Techstrong TV October 17, 2025

Hey, there, survey says, widespread adoption of AI to improve DevSecOps. You're watching Textron Gang. Welcome to Textron Gang.

It's Friday, the week is finally over. I'm John Schwartz. I just got back from Las Vegas at Oracle AI World, and I'm spending the day at Dreamforce.

Uh, I had to spend most of the day there, so it's been a long week. And I'm with us. Uh, we have two great guests.

We usually have on Thursdays, we have Ira Winkler, the czar of, uh, cybersecurity. And Fred Wilman, who is our DevSecOps expert. Mike, uh, Baard is still in Europe as far as I know, and Alan is somewhere in Texas.

I think he's driving north. That's the latest I've heard. Um, in any event, I'm back in Silicon Valley and we're gonna start off with the survey that Mike Baard wrote about in Dev DevOps on our website.

He, uh, looked at a global survey of about a thousand IT professionals who are responsible for application security, and he found that, and it found that three quarters are using AI with another 13% considering adoption. This is like a very interesting term of events, and it's something that Fred knows a lot about. And I'm gonna turn it over to Fred and maybe we can riff, especially between Fred and Ira about this topic.

Um, Fred, what did you, what'd you make of it? Well, I think, um, first thing is, you know, a thousand folks, probably not statistically significant in the DevSecOps universe, but what I would say is, uh, this illustrates the point we think we already know. We've been talking about a lot.

50% of the universe has adopted AI in some capacity. 50% of those folks are using it effectively. In this case, uh, what we're talking about is how do we rely on a software development lifecycle to get to a place where we're managing vulnerabilities in the software development lifecycle, not the deployment lifecycle.

So when we think about the statistics of what happens and the, and the, and the notion of what is the faith in AI versus regular engineering developers, right? Some of the metrics we use to gauge engineering, uh, quality, right, is the number of vulnerabilities, uh, that, that our code ships with the rate of fixing our vulnerabilities in code we've deployed. And you know, here what we're doing is we're talking about sort of enacting another set of developments, uh, requirements that may or may not think about the code practices of whatever organization I happen to be at.

So what's interesting about it is that the theory that AI produces more of vulnerabilities is a good one. Um, but the important part of that is that the rate of change with the current construct is people are adopting it anyway because the requirements are such. So they may not trust it, but they might implement it in this particular case.

And so what they're doing is they're also starting to orchestrate other ways to use AI to automate the process flow of determining what they need to remediate. So let's imagine today, and Ira, IRA and I, we'll talk about this, right? Uh, let's imagine today that most companies have, I don't know, 10,000 vulnerabilities, right?

Broadly distributed of that. There's a small percentage of really critical ones of that. There's a larger percentage of ones that might be high from a a, a, a criticality perspective.

A lot of those don't get patched for any number of reasons, but the critical moments of those are what if those could be passed before they became what they are? And do we need to have the persistence of those types of exploitable vulnerabilities, something be, become part of our operational security problems? So my advocacy here will be this, right?

We have tracked over the last two weeks, uh, 10 different, um, ODAY exploits dropped in five or six different products. Uh, that's almost one every other day. And at more than half of those are CEEs.

So keeping pace with what the rest of the universe is doing from an adversary perspective, it almost doesn't matter whether or not you, you trust ai, the simple scalable problem of not being able to patch as much in production as you really like to, you have already, we don't do a great job at hygiene. Why not? Is really the question.

Yeah, because I would actually have to add to that because usually I'm critical of people using the term ai, say they're using ai. 'cause it says like 77% of people used AI as developers. I mean, frankly, it's a hundred percent at this point, right, exactly.

Don't realize. Exactly. Yeah.

I mean, I set my alarm with AI by saying, Siri, that my wake up alarm for 8:00 AM and people are not understanding how it's embedded in what they're doing. But in this case, what I'm looking at and reading, assuming it's correct, is that they're actually using tools which are automating the patching of software, reducing the likelihood of vulnerabilities and so on. Because a lot of vulnerabilities, again, a little tweak here and there, you know, makes a big difference between a major crash and like a, a perfect program.

And so in this case, what they're doing is assuming the tools actually work, we are really going ahead and using ai. And I hate, again, AI use Dr. Evil quotes.

I know in ways it's supposed to be used, and that's the most critical factor that we need to understand. We're using it in ways that, again, it's a mathematical algorithm to fix the software and people are using it to speed up fixing of software. You know, can I, should I draw any conclusions?

There's this one statistic that is kind of jumps out at me. It was that a third of these people who were told said that more than half of the, their application security issues identified by al AI tooling are now acted upon without human review. How is that, is that fairly significant, or does that surprise you at all?

If, if you said that was 75%, I'd be shocked. But again, let's look at this backlog of vulnerabilities, right? If the, let's imagine there's 10,000, okay.

At least half of those are easy, obvious, simple, not intrusive, right? In the way of code. So I would think about that as, okay, the lowest hanging fruit is easily gathered, and that's probably exactly what's happening here for things that we know, but it's the process of remediation that's painful, right?

When it's already, uh, when it's already pushed out into production. So I think that's a healthy statistic. Uh, i, I, I agree that it's probably the right sort of metric, the difference between, you know, 50% and 80% is really significant.

I think that's gonna be the interesting point there. Uh, I rev I'm gonna ask you again, and I, again, I know you, I know I, I know about your fix, I know you about your AI fixation and, and I agree with you on many, on many levels. Um, did, did, does.

So in a sense, can I just ask a question that this is something that always goes through my mind whenever we talk about security and as kind of like a last measure with the whole issue of, of ai and based on some of these survey responses, um, is it, is it, is it, is it going to make, is it gonna make the job of security professionals easier? Or is it gonna add more headaches in the, in, in, in the immediate, in the immediate term. So in the first place, I hate surveys because a lot of surveys are done for marketing purposes.

Yeah. This was, I'm not saying, I'm not gonna say that about this survey, but they're always self-serving and they're almost always self-serving. And they're provided by a company that's selling something to solve the problem that they bring up.

You are, right. Well, well, I don't necessarily disagree with that, but so most surveys, they ask people questions that are poorly defined. Like again, saying, do you use AI in softening software security?

Or to do whatever the answer is? Yes, no matter what. The answer should be a hundred percent given how AI is embedded in just about everything we're doing, because AI is really parts of many infrastructures to begin with, but they need to better define what they mean by ai.

They need to better define what type of ai. In this case, when I read the report, you know, I was like, okay, they're actually using AI in the right ways when they're talking about, okay, what automated patching of software. That is not something that is a nebulous function of ai.

And again, I do think a lot of surveys are causing problems and everybody's all of a sudden saying, wow, everybody's using ai. I should be using it too. Or nobody's using ai, I shouldn't be using it.

Again, the fundamental question I keep coming back to is what are they describing regarding AI in the case? And I care more about a function than I care about the word ai. If they're talking about automated patching, by definition, that's gonna be some form of AI algorithm embedded within a software tool that they're using.

And so I wish they would say, are you using automated patching as opposed to using ai? Because AI right now is just a buzzword that's poorly applied and interpreted by people who have no idea what AI means, right? Alright.

That, that seems to be applying to a lot of the companies. They were doing some of these conferences. I'm not, I'm not going to specifically finger, uh, Oracle or Salesforce, but I mean, it's just, it just, uh, you know what I mean?

It's just like it, these used to be called, uh, Oracle Cloud World. Now it's Oracle AI world. I mean, I, I, my eyes glaze at these things.

Hey, Fred, do you have any, uh, final thoughts on this? Uh, we we're gonna move on to the next topic, but I wanna let you get the final word in. Yeah, just real quick.

I think the, the, the way that we talk about this is, is also the way, the way that we talk about our concerns about ai, right? And I'll use IRA's, AI quotes in here. It's the same way we talk about some of the things that are, if, if we were a VP of engineering at any company, right?

If we're saying that some of the concerns we have about AI is integration complexity, okay? That's every tool on the planet, uh, 46% lack of trust and results, 36%, okay? As a architect, I might find that to be also concerning about my junior devs poor explanation of security findings.

That's every product in the market, international, or excuse me, skills gaps, right? Again, junior developers and, uh, regulatory or compliance concerns accounts for 33%. So that sounds like a very normal distribution to me of the same sort of, uh, shenanigans that I would have, right?

As a CISO at, you know, said company with a VP of ENG that would have the dialogue about where's making the fix? And here's the critical part. Security folks aren't fixing these vulnerabilities, right?

That's never really the way that it works. Always engineers. And so when we think about that, that's important to understand that we're also crossing over some of the capability places that normally we would have infighting about.

So I think if we have normal statistics and we have this conversion that's happening here, I think it's terrific. You know, uh, despite our kind of, uh, hesitancy, uh, around surveys and our, our wariness, I think this one was an interesting one. And, um, it bears, bears watching.

So, um, enough on that, uh, we're gonna be coming back with a field report from Ira on cruise con, uh, in a second. I can't wait to hear what happened on the, on the, on the water. Uh, we'll be back in a moment.

You've Earned it. The spotlight, the responsibility, the weight of teams, companies, and entire industries fall on your shoulders, lives depend on your decisions. Your home life included that work.

You are protected physically and digitally. Nothing gets through your team without a fight. But in a globally connected world, everyone sees you, including those who mean to cause you and your organization harm.

And now home your sanctuary attackers see an opportunity. Your digital front door is wide open. And what compromises your home can breach your boardroom.

Because the devil's greatest trick isn't targeting your workplace firewall. It's convincing you that your personal life isn't at risk. Black cloak, digital executive protection, defending the new attack surface your personal life.

We're back with the, uh, B block. And, uh, IRA was just on a cruise con, which I, I'm very always interested in this. So this is something that you organize.

Maybe you can tell us a little bit about when it happened. I think you're at an airport right now. Are you, are you co are you returning home or are you going somewhere else?

I'm just trying to figure out the logistics of your travels. Um, nah. Yeah, cruise con ended, um, uh, it was October, well, the last one, cruise Con West happened October 2nd through sixth.

And now I am flying to Minneapolis to speak at an isaka event today. So I just happened to be at the airport and I rushed to the airport and of course found out my flight's an hour late. So anyway, um, ah, dear.

And I could have taken this from the sanctity of my home anyway. Um, yeah, but Cruise Con, the way I came up with it was, you know, I was, I've been chief security architect at Walmart, chief Security strategist at hp, and in those position positions, you get invited to events most people don't know existed. Like some people might see, for example, the teammate events because they promote those and you know, where they're sitting in a mud bath in the Florida Keys.

And anyway, what happened was, the thing about those events is content kind of Okay, content, sometimes original, like for example, wing Capital, awesome events bring in top people from, you know, top companies like running their ai, running their economics groups and stuff like that. But what I tried to do was, I mean, I'm sitting around in the desert with these Fortune 100 CISOs and I'm thinking, we are the last group of people that need something like this. You know, for all practical purposes, fortune 100 CISOs make a lot of money.

They have all the resources in the world, but they also have access. Like, you know, I used to joke I could pick up a phone and get like the CEO of Microsoft on the phone. Probably true, but not that I would ever do it.

But what I thought what needed to happen is to recreate these events for the average cybersecurity professional so that they can grow and not just take advantage of this if they hit the pinnacle of the career. So I created essentially a retreat style event where I bring in top speakers who usually speak at some of those events, and I put them in an area that's kind of like a nice a-list area, in this case, Royal Caribbean cruise ships. And we, you know, and the content is there, but more important, it's the networking that happens and, you know, so people are like developing long-term friendships because you have nowhere else to go.

I mean, it sounds bad, but it's good. So what are the rules? Can I interject?

I have to interject. One of the rules I have as a reporter, and as the, I'm speaking as a reporter, never go on a boat. So I was offered once a couple of times to go on Larry Ellison's yachts.

But even, even as much as I was curious about the idea as a press, as a reporter, you can't get off. You're trapped. But in the case of your case, uh, these are folks who wanna be together, who wanna network, who want to have some, uh, relative serenity from the chaos of a trade show.

Well, just for example. I mean, the vendors don't have, if the vendors are aggressive, we can kick them off, you know, or kick them out. Exactly.

And that's one thing. And frankly, a vendor on this, if they have five days to network and get to know, get, develop a quality connection. And if they can't do that, they shouldn't be a vendor.

But, you know, so they don't have to be aggressive, frankly, they're, they enhance the experience by buying people more drinks and stuff like that. And just to the point on the next, on Cruise Con 2026 in February, we're gonna have Chris Inglis talking about the first time that I know of Edward Snowden's incidents and treason. And that's gonna happen on Cruise Con 2026 on a boat.

And if reporters want to come, they have to get on that boat. Now. That's where that's worth going on.

Okay. Yeah. So we have that.

But, you know, fundamentally, I mean, we have a retreat style. It began with a C de in this case, a deputy CISO asked me anything. 'cause the first one, and, and the next one we're gonna have a CISO asked me anything.

But the feedback we got was that it was awesome, and we had to redo the event, you know, redo the panels. But the feedback was that for the first one, ciso, these hearing from these Fortune 100 CISOs was great, but the, a little bit of the information wasn't relatable. So I went with Deputy CISOs on the Cruise Con West as it was known, and people got a lot of good insight on how to get to that level in their career.

And then we had the, the next day was, um, Bob, uh, sorry, I'm so bad with names. Bob BigMan, who was the former CSO of the CIA, and we had him talking about, you know, when these people leave the government, they do more work than when they were at the government frequently. And he was talking about from doing assessments and stopping nation state attacks, what works and what doesn't.

And frankly, a lot of the things we think work don't, and a lot of the things we think are a waste of time are the most valuable things. And that's what Bob highlighted. Then we went on and we had people, for example, like Tim Youngblood, talk about agent ai.

We had, um, John, what did he, what did, before you, what did you think of AG Agentic ai? Because I, I'm starting to get so many different opinions about it, good and bad. Well, AG agentic AI is the way things are gonna go, whether you like it or not, like we spoke about in the last block, everybody's using things, but even what was happening with automated patching of code is essentially agentic ai, where an AI does a function without, per se, too much human intervention.

And these things are gonna happen. They happen all the time. A self-driving vehicle is essentially just one massive agentic AI and a lot of other things like, you know, essentially it's an AI doing calculations and making decisions.

I'm oversimplifying it, but also being able to enact on the dis or act on the decisions without a manual intervention. And these things are happening and they're gonna continue to happen. So that's one thing.

And then we went on, we had, um, ironically, and we'll talk about a little bit in the next session with like Will, I am, but we had Dan Meacham, who's the CSO of Legendary Entertainment. And you know, he, in other words, he's, he's actually the CSO, so he does the red carpet security along with all, like the transmission back of like, you know, dailies and stuff like that to the studios and editing pods and things. And, you know, he was telling us a little bit about hanging out with Tom Cruise and stuff like that, who he says is an awesome person.

But he was talking primarily about how he made a cybersecurity program of Profit Center. 'cause during the pandemic, when they didn't have movies to secure, he ended up taking his team and using AI Dr. Evil quotes, um, to start to see where pirated merchandise is being sold.

And then he start, had his team start tracking down the pirated merchandise, and then they went at, legally went after the people, and they're making millions of dollars for legendary entertainment, taking it down, merchandising Ping for both their studio and ironically others. So, you know, he spoke about that. We had, uh, I, the, the most engaged session, ironically, 'cause at my time at Walmart, it was, I always thought what made Walmart's program exceptional was project management and how everything was controlled, monitored and stuff like that.

So I had, um, co-author on my book, you Can't Stop Stupid Tracy, who's like a guru with project management, give it. And she's like, I hate you because it's the most boring subject ever. But she had more questions than Dan Meam had about Mickey movies.

So that gives you the idea of some of these mundane topics that are really so critical. They kind of come to life actually too, when you bring people together who are the experts, and they ask interesting questions of one another that maybe they kind of think outside the box of what they normally the box they're normally in. Well, the, the problem I will, well, the issue is, is that when you get together and you actually want to talk practicality, these mundane topics like, you know, Bob, big Man's presentation on vulnerabilities, mundane topics are more important on how do we perfect the mundane to make our cybersecurity programs the best they can be.

So anyway, besides this Jar Beason spoke on, you know, personal branding, I'm gonna embarrass myself. 'cause it's hard to remember all the other people that I had, um, at any given time. But, you know, we had, I mentioned John, is this Yeah, go ahead.

Is this gonna be available for people to Oh, yes. Good question. Thanks for the, so yeah, actually, ironically with Techstrong, Alan sent the film crew over, or a camera crew, as I should call it.

We don't do film, and we're doing Cruise Con virtual, I think it's November 6th. So hopefully you'll be able to get the link there. And I think we offer that for free.

So people will have all these sessions, except for one, one of the more interesting ones was, oh, Almar Ammar iv, who used to be the lead hacker, not the person who ran 8,200, but the actual Hands-on Hacker for 8,200. He spoke about APTs and he gave a session, which he wasn't sure how much was classified and how much wasn't classified. So he didn't want that one recorded.

So anyway, that's, um, an example of what we're having with the exception of Amer's thing. But again, Textron go to Cruise Con Virtual, and eventually it'll be pointing to that, hopefully tomorrow when I get, or by, by the time this airs when I get the link. Hey, and we are doing cruise.

Yeah, go ahead. Oh, no, I was gonna say, I we're kind of running outta time, but I wanted to say you did a really good job of in, of getting me interested in this because I, I really don't know. I hear a lot about it.

No, I'm serious. I hear a lot about it in my, my eyes usually glaze over, not not about Cruise Con, but just like a lot of these events, there's too many conferences and we're in the middle of conference season. This sounds though, really useful and interesting.

I mean, I, I would like to find out more about what all these folks have to say and their experiences. com and see the 2026, and if you go by, well, Friday the 17th, probably until the end of the weekend probably, but, you know, west 25 will get you a 25% discount. But, you know, really, I mean, I'm not a fool when I put this together.

CISOs of Fortune 100 companies can get away with having a mud bath in the Florida Keys. The average person who I'm trying to get is not, is gonna have a much harder time. And so what I did was I purposefully created content that you could get nowhere else.

And I called in favors, I called in friends, I, I attend so many events, I know you know who the best are, and that's who I've recruited for these events. All right, that sounds good. Uh, uh, again, um, thank you for the, for the field report.

I, we, we appreciate it. And we're gonna move on. You mentioned Will I am, and so we're gonna move on to the next segment and talk about, uh, he does, he does, uh, of several, several interviews a year.

I talked with him last year at Dreamforce, and I did again this year. He has some interesting insight into AI generated content, music and regulation. And we'll talk about that in the next segment.

So we'll be right back. Discover Textron Group, the epicenter of tech innovation. We are your go-to for reaching IT, leaders and practitioners worldwide.

Our secret impactful content that sparks awareness, engagement, and top quality leads with us. You'll access editorial websites, streaming videos, virtual events, custom content analyst research, and more. Join our satisfied clients.

Let's revolutionize your tech journey. Contact us today and tell your story to the world in the most powerful way. With Textron Group.

Welcome back on a Textron Gang of Will. I am is a fixture at the Dreamforce Show in San Francisco. Last year, I was lucky enough to talk to him about AI among other things.

This year I wanted to talk to him about content and, um, his thoughts on generated music actors, et cetera. He seemed generally open to that idea, uh, but he kind of pulled the, the, the conversation back and wanted to talk more about how as amazing and as awesome, pretty awesome as he says AI is and what it can do. His big fear is that the social media business model is gonna be applied in the agent space, which he says is gonna lead to all sorts of, and I, I can't really, I can't say what he said, but it starts with the letter F and ends with, ends with letter K.

He says, we know, we know what happened with social media. I'm, I'm afraid to fund checked. This is gonna lead to human greed.

It already has that will once again f it up. And, um, it, it, it's interesting, he, he also made a prediction about where we're gonna be by the year 2030 in terms of what we can do, how, how much more, um, interacted, interactive we will be with the, the content. We'll be part of the content.

So what I wanted to do is, I, I'm interested in both of your opinions, but especially I wanted to start with Fred, because Fred knows a lot about music based on conversations we have before the show. He's our music guy up in Seattle. And I'm wondering, given your thoughts and your expertise in, in the creative side, and, and I I'm sure you probably know a fair amount about Will I am, what, what do you, what do you think of kind of his thoughts and where do you, where do you think the content is going in terms of generation?

It's a great question. It's a really cool, uh, construct to, to sort of discuss. I think we're gonna start to see, so, you know, today we already have the music genome.

