PlatformCon 2026 and the AI Code Flywheel | Platform Engineering Ep 13

Hey everyone. Welcome back to our Platform Engineering show. Well, you probably already know this, but we've been on a bit of a hiatus lately because my friend Luka here, well, life jumped up and got him.

So he's been experiencing life as a daddy, and we've just been missing each other, as often happens with newborns in the house. But I'm glad to have him back here today. Luka, how are you?

I'm great, and it's great to be back. Yep. Well, it's great to be a dad too, though.

org community, doing a lot of different things. Actually, we're going to talk. Why don't we start there, Luka?

Yeah. What's new with the community? org?

I know we're coming up near Platform Con time frames. Give us a report. Yeah, there's a few things.

There's a few things. So one is we announced a world tour for Platform Con. So we basically have our flagship week, which is the event that people are normally familiar with.

It's the end of June, last week of June. And it basically is a hybrid of virtual talks, virtual workshops. We have about 40,000, 50,000 people that connect virtually throughout the week.

And there's panels and there's virtual round tables, virtual workshops, all sorts of stuff. And it's all for free. And then we have two live days, one in London, one in New York, on the Tuesday and the Thursday.

And you're going to be at the New York one on Thursday. Yes. And those are where we have about 1,000 people, give or take, in each location, coming together in person.

We have incredible locations in both cities, so that's going to be really fun. And what we decided to do is essentially replicate that model of just the live day format of London and New York and bring it as a standalone to other regions around the world, because there's platform engineers everywhere, not just in London and New York. And so we're bringing it now in the second part of the year to Paris, which we already did last year.

Went really, really well. As well as also São Paulo and Sydney. And so we're really excited about that.

And maybe there are some more cities that we're going to announce that's in the works. But for now, this is the world tour that we announced, and we're really excited about it. I love it.

I'd love to go to Sydney too. It's one of my favorite cities. We'll talk offline more too.

Singapore is a place to do it too. Singapore- Because Singapore is a tech hub ... also what happened is already one of the local communities reached out from Auckland, so platform engineers meetup in- Well, if you're already in Sydney, yeah, jump into Auckland- Exactly ...

is an easy. So that's what we're going to do. So the week before we're doing a thing there.

And you were mentioning Melbourne too the last time, so maybe we should just- Yeah, Melbourne. Well, Melbourne is, no offense to Sydney, I love Sydney, but Melbourne's the tech hub there. Yeah.

Right. Exactly. Great.

So like to your point, once you're there, you might as well. Yep. Right?

So. Excellent. And so any information about the June Platform Cons in terms of keynote speakers or anything like that, or it's too early?

Yeah. So no, we already have a good bunch confirmed. We have the usual, like Kelsey Hightower is going to be in the New York event.

We're going to have Gregor Hohpe, we're going to have Nikki Watt. We are going to have Caroline Wong as well. Oh, very cool.

Yeah. I think the interesting thing is we talked on the podcast before about platform engineering really becoming increasingly the operating model for the modern enterprise and moving beyond just the traditional infra and DevX focus into security, observability, obviously data, obviously AI. And so this is, I think, what also Platform Con is coming to represent more and more is not just the focus on application developers and DevX, but really like, okay, how do we interface with security teams?

How do we think about policy and governance as a code? And that's where Caroline and a few other speakers are coming in to really give other perspectives from sort of all these adjacent verticals. Because increasingly what we are seeing at Platform Con is enterprise teams coming increasingly as a team, as an org, right?

15, 20 people coming from the same company to really, A, figure out what's the lay of the land in platform engineering and talking to the vendors, figuring out what's the new tools, what's the stack, how's it evolving, but then also really to get this kind of interdisciplinary understanding of how do I think about this complex org transformation that is platform engineering across these different perspectives. And that's one of the main focus in terms of the content program that we wanted to have. It's funny, I know Caroline Wong, Luka.

10 years- Yeah ... maybe more, 12 years. She's great, right?

She's amazing. She's an amazing woman. First time I had her speak at our DevSecOps event at RSA, I think she was eight and a half months pregnant.

Wow. And here comes Caroline. I'm not making fun, but she's basically waddling down the aisle to get up on stage.

