*This transcript is produced using transcription software and reviewed for quality. Despite our best efforts, some passages may be incomplete or contain errors due to audio quality or software limitations.*

John Richards II:
Welcome to Cyber Sentries from CyberProof on TruStory FM. I’m your host, John Richards. Here, we explore the transformative potential of AI, cloud, and cybersecurity. Where rapid innovation meets the need for continuous vigilance. This episode is brought to you by CyberProof, a leading managed security services provider. Learn more at CyberProof.com.

On this episode of Cyber Sentries, we’re joined by Nick Warner, co-founder and CEO of Neo, to explore how the rise of AI-powered applications and autonomous agents is fundamentally changing the cybersecurity landscape. As AI becomes embedded in nearly every application, traditional approaches to endpoint security are facing an entirely new set of challenges. We’ll discuss the emerging threats, why securing individual AI agents may not be enough, and what a new security paradigm could look like.

When we need to protect not just humans from AI, but AI from AI.

Hello everyone. Today we are joined by Nick Warner, co-founder and CEO at Neo. Nick, thank you so much for coming on the podcast.

Nick Warner:
Hi, John, happy to be here.

John Richards II:
I’m really interested in talking to you. You guys are kind of doing some really new stuff in security around endpoint management and looking at things kind of from a new direction. But before I kind of dig into that, I’d love to hear, co-founder, CEO there. What got you into security? You know, what was that journey like for you that ended you up in the spot?

Nick Warner:
I originally got into security way back in 2002. I had spent the late 90s and early 2000s selling a variety of other types of software. I started my career selling performance monitoring software for mainframe computer systems, believe it or not.

John Richards II:
No, wow.

Nick Warner:
And then I moved into doing client server performance monitoring tools. I participated in the dot-com boom and bust. I lived in San Francisco 2000, 2001 and was selling marketing analytics software. And for me, selling marketing analytics software at the advent and really the massive adoption of the internet, and this is back when people just started to conceive of the idea of maybe you can purchase things and spend money over the internet, that’s when I started to see, even from my customers and prospects, a real interest and awareness in the internet as this really the new communication paradigm and a real channel for commerce.

And sadly, where there’s commerce, there’s crime. And I started to really think to myself that this new medium, this new thing called the internet, really had a future as it related to cybersecurity. And with that, I ended up getting into cybersecurity in 2002 at a company called Websense, which was doing content filtering and security for the web, for internet, and really never looked back for me. Cybersecurity was a great fit in that it definitely had more of a rogue status where you’d meet really interesting developers, interesting researchers. Things moved much more quickly. Sadly, much of which, the innovation is forced by the adversary, by the bad guys. But because of that, what I noticed, leaving sort of more corporate software sales and getting into cybersecurity sales, was things moved at a much more rapid and frenetic pace, which I really liked.

And because of that also, I think there was just a lot more hyperscale on development and innovation. And so I ended up spending over ten years at Websense through all sorts of iterations as we moved from just pure internet filtering to data security to advanced threat detection and all sorts of things that we morphed and grew along with how the internet was being used. Then I spent a couple of years at McAfee running an advanced technologies team globally there, where I got much more deeply into pure advanced threat detection. And that led me to joining very early a startup called Cylance. And Cylance had revolutionized a machine learning AI approach to detecting malware on systems at the endpoint, which ultimately replaced the antivirus industry. That was very much the dawn of what became known as the EDR market. And after three and a half years of Cylance, I then went over to a competing company called SentinelOne. And at SentinelOne, I moved up and through the sales [inaudible], first a CRO and then COO and then president.

And was able to grow them up and through an IPO in 2021. Stuck around there for a couple years after the IPO. Then thought, you know, I’m gonna take a step back, maybe do some investing, board work, and sort of ponder my next move. But really for me, what I missed almost immediately was that operational itch, the full-time combat of being at a vendor in the market. And, you know, cybersecurity, a lot of folks who are not in the space, who enter the space are shocked at how competitive the market is. It is an incredibly competitive market, and for those of us who’ve been in the space a long time, we love the competition. So I relish it.

I missed it. And you just don’t scratch that itch being on boards and doing investing and advising. And so, you know, by 2024, I really was starting to think about getting back in, jumping in with both feet, and this time starting my own company and trying to build the company, the culture, the technology in the way that I wanted to do it.

John Richards II:
I love that story. Yeah, you’ve seen so much change. Now, I mean, you know, starting in 2023, AI is really starting to kick off. Obviously you’ve been following that. I’m curious, you know, you saw kind of the birth of the dot-com, as you mentioned, that was kind of revolutionary and new threats rose. And then we moved towards, you know, cloud, a lot of cloud native is another big, you know, transition period and new threats.