We already have the, I can match beats on, you know, pick your platform, Spotify, apple Music, uh, Bandcamp, uh, I guess I should say, uh, what was that? One starts with a p that's still around, but shouldn't be. Uh, when you look at, uh, Pandora, when you look at all of the ways that music is constructed together today, it's really not a creator's market anymore.

So you've got some diversity in how, you know, like Bandcamp for example, and SoundCloud and some other things are allowing, you know, direct interactions there with the concern of the likeness and the iteration. The feedback loops are, oh, I like the sound of that particular thing. If I say those words out loud, right?

In essence, AI gin me up 15 songs, it sounds somewhat similar to this based on a thing that I liked and produce that for me, give it back to me. And so I believe what's gonna happen is you're gonna start to see a lot of the flooding of what sounded like the pop top 40 right? In the last 20 years.

And you're gonna get an ecosystem of adjacency here. And the interesting question will be like, what is new and different? And can you do new and different anymore?

Right? They don't make music like they made it in the seventies, it's not possible to do that again. And now, right?

Are we going to simplify the context of what music streams are and music and artistry, or is it going to become overly complex, but easily imitable? Those are the questions that I have. I think it'll be interesting to see what happens.

So there, there, uh, I I'm gonna, I'm gonna ask you, uh, IRA a question, but there was a guy, I was on a podcast, it was a couple years ago. There's a guy who used to tour with Pink Floyd. He played saxophone and like Ira, I forgot his name.

Uh, I think his last name is Page, I think it's Scott Page. But anyway, we were talking about the creation of music, and he told me that he had heard music that was created through AI that he thought was as good as anything he'd ever heard. The only downside he said were the lyrics.

He said they were really simplistic and pretty cliche written. But, um, I'm just wondering, IRA, do you think, and maybe Fred, you can mention, you can weigh in, we're gonna see like a new kind of, and I, I mentioned this to to, to Will. I am, and he kind of scoffed it, but whatever, I'll, I'll mention it to you.

Are we gonna see like in the AI age, like something like the Monkeys or the Wiggles, like some prefab group that was created out of, out of nothing, uh, where these are not even humans, they're just avatars or creations and that, that become hugely popular? Um, I think we will, but I think there's a factor, like with the, the, the monkeys and other bands like that, like In Sync is an example. I think part of the issue is, is that these bands Yes, you, you know, we have, I forgot the name of the, the the new female actress that they have.

That's all completely ai. Oh, Lily Norwood. Yes.

Yeah, Lily. So we have, yes. So we can talk about her.

The reality though is, and you know, I was joking 'cause I give these presentations making fun of ai and you know, some of the headlines I pull up, like I now have an AI boyfriend. The reason that's critical is that with these ais people or teenage girls don't have the impression they could ever meet these people in real life, you know, and there is something about going to see them in person. There is something about it that's gonna be missed.

You look at a lot of these people and you know, some of them kind of mediocre. I recently went to, my wife took me to a Billy Idol concert, and frankly, you know, getting an appreciation for that, there's nothing like a live show, a great deal of money, millions of potentially with Taylor Swift, billions of dollars is generated because of in-person shows that you're not gonna have until at some point they, maybe they create robots or something. There's an, remember they did that one era like Fred Wright with that, the holograms, like Yeah, yeah.

Images on, on stage. I mean, I'm not sure how successful that was or is we They are, And homage bands as well, right? Like Freddie Mercury were on stage and uh, you know, the, I was thinking of Freddie Mercury exactly right.

Mike Jackson, so on, so forth. But it's, you're, you're missing a certain aspect of the business of this. You're not gonna have these artists going out and well, I guess maybe will have these fake interviews.

'cause I see them interviewing that stupid robot that they were having a while ago. I can't remember it, like from the, from X machine of the same face type of thing. But, um, you, there's a certain element that's gonna be missing.

Yes, you can create music, but there's, it's still a business. And until they cut segments of the business out, they're still gonna prefer live people, in my opinion. So, So let me, let me counter that.

All right. I agree with you, but the notion of what Live People is can be different, right? So, uh, if, if you are a Daft punk fan, okay, there's a movie that Daft Punk did that was about a producer, okay?

That went to some place out in the universe and captured this amazing talent, right? And brought it back to Planet Earth and, you know, fully put these folks in chains metaphorically and made them do the thing, right? The viability of producers creating produced music that have the same capabilities of, you know, like 98 Degrees and Backstreet poise and the K-pop bands that are out today, I believe that's a hundred percent viable.

All they've gotta do is go get Milli Vanilli or go get, you know, so on and have them play the role in whatever concert, in whatever capacity. And that's it, right? The money is in the shows now because the money isn't in the music, and all you've gotta do is get enough music, attach ability in order to have to show, to generate that revenue.

And you might not even need artists to do that anymore. That's my worry. Well, I, I, in some cases I agree, I still don't know what was wrong with Milli Vanilli.

I mean, I know that's gotta be like a blame, blame it on the rain. But, but, but I mean, the fact is, you got people who got up, gave people an experience, the music was real. Maybe those people on stage were lip syncing, but people paid for an, you go there to pay for an experience, it's like, oh gee, I was fooled.

Like, get a life, you know, you felt good at some point, you know, sometimes I also think, I mean, the sphere maybe is part of this, maybe I'm wrong, but this idea that you perform and people I know who have seen U2 or the Eagles at at the sphere tell me that the experience, the music is fine. It's good. They, they love the band bands, obviously, but it's, they are like little props on a stage of, of a much larger entertainment.

And I wonder if that is some somewhat of the appeal, why? I mean, the Eagles are still playing. I was just in Las Vegas, they're playing through the end of January.

Um, and, and I know, I know they have a huge, huge fan base, but I also wonder if that also brings in this new generation of fans, folks who may not normally know anything about the bands. Well, I think you're gonna, I mean, so here's the issue. What are you, what is this entertainment for?

And part of it is the sphere could have done this without the Eagles themselves, just using your example. Yeah. But the reality was people want to go to see them.

I mean, I was in Las Vegas, this is gonna, okay, so I was in Las Vegas to see, and it just happened, I was walking by the park, MGM where they have the arena, and I see all these like 40 ish, you know, all these women like lined up and I'm like, what are you lined up for? And then they go, the Jonas Brothers. And I'm like sitting there thinking, oh my God, this is pathetic.

But you know, then I end up going to Billy Idle with my wife. I don't know, which is more pathetic. But the reality was that people wanted the experience of seeing these people live.

And we need to accept that, that there is some element of people wanting a connection. Yes. People wanting their fantasy.

And you, and if you know it's not real, you're not gonna have, sorry, I'm stereotyping, but you know, it's true. You're not gonna have these teenage girls and women fantasizing over an AI the same way they are mm-hmm, mm-hmm. About getting the Beatles and passing out when they hear them sing or see them in person or whatever.

Even though I think that was fake. But we need these experiences. People want to have this connection that I don't think is gonna go away anytime soon.

Yeah. You know, you actually, I'll give you a little prop. So I saw Billy I twice, and I believe his song Eyes Without A Face was Song of the Year.

One year I, I believe he wrote it. So, I mean, you know, he, he's a talented guy. But I think we, I, you know, I actually, I think we're running out of time.

Uh, I, God, this is weird. We started talking about DevOps and AI tools and now we're talking about and Cruise Billy. And in between we were talking about, uh, the CIA, this was a, is, uh, varied a conversation, I think I've been a part of, uh, in this show since I've been here.

So I wanna thank you guys. You guys are, uh, you have a wealth of knowledge and that's what I find so interesting about you two guys. You know a lot about a lot of different things and you have very interesting, insightful opinions, and that's what make the, makes the world go around.

So, um, thank you for your insight today. Uh, I'm John Sorts. Um, it's been a long week.

A lot of trade shows this week. We're so happy it's over. Um, and, uh, we have a lot of programming and a lot of it, a lot of the, uh, content that Mike produced from Amsterdam and Barcelona and his series of interviews is out there, as well as Alan's trip to Houston and Qualis.

So stay tuned for that on Techstrong tv. Um, for now, that's it. We're out.

And, uh, have a great weekend. Hey everyone, welcome back here to Text Drunk tv. You know, I'm so happy to have my next guest back on.

He, it's been, as I said, when I first saw him on before we went live. It's been a minute. Um, if you're familiar in the DevOps space, you probably have heard the name Nigel.

Kirsten, Nigel of course, was a long time executive at Puppet and probably best known there for their state of DevOps survey and report, which was a, a fixture, an anchor of, of the DevOps space. But like many other, you know, nothing stays the same in this world except AI investment maybe. Uh, but you know, Nigel's moved on and, uh, has it been about a year, a year and a half now at your new company, Nigel, and they've recently undergone some rebranding and changes.

Uh, we're going to hear all about it, but let's say hello to Nigel Kirsten, chief Product Officer at Upside. Hey, Nigel, it's good to see you, my friend. Hey, Alan, it's good to see you.

I think it's been a decade or so. We've been chatting on and off these days. I describe myself as post DevOps, like, Yes, okay, post DevOps.

That's fair. Do we live in a post DevOps world? Absolutely.

But you know, the funny thing is, is it's not that DevOps went away or anything, people still practice all that, but the missionary work there is over. Yeah. It, it's very sort of mundane, you know, this is how you do it.

Um, and people like you, you need new missions. Yeah. So let's hear about your new mission.

Sure. So I'm Chief Product Officer at UPS Sun. Up until about two weeks ago, we were known as platforms.

Sh so originally a French company, massively multinational. These days I think we're in 60 or 70 different countries with employees, a hundred percent remote. Started off as a platform, as a service focused on open source CMS and e-commerce solutions.

We still do those things really well. Drupal, WordPress, Magento, all of those sorts of things. But we've now expanded out into the cloud application platform space much more about giving developers a really robust cloud application to deploy their apps onto.

And I think if we, if we're gonna draw a line back to I think the DevOps world, the thing I think I'd realized was that one of the mistakes I think we made early on in DevOps, because we were all ops people who liked to write code, was thinking dev devs wanted to do ops. And thinking that, you know, surely if we make all these things accessible via APIs and programming languages, developers will just want to take on doing operational work and will have these happy little cross-functional teams doing things. I think, at least in my experience, what we're seeing is that really devs just wanna be able to ship their applications and have them be secure scale and be in the cloud somewhere.

And that doesn't mean they necessarily want to sit there writing Ansible or Puppet or Terraform or anything like that, Or, or be security advents for Yeah. Even, right? I, I think so I, I think from a mission point of view that that's very true.

Devs wanted Dev, right? Yep. Um, however, I, you know, and again, it always got the short shrift, it always got, you know, the afterthought, the whole cultural thing.

The whole working together with cross-functional teams is still more true than ever. It's just, you know, I, I coached my kids in sports as they were growing up from the time they were like five till 14 in high school. Not everybody is the num is the, is the center fielder.

Not everybody is the quarter, not every, right? We, all the making of a team is, you have parts where each, you know, teammate has particular skill sets, but they mesh together well. And that's really when I, you know, try to explain DevOps to people today.

It's not making my developer an ops or a security person, but you're part of this team on the, you want to call it a factory, factory floor fired, but you need the platform engineer, you need the DevOps engineer, your DevOps teams, you need your dev, you need your security, you need your SRE, you need all these different people that make a team. And, and that's really, I, I think the heart of it. Forget this.

I do, I do think so, but I, I think the one thing I'd maybe push back and I see a little bit, Alan, is like, not everyone can find all the players for every position at the moment. No. And I think one of the things I see out there is that, you know, I love platform engineering.

We spent the last couple of years of the DevOps report focused on platform engineering. There were a lot of companies I almost joined focused on platform engineering. But there's a few things we see out there with big companies, which is, it's really hard for them to scale their platform engineering from the most all critical applications to serve the rest of the business because they've gotta productize it, they've gotta consumerize it and like totally software devs a team sport and there's ops people and platform engineers.

But what we're seeing out there, at least at the moment, is you can't find really great cloud infrastructure architects and platform engineers, like at a scale to do what most companies are trying to do, particularly with the volume of applications being delivered via ai. Like co writing code was never the bottleneck. And now we can just write code faster than ever.

The big bottlenecks are further downstream. So how, how does upside help with that? Yeah, so we give you the guardrails for it.

So rather than, you know, having to worry too much about cloud infrastructure, you have a really simple YAML file that you can either write by hand or use our AI powered config generator that just looks at your code repository and goes, okay, this is a Golan app, or it's a Ruby app, it's using MySQL, it's using Postgres. Here's the simple scaffolding for it to go onto our platform. So very much develop a platform as a service, but we run on Google, run on Microsoft, we run on Azure on AWS, on OVH cloud across Europe, across the us and you can just go move your application or many of those cloud regions without actually having to really do any work.

So true portability, True portability in, in insurance from geopolitical tensions and the vagaries of hyperscalers. So we're gonna jump into that in a second, but let, let's do some groundwork on UPS Sun. What, what's the website now, Nigel?

com, if you go there, you can sign up for free trial, but let you go and experience things, play around with it, play around with our order scaling capabilities, deploying different kinds of apps. Um, and then, you know, simple, you know, product-led self-service experience or if you're looking, 'cause we do have quite a few really huge enterprise customers come and chat to our sales team and we can have a chat to you about, you know, uptime, SLA contracts and being able to manage whole portfolios of applications, not just projects. Got it.

So you mentioned the, the IT sovereignty situation, you know, and certainly every day we see more and more, you know, reasons why companies out there should give thought to an IT sovereignty or a sovereign type of strategy. Um, yeah, and it's something we've discussed here at Techstrong across the various, you know, uh, sites and video series and everything. It's not enough just not to host it in a particular country.

You gotta look at who your host is, who are the people maintaining it, who are the, you know, 'cause when the, when the, when the long arm of the government come and whichever government take your pick, right? When the long arm of the government comes knocking, who's going to stand up and say no for you? And you know, there is an issue, right?

We, we sort the, the, you're in Paris, the, the head of, I think it was Microsoft France testified recently there that hey, if the US government puts an information request into Microsoft, in spite of it being hosted in, in not saying Azure data centers or data center in in France, they're still gonna comply. They're still gonna comply. So It's a complicated, yeah, it's complicated.

So my background, you know, I'm Australian. I grew up in Malaysia. I have a US residency, I have UK residency, I have American children and an English wife.

So I feel I can raise and I'm currently sitting in Paris headquarters of the company I at. Oh. So the, you know, and I, and I love how someone made a comment once about our company having an accent because we're so multinational, which is something I really like.

Look, I think it's, this is a super, super complicated topic. I think true sovereignty is really, really difficult. But I guess what I would say is that I think fundamentally I would, diversity is good, you know, and diversity in the tech ecosystem is good.

And the more options that people have and the more different kind of cloud providers, the better. You know, I think the hyperscalers have been a huge force for pushing the cutting edge and set making what's possible with cloud for everyone else. But I also love the fact that that's smaller players as well out there.

That you've got, you know, small niche players like DigitalOcean, which is a massive business in and of itself. And you know, companies like OVH and stack it in Europe and Scale way and Exascale and all of these different companies. I think we very much want to be the sort of platform that can sit above all of those things and let people make the decisions that are right for them.

Because yeah, with the pace the world is developing these days, it's, it's difficult to predict a lot. Yes, it is day to day, minute by minute. Nigel, if you don't mind, I know you're a technical guy, you, if you back a little bit, give us a peek inside this platform based on open source, open standards, proprietary, what, you know, what's under the hood here?

Yeah, so it's a container orchestration system. So think very much like Kubernetes, but very much custom built for what we actually do here. So you come along and you define, you either want to use a composable image or one of our standard runtime images.

So composable images, let you pick anything from the nix package ecosystem and go, I would like this one IMIT container to have, you know, a bit of Ruby, a bit of Python for some ETL tool that I'm running. Maybe go on the library or you might have an application where you go, look, this is a Golan app. We have a standard runtime for go and you get to express in my yaml this is a Go app and I want this to run either a specific version or whatever the latest version you have.

Now, some of the things that I think are really amazing about our platform are continuous delivery is just baked in. So as soon as I do a git commit, um, to the production branch, it just deploys a whole new version of it. Now.

And here's the, one of the really cool bits. If you are sitting there with your whole standard database, you know, you might have front end and a backend and a database layer. If I do a GIT branch on my code repository, we clone a whole environment of bite for bite perfect data really that you can then iterate on.

You can share that URL around with people. So it makes experimentation really critical. And one of the things you said earlier at the beginning about, you know, all software devs, a team sport and communication and collaboration being so important, we see this as truly transformative.

'cause it means I can sit there and we used to joke in DevOps land all the time about, you know, let's test in production, but we can actually just give you another copy of production that behaves exactly the same way. You can test on that, iterate on that, maybe send that to your customers, your teammates, work really quickly in real time and then merge the whole thing back to the main lines Really. How, how far, so can you have like children of ch daughter of daughter kind of branch?

Yeah, full, full hierarchies and full hierarchies. And you can either have it fit, you know, like a standard sort of feature branch style development methodology or, you know, work from trunk based methodology, however you wanna do that. You can define envi, what we call environments, production environments and non-production environments and create relationships between them all.

And it's all very git ops. I think in many ways this company was doing GitHubs well before, you know, my good friend Alexis coin, the actual term GI git ops, but it's all very git centric, which makes it really easy to adopt, like whatever your current development workflow is. We just fit into that really seamlessly.

I mean, look at recent surveys we've seen is if you're doing cloud native and you're not doing GI ups, A you're probably in the minority, but b you're just doing it wrong, right? And, and yes. So it's, it is the kind of the defacto standard.

Nigel, how, how is this sort of packaged? Is it they by instance, by users, by i, I don't know how how Do you Yeah, so we, so, so the way we do it is that you say, I would like this much in terms of CPU and RAM in terms of resources, and then that's pre, that's a pre-allocated cost. Um, so you pay, pay with the credit card, that's where you get charged each month.

And then there's a few dynamic things on top of that. Now you can change that allocation at any point you want. You can start to create things like auto scaling that I'm sure most of the cloud native folks here are well used to that, you know, can increase the amount of resources you consume.

But that's essentially a basic model. So we charge you for pricing based upon the resources that you are allocating to the project, um, with a couple of variations depending on, you know, how much traffic you're getting, how much storage you're consuming, et cetera, et cetera. And, and where does the choice of cloud provider come in?

So there's a few things. One thing I meant to mention that I didn't is that, um, we are really, we really believe that just as we've seen this huge movement of finops over the last, you know, decade or more that's been going, that's been going on, we really think there's gonna be more and more carbon accounting and green ops happening. So we also measure the en the green, the carbon emissions for each of the grids that we work on and work with a few different providers to go and get that data.

And we give you a 3% discount if you move your projects to a greener location. So we're trying to align green incentives with financial incentives for folks. But yeah, so when you fire it up and you create a project, you just go, I would like to have you scroll through our list of regions.

You go, I would like to be on Azure in Canada. I would like to be on AWS on the west coast of the us. I would like to be in France for a VH cloud.

I would like to be in all of these different locations and you get to actually choose where you go. But everything above that is completely portable from our perspective. So because we work with just the base building blocks of VMs and storage and network essentially on hyperscalers, we actually give you true multi-cloud portability across all of those.

And, and you know what, at the end of the day, that's what people want. Yep, totally. They don't want the, the lock in or anything else this way, you know, 'cause this whole sovereign thing, for instance, it changes day to day.

Yeah. Minute by minute in some cases. So having that flexibility, I think is, is really, really excellent.

It, it's super important and I think it matters depending on what geo region you're coming from. And one of the things we'd been, and you know, this might be the record for an interview I've done without the word AI coming up into it, I think what are we, like 15 purposely tried to keep it away, but go ahead. So I was gonna say we've done, we've produced what I think is such a killer feature of a great MCP server for the platform.

So I now do a lot of the, my driving is upside from inside cursor. Um, and really, you know, 'cause a lot of the projects I'm doing are completely, you know, they're my own test projects. I can be in full, you know, YOLO vibe, operating mode, you know, risks are pretty low.

But I just can sit there and start to describe the code I when I have committed, but also go and tell Upson, Hey, what environment am I in? Go deploy a new environment, create a backup for me, restore a backup, you know, expand the database. You can go and we can start actually instructing the platform as a service straight from the IDE.

And this is, I think one of the things we're increasingly gonna see, which is what AI agents I think have done, have changed in people's heads what their development environment or coding assistant or ID is actually responsible for. You know, I, I mean the Eclipse folks and the EMAX folks always threw the whole kitchen sink inside their ideas and could do absolutely everything in, they'd be like, oh, I'm off writing an email while I'm writing some code to at the same time. But I think what we're now seeing with Claude, with Cursor, with Gemini, with all of these different rate code bases built upon Visual Studio Code is that people are now getting their ideas to do more.

