エージェント時代のウェブを守る：Cloudflare CTO Dane Knecht が語るセキュリティの民主化

AI has become the tool that's causing this kind of security apocalypse. It is also the tool that can help us evolve it faster as well. It went from having to get everyone just using AI, now all of a sudden everyone's racing to figure out what AI security means. I've heard serious technical people say things like, fear gap, everything important, and we're not going to be able to trust the internet for a while, and we just assume all the critical infrastructure and government services fall down at some point. Is that your expectation for what happens? Zane, I'm so excited to do this with you. Yeah, thank you. Thanks for coming here, too. I'm sure I'm not the first person to make this joke, but your last name, Connect, that's pretty good for the Cloudflare value prop. Yeah, yeah. There's been some jokes about renaming the show next year. So with everything that Cloudflare is doing, what are your top few priorities as CTO right now? Well, I mean, this past year, it feels like 10 years impacted into one.

So those priorities are constantly shifting. But, you know, it all goes back to our mission of helping build a better Internet. And that really hasn't changed over the last 15 years, where we want to make sure that the Internet is secure, that everyone has access to be able to get their content online easily and scale it up. and just, you know, over the arc of the AI changes in the past year, you know, it went from, you know, how do you get everyone just using AI, how do you make it easy for them to deploy and their agents deploy, to like most technical transitions, security is kind of an afterthought. And now all of a sudden, everyone's racing to figure out what AI security means. And it means things for different sides view it kind of differently. You know, one side is, you know, as a company is how do you keep your data safe from AI leaking the data out? But it's also how do you keep people from getting in as well, too? And, you know, over the last, I would say, three to six months, just the number of vulnerabilities that are being reported in CBEs has just gone up exponentially.

You know, previously on the Internet, we would see these log4j moments or these shell shock or type of incidents maybe once a year. And it would be all hands on deck internally south there to make sure how we protect not just, you know, our enterprise customers, but also our free customers because we view it as kind of just a public good and making sure that the Internet stays safe. These things are now happening weekly. Not all of them are publicly reported on, but there are things that are as serious as the log4j type things, but it's happening at a greater frequency. I expect that the rest of this year and in the next year, by the next 18 months, the majority of teams' time is going to be spent on security. I think there's a stat that was put up earlier today during one of our keynotes where it was showing that I think over 50% of engineering time is going to be sort of spent on securing.

And I don't think that will last forever. I think that will be a short transition. You know, at some point, the AI will have surveyed the majority of the code and found most of the bugs or found most of the shortcuts. You know, there's one that's kind of coming out today and has been started to be blogged about and tweeted about where one of the keys on the Internet that protects all TLS and WebDKI, which just secures all your connections, was secured by the number four. Literally, they basically used... You know about cryptography. It's all about randomness, right? That's like software hazard lava lamps so that you can get the randomness. and when a key out there is they use the seed, they use the initial thing to kind of create it with a single number four, it's going to be reverse engineered.

And AI can just do all these things that doesn't sleep. It's not like the one engineer you had that was red teaming things. You know, last week, I think OpenAI found the seeds for the NIST curves that were back in 2000 that were released. So just, you know, these things are just moving so fast and the bar is going up and the models are just getting so good at, you know, cybersecurity. You know, Mithos was just kind of the tip of the iceberg there where, you know, and since then, it's not just been the models getting better, to harness this. It's how people know how humans know how to use them and use those frontier models in order to find those exploits. Given your visibility, what do you know about the humans behind these attacks and harnessing these models and taking the volume of vulnerability discovery up so quickly? Are they

nation-state actors? Are they script kiddies? What can you say about how the attacker landscape has changed? Well, I actually think that some of these larger vulnerabilities that have come out more recently actually haven't been nation states. They've been high school kids even that are... We're going to call them agent kiddies now. Yeah, that are just spending their time. They used to do kind of capture the flag security contest. They're pointing their agents at an area and doing that, you know, there's also, you know, and there's just financial reward for them. There's buck bounties that they get paid out of sizable amounts. But it's given the tools that honestly the nation states have had in some forms for much longer, either through agents or just through, you know, sure number of people that were working on the problems, giving it to the masses. This is the first time in 15 years I've heard serious technical people