I was so afraid she was going to go into labor right while we were doing this, right? And she delivered a killer session, and she's spoken at so many of our events, and she's become a personal friend. Now she actually has a new book outAnd it sold out.

It was one of the few books that sold out at RSA this year on AI security. Mm-hmm. And how to do AI security.

Was that the main topic at RSA? The main topic at RSA this year was agentic. Right.

Agentic AI, securing it, using it, what to do about it. It's changing our world. Yeah.

And I spoke to Carolyn. Actually, Carolyn spoke at our event again this year- Yeah ... at RSA, and I spoke to her off camera.

I had a chance to catch up. Yeah. Sam said it was a super fun session.

Yeah. She's great. But, we had some good-- We had Guy Poe really from the AI- Yeah ...

native dev community. Yeah. His session was amazing as well.

Yeah. But it was tough this year because they made some changes to RSA, and our room was up on the third floor, and they had sandbox under us, and it was hard, and they gaped-- Traditionally, more than half of the people who come to our sessions at RSA are not security people, to your point about not being- Yeah ... DevX.

I usually get about 50% security people, 50% DevX, DevOps. Right. But they did away with the free expo pass, so you had to pay- Mm ...

I don't remember what it was, $150 or $175. So it used to be free, the expo? Right.

Well, it was a $50 fee, but they gave away codes- Okay ... that you could get it for free. Right.

I had unlimited free codes. Right. So that's how we would bring the DevOps community in, because a lot of them wouldn't stay the rest of the week.

Yeah. You know what I mean? For sure.

They were there for that. But that being said, certainly agentic AI was the theme in all of its flavors. But what's happened since then, Luka, and I'm sure Carolyn's going to talk about this, this Claude Mythos- Mm-hmm ...

announcement came out, and then just yesterday, we're recording this on Wednesday, 8th of April. Yesterday, Claude announced a, what do they call, Project Glasswing or something like this. Mm-hmm.

Basically, they're making Mythos available to 40 companies only. Some of the companies are their competitors, including Google and so forth. And the reason they're doing this is basically Claude Mythos breaks every piece of software on the planet.

Right. Yeah. Right?

It has found critical, not just nonsense, nuisance bugs. It has found critical vulnerabilities in virtually every operating system, every browser, just about every piece of software they've aimed it at. And the fear is not only does it find these vulnerabilities, but you could weaponize them using the tool.

Yeah. This is Defcon Level 1- Yeah ... for the security world.

Yeah. Some of my best friends, Rich Mogull, Gadi Evron, people I really, really respect in security are ringing the bells that if this... And it's going to get out.

You know what it is. No, I know. I mean, it's already out.

This is like "Jurassic Park," right? Yeah. Life will find a way.

It's going to get out. Yeah. And when it gets in the wrong hands, all hell's going to break loose.

And I think that's why at the platform level- Yeah ... we have got to be building resiliency, capital R resiliency, man. Capitals all the way through.

Yeah. Because it's going to happen. There's going to be vulnerabilities, there's going to be exploits, there's going to be repercussions, right?

And we've got to be able to kind of roll with the punches and recover here and keep the lights on and the wheels moving. Yeah. And I think that has to be, if it's not already, but having Carolyn there is going to, I think, spearhead that, but that has to be a major focus of platform engineers- Major.

Major next- ... foreseeable future. You were already saying I was at KubeCon in Amsterdam, and we had actually this really interesting series of conversations, actually.

One was a round table that we did together with Chainguard. And then we did another one with Claude Smith, right? And so there was again, obviously they're looking at vulnerabilities.

We talked a lot about security, and it was super interesting conversation. And one of the guys was this very brash, he kept interrupting other people, which is actually makes for, I think, a fun conversation. " Right?

In an agentic AI first world, what else? And I think he said it in that very direct way, right, and I disagree that it's just about that, but to your point, it's mostly about that, I think at this point, right? It's going to have to be, because everything else is broken otherwise.

Yeah. And if you don't, that's the table stakes, right? If you don't get your security in order, if you don't have governance, then everything else, nice DevX, nice whatever, it's all nice to have, right?