So they're not just refactoring code, but they're making choices about where we actually go and deploy this code and go and manage that operationally. So we can pause an environment, create a branch of an environment, revert something to a backup, all in a conversational interface from inside the IDA. And I think this is gonna fundamentally transform, um, you know, translation and localization and interfaces and workflow design, because some workflows are easier to describe than to spell out in the formal language.

Love it. Nigel. We're we're outta time, unfortunately, but we should get, we'll.

Let, let's make another appointment. Have you Sure. Uh, talk about the AI implications here and, and where all that's going.

Um, I'm trying to think where, where are we gonna be? I, I'm a cube con. Are you guys gonna be a cube con of Nah, that's not really your thing, Maybe.

Um, so yeah. Yeah. I might possibly be at coupon.

We'll see If you are come by, say hello. We'll do something first. All right.

Hey, Nigel, best of luck with Upson. It sounds exciting. And, and, you know, in, in the moment of time it's current for what I think the world's looking for, what the market wants.

So, as usual, awesome. Impeccable, impeccable timing. Nigel.

Uh, always lovely to catch up. Thank you my friend. Enjoy Paris and we'll be in touch.

Cheer. Alright, Nigel Ker, uh, chief Product Officer at upson. At ups upside do com here, formerly Platform.

Sh if you are familiar, we're gonna take a break. We'll be back on Textron in just a moment. Hey everyone, welcome back here to Tech Trunk tv.

I want to introduce you to our next guest. Her name is Tiffany Sjogren. Tiffany's with Optiv, where she is the Director of Services, enablement and cybersecurity education.

Tiffany, welcome to Text Drunk tv. It's great to have you on. Thank you, Alan.

Absolutely. And, uh, you know what, for those of you who don't know out there, October is Cybersecurity Awareness Month. I used to think it was one of these made up Hallmark holidays just to sell more cards, but we've, it's been going on for a couple years now, and I think it's kind of generally accepted that, at least in our world, October is Cybersecurity Awareness Month.

So happy Cybersecurity Awareness Month. Tiffany, thank you for joining. Absolutely.

Absolutely. Absolutely. I didn't be here, Uh, Tiffany, I, I gave them your title, but you know, a title can cover up a lot or not.

Give us an idea really though of your journey to, to, you know, being here with Optiv today. Absolutely. I have a pretty unique background.

Uh, once upon a time, I was a middle school math teacher, and I entered into the corporate training world over 12 years ago. And, um, started with Optiv, um, in one of the companies that formed Optiv in 2015. And, you know, right now I'm responsible for the education of our services organization.

Uh, so all of our analysts, engineers, uh, customer success managers, all of them. So I've had the opportunity to work with them and grow alongside them, understanding what they need in order to make our clients secure. Absolutely.

Very cool. What a great story. I, I, I got a confession to make.

I'm doing interviews here 12 years or more. You are the first former math teacher who's made the crossover in a tech like this I've ever interviewed. So, congratulations.

What grade math did you teach? I taught middle school, so, um, seventh, eighth grade. Those, those are the wonder years.

Those are bad. Those kids, man. Oh man.

Love, love. God bless you. I love 'em.

Did you? Oh yeah. Good for you.

No, they're amazing. And honestly, uh, they're very similar to the professionals, and I mean this in the best way possible, very similar to the professionals that I work with now, because in cybersecurity, many of the people that we're working with are hungry for more. They're hungry for understanding how to address the next threat.

They're hungry for, um, you know, understanding the new technology. You know, we're talking about AI every day right now, and similarly in middle school, they're just starting to get into that content where they're figuring out themselves and you know, what they wanna do in life. And so there is that bit of energy that is synonymous with both groups.

Um, so I find it, uh, it is interesting, but, uh, I find it fulfilling working with these professionals. Very cool. So I would've compared cybersecurity professionals to middle school kids with a different sort of analogy, but I like yours.

It's okay. It's okay. Uh, great stuff.

Tiffany Optiv. Mm-hmm. Some of our folks out here are probably familiar with Optiv, but I'm gonna bet a lot aren't.

How would you describe Optiv to them? Optiv is a cybersecurity solutions advisor for clients of all different sizes, all different industries. And really our focus is doing what we need, um, to help our clients secure greatness, whether that's through technology partners that we have, um, within, uh, all the different industries touching cloud, um, touching network security, touching ai, um, you know, whether it's a technology or a service.

We have a large services organization of consultants and managed services, uh, where we can meet clients where they're at, um, you know, not being reliant on a specific, um, approach, but finding what works best for them and helping them secure greatness. I love it. com.

O-P-T-I-V. That is correct. Excellent.

Alright. Tiffany, if you don't mind, I, I'd like to return to this Cybersecurity Awareness Month theme and, and talk a little bit about the Core four, right? Mm-hmm.

And again, some of you out here may know what we mean when we say the core four as it relates to cybersecurity awareness, but some of you don't, if you don't mind, Tiffany, why don't you, you know, refresh those who maybe forgot. Absolutely. So the reason we're calling them the Core four now, is that Cybersecurity Awareness Month used to have different themes every year, and they would have different areas of focus.

Um, but over the last several years, those areas of focus have remain the same. They are the core four strong, unique passwords, phishing awareness, reporting, it, multifactor authentication, and keeping software up to date. And the reason that those four became the core four is that no matter the technology in the environments of our customers, or even in their personal lives, it's that human behavior.

You setting your password, you opting into multi-factor authentication, you recognizing a phishing email and you taking a little bit of a pause and letting your software update that's going to keep you the most secure, both you and your organization. So that's why we call them the Core four. Excellent.

You know, taking a little bit of a pause, I came, came into the office early this morning. I, I use a Mac and a iPhone, and I, I logged into my Mac and I got, you know, the, the little, you know, the gray thing with the red number one, meaning there's a software update out there. I said, all right, let me update my Mac and while that I'll just work on my phone while it's updating and I update the Mac and, you know, it goes blank and I get the Apple logo and the, and the bar.

Yep. And, uh, I open up my phone and what do you think I got Update The same number one update, because now they update across the entire portfolio and I'm on the beta releases nonetheless. So now I had to hit, hit update on my phone.

Now I'm stuck here without any devices, right? Mm-hmm. And I'm twiddling my thumbs going outta my mind, but, so lesson, you know, but you're right.

It, it was just a few minutes and I felt better that, you know, I updated that it said Chrome needed an update. I did a quick relaunch of Chrome. Mm-hmm.

And I'm up to, I'm up to speed and, and as a security person, you know, that made me happy, I guess at some level. Um, looking at the Core four for this year, what, what, what's optos advice, best practices for our folks at home? Yeah.

So, you know, you, you had mentioned that not everyone is aware that this month is cybersecurity awareness month, really for Optiv. What we're trying to instill with our clients is that cybersecurity awareness month is a time where we celebrate, but it is all year round. And making sure that our employees and our business leaders who are in charge of the initiatives that, um, they're rolling out within their organizations, that they understand the human element of that.

And the importance of having a plan. Because again, like I mentioned earlier, no matter what software or technology is in your environment, it takes one person entering their password into a malicious site that they got to through a phishing email to make you sit back away from that technology a lot longer than a couple minutes. Right?

Um, the impact of those decisions and the impact of those behaviors, it's just making sure that you're covering all bases when you're in the middle of a new initiative. If you're trying to turn out a new product that has technology involved in it, maybe it's coding, taking time to do the threat modeling, oh, you want to incorporate ai ai threat modeling in front of that so you understand the risks. So it is that investment of time upfront, um, that you kind of mentioned, you know, gotta gotta push that update out, gotta sit here for a little bit, but it pays dividends on the backend to be more methodical and, uh, approach it the right way.

Uh, agreed. Absolutely. Um, you know, it, that, that whole idea though of I don't have time, I don't have time.

Mm-hmm. It is pervasive in, in fact, cases where you see security breaches. Mm-hmm.

Right? It's the same thing the developer says, I don't have time to test for security. I gotta push this code.

I gotta push the code. I don't have time, we're on deadline. Mm-hmm.

Or, you know, I, I gotta spin this up there. There's a deadline and, you know, at the ops level, and, you know, time time's not the enemy necessarily here when it, when it, when it comes to cybersecurity. So that, that's definitely a, a thing phishing.

Mm-hmm. Wanna talk a little bit about phishing? You know, it used to be so easy to spot phishing because most of the time it came from, you know, places where English was the second language and, and you know, Microsoft or Apple isn't writing things with like, uh, terrible, you know, grammar and stuff like that.

Of course with ai now, some of these phishing males are works of art. Yes. I mean, I, I sit here and I, 'cause I, I've taken the fishing classes.

I, I actually helped design a phishing course and, um, you know, I go into the headers and start looking at the reply twos and the, and the real names and where those links are going and everything else, URLs and actual link. Um, but for the average person, it's become a real challenge. A real challenge.

Absolutely. Um, like many of the people who are probably going to watch this or listen to it, um, I am my grandmother's IT help desk. Yes, we all are.

We all are. Right. And I wish my grandma, but the whole family, yes, the whole Family.

But those phone calls when, when she is distraught, because it is so believable, it is from her bank, it is from her, um, you know, investment portfolio people. And she's like, I, but I don't, I haven't done this. And I'm like, I know you haven't.

So what does that mean? If you have thought about the context, the content of that email, and it's not legitimate, what does that mean to you? And that's kind of the mindset shift that I'm trying to teach her rather than, and, and honestly more than just my grandma, our cybersecurity education, um, team that provides services and, and training to our clients here at Optiv, we are talking about slowing down, thinking through, um, evaluating the content.

And if something seems off, if just one piece of it doesn't seem real, there are things that you can do to validate, uh, that email there are other than just technology, right? Um, you know, you can send an email separately, you can report it for evaluation. Doesn't mean that it goes away forever, but have someone look at it, a professional before you're clicking anything, opening anything.

I mean, the best thing that they can do is reply and say, that wasn't a phishing email. You're like, okay, good. Now I'm safe to proceed.

Um, you know, so it is a, it it's more of a mindset shift from being tactical, looking at the misspellings, looking at the domain, looking at, um, you know, the, the urgency or formatting, uh, within the email. And instead it's almost more of a strategic look, look at communications, if you wanna think about it that way. So moving from tactical to strategic and thinking, is this something that I should be getting?

Is this, um, you know, relevant? Um, or is there something just a little bit off? Fair.

Excellent. Um, you know, I, I mentioned AI with the phishing, but AI is having an effect up and down here mm-hmm. With all of our security.

And, and you know, at the same time, it's also a force for good, right? We, a lot of companies are building AI into their cybersecurity protection, right? Because it can mm-hmm.

Sometimes you need AI to fight ai, Right? Absolutely. And I think cybersecurity awareness month is one of those times where you can start the conversation.

Um, I think for, uh, for most of the organizations that celebrate Cybersecurity Awareness Month, it's more about the individual end users. There may be some initiatives corporate wide, but kind of the focus is on the people aspect of it. And when it comes to ai, AI literacy is really important.

Uh, so having your general end user understand what an LLM is, what it looks like when an LLM is poisoned by a threat actor, uh, what bias looks like on output, um, what prompts you should be using or can use that still protect the information that you are handling. Um, rather than using that information to train an LLM, um, open, you know, public or open AI versus closed ai, um, being able to understand those terms so that when a policy comes out or when they see something in the news or an alert from it or the security team, it makes more sense. Uh, I think the literacy piece of it, really understanding all of the nomenclature and how they're intertwined is critical.

Agreed, agreed. Tiffany, we're about outta time. I want to thank you for coming on.

Keep up the great work at Optiv. Thank you. Um, there are a lot of middle school math kids who are missing out with you over here now, but the loss is our gain.

So thank you very much for what you do there and come back and keep us posted. Appreciate it. Thanks for having me.

Alright, we're gonna take a break here on Techstrong tv. We'll be back in just a bit. Hello and welcome back to Atlassian, Europe and we're here with Josh Millers, the CEO of the Browser company, which is in the process of being acquired by Atlassian.

So we can't get into too much detail about the future plans, but welcome to the show. Thank you very much. Awesome to be here.

First, uh, Atlassian team conference. All right. So a lot of people are going, well, why do we need a new and different browser?

And what's gonna change about the experience in the age of ai? And, and so kind educate everybody about what you guys are working on. Yeah.

So the origin of the company is actually pretty humble. My wife got a new job. She got a brand new MacBook with M1 Ship, super fancy.

She worked for a artist who was 76 in Flagstaff, Arizona, not the bastion of it, innovation and forward thinking teams. And I noticed that she never left Chrome during her workday. Like even in an old industry, she would get PDFs from old school New York galleries, and those PDFs were now URLs and her email was a URL.

And so the origin of the browser company was looking at how people were using their computers and noticing they weren't ever leaving their browser. And their browser was really more of an operating system for their day-to-day and the fact that their applications and files were not in the browser. So the idea behind the browser company arc or first browser and now idea, which will be expanding with Atlassian, is how would you re-architect and redesign a browser if your assumption was not tabs or information from the Super Information Highway from 2030 year, really 30 years ago.

But you said, Hey, these are actually the tools and files that I'm using every day that used to happen on Mac Os or used to happen on Windows, but it's now moved up the stack to the browser layer. So explain how that will change the way we work. 'cause I mean, today I'll open my browser and there'll be 15 tabs on that, that I'm kind of trying to mentally connect.

But is there a better way of thinking about all that? Yeah, There's, and we think about it from a couple different, uh, angles. One is applications.

So again, we don't think of them as tabs. We think of them as tickets or documents or videos. And when you think about it that way, you have features like if you're in a Google Meet meeting and then you have to switch away to another tab, that might be a document that everyone in the meeting's reviewing or some research you wanna do quickly on the side relevant to the conversation, we automatically take that Google meet meeting.

'cause we don't view it as a tab. We view it as a meeting and pop it out into a little custom video player just for video calls with little meeting controls that will follow you around to anywhere you go in the browser. So that's an example of it.

If you're someone that is in video calls a lot for your job, every time you do a call, we're making that experience more seamless and more convenient because we don't think of them as dumb browser tabs. We think of them as smart app objects. Yeah.

So that's one area. The other area is with ai, and if there's one thing we've learned about AI is unreliable and can feel like slop and the things that change, both of those downsides of AI are when it has a lot of context about you and your job. Where is that context?

Your context is in your tabs. Why is it in your tabs? Because your tabs are your apps and your files in 2025.

So the idea is that instead of having to export things outta your browser into some AI tool of all the context of what you're working on is right there, then can we teach an AI model when you use it natively in the browser to really already understand the things that you're working on because it's right there with you. But both of those are examples where it's not redesigning the browser for the sake of it. It's saying the browser is designed for something totally different and this many decades later.

Really people are turning to it as the heartbeat of their job. And let's make a browser that reflects that Dumb question. But what you're describing, is it really a browser or is it something else altogether?

Well, fun fact, we called it the Browser Company of New York, right? As sort of a misdirection. So we've always viewed what we were building as a new type of operating system at the web layer.

Now, this is an idea that is age old. There have been so many attempts at this. And our view is that the timing for this idea, in a world where we have devices across, you might have a Windows PC for work and an Apple device for your smartphone and your car and your, that you're gonna want a computer that follows you around all those different devices.

And in the modern world where everything's moving to the cloud and there are these proliferation of devices, you're gonna want a browser or something that sits across all of them at the web layer. Now, we don't think the average person, I think you probably, your, your audience may be the one narrow niche in the world that is wants to talk about operating systems, uh, based on top of the web. But for most other people, that's not a thing they're looking for.

So we call it a browser because three to 4 billion people a day use a browser. And, and they, they're familiar what to expect. So our hope is sort of like the iPhone one day someone picks it because it is better than Chrome or safari and very concrete ways that they can relate to.

And over time, if we do our job, they'll look and go like, wait a minute, I'm barely touching my downloads folder. Or I'm barely touching the folders on my desktop. Uh, and we can evolve the the browser to really reflect that new need.

Will the people who currently build browsers evolve along your path? Or are they kinda stuck in that lane because they're trying to service a million consumers? Yeah, I mean, one of the things that's fascinating is, you know, a year ago we said, Hey, we're gonna make this AI browser thing.

And everyone's like, you're nuts. Like you've been working on this other browser arc. Why are you going to try to invent this new category?

What does that even mean? What does an AI browser now there are five or six vendors rushing to build AI browsers, many of them very similar to RSDA. So we view that as validation that actually there is going to be this new category of browser, pseudo browser, pseudo AI isn't new, is it the old thing?

Updated? They're gonna be a lot of people. And what we're deciding to double down and focus on is an AI browser for work.

'cause our view is that in 2025, when you open your laptop, you're probably doing your job or school because on the weekend you probably wanna be on your phone or on Apple TV or out in the world doing an activity. And so if you're opening your laptop, it's probably 'cause someone's paying you to do that. And we wanna make you better at that where others focus more in the broader consumer market.

How unique or custom can the experience get for each company or even for each individual user per Se? Uh, that, that is one of the things that is when we started the browser company, we spent the first year actually rebuilding the infrastructure needed to build browsers on top of chromium, which is the web and uh, web rendering engine. And we did it in a way that allows us to make much more novel and creative interfaces on top of chromium than what other browser vendors think can provide.

And so if you go look at our first product arc, you'll see that, uh, it looks very different than Chrome and Safari in ways that actually challenged, uh, us in terms of novelty of people learning new things. But it's also a lot of our beloved arc features that people are fanatical about stem from that infrastructure layer we built that allows us to develop novel interfaces in new ways. Mm-hmm.

You combine that with really the properties of LLMs, which are inherently generative and personalized to each person in query you, you combine those things and we are really hopeful that a, a central value prop of our browser will be and continue to be. It is personalized for you and your job, and now your company after the Atlassian deal, uh, hopefully closes. Um, but we're very excited about, uh, personalization as a, as a defining selling point of our product, especially personalization.

That doesn't mean we're selling your data to advertisers or anything of that nature. So within the limitations of what you can say about Atlassian, how does what you're doing and what they do align? Yeah.

One of the things that, uh, we have always focused on that is in Atlassian's DNA as well, is focusing on the individual in the sense that we want, you know, Atlassian pioneered as, you know, kinda the bottoms up SaaS motion in many ways. And really in plain English, your, I know your, your viewers don't need to know this, but most people don't. That meant something that you would pick 'cause it was the best in class tool and you wanted to use it 'cause it was best for your job.

And if not that you at the company were using that tool, maybe they would go and buy a license from Atlassian. And so we've always been really focused on the first part of that equation, which is how do we build the most helpful browser for your job, for your workday? But there's that second part of that sentence, which is what the needs of a boss or an IT department or a security department, especially in the age of browser-based security with all these SaaS apps, is they need a lot of things that are not anything we have expertise in.

And so we're very excited to collectively focus on this AI browser for work focus on making the most valuable tool for the individual that they pick to use. But ultimately, if they're enough people at a company or an organization that are interested in it, what can we offer, um, the real buyers of the software and, and, and, and eventually make teams the be get better together in the browser. Actually, when we started the company was in, uh, 20 19, 20 20, like at the height of collaborative web-based software, Figma, GitHub, notion, Airtable, all these companies were coming out, uh, with very collaborative multiplayer software.

And we always wondered why do you have multiplayer and collaboration at each app? Shouldn't it be at the operating system layer? Should it be at the browser layer?

So there's teams and work, uh, functionality that, uh, we're excited about with Atlassian as it relates to learning how to distribute DIA to organizations that meet their needs. But I also think there's a lot to do, but just how do you make teams work better together? Um mm-hmm.

Just in terms of their day-to-day work and workflows. Um, how do I secure all this? Because there's a lot of people talking about prompt injections and if you're a browser, access is something somebody can have a malicious prompt and you're connected to everything.

So that kind of means I gotta secure everything, but how do I do that? Yeah, I mean, one of our selling points is security and privacy. So we have, uh, zero data retention, uh, on our, all of our LLM use.

Our memory functionality is end-to-end encrypted, stored on device. So though you have memories we can't see them. They are passed through an encrypted channel to an inference provider.

So everything that is best in class as it relates to security and privacy, that's available today. We do. Now there are a bunch of things that are, no one really knows how to secure yet, like computer using agents, which you're referencing.

We didn't ship them. We were one of the, I think we were the second, uh, external company on open AI's computer use beta. We were in the first five of anthropics.

