know, uh, people quickly kind of, uh, broke out into different cohorts of people that were really leaning in and, uh, um, you know, just naturally doing those things and taking ownership of them. Uh, so, you know, I, I think it was very, uh, bottoms up from the, uh, h- how we're going to, uh, uh, do those things.

    5. SGSarah Guo27:05

       Uh, it's been a major topic of conversation for organizations as to how they should think about,

14. 27:11 – 29:32

    Token Budgeting

    1. SGSarah Guo27:11

       um, token budgeting, right? Like, you know, what's a reasonable amount to spend? How do I think about this versus human capital? Who should get tokens even within our organization? Like, what is your philosophy on this now?

    2. DKDane Knecht27:25

       It, it's definitely changed. Uh, you know, uh, uh, and each model kind of r- m- makes you re- rethink it as, like, the, the cost dynamics change. But, uh, um, you know, it, in, in general, uh, um, uh, you know, I think it's kind of silly that we're actually asking humans to decide which model to do each task. Um-

    3. SGSarah Guo27:41

       Like, it should be intelligently routed sort of thing.

    4. DKDane Knecht27:42

       Yeah.

    5. SGSarah Guo27:43

       Okay, yeah.

    6. DKDane Knecht27:43

       E- exactly.

    7. SGSarah Guo27:44

       Yeah.

    8. DKDane Knecht27:44

       Like, humans just aren't, aren't gonna ever be good at that, right? Like, uh, um, you know, uh, uh, um, but, you know, early on you do it kind of, uh, brute force and you, you know, peop- you get people to experiment, and you say, "Hey, well, you know, let's try for the, uh, planning part. Let's use the, uh, you know, the, uh, top frontier models for that." Um, and then, uh, you know, once the plan's written out and agreed upon and iterated on, then, you know, uh, potentially some more of the open source models, uh, can go do that, and then you go back, and you have a, uh, one of the frontier models do the, the, the reviews and the red teaming and, and things like that. Um, now all of that today is, you know, fairly manual. Um, uh, but I, I think, you know, as we start to learn and experiment, I think it will become intelligent. Uh, and, uh, you know, uh, uh, uh, and, and, you know, over time there'll be more governance on that. You know, Cloudflare let, um, has been in a place where, uh, uh, you know, largely we've let people, uh, use the, the models and tools that, uh, they, they, they see fit, um, for the job. Uh, you know, we, we don't have, we don't have a token, uh, leaderboard. Uh, we don't encourage it. We encourage people to focus on the output. Um, the, uh, uh, uh, you know, they're not graded on, you know, if they used, uh, it. They're graded on, you know, what they've shipped and what they've built. Um, but then, uh, uh, you know, we do have some kind of, uh, we found, like, just kind of, like, giving people notices. Like, you know, i- if you happen to use $300 a day, you'll just get an email, right? Like, it says, "Hey, did you know?" A- and 'cause most of the time people didn't realize they were doing it.

    9. SGSarah Guo29:10

       Mm.

    10. DKDane Knecht29:10

        And, uh, they're like, "Oh, huh." Uh, and then I think if it gets to, like, 500, uh, it goes to your manager. If it goes to 1,000, it goes to a VP in a day. But it, it, it's, it's, uh, you know, it, it, those things rarely happen, and, and usually it's, it's pe- it's, uh, people are actually happy to s- get those notices.

    11. SGSarah Guo29:26

        Where do you think you are in your overall evolution of, like, take things just for the current level of capabilities

15. 29:32 – 33:39

    Cloudflare’s Intern Strategy

    1. SGSarah Guo29:32

       of, of models, assume no new development of, you know, rethinking the way different things at Cloudflare are done from go-to-market to engineering to be-

    2. DKDane Knecht29:41

       Oh, I, I, I think we are-

    3. SGSarah Guo29:42

       ... touched on

    4. DKDane Knecht29:42

       ... still so early. Uh, um, you know, uh, uh, Cloudflare did something, uh, you know, two years ago we had about 200 interns, and, uh, what we saw was those interns, uh, I think were, you know, uh, really the first, you know, fully kind of AI native, uh, you know, where the... If you took AI away from them, I don't think they would be able to work.

    5. SGSarah Guo30:00

       [laughs] Oh, no.

    6. DKDane Knecht30:01

       And, and, uh, uh-

    7. SGSarah Guo30:03

       Is that good?

    8. DKDane Knecht30:04

       I, actually, I think it is. I, I think they know how to use the tools better than us. It's just like you took Google away from me, you know, over the last 10 years, uh, you know, like, uh, like, you know, how would I learn anything, right? Like, uh, uh, th- that's just, that's where they reached to first. Um, and, and, and we actually saw the managers that had interns that, from that, uh, that, that summer, uh, actually adopt AI faster. So then this past summer, uh, this past year, uh, we decided we were gonna hire 1,000 interns. So that's, you know, uh-

    9. SGSarah Guo30:30

       For a 5,000-person company.