And so I think this is the interesting thing which In a way is very fascinating to me because we've been talking about platform engineering, we've done platform engineering for the last whatever years. But I think nobody would've predicted that you'd have this obviously this huge AI spike, but then that essentially would mean that platform engineers all of a sudden are one of the most essential roles. Well, but this is the same thing that happened in DevOps.

Mm-hmm. DevOps became DevSecOps. Right.

For all intents and purposes, every DevOps company was a DevSecOps company because security eats its young. Yeah. You know what I mean?

Security just becomes that critical to it. In addition to the Monday event that I think Sam was at, on Thursday, I did my talk. I do a talk every year at RSA, right?

And Thursday was my session. Thursday morning, I did it with my friend Mitch Ashley. Mm-hmm.

Mitch from Futurum. From Futurum. This was even before the Claude Mythos announcement.

But it was really what is fundamentally changed in the dev life cycle here, right? And with platforms and everything else. The world I grew up in, the world that you've come up in, Luka, was based on humans can generate X amount of lines of code an hour, a day, a week, whatever.

That code, if we use things like platform engineering and DevOps and Agile, that code makes its way into the pipeline and we can test it, we can do all these things and move towards deployment, right? And then managing it after deployment. Part of that food chain was that humans develop X amount of lines of code, and security can scan X amount of lines of code.

So there was a balance, right? There was this balance. It was a break on the system, if you will.

We just couldn't generate more code than we generated. Yeah. And so we only had to test that amount of code.

And then from the test, and that's what the whole AppSec, like Carolyn Wong is huge AppSec. The whole AppSec world, Luka, was built on humans using tools like Metasploit and stuff like that, using scanners to scan code for vulnerabilities. Yeah.

That's it. Well, now what happened is that break has become a flywheel. AI allows us to make as much code as we want.

We could write as much code. You could build anything, right? I think platform engineering, as much as we've talked about automation and being able to remove friction, I don't know if we really thought it all the way through to this extreme where- Yeah ...

AI, where code's liquid, code is- It's free, yeah ... infinite. Yeah.

It's free. Yeah. But now what we've seen with tools like Claude Opus and some of the scanners, you know what?

Finding vulnerabilities is free, too. Yeah. We could find as many vulnerabilities.

Well, but then, you know what? I find interesting, right? Also, I appreciate how good they are at marketing, right?

Anthropic. Because they are really good at combining this fear element and sensationalist and syncing it with their product launches. You can go back and see every Dario appearance on CNBC or whatever, where he's like, alarm bells, blah, blah, blah.

It was always two weeks before a product launch that then would address that thing. So they're definitely playing the game. So, we'll see what happens with Mythos, right?

But I think what's interesting is they'll release this, I think a week, 10 days after they had this huge fuck-up of actually- Well, no. So there were two fuck-ups. Right.

First, Mythos was pre-announced before they were ready to announce. Right. And then a few days after that, this code leak came out.

Now I'm going to tell you something, my opinion, they were both staged. Oh, yeah. I don't think either one of them were real.

I think both of them were staged to ratchet up, put pressure on OpenAI, put pressure on the market, and maybe to grab attention. But what we're talking about here is the vulnerability apocalypse. Gadi Evron, he had a great-- Gadi and a bunch of friends did a conference in Vegas, I think it was called Unprompted, a couple of weeks before RSA.

They nailed this. Gadi and a woman from Google called this shot six months ago. Nice.

" Yeah. We're not automated enough. Well, the focus is no longer on finding these vulnerabilities.

The focus is on governance. Yeah The focus has to be on resilience. The focus has to be on prioritizing what we need to fix and what we don't need to fix.

And I know where you're going with anthropic, but let me tell you another thing that came out yesterday. No. Just a bit.

Leave alone the anthropic thing. But I think it's whether these stages are or no. I think what we're seeing, just to make your point, is that there is this, not only the models are getting better and better at going back and finding vulnerabilities, but we're generating new vulnerabilities at a much higher rate because they're- Well, we're not.

You don't think- We're not generating vulnerabilities at a higher rate. So here's the deal. If you look at human-generated code, the amount of vulnerabilities per 100 lines of code, it's been constant for years.

Right. There's X amount of vulnerabilities per 100 lines of code. Code generated by AI, it started up here, way more vulnerabilities per 100 lines than human.