We had access to these models before they were public. And we said, no, no, no, no, that's too dangerous. It's not worth the trade off.

So one of the things you'll see is a lot of our competitors that are more or less a mimicry of our products have kind of championed how they have all these computer using agents that we do not. And we look in that and say, that is deeply insecure, not really that valuable, wildly expensive and wildly slow. I'm sure all that stuff will go away.

I'm an optimist and a futurist, but it's not there yet and it's not worth the trade off. So, um, your question about prompting Jackson is exactly why we don't do anything related to computer use. And as it relates to kind of general assistant usage, we have a five person security engineering team that has been red teaming for nearly a year.

Just those scenarios. And so you're not gonna get 'em all, but I'd think if you stack us up against our competitors, we are ahead of the pack as it relates to security and privacy. And after this deal closes, it'd be even more of a focus.

So how do you envision the browser kind of getting distributed? And I asked the question because so many of the browsers we use today are, you know, they're essentially embedded in the box that it comes in, or you just click on it and it's automatically installed. Um, are you envisioning that average end users are gonna go download this?

Or a company's gonna say, we want a browser that is specific to our work environment and our functions and we're gonna distribute that to our employees? I mean, I think there are a lot of interesting thing, I think this world might change in a, in a world where we're part of Atlassian, but to speak to what we've done historically, what we've found is if you are someone who spends eight hours a day in your browser for your job, then seemingly small quality of life improvements that make your workflows better are enough to get people to switch. So for arc, we, we had consistent organic word of mouth growth that was really from people screen sharing something in ARC and someone going, what's that thing?

And it starts a conversation about arc. Um, so now Chrome Safari, they're trying to be a browser for literally anywhere, anywhere doing anything on the web. And so that means a lowest common denominator product that is very difficult to differentiate because you gotta be a great browser for my mom and for me and my little cousin, we're approaching it very differently, which is say we don't need 4 billion people using our browser every day.

We want everybody that is in this conference hall to that who works in a browser for their jobs to go, oh, this is the professional tool made for me in my job. And that sort of software, as we know from this conference hall and how big it is, is if you make teams better and you make developers and individual workers better, they're willing to switch to new tools and they're not representative of the average Joe. Uh, but that's not who we're going after.

We're going after professionals who get paid to work on their computers. So this new project that you're working on, how far along are you guys exactly? Uh, so DIA is actually available, uh, in general availability today for anyone to download on Mac Windows coming in the next year.

Uh, so we had started working on DIA about a year ago. We've been working on arc, our original browser for three or four years, DIA for the past year. Uh, went into private beta for DIA this past June, and it's just sort of been a, a whirlwind since then.

Um, yeah, when we released it, everyone, uh, I don't think anyone really knew what we had been up to and what's an AI browser and you know, in the last three to four months, you're seeing, uh, the market kind of surround us and, and, and take their own, uh, attempt on the, on the category. So in some senses it feels like we've been doing this a long time, and then you kind of take a step back and go like, oh, we're just getting started. Others are just getting started.

We think that the winner of the space is gonna be crowned in the next 12 months. So I think if we're here in a, in a year, we're either gonna have champagne or it's tears, but it's gonna be a big year and we're really excited to go harder. Are the users starting to come together and be self-supporting?

I'm reminded of the early days of the Mac when the IT department kind of ignored it. So it was just a bunch end users supporting themselves. Is that kind of the same phenomenon we're seeing here?

And Yeah, I'm not. So what we are seeing so far, and one of the reasons again we're in this conference hall, is we're seeing, uh, a, a critical mass of employees at companies independently use DIA and their IT teams where their security teams popping going like, wait a minute, what's this thing? Like, how does this work?

Can we get? And so part, so one of the big things we're excited to, to address with Atlassian is, uh, how do we formalize what we're seeing organically develop, and how do we just go as fast as we can to bring this through as many people as possible? And for us, that always starts with shipping excellent software that is actually useful to people in their day-to-day and have trust and try to encourage that sort of word of mouth growth that comes from the best software tools and technology in your life.

That's a high bar and it's really hard and we don't always hit it. Sometimes we get high on our own supply and like think that we've built something great and we really haven't. But when you, man, when we built this, you know, integration for, uh, your calendar that pulled out video, uh, URL links and made little nice buttons to join the meeting two minutes before the word of mouth chatter we got from that.

Because if you're hopping between meetings all day, every time you're like, thank you ark, thank you Ark, thank you Dia. And so it's gonna be hard. It's gonna be really hard.

There's a lot of competition, but we're, we're encouraged by the groundswell we're seeing. And you know, hopefully this deal closes, we'll be able to go even faster. All right.

Hey folks, you heard it here. The way we work is changing and it, it may be in a browser or it may be we call it something else someday, who knows. But one thing for sure, we're not gonna be watching a bunch of tabs from now on.

Yeah. Hey, thank you very much. All right.

Thanks for coming by and we'll be back in a minute. Hey folks, we're back at Atlassian in Europe and we're here with my new friend San Sean, and we're talking about work and AI and collaboration. How you doing?

Welcome to the show. I'm Doing well. Thank you for having me.

I've been dying to ask you this question since I knew saw you on the list, but you guys have all these tools for collaboration and work, and I just have to ask, is there something wrong with the way we work today? And what is it? Great, great question.

Uh, I would say it's not that there's something wrong with the way we work today, but it's truly true that there is something that can be better. You know, the way we work today is, is tied up to silos. For example, we see all, all of our customers talk about how information is locked up in different tools, in different systems that they're using across their organization.

And bringing all that together can unleash a lot of productivity. Uh, my favorite stat is that, um, almost a days worth of equivalent time is spent per week searching for the right information, trying to find what they need. Oh, who's that person that I should contact?

Where is that information about a new marketing plan? How can I search it? How can I find it?

And that truly is a big inefficiency and coming in and living in the AI world, man, I'm so excited about how we solve that. So what exactly is in the, uh, collection here that you're managing? 'cause there's a video tool, there's something that looks, it's Confluence, I think, and a couple other things.

And then the AI agents. What is that portfolio exactly? Yeah, Great question.

So Teamwork Collection is a, is is a collection of products like Jira, confluence, loom together, deeply integrated to help solve only one problem, which is how do teams collaborate within each other. It's a tool, it's a set of tools for hr, finance, marketing, you name any team, they all need collaboration. So Jira allows you to plan and track your work.

Uh, confluence allows you to collaborate for creating documents, creating knowledge, unleashing knowledge. And Loom is our a synchronous tool where you and I are in different time zones, right? If I wanna send you something, I only two options.

I can send you a long email and bore you, or I can send you a long slack and bore you, but you're never gonna be able to see my gestures, my emotions, how I feel when I'm talking to you and those, those, those tools. But Loom allows you to take a video of this kind of a conversation and set it up so that you know exactly what I'm saying, why I'm saying it. You get the full picture of what I'm saying.

And that's the third tool that is part of teamwork collection. So it's kind of like an asynchronous version of a Zoom call, but I get a message from you and I can understand what you're trying to tell me, and I get all the gestures. Yeah, yeah.

I mean, you get all the context, the full human body picture. In other words, communication is rich, not because of the things that I'm saying, but also the things that I'm communicating through other means. Right?

When we are talking, you can pick up a lot of cues around what I'm saying, the tone that I'm saying, the the way I'm saying it. And that's the full body communication, if you may, that humans do. And Loom allows you to do that.

Now, it is true that Loom started off as an async tool where I can send something to you in the night, you wake up in the morning in your time zone, you can watch it. But now we also have enhancements. So for example, we do believe that certain meetings are really important.

'cause certain meetings is where decisions get made, keyboard gets formulated, right? And, but a lot of people just sit through those meetings without knowing what their role is. So what ends up happening is when the meeting ends, that information gets lost, right?

Because you discussed a bunch of things, maybe someone took notes, right? Right, maybe, right? But the information does get lost.

So now we have Loom for meetings, and what that does is it sends a meeting ai, uh, note taker to your, all your meetings and it'll automatically capture what were the key decision points, what were the key action items, who said what? Who has the assignment? But the beauty is that Loom and Jira are deeply integrated, and so is Confluence.

So once the meeting is over, the Jira work item that you talked about, updating, well, guess what? It's automatically updated. When you show up in Jira, you just press a button saying, yep, I was in that meeting.

Yep. I know we discussed this. Press a button.

The work item is a work item is updated really easily. Nice. Um, You know, to your point about Loom, and I don't think a lot of people really realize this, but when you get an email, it's the tone is really dependent upon the mood of the recipient, not the sender.

So true. And, and a lot of miscommunication as a result of that, because people are, I might be in a bad mood and suddenly I think you're yelling at me when you're just kinda like trying to send me a message. So, um, you know, do people understand that kind of subtlety or is it something they realize after they start using Loom?

Yeah, I think, great point. I think, uh, a lot of people that we chat with, um, understand the nature of what we call full body communication. Meaning it's not just the warble cues, but overall communication that people are doing the hand gestures with the tone how they're speaking.

So a lot of people, a lot of, uh, consumers who, a lot of users who are in companies where that is valued, they pick it up immediately. But for some, it takes time to understand the value of it. So in other words, we, we tell them to try it for certain use cases.

Simple example, I gotta provide a status update to you about my project. Now this event is happening, it's a pretty massive event. Different teams are working together and we need to know, is the venue gonna be ready?

Now I can send you a long slack, or I can get over there and say, man, that part is ready, but this part isn't, you know, and it's kind of dependent on some other things. So you get the full context of the communication through that. So it's a, it's a, it depends on the company, the culture, the industry that you're coming from.

For example, in the us uh, the new generation of employees that are there, they get on Loom easily. Mm-hmm. You know, they grew up in a world where video communication is the norm.

FaceTime is the norm, Instagram is the norm. So when they join the workflows, it is absolutely clear that they don't wanna send an email. You know, they don't wanna write up a giant email and set it out.

They would rather jump on a, on a, on a loom and provide an update share. I mean, even simple cases like bug reporting, all of us encounter bugs in our products. Right now, I have two options.

I can write a long text to say, click here, do this, click here, do that. Or I could just record a loom of the bug that I just saw. It could be on a mobile device.

So Loom has a mobile recorder. It could be on my desktop. It has a web recorder, and you can say, look, this is where I click.

This is what happened. And this is there. I got, that goes straight into Jira gets embedded inside of Jira.

So when the engineer picks that up, they watch the real reproduction of the bug rather than trying to decipher, did Hun mean to click here? Or they, where did he click? You know, a visual communication, I mean, we all know a picture says a thousand words.

A video probably says 10,000 words. Right? It's true.

And, and, and the power of video is, is the power of Luma. Yeah. And one of the things that drives people crazy, especially those engineers, is they'll spend hours trying to replicate the bug.

That's right. Which only probably takes them about two seconds to fix 1000000%. And, and this is the biggest challenge between knowing the details of what you need to do, which is called context, then actually doing it.

If we can solve the context problem where you get to know exactly what's happening, where the bug is, which part of the flow it is, the engineer can solve that problem very quickly. And Loom allows you to do that. We're also announcing Loom for bug reporting.

So if you go to Loom, it can also capture your error logs with it from the, from the screen that you're on. Right? And when the engineer receives it, they're like, wow, I got the video and the details.

I don't have to send them a message, say, Hey, can you send me the error logs as well? It all comes packaged in. And as you know, engineers work in Jira, uh, they have issues to track.

All of this gets embedded right in the Jira work item. So you're not looking inside of Slack or email, where is that Loom? No, no.

It's right there in the work that you're doing. Nice. So we're at this show, and if you walk around, every second booth says ai, right?

So what will be the impact that AI is gonna have on the way we work? And we see all these agents now, are they members of the team? And how do I manage them?

Do I develop a relationship with my AI agent? How's this gonna play out in your mind? Uh, great, Great question.

I think we are living in a world where, uh, human productivity is just getting increased significantly. Uh, I'll take a few examples here. The way to think about human work is that there's always this part of the work that is creative, and then there is other part of the work that is drudgery.

There's things that you just do. Mm-hmm. So that you get the chance to do the creative work.

That's true. Right? So the, the, the phase that we are in right now is that AI is picking up all the drudgery and all the things that you don't ha don't add much value, but it's part of the work.

It's important to do it. Example, uh, we just announced, um, robo has skills of project management, which is basically VO is our AI version. Uh, and what happens is if you're a project manager, one of the things you have to do is every Friday you gotta go clean up Jira and then provide a status update to your boss or this team right?

Now that is an important part of the, your job, and you cannot get away with it. Like you have to provide updates, but it's part of the job that's repetitive, not creative. And there's a lot of people who probably don't enjoy spending their Friday evenings sending their boxes status update.

I asked where AI comes in. Uh, robo has skills for project status update. All you do is ask robo, Hey, I gotta send out a project status update for this event where we'll go and look at all the work items, see what you worked on, what I worked on, whether we were blocked, what are we blocked on?

Are we escalating something? And come back with a great summary of what's happening over more. And all this project manager or the leader has to do is review it, make edits, of course, right.

Add some other context as well. And that part of the work is now packed up to be delivered to the stakeholders in your organization. That's just one example of how AI is going to help us on your question around agents.

We are excited to introduce a lot of third party agents inside of Jira. So for example, Canva, Databricks, and all of these agents are coming to your team inside of Jira. So what you can do is you can assign Canva AI agent in a Jira work, hide up if you're a designer.

Hmm. And what it'll do is look at what image you're trying to create. What size do you want in?

What kind of backdrop do you want in? And it'll get to work inside of Jira. So now instead of me assigning that work item to a human, I can assign it to can my agent, because can my agent is now part of my team and it can spit out that output right inside of Jira.

And I never left Jira to get the work done and my productivity increased significantly. The last thing I'll say is humans now, in my opinion at least, are getting freer and freer to do the thing that they do best, which is creative work. You know, all the drudgery around that can now be, uh, uh, so to say delegate it to AI as well.

So AI is gonna help us improve our productivity, unleash our creativity. The bottleneck no longer is execution, meaning can I write this code or not? Because AI is gonna help you with that.

The bottleneck is now human imagination. How far can we think, how big can we think is that is what we are thinking the right thing or not? 'cause AI can come in handy for everything else.

So should I start thinking about my work and start delegating it in certain buckets that says things I like doing, things I don't like doing, and I'm gonna give it the things I don't like doing to any number of AI agents. Yeah, I think that's will be a great starting point. But what the right recommendation would be that before you start doing anything, ask yourself the question, how would I do it if I had an AI teammate?

'cause the default training of the brain has been, how will I do it right? When we wake up and say, okay, I gotta write a market report, I gotta write a strategy document, I gotta write it. Mm-hmm.

Right? But if we start changing our framing to say, okay, I got all these amazing AI teammates on my team, how would I solve this problem leveraging ai? And sometimes AI can do the pre-work for you.

So for, in my case, I keep an eye on the market a lot. What's happening, what's, what AI announcements are happening, what are people doing in the industry? And that pre-work for my strategy thinking is equally important for me as the strategy.

So my agents run in the morning, get me all the information that I need to consume to be able to make smarter, better decisions. Now that's a new way of thinking about my job. Sure.

So coming back to collaboration, if I have AI agents and you have AI agents, how will our AI agents work together to do something? Yeah, great question. Uh, I think, uh, uh, uh, every company, as you know, is creating agents, you know, and, uh, they are, they, they are inside of Atlassian ecosystem.

So I mentioned third party agents like Canva, but also inside of Atlassian. You can also create your own custom agent by going to Atlassian studio. So I can create a PRD agent or a market research agent that does this work for me on my behalf.

Over time, these agents need to talk to each other, just like humans talk to each other, to truly be a teammate. And there are lots of innovation that are happening in the industry. One is between third parties, there is the MCP server.

You might have heard of MCP server model context protocol servers. We have announced RMCP server, so anybody could integrate with it. For example, yesterday I announced a partnership with Lovable and Confluence, where you could be in lovable and you can take the Confluence product requirements Doc and lovable will then turn that into a prototype.

And once the prototyping is done, it'll take that prototype and embed it back inside of Confluence so all your stakeholders can see, here's the product requirements doc and here's the prototype going along with it. That's possible. Now, because Lovable and Confluence can talk to each other using the MCP server, Aren't we kind of, uh, in a new era of ai?

I know AI is relatively new, but I feel like we just went from copilots now agents and it's, it's a radically different way of thinking. 'cause with Copilots, I had to know a fair amount about prompting and I had to get a, uh, some skills there. It seems like AI agents are just gonna make it a lot simpler, and I just kind of say what I need and I don't have to be become a super prompt engineering expert.

That's right. I think you're absolutely right that we are entering a new phase, um, using some, some terminology. The phase, the phase one or the first part, the phase was I'm doing something.

Co-pilot comes and helps me complete doing it, right? As an example, they were coding co-pilots where if you're type typing code, it helps you complete that. It can write the function details based on what you're trying to do.

But now we are entering the world, and by the way, that was true for, um, uh, uh, uh, collaboration in terms of creating content as well, right? You're writing content, it can come in and parse that paragraph, rewrite it and all that good stuff. But now we are entering a world of agentic ai where we need to reimagine not just what I'm doing and how AI can complete it, but rather how can AI solve core, core parts of my job in a fairly autonomous independent ways and how I can benefit from that.

In other words, we're going from a world where humans used to create and AI used to complete, enhance to a world where AI is going to create and humans are going to edit and combine. Nice. It's a fundamental mindset shift where agents can come in and work together to create part of your job that is really high quality output, really good things that you need to get your job done.

But then the human comes in the loop in the end and says, okay, I got my market research done through agents. I got competitive research done through agents. Now I can combine all of this stuff using my creativity and tie them together to get to the output.

So we are living in an agent AI world. You will see everybody talk about agents including Atlassian. And we have amazing set of tools that allow you to take every part of your work and turn them into agents that matter to you.

Hmm. Interestingly enough, you know, we see all these reports about these so-called failed AI projects, and I think MIT probably has the, the most widely known report on that. But as I listen to you, maybe the way to go after AI is a lot of smaller things that, you know, that the AI can help us with that might make a bigger difference than some of these, you know, home run type projects that people tried to do and maybe AI is not quite ready for.

Yeah, I mean, there, there are definitely cases where I would encourage everybody to start with, which are known out, uh, positive outcome cases. And then there are experimental cases as well where you should apply ai. So I'll start with the first bucket.

All of us write content, create content of some. So, right, if you're a marketer, you're creating marketing plans. If you're a product manager, you're creating some product requirements, doc.

And if you're an engineer, you're also completing and creating code in that category. AI is producing tremendous amount of returns. It's a, it's an area which is very well understood by now, and you can start using those kinds of AI tools to help you accomplish that.

For example, robo Robo can help you write code, robo can also help you provide status updates that I just talked about. And robo can also help you manage your Jira space. And you don't have to man manually manage that.

Those are areas that are going to improve your productivity significantly. But there's also an experiment to set up, uh, um, areas that I think I would encourage customers to try out. For example, uh, setting up admin tasks in Jira can now be done with AI significantly.

Well, so you are a Jira admin and you wanna manage the permissions, the access and all that stuff. AI can come in handy very well over there as well, right? Uh, and when you talk about agents, the ability to create no code agents, meaning literally by prompting, and you can say, okay, this is what I wanna do.

Right? And you no need to know any code is extremely powerful. Yesterday in the keynote, we demoed how you can use Atlassian studio to create a app for Jira without writing a single line of code.

Now, that would've required your IT team to do a bunch of coding. You know, similarly, we just did a podcast where we talked about how Atlassian human resources team is using agent AI to onboard new employees. So every new employee that joins Atlassian now has an agent called Nora.

That individual can talk to Nora and get all the answers around their onboarding. And the best part is personalized. So if you're in legal and I'm in HR or finance, it's personalized for our onboarding, because your onboarding is probably different than my onboarding.

You need legal context, I need HR context and all of that stuff. Nora manages that. And guess what?

It was written or it was created by two individuals in HR organization who have no idea how to write code. Hmm. Previous to AI that would've required working with the IT team, getting on their backlog, creating code, publishing code, testing code, and all that stuff.

In the world of AI onboarding is something that every company does, but onboarding through agent is a now a proven playbook that our customers and everybody can apply because you don't require any coding skills, special skills. And by the way, our HR team feels very proud of it because they did it without requiring any help, which is an incredible, uh, milestone in my opinion, you know, Which is all sounds pretty amazing. Hey folks, you heard it here.