    10. DKDane Knecht30:31

        Yes.

    11. SGSarah Guo30:32

        Wow.

    12. DKDane Knecht30:32

        Yeah. Uh, over the course of the year.

    13. SGSarah Guo30:34

        Yeah, still, that's-

    14. DKDane Knecht30:35

        Yeah, and, uh, it- it's- it's just been amazing 'cause, you know, uh, one, uh, uh, just the number of ideas that come from the interns. Uh, you- you know, that's something that, you know, with AI lets people experiment faster, and so having more ideas, uh, getting more people in there, but also, uh, just seeing the, the way that they, uh, uh, use AI, like, uh, you know, um, i- if they need to fill out a form, uh, they, they, they reach for AI. Um, and, and I, and I still find myself, you know, there are so many things where I'm like, "Oh, wait, I've just been doing this manually still." Uh, and then, then I'm like, "Yeah. Oh, wait, actually, I should, I should be using AI." And, and I, I don't think that that's a natural, uh, um, uh, natural for most of us yet. Um, uh, and I think that will, that will take time, and, uh, so yeah, I think we're still very early, uh, in, in our AI journey.

    15. SGSarah Guo31:19

        I love it, the, the mass intern strategy. Uh-

    16. DKDane Knecht31:22

        Yeah

    17. SGSarah Guo31:22

        ... I run a very small, um, partnership, and we always have a, uh, you know, an intern or two floating around a team of about a dozen for, you know, ideas and intern energy and all that, but we just converted one of our, um, you know, in college interns to full-time and, uh, and Jed had him drop out and everything. And I- I- I think that you're right, where maybe, like, the dial should be turned up on the amount of DNA that is really, really native to these tools.

    18. DKDane Knecht31:51

        Yeah. A- a- and I think it's great for them as well too. I mean, you see these schools like Wa- Waterloo and Northeastern, like, with these, uh, these co-op programs. Uh, um, and, and, you know, from what we've seen is, uh, uh, people that get that type of real work experience, uh, just, you know, uh, are some of our, our best employees, uh, uh, m- many years in and go on to do, you know, uh, great things.

    19. SGSarah Guo32:13

        It is interesting, uh, or encouraging, though, that in- instead of it being like, "Hey, here's a master plan. We're gonna map out every department and sub-department at Cloudflare," and be like, "Here are the key workflows. We're gonna try to re-engineer the workflows," it is instead a strategy of, like, assume people are rational about their tokens if given information about their usage, hire a bunch of interns, and assume high agency people we have here are gonna go, like-

    20. DKDane Knecht32:38

        Yeah

    21. SGSarah Guo32:38

        ... you know, shift sh- shift those workflows to something more intelligent over time.

    22. DKDane Knecht32:42

        Yeah, and then, and then brute force and just try things. Uh, you know, early on, uh, um, uh, we, uh, had an email, uh, alias called agents@cloudflare, where we, uh, this is back in January of last, uh, of this year, where we, uh, just told people to, uh, uh, you know, if you were curious, can I use AI for this, you know, email in your jobs to be done. You know, d- uh, and uh, uh, that email would, this would reply back with a skill file. Um, uh, and for a while, people thought it was, uh, actually, you know, thought it was all AI and automated. It was actually, uh, a bunch of interns that were, uh, uh, you know, uh, uh, uh, helping people write skill files. Uh, uh, but that let us kind of get to see, uh, uh, you know, in, in, in a, a way that's not going out and like, you know, uh, hiring a consulting firm to come out and like catalog every single thing to be done. It's, you know, people that, uh, are recognizing, "Hey, this seems harder than it needs to be. I wonder if an agent can help me here."

    23. SGSarah Guo33:33

        Is there anything else about the last year that's changed, um, uh, beyond the intern

16. 33:39 – 35:29

    Importance of Curiosity

    1. SGSarah Guo33:39

       level, like your hiring philosophy, what you look for in people to bring on?

    2. DKDane Knecht33:44

       Um, well, I mean, one, one of the biggest things we always look for is curiosity. And so, you know, if, if people aren't using AI at home in their personal life and all that, I mean, that's a pretty big red flag. Like, I mean, just, uh, how, how can you not, uh, uh, be e-embracing AI if you have, you know, a level of curiosity out there? So, uh, um, you know, uh, I think just double downing, d- d- doubling down on some of those, uh, uh, uh, kind of, uh, key characteristics of, you know, drive and curiosity and empathy, uh, um, uh, uh, play even better for, uh, uh, this next set of, uh, people.