Right. But sometime around October, that line started coming down. And sometime around January or end of February, it kind of drew even.

Yeah. We're relative, right? And now it's below.

Sure. But we're releasing 100X more code. As a bro, exactly.

Yeah. So it's not the rate of vulnerabilities- So it has to have more vulnerabilities ... it's the amount of- Yeah ...

that's the apocalypse. Right. Exactly.

When you've got 100X more code- Yeah ... theoretically you're going to have 100X more vulnerabilities with the ability to find 100 and scan and find- Right ... all those vulnerabilities.

All of those things just break- Yeah ... they break the system. Yeah.

And there's another point I want to throw out at you. I don't know. Did you see the OpenAI announcement yesterday?

Which one? So OpenAI- Because they have one like every day Yeah, no. So this is not purely security-related.

Uh-huh. But OpenAI released a paper about, they're calling it the AI New Deal. Oh, yeah.

And- I saw that, but I haven't read it. No. So what is it about?

And he did, what's his name, Sam Altman did an interview with Axios on it. Yeah? Basically, he didn't come out and say super intelligence or AGI, but he said the newest models in the industry, not just theirs, meaning anthropic, there's a lot of models out there now, are on the cusp within not a year, not three years from now, within months, of basically breaking capitalism.

Right? Right. Look, so here in the US we had what we call the Age of the Robber Barons.

Mm-hmm. When the Industrial Revolution, Andrew Carnegie owned the steel market. John D.

Rockefeller owned the oil market. The Vanderbilts owned shipping and railroads. JP Morgan owned Wall Street, banking- Right ...

finance. The wealth of the US, and it wasn't the US that it is now, but it was still a wealthy nation, was concentrated in the hands of 25, 50 families. Yeah.

Right? It was good and bad. We had tremendous growth.

But these people at the top, your typical oligarchy, and Italy went through a similar thing, I think under Mussolini and a lot of these things, the oligarchs. It took major legislation and change, and it took us 40 years in the US, because the Great Depression came out of this. And it wasn't until FDR came in, Franklin Roosevelt came in before World War II, right before, and did what they call the New Deal.

Right. Things like Social Security and the safety net and antitrust, and broke up the robber barons. They came out and said, "If you don't break this up now, there's going to be five to seven companies that control the wealth of the world.

" Right. " Yeah. And so how we- There was this interview with Elon on the- Elon Musk has a similar view on this.

Yeah, where he was like, they were asking him, he went on this The Stripe Guy podcast, and there's this three and a half hours conversation where they kept at different points of the conversation, pressuring him on like, okay, but is it actually sustainable? Because we're putting so much money into... He's famously built Colossus one and two, this- Yeah ...

huge data centers and so on. " Right? And it's like he's like, "Look at- And that's- You know?

He was like, "Look at the- That's the truth ... " In a heartbeat. In a heartbeat.

Yeah. So it's like, yeah. It's a crazy time, man.

It's a crazy time. This is it. So when you look at all these signals, now, but what does that mean for platform engineers?

What does that mean for security people? It's not a time to be afraid, though I think fear is healthy. Mm-hmm.

It's a time-- I think it's also a tremendous time of opportunity, right? Yeah. There's going to be opportunity here.

There's going to be- Huge ... wealth created- Huge ... and great things to do, but you got to go seize it.

You've got to figure out what does my platform look like in a world- Yeah ... where there's 100X more code, 100X more vulnerabilities, and 100X more users of the platform. Yeah.

Well, and I think interestingly, this quickly applies to everything even outside of IT, right? Oh, sure. Oh, no, this isn't just about IT.

Yeah. This is the world changing. The way you think about anything needs to be like a system thinking that starts with a platform.

What's my platform? What's my governance? Because then code is free, but media is free, right?

Anything that we've done on these screens basically- Is free ... is terminally free, right? And so, it's like, yeah, what are the constraints that you put around that to build some sort of an advantage?

But I agree with you, and I think at the end of the day, we've seen it before. We've seen it with internet, we've seen it with mobile, blah, blah, right? You've had an enormous amount of new millionaires that were minted out of- Yeah ...

whatever. Yeah. There will be wealth created- Like super fast, right?

but there's always disruption. We've already seen- Disruption ... the first one-person billion-dollar company, right?