AI agents are gonna be your new best friends at work, and maybe you might actually enjoy work a lot more than ever. Hey buddy, thanks for coming back to you. All right, and we'll be back in a minute.

Hey, there, survey says, widespread adoption of AI to improve DevSecOps. You're watching Textron Gang. Welcome to Textron Gang.

It's Friday, the week is finally over. I'm John Swartz. I just got back from Las Vegas at Oracle AI World and I'm spending the day at Dreamforce.

Uh, I had to spend most of the day there, so it's been a long week. And, um, with us, uh, we have two great guests. We usually have on Thursdays we have Ira Winkler Za of, uh, cybersecurity, and Fred Wilman, who is our DevSecOps expert.

Mike, uh, ARD is still in Europe as far as I know, and Alan is somewhere in Texas. I think he's driving north. That's the latest I've heard.

Um, in any event, I'm back in Silicon Valley and we're gonna start off with a survey that Mike Vard wrote about in Dev DevOps on our website. He, uh, looked at a global survey of about a thousand IT professionals who are responsible for application security, and he found that, and it found that three quarters are using AI with another 13% considering adoption. This is like a very interesting turn of events and it's something that Fred knows a lot about.

And I'm gonna turn it over to Fred and maybe we can riff, especially between Fred and Ira about this topic. Um, Fred, what did you, what'd you make of it? Well, I think, um, first thing is, you know, a thousand folks, probably not statistically significant in the DevSecOps universe, but what I would say is, uh, this illustrates the point we think we already know, we've been talking about a lot.

50% of the universe is adopted AI in some capacity. 50% of those folks are using it effectively. In this case, uh, what we're talking about is how do we rely on a software development lifecycle to get to a place where we're managing vulnerabilities in the software development lifecycle, not the deployment lifecycle.

So when we think about the statistics of what happens in the, and the, and the notion of what is the faith in AI versus regular engineering developers, right? Some of the metrics we use to gauge engineering, uh, quality right, is the number of vulnerabilities, uh, that, that our code ships with the rate of fixing our vulnerabilities in code we've deployed. And you know, here what we're doing is we're talking about sort of enacting another set of developments, uh, requirements that may or may not think about the code practices of whatever organization they happen to be at.

So what's interesting about it is that the theory that AI produces more of vulnerabilities is a good one. Um, but the important part of that is that the rate of change with the current construct is people are adopting it anyway because the requirements are such. So they may not trust it, but they might implement it in this particular case.

And so what they're doing is they're also starting to orchestrate other ways to use AI to automate the process flow of determining what they need to remediate. So let's imagine today, and Ira, IRA and I, and we'll talk about this, right? Uh, let's imagine today that most companies have, I don't know, 10,000 vulnerabilities, right?

Broadly distributed of that. There's a small percentage of really critical ones of that. There's a larger percentage of ones that might be high from a a, a, a criticality perspective.

A lot of those don't get patched for any number of reasons, but the critical moments of those are what if those could be passed before they became what they are? And do we need to have the persistence of those types of exploitable vulnerabilities, something be, become part of our operational security problems? So my advocacy here will be this, right?

We have tracked over the last two weeks, uh, 10 different, um, ODE exploits dropped in five or six different products. Uh, that's almost one every other day. And more than half of those are CEEs.

So keeping pace with what the rest of the universe is doing from an adversary perspective, it almost doesn't matter whether or not you, you trust ai, the simple as scalable problem of not being able to patch as much and production as you really like to, you have already, we don't do a great job at hygiene. Why not? Is really the question.

Yeah. 'cause I would actually have to add to that because usually I'm critical of people using the term ai say they're using ai. 'cause it says like 77% of people used AI as developers.

I mean, frankly, it's a hundred percent at this point, right, exactly. Don't realize. Exactly.

Yeah. I mean, I set my alarm with AI by saying, Siri set my wake up alarm for 8:00 AM and people are not understanding how it's embedded in what they're doing. But in this case, what I'm looking at and reading, assuming it's correct, is that they're actually using tools which are automating the patching of software, reducing the likelihood of vulnerabilities and so on.

Because a lot of vulnerabilities, again, a little tweak here and there, you know, makes a big difference between a major crash and like a, a perfect program. And so in this case, what they're doing is assuming the tools actually work, we are really going ahead and using ai. And I hate, again, AI use Dr.

Evil quotes. I know in ways it's supposed to be used, and that's the most critical factor that we need to understand. We're using it in ways that, again, it's a mathematical algorithm to fix the software and people are using it to speed up fixing of software.

You know, can I, should I draw any conclusions? There's this one statistic that is kind of jumps out at me. It was that a third of these people who were told said that more than half of the, their application security issues identified by al AI tooling are now acted upon without human review.

How is that, is that fairly significant or does that surprise you at all? If, if you said that was 75%, I'd be shocked. But again, let's look at this backlog of vulnerabilities, right?

If, let's imagine there's 10,000, okay, at least half of those are easy, obvious, simple, not intrusive, right? In the way of code. So I would think about that as, okay, the lowest hanging fruit is easily gathered, and that's probably exactly what's happening here for things that we know, but it's the process of remediation that's painful, right?

When it's already, uh, when it's already pushed out into production. So I think that's a healthy statistic. Uh, i, I I agree that it's probably the right sort of metric, the difference between, you know, 50% and 80% is really significant.

I think that's gonna be the interesting point there. Uh, I rev I'm gonna ask you again, and I, again, I know you, I know I, I know about your fix, I know you about your AI fixation, and then I agree with you on many, on many levels. Um, did, did, does.

So in a sense, can I just ask a question that this is something that always goes through my mind whenever we talk about security and as kind of like a last measure with the whole issue of, of ai and based on some of these survey responses, um, is it, is it, is it, is it going to make, is it gonna make the job of security professionals easier? Or is it gonna add more headaches in the, in, in, in the immediate, in the immediate term. So in the first place, I hate surveys because a lot of surveys are done for marketing purposes.

Yeah. This was, I mean, I'm not saying, I'm not gonna say that about this survey, but they're always self-serving and they're almost always self-serving and they're provided by a company that's selling something to solve the problem that they bring up your rights. Well, well, I don't necessarily disagree with that, but so most surveys, they ask people questions that are poorly defined.

Like again, saying, do you use AI in softening software security? Or to do whatever the answer is? Yes, no matter what.

The answer should be a hundred percent given how AI is embedded in just about everything we're doing, because AI is really parts of many infrastructures to begin with, but they need to better define what they mean by ai. They need to better define what type of ai. In this case, when I read the report, you know, I was like, okay, they're actually using AI in the right ways when they're talking about, okay, automated patching of software.

That is not something that is a nebulous function of ai. And again, I do think a lot of surveys are causing problems and everybody's all of a sudden saying, wow, everybody's using ai. I should be using it too.

Or nobody's using ai, I shouldn't be using it. Again, the fundamental question I keep coming back to is what are they describing regarding AI in the case? And I care more about a function than I care about the word ai.

If they're talking about automated patching, by definition, that's gonna be some form of AI algorithm embedded within a software tool that they're using. And so I wish they would say, are you using automated patching as opposed to using ai? Because AI right now is just a buzzword that's poorly applied and interpreted by people who have no idea what AI means, right?

Alright. That, that seems to be applying to a lot of the companies. They were doing some of these conferences.

I'm not, I'm not gonna specifically finger, uh, Oracle or Salesforce, but I mean, it's just, it just, uh, you know what I mean? It's just like it, these used to be called, uh, Oracle Cloud World. Now it's Oracle AI world.

I mean, I, I, my eyes glaze at these things. Hey, Fred, do you have any, uh, final thoughts on this? Uh, we we're gonna move on to the next topic, but I wanna let you get the final word in.

Yeah, just real quick. I think the, the, the way that we talk about this is, is also the way, the way that we talk about our concerns about ai, right? And I'll use IRA's, AI quotes in here.

It's the same way we talk about some of the things that are, if, if we were a VP of engineering at any company, right? If we're saying that some of the concerns we have about AI is integration complexity, okay? That's every tool on the planet, uh, 46% lack of trust in results, 36%, okay?

As a architect, I might find that to be also concerning about my junior devs poor explanation of security findings. That's every product in the market, international, or excuse me, skills gaps, right? Again, junior developers.

And that regulatory or compliance concerns accounts for 33%. So that sounds like a very normal distribution to me of the same sort of, uh, shenanigans that I would have, right? As a CISO at, you know, said company with a, a VP avenge that would have the dialogue about where's making the fix?

And here's the critical part. Security folks aren't fixing these vulnerabilities, right? That's never really the way that it works.

Always engineers. And so when we think about that, that's important to understand that we're also crossing over some of the capability places that normally we would have infighting about. So I think if we have normal statistics and we have this conversion that's happening here, I think it's terrific.

You know, uh, despite our kind of, uh, hesitancy around surveys and our, our wariness, I think this one was an interesting one. And, um, it bears, bears watching. So, um, enough on that, uh, we're gonna be coming back with a field report from Ira on cruise con, uh, in a second.

I can't wait to hear what happened on the, on the, on the water. Uh, we'll be back in a moment. You've Earned it.

The spotlight, the responsibility, the weight of teams, companies, and entire industries fall on your shoulders, lives depend on your decisions. Your home life included that work. You are protected physically and digitally.

Nothing gets through your team without a fight. But in a globally connected world, everyone sees you, including those who mean to cause you and your organization harm. And now home your sanctuary attackers see an opportunity.

Your digital front door is wide open. And what compromises your home can breach your boardroom. Because the devil's greatest trick isn't targeting your workplace firewall.

It's convincing you that your personal life isn't at risk. Black clerk, digital Executive protection, defending the new attack surface your personal life. We're back with the, uh, B block.

And, uh, IRA was just on a cruise con, which I, I'm very, I was always interested in this. So this is something that you organized. Maybe you can tell us a little bit about when it happened.

I think you're at an airport right now. Are you, are you co are you returning home or are you going somewhere else? I'm just trying to figure out the logistics of your travels.

Um, nah. Yeah, cruise con ended, um, uh, it was Octo, well, the last one, cruise Con West happened October 2nd through sixth. And now I am flying to Minneapolis to speak at an isaka event today.

So I just happened to be at the airport and I rushed to the airport and of course found out my flight's an hour late. So anyway, um, ah, dear. And I could have taken this from the sanctity of my home anyway.

Um, yeah, but Cruise Con, the way I came up with it was, you know, I was, I've been chief security architect of Walmart Chief Security Strategist at hp, and in those position positions, you get invited to events most people don't know existed. Like some people might see, for example, the teammate events because they promote those and you know, where they're sitting in a mud bath in the Florida Keys. And anyway, what happened was, the thing about those events is content kind of okay, content, sometimes original, like for example, wing Capital, awesome events bring in top people from, you know, top companies like running their ai, running their economics groups and stuff like that.

But what I tried to do was, I mean, I'm sitting around in the desert with these Fortune 100 CISOs and I'm thinking, we are the last group of people that need something like this. You know, for all practical purposes, fortune 100 CISOs make a lot of money. They have all the resources in the world, but they also have access.

Like, you know, I used to joke I could pick up a phone and get like the CEO of Microsoft on the phone. Probably true, but not that I would ever do it. But what I thought what needed to happen is to recreate these events for the average cybersecurity professional so that they can grow and not just take advantage of this if they hit the pinnacle of the career.

So I created essentially a retreat style event where I bring in top speakers who usually speak at some of those events, and I put them in an area that's kind of like a nice a-list area, in this case, Royal Caribbean cruise ships. And we, you know, and the content is there, but more important, it's the networking that happens and, you know, so people are like developing long-term friendships because you have nowhere else to go. I mean, it sounds bad, but it's good.

So what are the rules? Can I interject? I have to interject.

One of the rules I have as a reporter, and as the, I'm speaking as a reporter, never go on a boat. So I was offered once a couple of times to go on Larry Ellison's yachts. But even, even as much as I was curious about the idea as a press, as a reporter, you can't get off.

You're trapped. But in the case of your case, uh, these are folks who wanna be together, who wanna network, who want to have some, uh, relative serenity from the chaos of a trade show. Well, just for example, I mean, the vendors don't have, if the vendors are aggressive, we can kick them off, you know, or kick them out.

And that's one thing. And frankly, a vendor on this, if they have five days to network and get to know, develop a quality connection. And if they can't do that, they shouldn't be a vendor.

But, you know, so they don't have to be aggressive, frankly, they're, they enhance the experience by buying people more drinks and stuff like that. And just to the point on the next, on Cruise Con 2026 in February, we're gonna have Chris English talking about the first time that I know of Edwards Snowden's incidents and treason. And that's gonna happen on Cruise Con 2026 on a boat.

And if reporters want to come, they have to get on that boat. Now that's worth, that's worth going on. Okay.

Yeah. So we have that. But, you know, fundamentally, I mean, we have a retreat style.

It began with a C de in this case, a deputy CISO asked me anything. 'cause the first one, and, and the next one we're gonna have a CISO ask me anything. But the feedback we got was that it was awesome, and we had to redo the event, you know, redo the panels.

But the feedback was that for the first one, ciso, these hearing from these Fortune 100 CISOs was great, but the, a little bit of the information wasn't relatable. So I went with Deputy CISOs on the Cruise Con West as it was known, and people got a lot of good insight on how to get to that level in their career. And then we had the, the next day was, um, Bob, uh, sorry, I'm so bad with names.

Bob BigMan, who was the former CSO of the CIA, and we had him talking about, you know, when these people leave the government, they do more work than when they were at the government frequently. And he was talking about from doing assessments and stopping nation state attacks, what works and what doesn't. And frankly, a lot of the things we think work don't, and a lot of the things we think are a waste of time are the most valuable things.

And that's what Bob highlighted. Then we went on and we had people, for example, like Tim Youngblood, talk about agent ai. We had, um, John, what did he, what did, before you, what did you think of AG Agentic ai?

Because I, I'm starting to get so many different opinions about it, good and bad. Well, agen AI is the way things are gonna go, whether you like it or not, like we spoke about in the last block, everybody's using things, but even what was happening with automated patching of code is essentially a agentic ai, where an AI does a function without, per se, too much human intervention. And these things are gonna happen.

They happen all the time. A self-driving vehicle is essentially just one massive agent. AI and a lot of other things, like, you know, essentially it's an AI doing calculations and making decisions.

I'm oversimplifying it, but also being able to enact on the de or act on the decisions without a manual intervention. And these things are happening and they're gonna continue to happen. So that's one thing.

And then we went on, we had, um, ironically, and we'll talk about a little bit in the next session with like Will I am, but we had Dan Meum, who's the CSO of Legendary Entertainment. And you know, he, in other words, he's, he's actually the CSO, so he does the red carpet security along with all, like the transmission back of like, you know, dailies and stuff like that to the studios and editing pods and things. And, you know, he was telling us a little bit about hanging out with Tom Cruise and stuff like that, who he says is an awesome person.

But he was talking primarily about how he made a cybersecurity program, a profit center. 'cause during the pandemic, when they didn't have movies to secure, he ended up taking his team and using AI Dr. Evil quotes, um, to start to see where pirated merchandise is being sold.

And then he Star had his team start tracking down the pirated merchandise, and then they went a legally went after the people, and they're making millions of dollars for legendary entertainment, taking it down, merchandising Ping for both their studio and ironically others. So, you know, he spoke about that. We had, uh, I, the, the most engaged session, ironically, 'cause at my time at Walmart, it was pro, I always thought what made Walmart's program exceptional was project management and how everything was controlled, monitored and stuff like that.

So I had my, um, co-author on my book, you Can't Stop Stupid Tracy, who's like a guru with project management, give it. And she's like, I hate you because it's the most boring subject ever. But she had more questions than Dan Meam had about Mickey movies.

So that gives you the idea of some of these mundane topics that are really so critical. They kind of come to life actually too, when you bring people together who are the experts, and they ask interesting questions of one another that maybe they kind of think outside the box of what they normally the box they're normally in. Well, the, the problem I will, well, the issue is, is that when you get together and you actually want to talk practicality, these mundane topics like, you know, Bob, big Man's presentation on vulnerabilities, mundane topics are more important on how do we perfect the mundane to make our cybersecurity programs the best they can be.

So anyway, besides this Jar Beason spoke on, you know, personal branding, I'm gonna embarrass myself. 'cause it's hard to remember all the other people that I had, um, at any given time. But, you know, know we had, I mentioned John, is this Yeah, go ahead.

Is this gonna be available for people to Oh, yes. Good question. Thanks for the, so yeah, actually, ironically with Text Strong, Alan sent the film crew over, or a camera crew, as I should call it.

We don't do film, and we're doing Cruise Con virtual, I think it's November 6th. So hopefully you'll be able to get the link there. And I think we offer that for free.

So people will have all these sessions, except for one, one of the more interesting ones was, oh, Amar Amar iv, who used to be the lead hacker, not the person who ran 8,200, but the actual Hands-on Hacker for 8,200. He spoke about apps and he gave a session, which he wasn't sure how much was classified and how much wasn't classified. So he didn't want that one recorded.

So anyway, that's, um, an example of what we're having with the exception of Amer's thing. But again, Textron go to Cruise Con Virtual, and eventually it'll be pointing to that hopefully tomorrow when I get, or by, by the time this airs, when I get the link. And we are doing cruise.

Yeah, go ahead. Oh, no, I was gonna say you, I we're kind of running outta time, but I wanted to say you did a really good job of in, uh, getting me interested in this because I, I really don't know. I hear a lot about it.

No, I'm serious. I hear a lot about it. And my, my eyes usually glaze over, not not about Cruise Con, but just like a lot of these events, there's too many conferences and we're in the middle of conference season.

This sounds though, really useful and interesting. I mean, I, I would like to find out more about what all these folks have to say and their experiences. com and see the 2026, and if you go by, well, Friday the 17th, probably until the end of the weekend probably, but, you know, west 25, we'll get you a 25% discount.

But, you know, really, I mean, I'm not a fool when I put this together. CISOs of Fortune 100 companies can get away with having a mud bath in the Florida Keys. The average person who I'm trying to get is not, is gonna have a much harder time.

And so what I did was I purposefully created content that you could get nowhere else. And I called in favors, I called in friends, I, I attend so many events, I know you know who the best are. And that's who I've recruited for these events.

All right, that sounds good. I, I, again, um, thank you for the, for the field report. I, we, we appreciate it and we're gonna move on.

Well, you mentioned Will. I am. And so we're gonna move on to the next segment and talk about, uh, he does, he does, uh, of several, several interviews a year.

I talked with him last year at Dreamforce, and I did again this year. He has some interesting insight into AI generated content, music and regulation. And we'll talk about that in the next segment.

So we'll be right back. Discover Textron Group, the epicenter of tech innovation. We are your go-to for reaching IT, leaders and practitioners worldwide.

Our secret impactful content that sparks awareness, engagement, and top quality leads with us. You'll access editorial websites, streaming videos, virtual events, custom content analyst research, and more. Join our satisfied clients.

Let's revolutionize your tech journey. Contact us today and tell your story to the world in the most powerful way. With Techron Group.

Welcome back on a Techron Gang of Will. I am is a fixture at the Dreamforce Show in San Francisco. Last year, I was lucky enough to talk to him about AI among other things.

This year I wanted to talk to him about content and, um, his thoughts on generated music actors, et cetera. He seemed generally open to that idea, uh, but he kind of pulled the, the, the conversation back and wanted to talk more about how as amazing and as awesome, pretty awesome, as he says AI is and what it can do. His big fear is that the social media business model's gonna be applied in the agent space, which he says is gonna lead to all sorts of, and I, I can't really, I can't say what he said, but it starts with the letter F and ends with, ends with letter K.

He says, we know, we know what happened with social media. I'm, I'm afraid to unchecked this is gonna lead to human greed. It already has that will once again f it up.

And, um, it, it, it's interesting, he, he also made a prediction about where we're gonna be by the year 2030 in terms of what we can do, how, how much more, um, interacted, interactive we will be with the, the content. You'll be part of the content. So what I wanted to do is, I, I'm interested in both of your opinions, but especially I wanted to start with Fred, because Fred knows a lot about music based on conversations we have before the show.

He's our music guy up in Seattle. And I'm wondering, given your thoughts and your expertise in, in the creative side, and, and I I'm sure you probably know a fair amount about Will I am, what, what do you, what do you think of kind of his thoughts and where do you, where do you think the content is going in terms of generation? It's a great question.

It's a really cool, uh, construct to, to sort of discuss. I think we're gonna start to see, so, you know, today we already have the music genome. We already have the, I can match beats on, you know, pick your platform.