    3. SGSarah Guo34:20

       Uh, well, I, I'm, I mean, I'm, uh, I am a, uh, alpha user of all products and technology forever, so, but I, I think the answer is, like, fear and skepticism, right?

    4. DKDane Knecht34:31

       Hmm.

    5. SGSarah Guo34:31

       Um, and, and so I- I- I guess implicit in this, um, claim about, like curiosity, including in experimentation, uh, with, uh, with frontier tools is, uh, like, that needs to, uh, that needs to be a core principle for people who work at Cloudflare.

    6. DKDane Knecht34:46

       Yeah. I mean, I mean, a lot of the things we're doing, we're not, you know, uh, uh, w- w- we're inventing new ways of doing things. I mean, the scale that we operate at, uh, uh, for the, uh, number of sites behind us, uh, um, and the, the amount of, uh, free, uh, services we give away, it's just not possible with off-the-shelf technology. Uh, um, so you, you need people that can come in and literally invent new things, and, and, uh, that, I mean, that, that starts with curiosity.

    7. SGSarah Guo35:11

       I have a couple questions for you to, to close out, and it's, uh, mainly about security, both, uh, and how to do that in a new way, both at, um, at Cloudflare and then how you think it's gonna work in the, in the broader ecosystem. Um, what do you think is the, like, process by which if, if h- half the engineering team is gonna go work

17. 35:29 – 37:08

    Attacking the Legacy Software Security Problem

    1. SGSarah Guo35:29

       on security and just, like, fix 70 years of vulnerability, um, how do you attack that problem internally, assuming that not all software is perfect, even amazing production internet scale software, and then, you know, we'll talk about the ecosystem.

    2. DKDane Knecht35:42

       Yeah, I mean, I- I- I think largely, uh, you know, we're bef- you know, today we have one red team. I, I think by the end of the, you know, the end of the year next year, we will probably have four or five red teams. Uh, so, uh, you know, break people out into, uh, groups that are actually, um, uh, you know, being more adversarial and actually, like, uh, uh, going out and actively trying to find, uh, uh, vulnerabilities. Uh, I-

    3. SGSarah Guo36:04

       Why is that the approach when instead of like, "Oh, we're finally gonna get, like, our patching systems right, our processes right"?

    4. DKDane Knecht36:12

       I mean, processes and those things can always be better.

    5. SGSarah Guo36:14

       Mm-hmm.

    6. DKDane Knecht36:15

       Uh, uh, we have a vuln process. We have a patching process.

    7. SGSarah Guo36:17

       Mm.

    8. DKDane Knecht36:18

       Uh, are they perfect? No. Uh, but uh, uh, you know, the best way I've found for those types of things to get better is to o- out of, out of crisis kind of comes, uh, uh, uh, uh, that, that, that, that, how's, that's how you get those things fixed. You know, when the vulns get too big for, uh, the engineering team to just do them on using their normal processes- You know, uh, engi- you know, engineers are inherently lazy in a good way. Uh, and so they, they will, they will automate, uh, a way those, those things as they, as they, as they need to, as they kind of realize that there's no other way, way, way to do that. Um, so, you know, uh, you know, I think the focus needs to be on the discovery side. Uh, and, uh, uh, uh, you know, people will do the right thing and figure out how to patch it in a, in a scalable way over time.

    9. SGSarah Guo37:02

       Do you express a philosophy on just prioritization of this versus, like, shipping

18. 37:08 – 38:25

    Engineering Team Prioritization

    1. SGSarah Guo37:08

       new features? Uh, because, uh, I guess my understanding of... It's, it's not as if we didn't have a backlog-

    2. DKDane Knecht37:14

       Yeah

    3. SGSarah Guo37:14

       ... of, like, vulnerabilities in every large piece of software to go fix. It was just, like, whether or not that was a priority for engineering teams previously, uh, as one common state.

    4. DKDane Knecht37:24

       Uh, I, I mean, I, I think, uh, you, you need to figure out how to do both.

    5. SGSarah Guo37:28

       Mm-hmm.

    6. DKDane Knecht37:28

       Um, you know, it, it might come at the expense of, uh, cost optimization or other things. But I mean, uh, uh, companies, uh, if you're not shipping, you're dying-

    7. SGSarah Guo37:37

       Mm-hmm

    8. DKDane Knecht37:37

       ... i- is, is how we think about it. So, uh-

    9. SGSarah Guo37:39

       So it's not gonna be freeze in order-

    10. DKDane Knecht37:41

        Yeah

    11. SGSarah Guo37:41

        ... to do this.