And now we’ve got AI and AI software as kind of the latest landscape adjustments. What do you see for how that will impact the industry? But also, is it similar to some of those big changes in the past? And then, you know, maybe how is it different as well?

Nick Warner:
The commercial embodiment of the disruption that we’re living through is quite similar in terms of a lot of startups, a lot of venture funding, a lot of hype, some of it’s justified around new technologies, new companies. Some of that does remind me of the fervor that surrounded the dot-com days. From a technology perspective, what we’re living through dwarfs all the technology innovations that have happened in my lifetime. You know, I don’t think it’s an overstatement to say AI is the biggest technology breakthrough that mankind has ever really lived through. And obviously we’ve all been a part of creating. And I think as it relates to the disruption that it’s going to cause in everyone’s lives, but also as it relates to technology, both good and bad, and it’s mostly good, is so thorough and so far reaching, it’s every aspect.

It’s how networks work, how computers work, how software works, how we build things, how things are developed. You know, we’re starting to enter into a phase of AI’s impact on the physical world, you know, with automation, with robots, with machines that can think, act, and behave on their own physically. And so, you know, it’s an incredibly exciting time. And I think what is also different is that the speed at which things are changing, I’ve never seen anything like it.

John Richards II:
That’s crazy.

Nick Warner:
I’ve never seen anything like it.

John Richards II:
So I’m curious, a lot of existing security companies are needing to figure out how they shift their approach to the new challenges and stuff that are coming in. But you mentioned, you know, part of what attracted you to jumping into the security space is being able to build exactly, you know, build it the way you wanted with this kind of vision that you had without bringing a lot of that legacy stuff. So what is the kind of new way to approach security if you’re coming in and you’re saying, I don’t have to try and transition, you know, my standard data security process and my network security. You know, what does that look like now for saying, hey, we’re in a whole new world, I want to tackle this in a different way?

Nick Warner:
It’s even more broad than that, where, put technology to the side for a moment, it’s really the speed and complexity of the changes demands a total focus on the technology and innovation. And one of the challenges that cybersecurity has always presented is that cybersecurity, part of what you’re having to do is predict, best you can, where things will go, but you absolutely also have to react to what innovation is being pushed out into the world, either from an IT perspective or from an attacker’s perspective using different tradecraft or different techniques. But in this case, it’s happening so fast that news will be different on a Thursday than it was on a Tuesday about far-reaching products that get introduced, that many of which demand a totally new paradigm of security. I was with a customer, Fortune 100 customer, a couple of weeks ago, and all they wanted to talk about was Dots. And Dots is one of the many new AI assistants that was, you know, that had been released. And I think I met with them on a Monday and Dots have been announced a prior Thursday.

And they’re like, tell us all about it and what you guys can do with it. And it’s like, and the thing is, that’s not an aberration. Like, that’s just a year ago what everyone wanted to talk about was like Comet browser, Atlas browser, both of which are largely end of life now because we’ve just moved on, but that was like the first iteration of like an agentic browser. And then there was OpenClaw and then there was Claude Code and the massive adoption there. And then all of what, say, Google has done with making Chrome fully agentic out of the box, really embedding AI into search. I mean, so much is changing so fast that for any of us who want to tackle this problem in a fluent and native way, I think you really need to do a clean sheet design on a company to begin with.

At our company, we don’t have time for politics, for slow processes, for slow development cycles. When you talk about building software, if you’re not building software in a totally AI native, AI coding world, you’re not going to be able to develop fast enough and then iterate quickly enough on top of that. And then it also extends to things like the research that we do, the research that we need to do to cover what we can cover, and we can get into the technology in a bit. We could never do it with human researchers. We’d have to hire hundreds and hundreds of researchers, which would take many, many months, even if we had a bottomless well of money. It would just take too much time. Instead we can have thousands of agentic research agents that are doing the work of ten people and doing it 24-7 and doing it much, much faster. And then what we can properly apply are the right type of people to orchestrate what these agents are doing, whether or not they’re doing research, code development, vetting, design.

And so when I look at the speed and rapidity at which we’re having to operate, I can’t imagine that these larger cybersecurity companies can keep pace. And I’ve worked, you know, I’ve worked at companies that were in the many thousands of folks, and even with all the best intentions, you just can’t move as fast as you need to move today, which is why I think what we’re gonna see is a real new crop of AI native cybersecurity companies largely being the solutions of tomorrow.