say things like, well, we should just like intergap everything important and we're like, you know, not going to be able to trust the internet for a while and we just assume all the critical infrastructure and government services fall down at some point. Is that your expectation for what happens? Humans, we are pretty adaptable and we can move fast when we need to. And, you know, I've seen the industry kind of partner together. So when things like this happen. People that usually think of competitors are no longer competitors. We're just literally protecting trivial infrastructure, as you said. And I think when those kind of critical moments happen, people have been wise to that challenge. So on a little less doomsday, I do think that a lot of the things that we've done over the past five or two years, moving away from a kind of a castle moat infrastructure for security to moving to more of a zero trust, does put a lot of companies in a better position where You're not saying this office is completely air-dap.

You're saying these devices, these flows are secured in a different way, and everything's going to be tightened. What is it going to take for organizations to do what you're describing? Like 50% of engineers do not work on security right now. I had Greg Brockman from OpenAI on the No Priors podcast last week, and he said that he thought in 2027 people were going to spend as much money on tokens for security as engineering, like you're saying, a very related idea. What is going to drive that shift? This emergency, right? So you're going to move forward all your security spent over the next 18 months, both from the red team side, which is more the offensive, trying to actively try to exploit things, as well as the expensive side, how you prepare things. But I don't think that's going to last forever. You know, I see a world in like 18 months where, you know,

new software productivity goes way up because all those resources are back focused on that. But there's definitely the same in this period where security is going to be on everybody's mind. What are some of the key elements of getting to a better place in terms of overall software and Internet security? I think people discover, of course, that there are libraries and services everyone uses that had vulnerabilities that took effort to discover and now do not. And I think we'll hit some of those. What else is important there? because part of the concern that I have is the rate of software production is also going up a great deal, right? So to some degree, we've got to go, like, patch everything that we have already made and then keep up and get ahead of the pace of delivery. Yeah. Also, I mean, for one, right now we're patching 70 years of software out there. So it is just catch up.

and then on a go-forward basis, you know, I think the software development life cycle, the agent development life cycle is going to need to change and, you know, luckily the same way that we can use security right now for Red King and things like that, it'll just be built into the process every step of the way and I think the software will just get more secure over time. What have you learned about building secure production software internally already that you think people can learn from? Like, what does that mean? Like, shift left, and, like, can we... There are many theories of how to do this, including, you know, broader use of formal verification, using agents for security in the development process. Like, what do you think is going to create better software from first delivery? I kind of go back to first principles of theirs You want to reduce your attack surface area The easiest thing you can do is to give less places for there to be vulnerabilities

So, you know, looking at all your software and saying, how can I simplify this? How can I reduce the footprint, the code? And then, you know, beyond that, things like formal verification and I think things that are safer programming languages and things that are kind of built into the runtimes that make everything safer will come, but I think it just starts with AI, at least the early AI is very verbose and likes to create complexity. AI, in a sense of what we've been dealing with, has actually not been helping build a more secure stuff right now, but I think it will get there. That's where humans still come in and human judgment comes in and making sure that we design the software in a way that that can stand on some security. That was actually going to be my reaction when you say we want to reduce the surface area. I'm like, oh, yes, of course, in principle. And that's not the natural inclination of today's models, right?