Spotify, apple Music, uh, band camp, uh, I guess I should say, uh, what was that? One starts with a p that's still around, but shouldn't be. Uh, when you look at, uh, Pandora, when you look at all of the ways that music is constructed together today, it's really not a creator's market anymore.

So you've got some diversity in how, you know, like Bandcamp for example, and SoundCloud and some other things are allowing, you know, direct interactions there with the concern of the likeness and the iteration. The feedback loops are, oh, I like the sound of that particular thing. If I say those words out loud, right?

In essence, AI gin me up 15 songs that sounds somewhat similar to this based on a thing that I liked and produce that for me, give it back to me. And so I believe what's gonna happen is you're gonna start to see a lot of the flooding of what sounded like the pop top 40 right? In the last 20 years.

And you're gonna get an ecosystem of adjacency here. And the interesting question will be like, what is new and different? And can you do new and different anymore?

Right? They don't make music like they made it in the seventies, it's not possible to do that again. And now, right?

Are we going to simplify the context of what music streams are and music and artistry, or is it going to become overly complex, but easily imitable? Those are the questions that I have. I think it'll be interesting to see what happens.

So there, there, uh, I I'm gonna, I'm gonna ask you, uh, IRA a question, but there was a guy, I was on a podcast, it was a couple years ago. There's a guy who used to tour with Pink Floyd. He played saxophone and like Ira, I forgot his name.

Uh, I think his last name is Page, I think it's Scott Page. But anyway, we were talking about the creation of music, and he told me that he had heard music that was created through AI that he thought was as good as anything he'd ever heard. The only downside he said were the lyrics.

He said they were really simplistic and pretty cliche written. But, um, I'm just wondering, IRA, do you think, and maybe Fred, you can mention, you can weigh in, we're gonna see like a new kind of, and I, I mentioned this to to, to Will. I am, and he kind of scoffed it, but whatever, I'll, I'll mention it to you.

Are we gonna see like in the AI age, like something like the Monkeys or the Wiggles, like some prefab group that was created out of, out of nothing, uh, where these are not even humans, they're just avatars or creations and that, that become hugely popular? Um, I think we will, but I think there's a factor, like with the, the, the monkeys and other bands like that, like in Sync is an example. I think part of the issue is, is that these bands Yes, you, you know, we have, I forgot the name of the, the the new female actress that they have.

That's all completely ai. Oh, Lily Norwood. Yes.

Yeah, Lily. So we have, yes. So we can talk about her.

The reality though is, and you know, I was joking 'cause I give these presentations making fun of ai and you know, some of the headlines I pull up, like I now have an AI boyfriend. The reason that's critical is that with these ais people or teenage girls don't have the impression they could ever meet these people in real life, you know, and there is something about going to see them in person. There is something about it that's gonna be missed.

You look at a lot of these people and you know, some of them kind of mediocre. I recently went to, my wife took me to a Billy Idol concert, and frankly, you know, getting an appreciation for that, there's nothing like a live show, a great deal of money, millions of potentially with Taylor Swift, billions of dollars is generated because of in-person shows that you're not gonna have until at some point they, maybe they create robots or something. There's, hey, remember they did that one era like Fred Wright with that, the holograms, like Yeah, yeah.

Objective images on, on stage. I mean, I'm not sure how successful that was or is We, they apart that and homage bands as well, right? Like Freddie Mercury on stage and uh, you know this Yeah, I was thinking of Freddie Mercury Exactly Right.

Michael Jackson, so on, so forth. But it's, you're, you're missing a certain aspect of the business of this. You're not gonna have these artists going out and, well, I guess maybe we'll have these fake interviews.

'cause I see them interviewing that stupid robot that they were having a while ago. I can't remember it, like from the, from X machine of the same face type of thing. But, um, you, there's a certain element that's gonna be missing.

Yes, you can create music, but there's, it's still a business. And until they cut segments of the business out, they're still gonna prefer live people, in my opinion. So, So let me, let me counter that.

All right. I agree with you. But the notion of what Live People is can be different, right?

So, uh, if you are a, a Daft punk fan, okay, there's a movie that Daft Punk did that was about a producer, okay? That went to some place out in the universe and captured this amazing talent, right? And brought it back to Planet Earth and, you know, fully put these folks in chains metaphorically and made them do the thing, right?

The viability of producers creating produced music that have the same capabilities of, you know, like 98 Degrees and Backstreet poise and the K-pop bands that are out today, I believe that's a hundred percent viable. All they've gotta do is go get Milli Vanilli or go get, you know, so on and have them play the role in whatever concert, in whatever capacity. And that's it, right?

The money is in the shows now because the money isn't in the music, and all you've gotta do is get enough music, attach ability in order to have show to generate that revenue. And you might not even need artists to do that anymore. That's my worry.

Well, I, I, in some cases I agree, I still don't know what was wrong with, with Milli Vanilli. I mean, I know that's gotta be like a blame, blame it on the rain. But, but, but I mean, the fact is, you got people who got up, gave people an experience, the music was real.

Maybe those people on stage were lip syncing, but people paid for an, you go there to pay for an experience, it's like, oh gee, I was fooled. Like, get a life, you know, you felt good at some point, you know, sometimes I also think, I mean, the sphere maybe is part of this, maybe I'm wrong, but this idea that you perform and people I know who have seen you two or the Eagles at, at the sphere tell me that the experience, the music is fine. It's good.

They, they love the bands, obviously, but it's, they are like little props on a stage of, of a much larger entertainment. And I wonder if that is some somewhat of the appeal, why? I mean, the Eagles are still playing.

I was just in Las Vegas, they're playing through the end of January. Um, and, and I know, I know they have a huge, huge fan base, but I also wonder if that also brings in this new generation of fans, folks who may not normally know anything about the bands. Well, I think you're gonna, I mean, so here's the issue.

What do you, what is this entertainment for? And part of it is the sphere could have done this without the Eagles themselves, just using your example. Yeah.

But the reality was people want to go to see them. I mean, I was in Las Vegas, this is gonna, okay, so I was in Las Vegas to see, and it just happened, I was walking by the park, MGM where they have the arena, and I see all these like 40 ish, you know, all these women like lined up and I'm like, what are you lined up for? And then they go, the Jonas Brothers.

And I'm like sitting there thinking, oh my God, this is pathetic. But, you know, then I end up going to Billie Idle with my wife. I don't know, which is more pathetic.

But the reality was that people wanted the experience of seeing these people live. And we need to accept that, that there is some element of people wanting a connection. Yes.

People wanting their fantasy. And you, and if you know it's not real, you're not gonna have, sorry, I'm stereotyping, but you know, it's true. You're not gonna have these teenage girls and women fantasizing over an AI the same way they are mm-hmm, mm-hmm.

About getting the Beatles and passing out when they hear them sing or see them in person or whatever. Even though I think that was fake. But we need these experiences.

People want to have this connection that I don't think is gonna go away anytime soon. Yeah. You know, you actually, I'll give you a little prop.

So I saw Billy I twice, and I believe his song Eyes Without A Face was Song of the Year. One year I, I believe he wrote it. So, I mean, you know, he, he's a talented guy.

But I think we, I, you know, actually I think we're running out of time. Uh, I, God, this is weird. We started talking about DevOps and AI tools and now we're doing cruise, Billy I, and in between we were talking about, uh, the CIA, this was a, is, uh, varied a conversation, I think I've been a part of, uh, in this show since I've been here.

So I wanna thank you guys. You guys are, uh, you have a wealth of knowledge and that's what I find so interesting about you two guys. You know a lot about a lot of different things and you have very interesting, insightful opinions, and that's what make the, makes the world go around.

So, um, thank you for your insight today. Uh, I'm John Sorts. Um, it's been a long week.

A lot of trade shows this week. We're so happy it's over. Um, and, uh, we have a lot of programming and a lot of the, a lot of the, uh, content that Mike produced from Amsterdam and Barcelona, a series of interviews is out there as well as Alan's trip to Houston and Qualis.

So stay tuned for that on Techstrong tv. Um, for now, that's it. We're out.

And, uh, have a great weekend. Hey everyone, welcome back here to Tech Drunk tv. You know, I'm so happy to have my next guest back on.

He, it's been, as I said, when I first saw him on before we went live. It's been a minute. Um, if you're familiar in the DevOps space, you probably have heard the name Nigel, Kirsten, Nigel of course, was a long time executive at Puppet and probably best known there for their state of DevOps survey and report, which was a, a fixture, an anchor of, of the DevOps space.

But like many other, you know, nothing stays the same in this world except AI investment maybe. Um, but you know, Nigel's moved on and, uh, has it been about a year, a year and a half now at your new company, Nigel, and they've recently undergone some rebranding and changes. Uh, we're going to hear all about it, but let's say hello to Nigel Kirsten, chief Product Officer at Up Upside.

Hey, Nigel, it's good to see you, my friend. Hey, Alan, it's good to see you. I think it's been a decade or so.

We've been chatting on and off these days. I describe myself as post DevOps, Like, yes, okay, post DevOps. That's fair.

Do we live in a post DevOps world? Absolutely. But you know, the funny thing is, is it's not that DevOps went away or anything, people still practice all that, but the missionary work there is over it.

It's very sort of mundane, you know, this is how you do it. Um, and people like you, you need new missions. Yeah.

So let's hear about your new mission. Sure. So I'm Chief Product Officer at UPS Sun.

Up until about two weeks ago, we were known as Platform sh so originally a French company, massively multinational. These days I think we're in 60 or 70 different countries with employees, a hundred percent remote. Started off as a platform, as a service focused on open source CMS and e-commerce solutions.

We still do those things really well. Drupal, WordPress, Magento, all of those sorts of things. But we've now expanded out into the cloud application platform space much more about giving developers a really robust cloud application to deploy their apps onto.

And I think if we, if we're gonna draw a line back to I think the DevOps world, the thing I think I'd realize was that one of the mistakes I think we made early on in DevOps, because we were all ops people who liked to write code, was thinking dev devs wanted to do ops. And thinking that, you know, surely if we make all these things accessible via APIs and programming languages, developers will just want to take on doing operational work and we'll have these happy little cross-functional teams doing things. I think, at least in my experience, what we're seeing is that really devs just wanna be able to ship their applications and have them be secure scale and be in the cloud somewhere.

And that doesn't mean they necessarily want to sit there writing Ansible or Puppet or Terraform or anything like that. Or, or be security advents for Yeah, evens, right? I, I think so I I think from a mission point of view that that's very true.

Devs wanted Dev, right? Yep. Um, however, I, you know, and again, it always got the short shift.

It always got, you know, the afterthought, the whole cultural thing. The whole working together with cross-functional teams is still more true than ever. It's just, you know, I, I coached my kids in sports as they were growing up from the time they were like five till 14 in high school.

Not everybody is the num is the, is the center fielder. Not everybody is the court. Not every, right?

We, all the making of a team is, you have parts where each, you know, teammate has particular skill sets, but they mesh together well. And that's really when I, you know, try to explain DevOps to people today. It's not making my developer an ops or a security person, but you're part of this team on the, you want to call it a factory, factory floor fired, but you need the platform engineering, you need the DevOps engineer, your DevOps teams, you need your dev, you need your security, you need your SRE, you need all these different people that make a team.

And, and that's really, I, I think the heart of it. Forget. I do.

I do think so, but I, I think one thing I'd maybe push back and I see a little bit, Alan, is like, not everyone can find all the players for every position at the moment. No. And I think one of the things I see out there is that, you know, I love platform engineering.

We spent the last couple of years of the DevOps report focused on platform engineering. There were a lot of companies I almost joined focused on platform engineering. But there's a few things we see out there with big companies, which is, it's really hard for them to scale their platform engineering from the most all critical applications to serve the rest of the business because they've gotta productize it, they've gotta consumerize it and like totally software devs a team sport and there's ops people and platform engineers.

But what we're seeing out there, at least at the moment, is you can't find really great cloud infrastructure architects and platform engineers like at a scale to do what most companies are trying to do, particularly with the volume of applications being delivered via ai. Like code writing code was never the bottleneck. And now we can just write code faster than ever.

The big bottlenecks are further downstreams. So how, how does Upside help with that? Yeah, so we give you the guardrails for it.

So rather than, you know, having to worry too much about cloud infrastructure, you have a really simple YAML file that you can either write by hand or use our AI powered config generator that just looks at your code repository and goes, okay, there's a Go laying app, or it's a Ruby app that's using MySQL, it's using Postgres. Here's the simple scaffolding for it to go onto our platform. So very much develop a platform as a service, but we run on Google, run on Microsoft, we run on Azure on AWS, on OVH cloud across Europe, across the us and you can just go and move your application from any of those cloud regions without actually having to really do any work.

So true portability, True portability in, in insurance from geopolitical tensions and the vagaries of hyperscalers. So we're going to jump into that in a second, but let, let's do some groundwork on UPS Sun. What, what's the website now, Nigel?

com, if you go there, you can sign up for free trial that let you go and experience things, play around with it, play around with our auto scaling capabilities, deploying different kinds of apps. Um, and then, you know, simple, you know, product-led self-service experience or if you're looking, 'cause we do have quite a few really huge enterprise customers come and chat to our sales team and we can have a chat to you about, you know, uptime, SLA contracts and being able to manage whole portfolios of applications, not just projects. Got it.

So you mentioned the, the IT sovereignty situation, you know, and certainly every day we see more and more, you know, reasons why companies out there should give thought to an IT sovereignty or a sovereign type of strategy. Um, yeah, and it's something we've discussed here at Techstrong across the various, you know, uh, sites and video series and everything. It's not enough just not to host it in a particular country.

You gotta look at who your host is, who are the people maintaining it, who are the, you know, 'cause when the, when the, when the long arm of the government come and whichever government take your pick, right? When the long arm of the government comes knocking, who's gonna stand up and say no for you? And you know, there, there's an issue, right?

We, we saw it the, the year in Paris, the, the head of, I think it was Microsoft France testified recently there that hey, if the US government puts an information request into Microsoft, in spite of it being hosted in end up saying Azure data centers or data center in in France, they're still gonna comply. They're still gonna comply. So It's a complicated, yeah, it's complicated.

So my background, you know, I'm Australian. I grew up in Malaysia. I have a US residency, I have UK residency, I have American children and an English wife.

So I feel I can reason and I'm currently sitting in Paris headquarters of the company I'm at. Oh. So the, you know, and I, and I love how someone made a comment once about our company having an accent because we're so multinational, which is something I really like.

Look, I think it's, this is a super, super complicated topic. I think true sovereignty is really, really difficult. But I guess what I would say is that I think fundamentally biodiversity is good, you know, and diversity in the tech ecosystem is good.

And the more options that people have and the more different kind of cloud providers, the better. You know, I think the hyperscalers have been a huge force for pushing the cutting edge and set making what's possible with cloud for everyone else. But I also love the fact that there's smaller players as well out there that you've got, you know, small niche players like DigitalOcean, which is a massive business in and of itself.

And you know, companies like OVH and stack it in Europe and scale way in Exascale and all of these different companies. I think we very much want to be the sort of platform that can sit above all of those things and let people make the decisions that are right for them. 'cause yeah, with the pace the world is developing these days, it's, it's difficult to predict a lot.

Yes, it is day to day, minute by minute. Nigel, if you don't mind, I know you're a technical guy. Yeah.

You, you back a little bit. Give us a peek inside this platform based on open source, open standards, proprietary, what, you know, what's under the hood here? Yeah, so it's a container orchestration system.

So think very much like Kubernetes, but very much custom built for what we actually do here. So you come along and you define, you either want to use a composable image or one of our standard runtime images. So composable images, let you pick anything from the N package ecosystem and go, I would like this one IMIT container to have, you know, a bit of Ruby, a bit of Python for some ETL tool that I'm running.

Maybe go and the library or you might have an application where you go, look, this is a go laying app. We have a standard runtime for go and you get to express in my yaml this is a Go app and I want this to run either a specific version or whatever the latest version you have. Now, some of the things that I think are really amazing about our platform are continuous delivery is just baked in.

So as soon as I do a get commit, um, to the production branch, it just deploys a whole new version of it. Now. And here's the, one of the really cool bits.

If you are sitting there with your whole standard database, you know, you might have front end and a backend and a database layer. If I do a GI branch on my rep code repository, we clone a whole environment, a bite for bite perfect data that you can then iterate on. You can share that URL around with people.

So it makes experimentation really critical. And one of the things you said earlier at the beginning about, you know, all software devs, a team sport and communication and collaboration being so important, we see this as truly transformative. 'cause it means I can sit there and we used to joke in DevOps land all the time that, you know, let's test in production, but we can actually just give you another copy of production that behaves exactly the same way.

You can test on that, iterate on that, maybe send that to your customers, your teammates, work really quickly in real time and then merge the whole thing back to the main lines Really. How, how far, so can you have like children of chil daughter of daughter kind of branch? Yeah, full, full hierarchies and full hierarchies.

And you can either have it fit, you know, like a standard sort of feature branch style development methodology or, you know, work for trunk based methodology, however you wanna do that. You can define envi, what we call environments, production environments and non-production environments and create relationships between them all. And it's all very git ops.

I think in many ways this company was doing GitHubs well before, you know, my good friend Alexis coin, the actual term GI git ops, but it's all very git centric, which makes it really easy to adopt, like whatever your current development workflow is. We just fit into that really seamlessly. I mean, look at recent surveys we've seen is if you're doing cloud native and you're not doing GI ups, A you're probably in the minority, but b you're just doing it wrong, right?

And, and yes. So it's, it is the kind of the defacto standard. Nigel, how, how is this sort of packaged?

Is it they by instance, by users, by i, I don't know how how Do you Yeah, so we, so the way we do it is that you say, I would like this much in terms of cpu, U and RAM in terms of resources. And then that's pre, that's a pre allocated cost. Um, so you pay, pay with the credit card, that's where you get charged each month.

And then there's a few dynamic things on top of that. Now you can change that allocation at any point you want. You can start to create things like autoscaling that I'm sure most of the cloud native folks here are well used to that, you know, can increase the amount of resources you consume.

But that's essentially a basic model. So charge you for pricing based upon the resources that you are allocating to the project, um, with a couple of variations depending on, you know, how much traffic you're getting, how much storage you're consuming, et cetera, et cetera. And, and where does the choice of cloud provider come in?

So there's a few things. One thing I meant to mention that I didn't is that, um, we are really, we really believe that just as we've seen this huge movement of finops, so the last, you know, decade or more that's been going, that's been going on, we really think there's gonna be more and more carbon accounting and green ops happening. So we also measure the en the green, the carbon emissions for each of the grids that we work on and work with a few different providers to go and get that data.

And we give you a 3% discount if you move your projects to a greener location. So we're trying to align green incentives with financial incentives for folks. But yeah, so when you fire it up and you create a project, you just go, I would like to have you scroll through our list of regions.

You go, I would like to be on Azure in Canada. I would like to be on AWS on the west coast of the us. I would like to be in France for a VH cloud.

I would like to be in all of these different locations and you get to actually choose where you go. But everything above that is completely portable from our perspective. So because we work with just the base building blocks of VMs and storage and network essentially on hyperscalers, we actually give you true multi-cloud portability across all of those.

And, and you know what, at the end of the day, that's what people want. Yep, totally. They don't want the, the lock in or anything else this way, you know, 'cause this whole sovereign thing, for instance, it changes day to day.

Yeah. Minute by minute in some cases. So having that flexibility, I think is, is really, really excellent.

It, it's super important and I think it matters depending on what geo region you're coming from. And one of the things we'd been, and you know, this might be the record for an interview I've done without the word AI coming up into it, I think, what are we into like 15? I purposely tried to keep it away, but Go ahead.

So I was gonna say we've done, we've produced what I think is such a killer feature of a great MCP server for the platform. So I now do a lot of the, my driving is up upside from inside cursor. Um, and really, you know, 'cause a lot of the projects I'm doing a completely, you know, they're my own test projects.

I can be in full, you know, YOLO vibe, operating mode, you know, risks are pretty low. But I just can sit there and start to describe the code I wanna, I have committed, but also go and tell Upson, Hey, what environment am I in? Go deploy a new environment, create a backup for me, restore a backup, you know, expand the database.

You can go and we can start actually instructing the platform as a service straight from the IDE. And this is, I think one of the things we're increasingly gonna see, which is what AI agents I think have done, have changed in people's heads what their development environment or coding assistant or IDE is actually responsible for. You know, I, I mean the Eclipse folks in the EMAX folks always through the whole kitchen, sink inside their ideas and could do absolutely everything in, they'd be like, oh, I'm off writing an email while I'm writing some code to at the same time.

