Yoav Landman – Empowering Secure, Agentic Software Delivery | swampUP 2025

Hey everyone, it's Alan Shilo. We're back here on Tech Drunk TV in beautiful Napa Valley at the Jfr Swamp Up event, continuing our Day two coverage. There's a little bit of a break going on, you can't see, but out there people are eating ice cream and peanuts and potato chips.

It's a little mid-afternoon break, but we're still here 'cause we've got a lot more to bring you. Let me introduce you to our next guest. If you've been watching Tech Junk TV over the years and any of our coverage of Jfr, you already know him, but I'm gonna pronounce his name right for the first time.

'cause it seems my pronunciation is a little old fashioned. So let me introduce you to Yoav Laman. Perfect.

Hey, nice to Meet you, Yoav. It's good to see you. Yoav, of course, is a co-founder, one of the co-founders in CTO here at Jfr.

You have a pleasure. How are you today? Likewise, Busy.

Lots of announcements. This warm up. Probably the most, A Few warm up that we have had.

Uh, lots of good, good feedback from customers and, uh, also some suggestions. So, uh, And that feedback's, that's, That's the goal actually. You know, what they say, the feedback from this year's Swamp Up will be in the products for the next, Hopefully even well Before with ai.

We have to. So you, we were talking, you know, before we got on, we have had a lot of people give us a piecemeal, a piece here, a piece there, a piece there. I'm gonna ask you, pull it all together for us, right?

Give us the a go overview of all of these great announcements, all this great innovation mm-hmm. That was announced here at Swamp Up. Okay.

So I'll try to give the full umbrella of announcements that we made. So we started with Jeff O Fly and Fly is, uh, uh, our own disruption of the platform for, uh, a new agent, uh, repository based on Artifactory. And that's, uh, that comes with, uh, a new user experience for managing software releases.

Uh, so that was our first announcement. Then we went over to, uh, UPT Trusts. And UPT Trusts is, uh, the way to control your software supply chain based on three, uh, major concepts.

First one is application that gives you ownership assignment for every release, every artifact, uh, in the JO platform. The second one is, uh, signed evidence. And we announced, uh, partnership, uh, with many leading industry vendors, uh, such as GitHub, such as sonar, such as ServiceNow, uh, to, uh, uh, integrates their evidence, uh, into, uh, into the JO platform to accompany the, the releases.

And, uh, finally, uh, it's, uh, policies that, uh, allow you to use the information, uh, within the JO platform, use evidence in order to assign rules for the progression of your artifacts, uh, of your releases, uh, all the way towards, uh, production. Uh, so this is aplu. It's a, it's a unified package that includes all these, uh, three main features, uh, ownership evidence and uh, uh, policies.

Um, so that was, uh, uh, another announcement. We also had a deep dive to our integration around evidence with, um, with GitHub to take the salsa provenance of GitHub, uh, workflow bills and put them alongside artifacts in the JFO platform, uh, as evidence, which is, when you come to think about it, it's the logical thing because, uh, you, it makes sure that, um, that the evidence itself is bound to the artifact and you can never get out of thing. And it's also the fact that Artifactory is the entity that is exposed through your production.

So that's, uh, one thing that where we did a deep dive of Appt trusts. And the, uh, other thing is we announced on stage in integration with ServiceNow, uh, around AmTrust as a, as a full, as a, as a whole. Uh, and we show the, uh, synergy between applications that many of our customers are already managing in ServiceNow, and how change requests in ServiceNow are going to be, uh, reflected as evidence in, in, uh, in JO, uh, and vice versa, how you, how you can move between the platforms.

So that was, uh, also, uh, part of the big announcement of apta. Yes. Then, so it's a mouthful.

Then we move to a new announcement, which is around machine learning and ai. This is AI catalog. Yes.

And AI catalogs allows you to have governance over models that are packages, but also models that are, uh, uh, SaaS like, uh, anthropic and open AI and so on. Uh, under a single platform, you have a catalog where you can find the latest versions of the models and the metadata about them, like, uh, the security status, the, the licensing and, and, um, other metrics that have to do with the model health. And then, uh, similar to what we have, uh, uh, in curation, uh, we elevated the same features for machine learning.

So you can allow different teams to use different type of models. Um, for instance, you may allow a research team to use deep seek, but you never want to see that, uh, in a production facing, uh, uh, release. And part of that when it comes to, uh, to SaaS models is, uh, also being a gateway between you and the SaaS models.

So if you, for instance, if you're using open ai, uh, you will use it through the GFO platform, and that allows you to have governance also of this type of models. Uh, so, so this is, uh, this is the gist about the AI catalog. Mm-hmm.

And then we went into a bunch of security related, uh, announcement. I think I, I can mention two, uh, highlights there. The first one is the support for ID extensions.

Yes. Uh, and uh, basically it's a combination of artifactory acting as a proxy for your, uh, vs code extensions. So we start with VS code, we will extend it to other ideas and, uh, curation allowing you, uh, to, uh, to, to control the, the, the, the, the extensions that your developers are able to install on their endpoints.