This guy that was selling- Yeah ... GLPs or something, and- Uh-huh ... a bunch of agents.

Crazy. But yeah, so obviously that's happening. I think obviously, you and I also work a lot also with large enterprises.

Those are the ones that are interested in platform engineering, security, and so on. I'm really interested in that aspect as well, right? So what happens to the enterprise?

Because obviously you're going to have all this net new wealth creation that we're talking about can happen with a way more reduced amount of people, right? You don't need to scale up to 100,000. Look what Oracle-- Did you see what Oracle did this week?

Yeah, they just fired 30,000 people, right? 3,000? No, like- ...

30. 30. Yeah, 30.

Basically, they laid off, I know, I forgot what it was, 12%, 15% of their workforce. Yeah. And not because they're replacing them with AI.

They just wanted to take that money to build out more AI data center, more AI infrastructure that they can then sell customers onto. Yeah. But what does that mean?

So think about that. You're an enterprise. You've got, I don't know, 250,000, 300,000 employees.

That's a crazy amount of employees. Yeah. You fire 10% of them, 30,000.

You don't think that affects your business, your ability to deliver, your ability to innovate, your ability to be resilient? Do we have that much fat? I think so.

I think so still. And this is still hungover from Zerp era, right? If you look at the people that actually took the medicine in the last three to five years, and some of the tech companies have.

Like Meta has done big restructurings. Amazon has done big restructurings. Twitter famously, Elon came in and fired 80% of people, the company still worked, right?

And then you got to ask yourself, it's like, okay, well, if you then move down, I think, the ladder of fast movers, right, and you go to the slower movers, and you go to companies like, I don't know, whatever, name your favorite enterprise, right? Then have they done the RIFs? Have they taken the medicine?

I don't think so. Not as much. Also, to be fair, they hadn't built up as much fat as- They didn't hire like drunken sailors during COVID either, right?

Exactly. There is some of that. But then you have this AI thing coming, and it's like, okay, well, where are you?

And that to me is really the interesting question, right? Because I think even if I look at my personal experience, selling, for example, into platform engineering teams, right, when we were developing a tool, you'd have all these weird political conversations that essentially where you could never say a tool is replacing a human. You know what I mean?

It's like- Yeah ... it was a taboo thing to say, right? It was like, "Oh-" Right.

But today it's not. But it was true. And now it's like all of a sudden, you see this cultural shift where people are like, "Okay, well, this is just happening.

" And so that to me is the interesting inflection point in how I think enterprises are going to think about- Society ... buying software. It's beyond enterprise.

It's how society looks at the value of a human worker. As well. Yeah.

But in some ways, right, it's like be careful what you wish for. Because when we started talking about platform engineering and building these platforms, right, we wanted to set up platforms that would allow us to go faster- Mm-hmm ... allow us to automate more, right?

And so now we see it coming through, right? Mm-hmm. And so in many ways what we're seeing is the culmination, if you will-Or the coming true of our wildest sort of dreams or fantasies about being able to scale these things.

Because now we're talking scale, right? Now we're talking scale. Yeah.

It's no longer human hands. It's wild. But that's going to be, I think, our main message, going back to the community and PlatformCon, that's going to be the main thing, right?

It's like, hey, it's exactly what you said. It's like be careful what you wish for, right? Because now my friends sitting in the audience at PlatformCon, you're going to be the ones that need to figure this whole thing out.

Someone's got to. Yeah. Hey, man, so it's the week of, I think, June 25th, right?

It's that Tuesday and Thursday are in person. Monday to Thursday is online. Yeah.

So Monday to Friday is the virtual event, and then Tuesday we are in London, on the 23rd and 25th of June we are in New York. Perfect. Yes.

com for more info. Yes. I love it.

Hey, Luca, I'm going to let you go take care of your little son there. I got to get on. I got to go do more interviews, more Techstrong TV.

Awesome. It's great seeing you. I hope to see you in person soon.

Well, I'll see you. I'll see you in Sicily in two... Well, no, we'll see you- A couple weeks ...

before that. Yeah. Okay.

Sounds good, man. I'll be in touch. Sounds good.

All right. org. " We'll be back with another show soon.

Until then, though, we're out.