But I think what we're now seeing with Claude, with Cursor, with Gemini, with all of these different rate code bases built upon Visual Studio Code is that people are now getting their ideas to do more. So they're not just refactoring code, but they're making choices about where we actually go and deploy this code and go and manage that operationally so we can pause an environment, create a branch of an environment, revert something to a backup, all in a conversational interface from inside the idea. And I think this is gonna fundamentally transform, um, you know, translation and localization and interfaces and workflow design, because some workflows are easier to describe than to spell out in the formal language.

Love it. Nigel. We're we're outta time, unfortunately, but we should get, we'll.

Let, let's make another appointment. Have you Sure. Uh, talk about the AI implications here and, and where all that's going.

Um, I'm trying to think where, where are we gonna be? I, I'm a cube con. Are you guys gonna be a cube con?

Nah, that's not really your thing. Maybe. Um, so yeah.

Yeah. I might possibly be at coupon. We'll see If you are come by, say hello.

We'll do something first. All right. Hey, Nigel, best of luck with UPS Sun.

It sounds exciting. And, and, you know, in, in the moment of time, it's current for what I think the world's looking for, what the market wants. So, as usual, awesome.

Impeccable, impeccable timing. Nigel. Uh, always Lovely to catch Up.

Thank you my friend. Enjoy Paris and we'll be in touch cheer. com here, formerly Platform.

Sh if you are familiar, we're gonna take a break. We'll be back on Textron in just a moment. Hey everyone, welcome back here to Tech Trunk tv.

I wanna introduce you to our next guest. Her name is Tiffany Sjogren. Tiffany's with Optiv, where she is the Director of Services, enablement and cybersecurity education.

Tiffany, welcome to Techstrong tv. It's great to have you on. Thank You, Alan.

Absolutely. And, uh, you know what, for those of you who don't know out there, October is Cybersecurity Awareness Month. I used to think it was one of these made up Hallmark holidays just to sell more cards, but we've, it's been going on for a couple years now, and I think it's kind of generally accepted that, at least in our world, October is Cyber Security Awareness Month.

So happy Cybersecurity Awareness Month. Tiffany, thank you for joining. Absolutely.

Absolutely. Absolutely. I didn't be here, Uh, Tiffany, I, I gave them your title, but you know, a title can cover up a lot or not.

Give us an idea really though of your journey to, to, you know, being here with Optiv today. Absolutely. I have a pretty unique background.

Uh, once upon a time, I was a middle school math teacher, and I entered into the corporate training world over 12 years ago. And, um, started with Optiv, um, in one of the companies that formed Optiv in 2015. And, you know, right now I'm responsible for the education of our services organization.

Uh, so all of our analysts, engineers, uh, customer success managers, all of them. So I've had the opportunity to work with them and grow alongside them, understanding what they need in order to make our clients secure. Absolutely.

Very cool. What a great start. I, I, I got a confession to make.

I'm doing interviews here 12 years or more. You are the first former math teacher who's made the crossover in a tech like this I've ever interviewed. So, congratulations.

What grade math did you teach? I taught middle school, so, um, seventh, eighth grade. Those, those are the wonder years.

Those are bad. Those kids, man. Oh man.

I love, love, God bless you. I love 'em. Did you?

Oh yeah. Good for you. No, they're amazing.

And honestly, uh, they're very similar to the professionals. And I mean this in the best way possible, very similar to the professionals that I work with now, because in cybersecurity, many of the people that we're working with are hungry for more. They're hungry for understanding how to address the next threat.

They're hungry for, um, you know, understanding the new technology. You know, we're talking about AI every day right now, and similarly in middle school, they're just starting to get into that content where they're figuring out themselves and you know, what they wanna do in life. And so there is that bit of energy that is synonymous with both groups.

Um, so I find it, uh, it is interesting, but, uh, I find it fulfilling working with these professionals. Very cool. So I would've compared cybersecurity professionals to middle school kids with a different sort of analogy, but I like yours.

It's okay. It's okay. Uh, great stuff.

Tiffany Optive. Mm-hmm. Some of our folks out here are probably familiar with Optiv, but I'm gonna bet a lot on it.

How would you describe Optiv to them? Optiv is a cybersecurity solutions advisor for clients of all different sizes, all different industries. And really our focus is doing what we need, um, to help our clients secure greatness, whether that's through technology partners that we have, um, within, uh, all the different industries touching cloud, um, touching network security, touching ai, um, you know, whether it's a technology or a service.

We have a large services organization of consultants and managed services, uh, where we can meet clients where they're at, um, you know, not being reliant on a specific, um, approach, but finding what works best for them and helping them secure greatness. I love it. com.

O-P-T-I-V. That is correct. Excellent.

Alright. Tiffany, if you don't mind, I, I'd like to return to this Cybersecurity Awareness Month theme and, and talk a little bit about the Core four, right? Mm-hmm.

And again, some of you out here may know what we mean when we say the core four as it relates to cybersecurity awareness, but some of you don't, if you don't mind, Tiffany, why don't you, you know, refresh those who maybe forgot. Absolutely. So the reason we're calling them the Core four now, is that Cybersecurity Awareness Month used to have different themes every year, and they would have different areas of focus.

Um, but over the last several years, those areas of focus have remained the same. They are the core four strong, unique passwords, phishing awareness, reporting, it, multifactor authentication, and keeping software up to date. And the reason that those four became the core four is that no matter the technology in the environments of our customers, or even in their personal lives, it's that human behavior.

You setting your password, you opting into multifactor authentication, you recognizing a phishing email, and you taking a little bit of a pause and letting your software update that's going to keep you the most secure, both you and your organization. So that's why we call them the Core four. Excellent.

You know, taking a little bit of a pause, I came, came into the office early this morning. I, uh, I use a Mac and an iPhone, and I, I logged into my Mac and I got, you know, the, the little, you know, the gray thing with the red number one, meaning there's a software update out there. I said, all right, let me update my Mac, and while that I'll just work on my phone while it's updating and I update the Mac and, you know, it goes blank and I get the Apple logo and the, and the bar.

Yep. And, um, I open up my phone and what do you think I got Update The same number one update, because now they update across the entire portfolio, and I'm on the beta releases nonetheless. So now I had to hit, hit update on my phone.

Now I'm stuck here without any devices, right? Mm-hmm. And I'm twiddling my thumbs going outta my mind, but, so lesson, you know, but you're right.

It, it was just a few minutes and I felt better that, you know, I updated that it said Chrome needed an update. I did a quick relaunch of Chrome. Mm-hmm.

And I'm up to, I'm up to speed and, and as a security person, you know, that made me happy, I guess at some level. Um, looking at the Core four for this year, what, what, what's optives advice, best practices for our folks at home? Yeah.

So, you know, you, you had mentioned that not everyone is aware that this month is cybersecurity awareness month, really for Optiv. What we're trying to instill with our clients is that cybersecurity awareness month is a time where we celebrate, but it is all year round. And making sure that our employees and our business leaders who are in charge of the initiatives that, um, they're rolling out within their organizations, that they understand the human element of that.

And the importance of having a plan. Because again, like I mentioned earlier, no matter what software or technology is in your environment, it takes one person entering their password into a malicious site that they got to through a phishing email to make you sit back away from that technology a lot longer than a couple minutes. Right?

Um, the impact of those decisions and the impact of those behaviors, it's just making sure that you're covering all bases when you're in the middle of a new initiative. If you're trying to turn out a new product that has technology involved in it, maybe it's coding, taking time to do the threat modeling, oh, you want to incorporate ai ai threat modeling in front of that so you understand the risks. So it is that investment of time upfront, um, that you kind of mentioned, you know, gotta gotta push that update out, gotta sit here for a little bit, but it pays dividends on the backend to be more methodical and, uh, approach it the right way.

Uh, agreed. Absolutely. Um, you know, it, that, that whole idea though of I don't have time, I don't have time.

Mm-hmm. It is pervasive in, in fact, cases where you see security breaches. Mm-hmm.

Right? It's the same thing the developer says, I don't have time to test for security. I gotta push this code.

I gotta push the code. I don't have time, we're on deadline. Mm-hmm.

Or, you know, I, I gotta spin this up. The, there's a deadline and, you know, at the ops level and, you know, time time's not the enemy necessarily here when it, when it, when it comes to cybersecurity. So that, that's definitely a, a thing phishing.

Mm-hmm. Wanna talk a little bit about phishing, you know, used to be so easy to spot phishing because most of the time it came from, you know, places where English was the second language and, and you know, Microsoft or Apple isn't writing things with like, uh, terrible, you know, grammar and stuff like that. Of course with ai, now, some of these phishing males are works of art.

Yes. I mean, I, I sit here and I, 'cause I, I've taken the phishing classes. I, I actually helped design a phishing course and, um, you know, I go into the headers and start looking at the reply tos and the, and the real names and where those links are going and everything else, URLs and actual link.

Um, but for the average person, it's become a real challenge. A real challenge. Absolutely.

Um, like many of the people who are probably going to watch this or listen to it, um, I am my grandmother's IT help desk. Yes, We all are. We all are.

Right. And I wish my grandma, but the whole family, yes, the Whole family. But those phone calls when, when she is distraught, because it is so believable, it is from her bank, it is from her, um, you know, investment portfolio people.

And she's like, I, but I don't, I haven't done this. And I'm like, I know you haven't. So what does that mean?

If you have thought about the context, the content of that email, and it's not legitimate, what does that mean to you? And that's kind of the mindset shift that I'm trying to teach her rather than, and, and honestly more than just my grandma, our cybersecurity education, um, team that provides services and, and training to our clients here at Optiv, we are talking about slowing down, thinking through, um, evaluating the content. And if something seems off, if just one piece of it doesn't seem real, there are things that you can do to validate, uh, that email there are other than just technology, right?

Um, you know, you can send an email separately, you can report it for evaluation. Doesn't mean that it goes away forever, but have someone look at it, a professional before you're clicking anything, opening anything. I mean, the best thing that they can do is reply and say, that wasn't a phishing email.

And you're like, okay, good. Now I'm safe to proceed. Um, you know, so it is a, it it's more of a mindset shift from being tactical, looking at the misspellings, looking at the domain, looking at, um, you know, the, the urgency or formatting, uh, within the email.

And instead it's almost more of a strategic look at communications, if you wanna think about it that way. So moving from tactical to strategic and thinking, is this something that I should be getting? Is this, um, you know, relevant?

Um, or is there something just a little bit off? Fair. Excellent.

Um, you know, I, I mentioned AI with the phishing, but AI is having an effect up and down here mm-hmm. With all of our security. And, and you know, at the same time, it's also a force for good, right?

Where a lot of companies are building AI into their cybersecurity protection, right. 'cause it can, sometimes you need AI to fight ai, Right? Absolutely.

And I think cybersecurity awareness month is one of those times where you can start the conversation. Um, I think for, uh, for most of the organizations that celebrate Cybersecurity Awareness Month, it's more about the individual end users. There may be some initiatives corporate wide, but kind of the focus is on the people aspect of it.

And when it comes to ai, AI literacy is really important. Uh, so having your general end user understand what an LLM is, what it looks like when an LLM is poisoned by a threat actor, uh, what bias looks like on output, um, what prompts you should be using or can use that still protect the information that you are handling. Um, rather than using that information to train an LLM, um, open, you know, public or open AI versus closed ai, um, being able to understand those terms so that when a policy comes out or when they see something in the news or an alert from it or the security team, it makes more sense.

Uh, I think the literacy piece of it, really understanding all of the nomenclature and how they're intertwined is critical. Agreed. Agreed.

Tiffany, we're about outta time. I want to thank you for coming on. Keep up the great work at Optiv.

Thank you. Um, there's a lot of middle school math kids who are missing out with you over here now, but their loss is our gain. So thank you very much for what you do there and come back and keep us posted.

Appreciate it. Thanks for having me. All right.

We're gonna take a break here on Techstrong tv. We'll be back in just a bit. Hello and welcome back to Atlassian, Europe, and we're here with Josh Millers, the CEO of the Browser company, which is in the process of being acquired by Atlassian.

So we can't get into too much detail about the future plans, but welcome to the show. Thank you very Much. Awesome to be here.

First, uh, Atlassian team conference. All right. So a lot of people are going, well, why do we need a new and different browser?

And what's gonna change about the experience in the age of ai? And, and so kind of educate everybody about what you guys are working on. Yeah.

So the origin of the company is actually pretty humble. My wife got a new job. She got a brand new MacBook with M1 Ship, super fancy.

She worked for a artist who was 76 in Flagstaff, Arizona, not the bastion of it, innovation and forward thinking teams. And I noticed that she never left Chrome during her workday. Like even in an old industry, she would get PDFs from old school New York galleries, and those PDFs were now URLs and her email was a URL.

And so the origin of the browser company was looking at how people were using their computers and noticing they weren't ever leaving their browser. And their browser was really more of an operating system for their day to day, and the fact that their applications and files were not in the browser. So the idea behind the browser company arc or first browser and now idea, which will be expanding with Atlassian, is how would you re-architect and redesign a browser if your assumption was not tabs or information from the Super Information Highway from 2030 year, really 30 years ago.

But you said, Hey, these are actually the tools and files that I'm using every day that used to happen on Mac Os or used to happen on Windows, but it's now moved up the stack to the browser layer. So explain how that will change the way we work. 'cause I mean, today I'll open my browser and there'll be 15 tabs on that, that I'm kind of trying to mentally connect.

But is there a better way of thinking about all that? Yeah, there's, We think about it from a couple different, uh, angles. One is applications.

So again, we don't think of them as tabs. We think of them as tickets or documents or videos. And when you think about it that way, you have features like if you're in a Google Meet meeting and then you have to switch away to another tab, that might be a document that everyone in the meeting's reviewing or some research you wanna do quickly on the side relevant to the conversation, we automatically take that Google meet meeting.

'cause we don't view it as a tab. We view it as a meeting and pop it out into a little custom video player just for video calls with little meeting controls that, that will follow you around to anywhere you go in the browser. So that's an example of if, if you're someone that is in video calls a lot for your job, every time you do a call, we're making that experience more seamless and more convenient because we don't think of them as dumb browser tabs.

We think of them as smart app objects. Yeah. So that's one area.

The other areas with ai, and if there's one thing we've learned about AI is unreliable and can feel like slop. And the things that change both of those downsides of AI are when it has a lot of context about you and your job. Where's that context?

Your context is in your tabs y is it in your tabs? Because your tabs are your apps in your files in 2025. So the idea is that instead of having to export things outta your browser into some AI tool of all the context of what you're working on is right there, then can we teach an AI model when you use it natively in the browser to really already understand the things that you're working on because it's right there with you.

But both of those are examples where it's not redesigning the browser for the sake of it. It's saying the browser is designed for something totally different and this many decades later. Really people are turning to it as the heartbeat of their job.

And let's make a browser that reflects that Dumb question. But what you're describing, is it really a browser or is it something else altogether? Well, Fun fact, we called it the Browser Company of New York, right?

As sort of a misdirection. So we've always viewed what we were building as a new type of operating system at the web layer. Now, this is an idea that is age old.

There have been so many attempts at this. And our view is that the timing for this idea, in a world where we have devices across, you might have a Windows PC for work and an Apple device for your smartphone and your car and your, that you're gonna want a computer that follow you around all those different devices. And in the modern world where everything's moving to the cloud and there are these proliferation of devices, you're gonna want a browser or something that sits across all of them at the web layer.

Now, we don't think the average person, I think you probably, your, your audience may be the one narrow niche in the world that is wants to talk about operating systems, uh, based on top of the web. But for most other people, that's not a thing they're looking for. So we call it a browser because three to 4 billion people a day use a browser.

And, and they, they're familiar what to expect. So our hope is sort of like the iPhone one day someone picks it because it is better than Chrome or safari and very concrete ways that they can relate to. And over time, if we do our job, they'll look and go like, wait a minute, I'm barely touching my downloads folder.

Or I'm barely touching the folders on my desktop. Uh, and we can evolve the the browser to really reflect that new need. Will the people who currently build browsers evolve along your path?

Or are they kind of stuck in that lane because they're trying to service a million consumers? Yeah, I mean, one of the things that's fascinating is, you know, a year ago we said, Hey, we're gonna make this AI browser thing. And everyone's like, you're nuts.

Like you've been working on this other browser arc. Why are you gonna try to invent this new category? What does that even mean?

What does an AI browser now there are five or six vendors rushing to build AI browsers, many of them very similar to RSDA. So we view that as validation that actually there is going to be this new category of browser, pseudo browser, pseudo ai. Is it new?

Is it the old thing? Updated? There are gonna be a lot of people.

And what we're deciding to double down and focus on is an AI browser for work. 'cause our view is that in 2025, when you open your laptop, you're probably doing your job or school because on the weekend you probably wanna be on your phone or on Apple TV or out in the world doing an activity. And so if you're opening your laptop, it's probably 'cause someone's paying you to do that.

And we wanna make you better at that, where others focus more on the broader consumer market. How unique or custom can the experience get for each company or even for each individual user per se? Uh, that, that is one of the things that is when we started the browser company, we spent the first year actually rebuilding the infrastructure needed to build browsers on top of chromium, which is the web and uh, web rendering engine.

And we did it in a way that allows us to make much more novel and creative interfaces on top of chromium than what other browser vendors think can provide. And so if you go look at our first product arc, you'll see that, uh, it looks very different than Chrome and Safari in ways that actually challenged, uh, us in terms of novelty of people learning new things. But it's also a lot of our beloved arc features that people are fanatical about stem from that infrastructure layer we built that allows us to develop novel interfaces in new ways.

You combine that with really the properties of LLMs, which are inherently generative and personalized to each person in query you, you combine those things and we are really hopeful that a, a central value prop of our browser will be and continue to be. It is personalized for you and your job, and now your company after the Atlassian deal, uh, hopefully closes. Um, but we're very excited about, uh, personalization as a, as a defining selling point of our product, especially personalization.

That doesn't mean we're selling your data to advertisers or anything of that nature. So within the limitations of what you can say about Atlassian, how does what you're doing and what they do align? Yeah, one of the things that, uh, we have always focused on that is in Atlassian's DNA as well, is focusing on the individual in the sense that we want, you know, Atlassian pioneered as, you know, kinda the bottoms up SaaS motion in many ways.

And really in plain English, your, I know your, your viewers don't need to know this, but most people don't. That meant something that you would pick 'cause it was the best in class tool and you wanted to use it 'cause it was best for your job. And if not at you at the company were using that tool, maybe they would go and buy a license from Atlassian.

And so we've always been really focused on the first part of that equation, which is how do we build the most helpful browser for your job, for your workday? But there's that second part of that sentence, which is what the needs of a boss or an IT department or a security department, especially in the age of browser-based security with all these SaaS apps, is they need a lot of things that are not anything we have expertise in. And so we're very excited to collectively focus on this AI browser for work focus on making the most valuable tool for the individual that they pick to use.

But ultimately, if there are enough people at a company or an organization that are interested in it, what can we offer, um, the real buyers of the software and, and, and, and eventually make teams to be get better together in the browser? Actually, when we started the company was in, uh, 20 19, 20 20, like at the height of collaborative web-based software, Figma, GitHub, notion, Airtable, all these companies were coming out, uh, with very collaborative multiplayer software. And we always wondered why do you have multiplayer and collaboration at each app?

Shouldn't it be at the operating system layer? Should it be at the browser layer? So there's teams and work, uh, functionality that, uh, we're excited about with Atlassian as it relates to learning how to distribute DIA to organizations that meet their needs.

But also there's a lot to do, but just how do you make teams work better together? Uh mm-hmm. Just in terms of their day-to-day work and workflows.

Um, how do I secure all this? Because there's a lot of people talking about prompt injections and if your browser accesses something, somebody could have a malicious prompt and you're connected to everything. So that kind of means I gotta secure everything, but how do I do that?

Yeah, I mean, one of our selling points is security and privacy. So we have, uh, zero data retention, uh, on our, all of our LLM use. Our memory functionality is end-to-end encrypted, stored on device.

So though you have memories we can't see them. They are passed through an encrypted channel to an inference provider. So everything that is best in class as it relates to security and privacy, that's available today.

We do. Now there are a bunch of things that are, no one really knows how to secure yet, like computer using agents, which you're referencing. We didn't ship them.

We were one of the, I think we were the second, uh, external company on open AI's computer use beta. We were in the first five of anthropics. We had access to these models before they were public.