And this is one of the most dangerous and overlooked, uh, risk that developers are, uh, currently facing because you basically install a software on your, on from the internet that everyone knows that it's wrong, but, uh, for some reason with the ID plugins, it's assumed to be safe. It's not. And we demonstrated a social engineering hack that tempted developers.

We read about 'em, we hear about it every other week, whether it's a docker container or from a repo component. It, it, Yeah. So, so now you can apply this protection by, uh, pointing at, uh, Jeff oga your, uh, single source of record for, uh, for your ID plugins too.

And another security related announcements that we made is around the genal remediation and, uh, what we've done there. So, uh, we do with modesty, we, we have one of the best, uh, research teams, uh, uh, in the world at Jeff o mm-hmm. The security research team and our security advisories are very accurate to a degree that you can, if you find a, um, a, a a zero day in when you scan the code, the advisory that Jeff o gives you is, is one that if you take this advisor as a junior developer, it really tells you what the problem is.

It gives you an example of how to fix it, and it goes into details of, uh, what exactly need to be changed in your code. And what we figured is that we can just give it to the LLM and we can prompt the LLM with the research data of jfo. And the LLM will remediate the, the vulnerability or, or the zero that, that, uh, the JO scanners found.

We started with the integration with the, uh, co-pilot with the GitHub copilot, um, as part of the VS code integration. But we will extend it. And the, the user experience is you write your code, Jeff Fog is, uh, scanning your code continuously, it finds issues, and it's taking the research data of the JO team to prompt the LLM and apply immediate, uh, uh, suggestions of how to fix that.

And you just have to accept it and, uh, and merge the changes. So, uh, that's the, the, uh, I think that's the last, uh, uh, big announced. No, I don't think we did, did we do fly?

We, yeah. Yeah. Started Fly, fly With Fly.

Right. Okay. I got a little confused.

An ambitious, an ambitious lineup. Yeah. For one Swamp Up.

Yeah. Very ambitious. And the it, uh, team that talks relentlessly on the, I mean, that breaking trust to, to our users.

The theme around all of it though, yo, Yoav, excuse me. You're okay. Yoav, the theme around all of this is really the, the transcendence of ai and you know, how we're seeing this just totally upend the normal flow of, of, of progress, of, of it, of software development, of the software development, life cycle insecurity in DevOps, in platform engineering, in, in everything.

It's, if you're not adopting this to as, as Shami said on the stage, if you're not adopting this, get out of the room. Get out of the room. Another important kind of theme here though was no one company can do this alone, right?

Even J F's a great company. You got a great research team, you got great developers, but the, we're talking about just upending entire Yeah. Ecosystems in, in of blink of an eye almost.

And so you need a partners like a ServiceNow and an Nvidia and Sonar and some of the other ones that we've spoken about. Definitely. How is it working?

'cause now you're not just working as one team, you've gotta work at the pace and in coordination with other engineering team. Yeah. How does that affect the pace of what you, you are doing at Jfr?

So, first of all, like you said, we are in an ecosystem, but, um, I think we are in an ecosystem of, of platforms today. Yes, there may be a few platforms in, in each domain, but still it's an ecosystem of lots of platforms that also makes the integration points. Once you figure out the integration points, uh, it, they, they are becoming very natural.

So what we find out, first of all, we have great, great partners with us. You mentioned ServiceNow and GitHub and Sono, but once you found out the logical integration points, it's very easy to get the teams together and, uh, create sort of a v team that works together and, uh, and creates the inter the, the first level of the integration and then carries on to, uh, uh, to polish it. Uh, so it's actually surprisingly maybe, but works exceptionally well once, uh, ev once you have the clearance of, uh, how things are working together.

Now, another thing that you mentioned is the, the impact of, uh, of ai. So AI already made a huge change in how we code. Yes.

It's completely different now. Nobody even is surprised by that. Maybe the next surprising thing, but this is also, uh, a reality today is that you have coding agents leaving, uh, alongside the, the, the human developers.

But I think that the main gap is around. So, so coding is kind of solved. It'll change a a lot I assume also, but, um, it's already, it's already happened.

But I think where we still free, uh, see friction is around software delivery. Because what's happening is that releases are being created in a much faster pace than ever. So it's a really a nonstop release train that is happening.

And you cannot stop to, uh, think about irrelevant problems such as how do I version my release? And what is the compatibility meaning compared to the, to the previous release? It's just an ongoing flow of, uh, of releases.

With frameworks like UPT trusts, you will get the quality of the release so that you can trust. It doesn't matter if, uh, it was an, a agent that created the release or, or, or a human or a combination of both. You have the gating, you, you have the governance to make sure that your release is, is ready for to be, to be deployed in, uh, in production, uh, and to be promoted, uh, across the different, um, um, policy gates.

Uh, but at the end of the day, you need a new way to identify your releases. Yeah. You need a new way to pinpoint them and, and, uh, and scale them up and roll them, roll back and identify issues with existing releases.

And this is, uh, part of what, part of the change that we introduced with Fly with the gen release as well. I, I think between Fly and with, with AI catalog, that's one of the sort of unwritten or underlying thing things is that versioning is going to change. Versioning.