And, like, you know, I asked you to do something, and I'm like, well, like, with one-tenth of complexity, please try again. Is that the role of engineering and security engineering today? Is that something that's going to be solved at the model level? The way that humans did it before agents, it needs to be solved at all levels. You need to train the engineers that are writing the code, the product engineers. The security teams still need to be involved in making sure that they're getting checks and balances, second set of eyes on things. You need to build in processes. We've gone to defining things a lot more internally on how we built a Cloudflare, writing down our principles. we have a document called the Codex, which is kind of like a buildup of a lot of RFCs that the teams have built. Here's how you build secure software Cloudflare. Here's how you build available software Cloudflare. Here's our best practices. And then it kind of gets boiled up into some 10 commandments that the agents know how to follow and use in every part of the review process that can help enforce those things.

So, you know, you have agents out there that are, you know, just riding a lot of the slop, and then you have deeper down in the factory, you have people that are doing the performance runs and the security runs. And just like helping a company operate before, you need those adversarial reviews. When you zoom out a little bit and just look at overall traffic on the Internet and how much of it has become agent-driven over the last year, I think it's outpaced most people's expectations. What has updated in your worldview of, like, what the web a year from now looks like, either from an economic model perspective or a security or requisite infrastructure perspective? Yeah. I mean, I kind of think of it as we're in the messy middle right now where humans and agents are riding the same rails on the Internet, where, you know, agents are trying to parse a human web when it's just inefficient, you know,

and was designed for humans to do things at different speeds, going to a website and be able to read and see the ads and participate in the full economic model versus an agent that now can go to a thousand web pages in the same period of time, which is great. It's just me to find a new economic model to support that. Do we get parallel webs? Is there like a human web and a machine web? Like, everybody's trying to do, what's it called, AEO now? Yeah, I mean, yes, I think we do. I think we find ways to deliver the content and meet agents and humans where they are, as opposed to trying to meet them in the same place. And right now there's, like, translation layers. You know, there's a lot of companies that, like, you know, help you, you know, an agent view a web page. These are just all extra, you know, burning of tokens for things that probably don't need to be, need to happen.

You know, the website usually knows what data, and, you know, we've had things like this, you know, we've had APIs, you know, ways that computers talk to each other for years. It just, you know, APIs only covered a small fraction of the information on the Internet. And agents have a thirst to, you know, understand everything. And so they're going out and trying to explore the human Internet. And, you know, we need to make it easier for them. We need to make it less costly for the site owners, and we need to find a way for them to get compensated. I think it's in a world where you can get very simple. Most of the content website, like a sub stack, they know what their CPM is for how much money they should be making on ads for that site. And so if an agent's reading the site, I think there is a world where you get to the point where an agent can decide whether or not they want to read the content and then they can decide if they want to pay the CPM rate, right? And, you know, that's where you need to then get you payment rails for the Internet that can do, you know, millions of transactions a second for all these little micropayments.

all these things we've been talking about for years. You know, micropayments, you know, these are two years away. And, you know, I think agents will actually push that forward and actually end up in the CEO world where actually there is a new account model for content creators. Who do you think the players are? What are the variations of that infrastructure? Right. Like, I think, obviously, Cloudflare has an important role to play here. but the rise of personal agents like Instinct and Muse have also made this like an immediate question from a transactional perspective? I don't think everyone knows, you know, on the other side what that business outcome is going to look like. You know, everyone's been through these transformations where the Internet, you know, if I was going to kill Main Street, it didn't kill Main Street. The small businesses are still thriving. But, you know, there were people that were displaced, and so there's always some skepticism there. and so there's some natural inclination to just block them out.

You saw Amazon just say, no personal shopping there from an agent. I think these are all people that are that messy middle that they're trying to figure out what that path forward is and trying to keep some of the negotiation leverage there. I think we will get to a place where Muse and Dots and all those personal agents will be able to accomplish tasks seamlessly as you as a human could do, even easier. But I don't know if the technology is quite caught up to that yet, and the business model is either. Is there anything you're personally excited about on the roadmap or just from a technical exploration perspective on the CloudFlare front that you feel like is going to enable this ecosystem in the future? Well, I mean, absolutely. On the content side, you know, we've released a conference monetization gateway