And we said, no, no, no, no, no, that's too dangerous. It's not worth the trade off. So one of the things you'll see is a lot of our competitors that are more or less a mimicry of our products have kind of championed how they have all these computer using agents that we do not.

And we look in that and say, that is deeply insecure, not really that valuable, wildly expensive and wildly slow. I'm sure all that stuff will go away. I'm an optimist and a futurist, but it's not there yet and it's not worth the trade off.

So, um, your question about prompt injections is exactly why we don't do anything related to computer use. And as it relates to kind of general assistant usage, we have a five person security engineering team that has been red teaming for nearly a year. Just those scenarios.

And so you're not gonna get 'em all, but I'd think if you stack us up against our competitors, we are ahead of the pack as it relates to security and privacy. And after this deal closes, it'd be even more of a focus. So how do you envision the browser kind of getting distributed?

And I asked the question because so many of the browsers we use today are, you know, they're essentially embedded in the box that it comes in, or you just click on it and it's automatically installed. Um, are you envisioning that average end users are gonna go download this, or a company's gonna say, we want a browser that is specific to our work environment and our functions and we're gonna distribute that to our employees? I mean, I think there are a lot of interesting thing, I think this world might change in a, in a world where we're a part of Atlassian, but to speak to what we've done historically, what we've found is if you are someone who spends eight hours a day in your browser for your job, then seemingly small quality of life improvements that make your workflows better are enough to get people to switch.

So for arc, we, we had consistent organic word of mouth growth that was really from people screen sharing something in ARC and someone going, what's that thing? And it starts a conversation about arc. Um, so now Chrome Safari, they're trying to be a browser for literally anywhere, anywhere doing anything on the web.

And so that means a lowest common denominator product that is very difficult to differentiate because you gotta be a great browser for my mom and for me and my little cousin, we're approaching it very differently, which is say we don't need 4 billion people using our browser every day. We want everybody that is in this conference hall to that who works in a browser for their job to go, oh, this is the professional tool made for me in my job. And that sort of software, as we know from this conference hall and how big it is, is if you make teams better and you make developers and individual workers better, they're willing to switch to new tools and they're not representative of the average Joe.

Uh, but that's not who we're going after. We're going after professionals who get paid to work on their computers. So this new project that you're working on, how far along are you guys exactly?

Uh, so DIA is actually available, uh, in general a availability today for anyone to download on Mac Windows coming in the next year. Uh, so we had started working on DIA about a year ago. We've been working on arc, our original browser for three or four years, DIA for the past year.

Uh, went into private beta for DIA this past June, and it's just sort of been a, a whirlwind since then. Um, yeah, when we released it every, I don't think anyone really knew what we had been up to and what's an AI browser and you know, in the last three to four months, you're seeing, uh, the market kind of surround us and, and, and take their own, uh, attempt on the, on the category. So in some senses it feels like we've been doing this a long time, and then you kind of take a step back and go like, oh, we're just getting started.

Others are just getting started. We think that the winner of the space is gonna be crowned in the next 12 months. So I think if we're here in a, in a year, we're either gonna have champagne or it's tears, but it's gonna be a big year and we're really excited to go harder.

Are the users starting to come together and be self-supporting? I'm reminded of the early days of the Mac when the IT department kind of ignored it. So it was just a bunch end users supporting themselves.

Is that kind of the same phenomenon we're seeing here? And Yeah, I'm not. So what we are seeing so far, and one of the reasons again, we're in this conference hall, is we're seeing, uh, a, a critical mass of employees at companies independently use DIA and their IT teams or their security teams popping going like, wait a minute, what's this thing?

Like, how does this work? Can we get? And so part, so one of the big things we're excited to, to address with Atlassian is, uh, how do we formalize what we're seeing organically develop, and how do we just go as fast as we can to bring this through as many people as possible?

And for us, that always starts with shipping excellent software that is actually useful to people in their day to day and have trust and try to encourage that sort of word of mouth growth that comes from the best software tools and technology in your life. And that's a high bar and it's really hard and we don't always hit it. Sometimes we get high on our own supply and like think that we built something great and we really haven't.

But when you, man, when we built this, you know, integration for, uh, your calendar that pulled out video, uh, URL links and made little nice buttons to join the meeting two minutes before the word of mouth chatter we got from that. Because if you're hopping between meetings all day, every time you're like, thank you arc, thank you arc, thank you Dia. And so it's gonna be hard.

It's gonna be really hard. There's a lot of competition, but we're, we're encouraged by the groundswell we're seeing. And you know, hopefully this deal closes, we'll be able to go even faster.

All right. Hey folks, you heard it here. The way we work is changing and it, it may be in a browser or maybe we call it something else someday, who knows.

But one thing for sure, we're not gonna be watching a bunch of tabs from now on. Yeah. Hey, thank you very much.

All right. Thanks for coming back and we'll be back in a minute. Hey folks, we're back at Atlassian in Europe and we're here with my new friend, hon, and we're talking about work and AI and collaboration.

How you doing? Welcome to the show. I'm Doing well.

Thank you for having me. I've been dying to ask you this question since I knew saw you on the list, but you guys have all these tools for collaboration and working. I just have to ask, is there something wrong with the way we work today?

And what is it? Great, great question. Uh, I would say it's not that there's something wrong with the way we work today, but truly true that there is something that can be better.

You know, the way we work today is, is tied up to silos. For example, we see all, all of our customers talk about how information is locked up in different tools, in different systems that they're using across their organization. And bringing all that together can unleash a lot of productivity.

Uh, my favorite stat is that, um, almost a day's worth of equivalent time is spent per week searching for the right information, trying to find what they need. Oh, who's that person that I should contact? Where is that information about a new marketing plan?

How can I search it? How can I find it? And that truly is a big inefficiency and coming in and living in the AI world, man, I'm so excited about how we solve that.

So what exactly is in the, uh, collection here that you're managing? 'cause there's a video tool, there's something that looks, it's Confluence, I think, and a couple other things. And then the AI agents.

What is that portfolio exactly? Yeah, Great question. So Teamwork Collection is a, is a collection of products like Jira, confluence, loom together, deeply integrated to help solve only one problem, which is how do teams collaborate within each other?

It's a two, it's a set of tools for hr, finance, marketing, you name any team, they all need collaboration. So Jira allows you to plan and track your work. Uh, confluence allows you to collaborate for creating documents, creating knowledge, unleashing knowledge.

And Loom is our asynchronous tool where you and I are in different time zones, right? If I wanna send you something, I only two options. I can send you a long email and bore you, or I can send you a long slack and bore you, but you're never gonna be able to see my gestures, my emotions, how I feel when I'm talking to you and those, those, those tools.

But Loom allows you to take a video of this kind of a conversation and set it up so that you know exactly what I'm saying, why I'm saying it. You get the full picture of what I'm saying. And that's the third tool that is part of teamwork collection.

So it's kind of like an asynchronous version of a Zoom call, but I get a message from you and I can understand what you're trying to tell me, and I get all the gestures. Yeah, Yeah. I mean, you get all the context, the full human body picture.

In other words, communication is rich, not because of the things that I'm saying, but also the things that I'm communicating through other means. Right? When we are talking, you can pick up a lot of cues around what I'm saying, the tone that I'm saying, the the way I'm saying it.

And that's the full body communication, if you may, that humans do. And Loom allows you to do that. Now, it is true that Loom started off as an async tool where I can send something to you in the night, you wake up in the morning in your time zone, you can watch it.

But now we also have enhancements. So for example, we do believe that certain meetings are really important. 'cause certain meetings with where decisions get made, keyboard gets formulated, right?

And, but a lot of people just sit through those meetings without knowing what their role is. So what ends up happening is when the meeting ends, that information gets lost, right? Because you discussed a bunch of things, maybe someone took notes, right?

Right, maybe, right? But the information does get lost. So now we have Loom for meetings, and what that does is it sends a meeting, ai, uh, notetaker to your, all your meetings and it'll automatically capture what were the key decision points, what were the key action items, who said what, who has the assignment?

But the beauty is that Loom and Jira are deeply integrated, and so is Confluence. So once the meeting is over, the Jira work item that you talked about, updating, well, guess what? It's automatically updated.

When you show up in Jira, you just press a button saying, yep, I was in that meeting. Yep. I know we discussed this.

Press a button. The work workout is, work item is updated really easily. Nice.

Um, You know, to your point about Loom, and I don't think a lot of people really realize this, but when you get an email, it's the tone is really dependent upon the mood of the recipient, not the sender. And, and a lot of miscommunication as a result of that, because people are, I might be in a bad mood and suddenly I think you're yelling at me when you're just kinda like trying to send me a message. So, um, you know, do people understand that kind of subtlety or is it something they realize after they start using Loom?

Yeah, I think, great point. I think, uh, a lot of people that we chat with, uh, understand the nature of what we call full body communication, meaning it's not just the warble cues, but overall communication that people are doing the hand gestures with the tone how they're speaking. So a lot of people, a lot of, uh, consumers who, a lot of users who are in companies where that is valued, they pick it up immediately.

But for some, it takes time to understand the value of it. So in other words, we, we tell them to try it for certain use cases. Simple example, I gotta provide a status update to you about my project.

Now this event is happening, it's a pretty massive event. Different teams are working together and we need to know, is the venue gonna be ready? Now I can send you a long slack, or I can get over there and say, man, that part is ready, but this part isn't, you know, and it's kind of dependent on some other things.

So you get the full context of the communication through that. So it's a, it's a, it depends on the company, the culture, the industry that you're coming from. For example, in the us uh, the new generation of employees that are there, they get on Loom easily.

Mm-hmm. You know, they grew up in a world where video communication is the norm. FaceTime is the norm, Instagram is the norm.

So when they join the workflows, it is absolutely clear that they don't wanna send an email. You know, they don't wanna write up a giant email and set it out. They would rather jump on a, on a, on a loom and provide an update share.

I mean, even simple cases like bug reporting, all of us encounter bugs in our products. Right now. I have two options.

I can write a long text to say, click here, do this, click here, do that. Or I could just record a loom of the bug that I just saw. It could be on a mobile device.

A Loom has a mobile recorder. It could be on my desktop. It has a web recorder.

And you can say, look, this is where I click. This is what happened. And this is the error I got.

That goes straight into Jira gets embedded inside of Jira. So when the engineer picks that up, they watch the real reproduction of the bug rather than trying to decipher, did sanction mean to click here? Or they, where did he click, you know, a visual communication, I mean, we all know a picture says a thousand words.

A video probably says 10,000 words. Right? It's true.

And, and, and the power of video is, is the power of loo. Yeah. And one of the things that drives people crazy, especially those engineers, is they'll spend hours trying to replicate the bug.

That's right. Which only probably takes them about two seconds to fix 1000000%. And, and this is the biggest challenge between knowing the details of what you need to do, which is called context, and actually doing it.

If we can solve the context problem where you get to know exactly what's happening, where the bug is, which part of the flow it is, the engineer can solve that problem very quickly. And Loom allows you to do that. We're also announcing Loom for bug reporting.

So if you go to Loom, it can also capture your error logs with it from the, from the screen that you're on. Right? And when the engineer receives it, they're like, wow, I got the video and the details.

I don't have to send them a message to say, Hey, can you send me the error logs as well? It all comes packaged in. And as you know, engineers work in Jira, uh, they have issues to track.

All of this gets embedded right in the Jira work item. So you're not looking inside of Slack or email, where is that Loom? No, no.

It's right there in the work that you're doing. Nice. So we're at this show, and if you walk around, every second booth says ai, right?

So what will be the impact that AI is gonna have on the way we work? And we see all these agents now, are they members of the team? And how do I manage them?

Do I develop a relationship with my AI agent? How's this gonna play out in your Mind? Uh, great, great question.

I think we are living in a world where, uh, human productivity is just getting increased significantly. Uh, I'll take a few examples here. The way to think about human work is that there's always this part of the work that is creative, and then there's other part of the work that is drudgery.

It's things that you just do. Mm-hmm. So that you get the chance to do the creative work.

That's true. Right? So the, the, the phase that we are in right now is that AI is picking up all the drudgery, you know, all the things that you don't ha don't add much value, but it's part of the work.

It's important to do it. Example, uh, we just announced, um, robo has skills of project management, which is basically robo is our AI version. Uh, and what happens is if you're a project manager, one of the things you have to do is every Friday you gotta go clean up Jira and then provide a status update to your boss or this team right?

Now that is an important part of the, your job, and you cannot get away with it. Like you have to provide updates, but it's part of the job that's repetitive, not creative. And there's a lot of people who probably don't enjoy spending their Friday evenings sending their boxes status update.

I ask where AI comes in. Uh, robo has skills for project status update. All you do is ask robo, Hey, I gotta send out a project status update for this event, will go and look at all the work items, see what you worked on, what I worked on, whether we were blocked, what are we blocked on?

Are we escalating something? And come back with a great summary of what's happening over more. And all this project manager or the leader has to do is review it, make edits, of course, right?

Add some other context as well. And that part of the work is now packed up to be delivered to the stakeholders in your organization. That's just one example of how AI is going to help us on your question around agents.

We are excited to introduce a lot of third party agents inside of Jira. So for example, Canva, Databricks, and all of these agents are coming to your team inside of Jira. So what you can do is you can assign Canva AI agent in a Jira work item if you're a designer.

Hmm. And what it'll do is look at what image you're trying to create, what size do you want in? What kind of backdrop do you want in?

And it'll get to work inside of Jira. So now instead of me assigning that work item to a human, I can assign it to Canva agent because can, my agent is now part of my team and it can spit out that output right inside of Jira. And I never left Jira to get the work done and my productivity increased significantly.

The last thing I'll say is humans now, in my opinion at least, are getting freer and freer to do the thing that they do best, which is creative work. You know, all the drudgery around that can now be, uh, uh, so to say delegate it to AI as well. So AI is gonna help us improve our productivity, unleash our creativity.

The bottleneck no longer is execution, meaning can I write this code or not? Because AI is gonna help you with that. The bottleneck is now human imagination.

How far can we think, how big can we think? Is that is what we are thinking the right thing or not? 'cause AI can come in handy for everything else.

So should I start thinking about my work and start delegating it in certain buckets that says things I like doing, things I don't like doing, and I'm gonna give the things I don't like doing to any number of AI agents. Yeah, I think that's would be a great starting point. But what the right recommendation would be that before you start doing anything, ask yourself the question, how would I do it if I had an AI teammate?

'cause the default training of the brain has been, how will I do it right? When we wake up and say, okay, I gotta write a market report, I gotta write a strategy document, I gotta write it. Mm-hmm.

Right? But if we start changing our framing to say, okay, I got all these amazing AI teammates on my team, how would I solve this problem leveraging ai? And sometimes AI can do the pre-work for you.

So for, in my case, I keep an eye on the market a lot. What's happening, what's, what AI announcements are happening, what are the people doing in the industry? And that pre-work for my strategy thinking is equally important for me as the strategy.

So my agents run in the morning, get me all the information that I need to consume to be able to make smarter, better decisions. And that's a new way of thinking about my job. True.

So coming back to collaboration, if I have AI agents and you have AI agents, how will our AI agents work together to do something? Yeah, Great question. Uh, I think, uh, uh, uh, every company, as you know, is creating agents, you know, and, uh, they are, they, they are inside of Atlassian ecosystem.

So I mentioned third party agents like Canva, but also inside of Atlassian. You can also create your own custom agent by going to Atlassian studio. So I can create a PRD agent or a market research agent that does this work for me on my behalf.

Over time, these agents need to talk to each other, just like humans talk to each other, to truly be a teammate. And there are lots of innovation that are happening in the industry. One is between third parties, there is the MCP server.

You might have heard of MCP server model context protocol servers. We have announced our MCP server, so anybody could integrate with it. For example, yesterday I announced a partnership with Lovable and Confluence, where you could be in lovable and you can take the Confluence product requirements Doc and lovable will then turn that into a prototype.

And once that prototyping is done, it'll take that prototype and embed it back inside of Confluence so all your stakeholders can see, here's the product requirements doc and here's the prototype going along with it. That's possible. Now, because Lovable and Confluence can talk to each other using the MCP server, Aren't we kinda, uh, in a new era of ai?

I know AI is relatively new, but I feel like we just went from copilots now agents and it's, it's a radically different way of thinking. 'cause with Copilots, I had to know a fair amount about prompting and I had to get them, uh, some skills there. It seems like AI agents are just gonna make it a lot simpler, and I just kind of say what I need and I don't have to become a super prompt engineering expert.

That's right. I think you're absolutely right that we are entering a new phase, um, using some, some terminology. The phase, the phase one or the first part, the phase was I'm doing something copilot comes and helps me complete doing it, right?

As an example, there were coding copilot where if you're typing code, it helps you complete that. It can write the function details based on what you're trying to do. But now we are entering the world, and by the way, that was true for, uh, uh, uh, uh, collaboration in terms of creating content as well, right?

You're writing content, it can come in and parse that paragraph, rewrite it and all that good stuff. But now we are entering a world of agentic ai where we need to reimagine not just what I'm doing and how AI can complete it, but rather how can AI solve core, core parts of my job in a fairly autonomous independent ways and how I can benefit from that. In other words, we're going from a world where humans used to create and AI used to complete or enhance to a world where AI is going to create and humans are going to edit and combine.

Nice. It's a fundamental mindset shift where agents can come in and work together to create part of your job that is really high quality output, really good things that you need to get your job done. But then the human comes in the loop in the end and says, okay, I got my market research done through agents.

I got competitive research done through agents. Now I can combine all of this stuff using my creativity and tie them together to get to the output. So we're living in an agent AI world.

You will see everybody talk about agents including Atlassian. And we have amazing set of tools that allow you to take every part of your work and turn them into agents that matter to you. Interestingly enough, you know, we see all these reports about these so-called failed AI projects, and I think MIT probably has the, the most widely known report on that.

But as I listen to you, maybe the way to go after AI is a lot of smaller things that, you know, that the AI can help us with that might make a bigger difference than some of these, you know, home run type projects that people tried to do and maybe AI is not quite ready for. Yeah, I mean, there, there are definitely cases where I would encourage everybody to start with, which are known out, uh, positive outcome cases. And then there are experimental cases as where you should apply ai.

So I'll start with the first bucket. All of us write content, create content of some sort, right? If you're a marketer, you're creating marketing plans.

If you're a product manager, you're creating some product requirements, doc. And if you're an engineer, you're also completing and creating code in that category. AI is producing tremendous amount of returns.

It's a, it's an area which is very well understood by now and you can start using those kinds of AI tools to help you accomplish that. For example, robo Robo can help you write code, robo can also help you provide status updates that I just talked about. And robo can also help you manage your Jira space.

And you don't have to man manually manage that. Those are areas that are going to improve your productivity significantly. But there's also an experimental set of, uh, um, areas that I think I would encourage customers to try out.

For example, uh, Setting Up admin tasks in Jira can now be done with AI significantly. Well, so you are a Jira admin and you wanna manage the permissions, the access and all that stuff. AI can come in handy very well over there as well, right?

Uh, and when you talk about agents, the ability to create no code agents, meaning literally by prompting, and you can say, okay, this is what I want to do, right? And you no need to know any code is extremely powerful. Yesterday in the keynote, we demoed how you can use Atlassian studio to create a app for Jira without writing a single line of code.

And that would've required your IT team to do a bunch of coding. You know, similarly, we just did a podcast where we talked about how Atlassian human resources team is using agent AI to onboard new employees. So every new employee that joins Atlassian now has an agent called Nora.

That individual can talk to Nora and get all the answers around their onboarding. And the best part is personalized. So if you're in legal and I'm in HR or finance, it's personalized for our onboarding because your onboarding is probably different than my onboarding.

You need legal context, I need HR context and all of that stuff. Nora manages that. And guess what?

It was written or it was created by two individuals in HR organization who have no idea how to write code. Hmm. Previous to AI that would've required working with the IT team, getting on their backlog, creating code, publishing code, testing code, and all that stuff.

In the world of AI onboarding is something that every company does, but onboarding through agent is a now a proven playbook that our customers and everybody can apply because you don't require any coding skills, special skills. And by the way, our HR team feels very proud of it because they did it without requiring any help, which is an incredible, uh, milestone in my opinion, you know, Which is all sounds pretty amazing. Hey folks, you heard it here.

AI agents are gonna be your new best friends at work, and maybe you might actually enjoy work a lot more than ever. Hey buddy, thanks for coming back to you. All right, and we'll be back in a minute.