    12. DKDane Knecht37:41

        Oh, no, absolutely not. You know, uh, you need to be, you, you need to be able to continue, uh, um, building and shipping new things. Um, but you need to be able to, uh, uh, make sure that you're doing it, you know, uh, securely and patching and, and fixing bugs. And, uh, um, uh, uh, I, I think if we do it right, we'll actually be able to do them both faster, uh, with AI. I mean, while, while AI has become the, uh, the tool that's causing this kind of security apocalypse, uh, uh, vuln apocalypse, uh, to happen, uh, it, it, it, it is also the tool that, uh, can help us, uh, solve it faster as well, right? So, so it's, so it's on both sides of it.

    13. SGSarah Guo38:19

        Oh, where do you fall on this debate of, um, the role, uh, like, good and

19. 38:25 – 39:43

    Open vs. Closed Models

    1. SGSarah Guo38:25

       bad of open and closed models on the cyber front, right? Um, because the, the, the argument, the broad argument is, well, having defensive and offensive cyber vulnerab- um, uh, cyber capabilities, you know, they're parallel in the same model, m- um, uh, despite, uh, safety and guardrails being, being built into them. And so you can't have open defensive models without them also being offensive. And then the argument, um, sort of, uh, or the concern around only having security capabilities in, um, a, a set of frontier-closed models is, well, how are you gonna release them? And you can't possibly get them out to the distributed set of actors that need to defend. Like, what, what do you think? Or did I characterize that correctly?

    2. DKDane Knecht39:08

       Yeah, I mean, uh, I think every, o- over time, uh, it all has to be open because everyone's gonna get access to it anyways. And, uh, um, uh, you know, the-

    3. SGSarah Guo39:17

       That's how open source tends to work.

    4. DKDane Knecht39:18

       Yeah.

    5. SGSarah Guo39:18

       Yes. [laughs]

    6. DKDane Knecht39:19

       The, the bad guys, the bad guys are, are gonna find a way to get it. Um, so all UR's, uh, and the, you know, the, the top companies will have a way of getting it as well. So, uh, I, I think y- you're, you're just, uh, excluding a, a, a, a mass population that just, uh, doesn't have, have the access that, that probably needs it.

    7. SGSarah Guo39:36

       Mm-hmm. And, um, and then so, so final question, just because, you know, Cloudflare, uh, very, uh, mission-oriented,

20. 39:43 – 41:29

    Democratizing Security for Everyone

    1. SGSarah Guo39:43

       does carry, uh, uh, the weight of some, you know, uh, internet, uh, resilience on, on its back. What about all of the people who can't afford to have four red teams, or, like, never had a red team to begin with, that run important systems?

    2. DKDane Knecht39:55

       Yeah.

    3. SGSarah Guo39:55

       Like, how do they, how do they protect themselves?

    4. DKDane Knecht39:57

       Well, so, uh, you know, uh, uh, I, I would say put your sights behind Cloudflare.

    5. SGSarah Guo40:02

       [laughs]

    6. DKDane Knecht40:02

       Put your infrastructure behind Cloudflare. Build on Cloudflare. Uh, you know, uh, when these major vu- vulnerabilities come out, uh, like the React one, uh, uh, last year, uh, we don't just give it to our paid customers, uh, who have, like, the advanced firewall and WAF capabilities. We, we give it to everyone.

    7. SGSarah Guo40:17

       Mm-hmm.

    8. DKDane Knecht40:17

       Uh, we view those kind of things as a, um, a part of the utility that we offer. Um, and, uh, you know, uh, uh, um, uh, we want to provide that just like, you know, uh, we want to provide performance for everyone. You know, when, before Cloudflare started, uh, you know, uh, there were probably 3,000 sites in the world that had a large-scale CDN, uh, to cache their stuff at the edge. You know, now there's, uh, uh, hundreds of millions of sites that do. Uh, so, uh, you know, Cloudflare's always viewed our, uh, our, our goal as providing, uh, democratizing the security and performance for everyone.

    9. SGSarah Guo40:48

       Awesome. Thanks so much for doing this, Dane. And, and you guys-

    10. DKDane Knecht40:50

        Thank you so much

    11. SGSarah Guo40:50

        ... heard it first. Uh, we have the, the Agent Kitties and the Vuln Poca- Vuln Pocalypse. Am I pronouncing that right?

    12. DKDane Knecht40:57

        Yeah.

    13. SGSarah Guo40:57

        Yeah. Uh, but, but it's resolvable. All right. Thanks so much, guys.

    14. DKDane Knecht41:01

        Thanks. [outro music]

    15. SGSarah Guo41:05

        Find us on Twitter at no priors pod. Subscribe to our YouTube channel if you want to see our faces. Follow the show on Apple Podcasts, Spotify, or wherever you listen. That way you get a new episode every week. And sign up for emails or find transcripts for every episode at no-priors.com.

Episode duration: 41:23