where we make it easy for people to put their sites behind us and take microtransactions for their content, including providing a wallet for agents to use and a stable point that's going to be able to help kind of facilitate that transaction as well. You know, we're also doing things with OpenAI, practical signals where we're making it easier for agents to actually discover content. Instead of having to crawl the entire internet and continually go back to pages, we're making it easier for them to know what's new content and actually kind of more proactive to do that. So, you know, it's a win for the AI labs. as well as a win for the site owners not having to get constantly crawled and pay for that infrastructure. So, you know, there's a whole set of kind of new laws on the Internet that I'm really excited to see all those kind of grow, to see, you know, the X402 from Winstrike for now.

I loved it because it went back to the 402 HTTP code, which was, you know, Tim Berners-Lee created 20-plus years ago, or three plus years ago for payments. So like, you kind of always knew that you needed a better payments rail on the internet, but we haven't been able to, you know, kind of figure it out. And I think agents will lead us to that as well. When you think about these initial products that you've released, like, is there, what would success for a content creator or somebody who ostensibly had a website on the internet that they were monetizing with ads before? Like, what's the killer success case you guys need to see or show the world where it just becomes like a default to do this? Well, I mean, I think we're, instead of them paying us, we're paying them, right? You know, it's covering their infrastructure costs. It's providing money that supports the livelihood.

You know, we can actually increase the number of content creators out there. which, you know, the last generation of the Internet has done very well, like with YouTube and TikTok and actually making it exponentially larger. And when you look at the workspace OS, like release and ecosystem work that you guys have been doing, what are you hoping are the biggest use cases of it coming up? It's transitioning a little to a release called Cloudflare OS. Cloudflare OS is our internal platform for how our employees use AI every day. It actually goes back to security routes where we were very worried about customer data, internal data leaking out and we wanted to make sure that our employees could use all the new AI tools and models but have a way to safely deploy them internally to understand how that data is being used and flowing

and have, you know, kind of good governance over that. In addition, the reason why we call Cloud4OS is we started to realize that, you know, as we have more and more agents, you know, we need to be able to teach them what we call Cloud4 special, how we build a cloud server. You know, and for humans, we did that through Cloud for University and the onboarding process and, you know, meeting your colleagues and working with them. But we needed to more clearly define that and document that for agents. And so Cloud for OS is both the platform where our employees can build anything that they want in a secure way without having, you know, security is not something they have to think about. You know, the BR that's trying to create a call list, they don't have to worry about security. It's built in there. for them, but they also know that it's being done in a way that is consistent with the themes and values of how Cloudflare works. And why release? I think of this as somewhat different from the other products that Cloudflare offers today in that it is not infrastructure.

It's like an end-user-facing product for managing AI use within the organization. Why release it? Do you think of it as a departure? Yeah. I mean, for one, it's kind of a reference architecture, really. It's, you know, over the past 10 years, we've built our developer platform where we started with just a simple serverless compute primitive. And now, you know, over 100 different developer platform tools from storage to databases to durable objects. We wanted to show someone, show how you can build it completely on Flirt and how we built things internally. and kind of give people the option to fork in and build their own version of their own company OS on top of it. And what is the way in which it is helping your people and your organization that you think is like clear success? It's actually used more by our go-to-market teams and our G&A teams than it is even used by our engineering teams.

is giving them a very fast... Early on, I thought we saw training was the biggest gap for people using AI. And when you just kind of point them at a chat interface or another by-putting tool, it's too much of a blank slate for them. And so this is a platform that's designed... You design everything for how your business works, and they immediately can go there and get access to all the data that they need. They can get guided and taken through where they quickly realize, oh, this is not trying to replace me. This is trying to make me better at my job. And that's really exciting to see just all the different ways people at the company have done that. A lot of the... How this conference got put together, the marketing team built hundreds of internal tools where previously they would have to go out and worked with different agencies, but the speed that they can move with the smaller team now is just amazing.