Yeah. You will need a version because at the end of the day, you to for the same down. Yeah.

But it doesn't need to be something that you, uh, take note of or remember. Uh, and it cannot be, and I think the trust is still not there to walk in a full semantic way with the releases, but it'll get, it'll, I'm sure it could get, because trust, trust is a trailing indicator, never a leading indicator, you know what I mean? You gotta earn it.

Trust, You gotta earn it. Yeah. But I think it'll also play out like that because of, uh, of agent to agent communication.

Yeah. So the negotiation of what kind of capabilities you have, it cannot be bound to a, to a specific version. It doesn't make sense anymore.

No. It'll be negotiated based on semantic agents between agents. And speaking of that, we actually had, uh, uh, ya Janan on, uh, about the FPC server.

He, he did a lot of great work on that. Yeah. Made sure to tell us.

So very proud of him. Yeah. Yan started the MCP server of Jeff Fog as a local MCP server.

As a, as a almost a, as a pet project. Yep. Uh, and then we, um, kind of, uh, upped the game and, and did a fully remote server.

Yes. Which is more, more difficult to do. But, uh, as a company, it allows you, uh, to have better control over security.

And also, um, you don't have to request clients to update the, um, the MCP installation on the local machine. But it's a, it's a, uh, what's the word? A reference.

It's an indication. Uh, a reflection. That's the word I'm looking for.

It's a reflection of our times that before January, no one knew we didn't have MPC service. Here we are, September MPC, here we are in September. And it is the standard.

You must have it, you can't do without it. Yeah. I think it's a kind of a common thing that we're seeing today.

That, uh, thing is our changing on a, on a, You Know, Today it's adequately new tomorrow it's old hat. Yeah. Well, MCP has a lot ahead of it.

Like, there a lot of proposal of, uh, improving the standout and adding, um, so, um, stronger authentication and, um, and the iden stronger identity and, and so on. Well, I think there's also the A two A thing and There's the A two A thing, which I, we, we can argue whether the standards are Picking complementary. Well, the thing about A two A is now that's part of Linux, I believe.

Foundation. Yeah. That's some big names.

Yeah. And, uh, we'll see, I mean, this is all gonna play out that the, the issue is for people like you and I who've seen this, you know, we've seen these games. We've seen these plays before, never at this velocity.

That that's the key thing. The velocity here, the, the time crunch. Yeah.

It's, uh, incredible. The Yeah, yeah, yeah. No doubt.

What could we look? So next year in New York? Yeah.

God willing, I'll be there. It's my home. September 1st, We will be there.

What do we, what You want to give us an early preview or too early? I think it's too early, especially we just, uh, uh, wrapped up saying that, uh, which things are changing so quickly actually. Yeah.

So betting on, even betting on next year, uh, is hard. I think you will see, uh, first of all, you will see there are some things that I can say that, uh, uh, you will definitely see like, uh, a lot of improvements on what we are bringing to market. Uh, today with APTAs, we have, uh, a few more things, uh, at our sleeve.

And also, uh, with fly, uh, I think we will see a more, um, a more intention based way to do DevOps. Yeah. Almost, uh, um, vibe ops thing if you want.

Yeah. Vibe ops. Okay.

Well, well, ops, dev, vibe, ops. 'cause you gotta have the dev in the ops with something in the middle. No, But in, seriously, it's going to be much more intention based, uh, with, uh, a higher degree of trust.

So I think that this Is, this is, yeah. I remember when HTML came out, all of a sudden I was a coder. I was never a coder, but H-T-M-L-I could do then.

Yeah. HTML 2 0 3, 0 4 oh CSS JS script, you know, all these things came on. All of a sudden I wasn't a coder no more.

I think we're gonna see a similar kind of thing. You'll have, everyone could be a, a developer with vibe coding. Everyone will with AI will develop something if they need, but there will be the tools that the pros use, right?

That vibe coating, refined vibe, coating squared, or whatever you want to call it, where it'll be for professional developers and, and that's, you know, developers aren't going away. They're not gonna be replaced. They're just gonna be empowered with this.

I, I, I agree with you. I think we will have humans mainly for, uh, just expressing intention and providing, uh, feedback loop. There's that.

I, I'll tell you what else, and I've written about this Uhhuh For, You'll Need Humans for the Creative Spark. AI is very good. It's when you say, I wanna do this, I want you to do this for me, I want you to create that for me.

But it doesn't create the ideas. Of course, The human brain still creates the idea. It's that spark of humanity that I think will always be The human is the guide.

The human is the guy. Yeah. Uh, yeah.

But I'm, but the reason I asked you about next year is because I didn't think you would know what's gonna be next year, otherwise why you should retire if you already know what's gonna be next year, retire. But I would like to have you back on in July, maybe next year. We will talk about Swamp Up September 1st With pleasure.

Alright. Yoav, Yoav Laman, CTO, co-founder helping wrap up our day two coverage. But we're not done.

We still have a few more. So stay tuned. This is Alan Shimmel for Tech Drunk tv.

We'll be right back. Thank.