Assuming this is a continuation of, you know, starting in May, you guys did this restructuring to be an AI-first organization. What else, reflecting on the last number of months, has worked or not worked that you would recommend to others? Yeah, I mean, so, you know, the restructuring was hard. saying goodbye to some of our colleagues as the first time software ever did it. You know, we had always been very careful not to overhire, and this was for different reasons. This is because we saw the way AI was transforming some teams and how they work, and, you know, we kind of thought of it as like a factory floor where you needed to actually rebuild, rethink how things happen. You know, there were some processes, there were some, you know, the way a product inventor would send an email forward to customers and involved three teams. It involved a team where you went to BI to go get a cohort of the people

that you wanted to send an email to. You went to the marketing team to help you design the email and get the voice right. You went to the marketing operations team to get the email out. You're never going to be able to actually redesign that process unless you kind of make some hard changes and force people to kind of rethink, well, what actually is the right way to do that? And it might not involve those three teams at all. It might just involve a new way of doing things. And so what came out of that was a tool where a product manager now goes in and describes the cohort. They write an email. It rewrites it in Cloudflare's voice. It sends it to their manager. And the manager can click approve if they like it. And it goes up. We didn't go from three teams getting faster at doing that. We went to, you know, one tool that can kind of let a product manager know if they have a superpower they didn't have before. When you think of all of the different workflows and tasks within an organization that's got about 5,000 people, like CloudFlare,

like, how do you decide who the owner is of rethinking that process? And, like, was it bottoms up from one of those teams in this case? Like, is it an organizational leader? when you have so many of these things that could change to be faster and make more sense, as you described? Yeah, I mean, CloudBird has always had a thousand more things that we could ever do, whether it was products and features or things like this. And so we always look for people that are going to take initiative and ownership. And so it doesn't really matter if you're ordering it one to a hundred and trying to prioritize it. Any one of those hundred things are probably safe if someone's passionate about it. So, you know, we kind of gave people at the beginning of last year the tools and started seeing how they were experimenting. And, you know, people quickly kind of broke out into different cohorts of people that were really leaning in and, you know, just naturally doing those things and taking ownership of them. So, you know, I think it was very bottoms up from how we're going to do those things.

it's been a major topic of conversation for organizations as to how they should think about token budgeting, right? Like, you know, what's a reasonable amount to spend? How do I think about this versus human capital? Who should get tokens even within our organization? Like, what is your philosophy on this now? It's definitely changed. You know, and each model kind of makes you rethink it as the cost dynamics change. But, you know, in general, you know, I think it's kind of silly that we're actually asking humans to decide which model to do each task. Like it should be intelligently routed. Yeah, exactly. Like humans just aren't going to ever be good at that, right? Like, you know, but, you know, early on you do it kind of brute force and, you know, you get people to experiment. And you say, hey, well, you know, let's try for the planning part. Let's use the, you know, the top frontier models for that. And then, you know, once the plan's written out and agreed upon and iterated on,

then, you know, potentially some more of the open source models can go do that. And then you go back and you have one of the frontier models do the reviews and the red teaming and things like that. Now, all of that today is, you know, fairly manual. But I think, you know, as we start to learn and experiment, I think people will become intelligent. And, you know, over time there will be more governance on that. on that. Cloudflare has been a place where largely we've let people use the models and tools that they see fit for the job. We don't have a token leaderboard. We don't encourage it. We encourage people to focus on the output. They're not graded on if they use it. They're graded on what they've shipped and what they've built. But then we do have some kind of, we found giving people notices. If you happen to use $300 a day, just get an email.

It says, hey, did you know? Because most of the time, people didn't realize they were doing it. And they're like, oh, huh. And then I think if it gets to $500, it goes to your manager, if it goes to $1,000, it goes to a VP in a day. But those things rarely happen, and usually people are actually happy to get those notices. Where do you think you are in your overall evolution of, like, take things just for the current level of capabilities of models, assume no new development, of, you know, rethinking the way different things at Cloudflare are done from go-to-market to engineering to be? Oh, I think we're still so early. You know, Comfort did something, you know, two years ago we had about 200 interns, and what we saw was those interns were, you know, really the first fully kind of AI native where you took AI away from them, I don't think they would be able to work. Is that good? Actually, I think it is. They know how to use the tools better than us.

It's just like you took Google away from me over the last 10 years. You know, how would I learn anything, right? That's where they reached you first. And we actually saw the managers that had interns from that summer actually adopt AI faster. So then this past summer, this past year, we decided we were going to hire 1,000 interns. So that's, you know... For a 5,000-person company? Yes. Wow. Yeah, over the course of the year. Yeah, still. Yeah, and it's just been amazing because, you know, one, just a number of ideas that come from the interns. You know, that's something that, you know, with AI lets people experiment faster, and so having more ideas, getting more people in there, but also just seeing the way that they use AI, like, you know, they need to fill out a form. They they they betray AI And I and I still find myself you know there so many things where I like oh wait I just been doing this manually still And then I like yeah wait I should be using AI

And I don't think that that's natural for most of us yet. And I think that will take time. And so, yeah, I think we're still very early in our AI journey. I love it, though, the mass intern strategy. I run a very small partnership, and we always have an intern or two floating around a team of about a dozen for ideas and intern energy and all that. But we just converted one of our in-college interns to full-time and had them drop out and everything. And I think that you're right where maybe the dial should be turned up on the amount of DNA that is really, really native to these tools. Yeah, I think it's great for them as well, too. You see these schools like Waterloo and Northeastern with these co-op programs. And from what we've seen is people that get that type of real work experience are some of our best employees many years in and go on to do great things.

it is interesting or encouraging though that instead of it being like, hey, here's a master plan. We're going to map out every department and sub department at Cloudflare and be like, here are the key workflows. We want to try to re-engineer the workflows. It is instead of a strategy of like, assume people are rational about their tokens. If given information about their usage, hire a bunch of interns and assume high agency people we have here are going to go like, you know, shift, shift those workflows to something more intelligent over time. And then brute force and just try things. You know, early on, we had an email alias called Agent 6 Cloudflare, where we, this is back in January of this year, where we just told people to, you know, if you're curious, can I use AI for this? You know, email in, your job's to be done. And that email list would reply back to the skill file. And for a while, people thought it was actually, you know, thought it was all AI and automated. It was actually a bunch of interns that were helping people write still files.

But that let us kind of get to see, you know, in a way that's not going out and like, you know, hiring a consulting firm to come out and like catalog every single thing to be done. It's, you know, people that are recognizing, hey, this seems harder than it needs to be. I wonder if an agent can help me here. Is there anything else about the last year that's changed beyond the intern level, like your hiring philosophy? once you look for people to bring on? Well, I mean, one of the biggest things we always look for is curiosity. And so, you know, if people aren't using AI at home in their personal life and all that, I mean, that's a pretty big red flag. Like, how can you not be embracing AI if you have a level of curiosity out there? So, you know, I think just doubling down on some of those kind of key characteristics of, you know, drive and curiosity and empathy play even better for this next set of people?

Well, I mean, I am an alpha user of all products and technology forever. But I think the answer is, like, fear and skepticism, right? And so I guess implicit in this claim about, like, curiosity, including an experimentation with Frontier Tools, that needs to be a core principle for people who work at Vansler. Yeah, I mean, a lot of things we're doing, we're not, you know, we're inventing new ways of doing things. I mean, the scale that we operate at for the number of sites behind us and the amount of free services we give away, it's just not possible with off-the-shelf technology. So you need people that can come in and literally invent new things, and that starts with curiosity. I have a couple questions for you to close out, and it's mainly about security and how to do that in a new way, both at Cloudflare and then how you think it's going to work in the broader ecosystem.

What do you think is the process by which if half the engineering team is going to go work on security and just fix 70 years of vulnerability, how do you attack that problem? Internally, assuming that not all software is perfect even amazing production, internet scale software and then we'll talk about the ecosystem. Yeah, I mean, I think largely today we have one red team I think by the end of the year next year we will probably have four or five red teams so break people out into groups that are actually being more adversarial and actually going out and actively trying to find vulnerabilities. Why is it the approach when instead of like, oh, we're finally going to get our patching systems right, our processes right? I mean, processes and those things can always be better. We have a vulnerable process. We have a patching process. Really perfect, no. But the best way I've found for those

types of things to get better is to, out of crisis kind of that's how you get those things fixed. You know, when the volumes get too big for the engineering team to just do them using their normal processes, you know, engineers are inherently lazy in a good way. And so they will automate away those things as they need to, as they kind of realize that there's no other way to do that. So, you know, I think the focus needs to be on the discovery side and, you know, people will do the right thing and figure out how to patch it in a single way over time. Do you express a philosophy on just prioritization of this versus, like, shipping new features? Because I guess my understanding of, it's not as if we didn't have a backlog of, like, vulnerabilities and every large piece of software to go fix. It was just, like, whether or not that was a priority for engineering teams previously, as one common state.

I mean, I think you need to figure out how to do both. You know, it might come at the expense of cost optimization or other things, but I mean, companies, if you're not shipping, you're buying. That's how we think about it. So it's not going to be free in order to do this. No, absolutely not. You need to be able to continue building and shipping new things, but you need to be able to make sure that you're doing it securely and patching and fixing bugs. And I think if we do it right, we'll actually be able to do them both faster with AI. While AI has become the tool that's causing this kind of security apocalypse, one apocalypse to happen, it is also the tool that can help us solve it faster as well. So it's on both sides of it. Where do you fall in this debate of the role, like good and bad, of open and closed models on the cyber front, right?

Because the argument, the broad argument is, well, having defensive and offensive cyber capabilities, you know, they're parallel in the same model despite safety and guardrails being built into them. And so you can't have open defensive models without them also being offensive. And the argument sort of that were the concern around only having security capabilities in a set of frontier closed models as well. How are you going to release them? And you can't possibly get them out to the distributed set of actors that need to defend. Like, what do you think? Or did I characterize that correctly? Yeah, I mean, I think over time it all has to be open because everyone's going to get access to it anyways. and, you know... That's how open source tends to work, yes. The bad guys are going to find a way to get it. So all URs, and the top companies will have a way of getting it as well. So you're just excluding a mass population

that just doesn't have the access that probably needs it. And then, so final question, just because, you know, Clouds are very mission-oriented, does carry the weight of some, you know, Internet resilience on its back. What about all of the people who can't afford to have four red teams or, like, never had a red team to begin with that run important systems? How do they protect themselves? So, you know, I would say put your sites behind software, put your infrastructure behind software, build on software. You know, when these major vulnerabilities come out, like the React one last year, we don't just give it to our paid customers who have the advanced firewall and WAF capabilities. We give it to everyone. We view those kind of things as part of the utility that we offer. And we want to provide that. We want to provide performance for everyone. Before Coppola started, there were probably 3,000 sites in the world

that had a large-scale CDN to cache their stuff at the edge. Now there's hundreds of millions of sites that do. So, you know, Koffer's always viewed our goal as providing democratizing the security and performance for everyone. Awesome. Thanks so much for joining us, Dane. And you guys heard it first. We have the agent kitties and the vuln-pocalypse. Am I pronouncing that right? Yeah. Yeah, but it's resolvable. All right. Thanks so much, guys. Thanks. Find us on Twitter at NoPriorsPod. Subscribe to our YouTube channel if you want to see our faces. Follow the show on Apple Podcasts, Spotify, or wherever you listen. That way you get a new episode every week. And sign up for emails or find transcripts for every episode at no-priors.com.