John Richards II:
Wow. Now, as you talk about how broad that is and needing these new approaches, it has me thinking about the fact, you know, you mentioned that the client you were talking to and they’re like, hey, we’ve got this new tool, we want to know what that is. Like, I can empathize with the fact that as an organization, a Fortune 500 company, Fortune 100, it is terrifying to try and understand AI across every sector and the need to try and box that in. So saying, hey, can we just figure out what to do with Dots or Claude or something like that, is a way to reduce that down, but is that an effective approach? You know, you mentioned the Comet browsers and stuff that are kind of of the past.

What’s the danger of that as well?

Nick Warner:
It’s a limited approach. There’s an idea that, you know, any risk reduction is a good thing. But I think what’s happened in the past is, if you tried to take a pragmatic approach to security, you could meaningfully reduce your risk and maybe that would hold true for a couple years. And in the light speed at which things are moving now, that could hold true for two months and three months. Like, there could be a new AI development harness we’re all talking about in December that we’ve never heard of. I’ll give you an example. So like one of the biggest disruptors, especially as it relates to agentic software and tools and development tools themselves, are things called skills. And skills are, think of them as like a plain language recipe that you can import and then run as a prompt within a session. And if it’s the right type of skill in the right hands, it can be very useful, right?

Like, it can really direct the AI in the right way to do the right thing in an efficient way and possibly execute a highly complex sequence of processes. But in the wrong hands, skills, which again are in plain English, skills can actually be malicious. So embedded in a skill could be instructions to exfiltrate data, to run a piece of malware, to do all sorts of nefarious things. And skills were invented last December, and by April or May, they were a top five concern for chief security officers at companies. And naturally there was no security tooling in place in any organization, largely in the world, to cover skills because they were just invented four months before. And so that’s how fast things are changing and moving. And it represents a significant challenge for folks in security.

And I think the other really interesting thing also is, unlike other real paradigm shifts that I’ve seen, whether it was the rise of things like instant messaging and the proliferation of email and then streaming media and high bandwidth internet access and all of the requisite risks that those things posed, a lot of companies’ reaction to that would be to sort of close off, ring fence, slow down, and shut down a lot of those things until they could be properly and thoughtfully deployed. We’re in a space race now that if you and I worked at an insurance company, we’re thinking, how fast can we deploy AI throughout our organization? Because if we don’t, our competitors will, and we’ll be left for dead tomorrow. And so it’s really this balance between how do we understand and secure this thing that’s changing so fast. At the same time, how do we even deploy those type of tools faster? That’s totally unique. I’ve never witnessed anything like it.

It’s super interesting because the technology itself, in many ways, is really fascinating and the applications of the technology are never ending. And so the chance to listen and to work with customers and understand what risks they’re seeing, what solutions they’re looking for, and the ability to provide them with a better way to operationalize, deploy, and secure AI, it’s a universal problem, a universal challenge and opportunity. So it’s a really great time to be in the market. But a real challenge. And I think what companies are quickly waking up to is that they need a fundamentally different approach, like a different type of control plane for this new world we’re living in, because legacy tools don’t work.

They’re designed for a different era.

John Richards II:
I mean, yeah, the shift from even, you know, individual agents to the idea of having an agentic model with a bunch of agents working on your behalf has changed how, even how I look at what I should be doing. And now I’m like, hey, go do this task for me. And that is just starting to, you know, oh, now my agent could talk to somebody else’s agent and we’ve just got, you know, this crazy new world. So what’s the approach that Neo is looking at in this kind of space to say, here’s how we can maybe help give an organization the handles they need to try and stay current, if not ahead, of where things are at?

Nick Warner:
Fundamentally, the backdrop against what we’re all operating with today is, in the past, cybersecurity software was largely conceived and implemented around a couple of basic notions, which largely activity was driven by humans, software activity, and also software was deterministic. It was predictable. So you could look at certain software types and understand, well, that’s what they do. That’s accounting software, that’s HR software. It’s legitimate. It’s certified. It came out of the software factory, whether it’s Adobe or Intuit or some other legitimate company.

And we know what it does. And if it’s operating, behaving, there’s a human behind that. So all of that has gone away in the last 24 months, where we have these things called agents and an agent can act autonomously. An agent can now even control your machine on its own. An agent can act also in concert with a human or it can act in concert with other agents. Software can think for itself. Software is non-deterministic now. So even from, if you look at like the EDR market, which was really the market I had mentioned that sprung up and provided a much better way to secure software and systems versus, you know, static, legacy-based signature AV. EDR was really built inherently around this idea of you can predict what normal software looks like.

You look for anomalies against normal behavior, and with high accuracy, you can determine that those things are probably malicious. And that’s all gone away entirely too. So at Neo, what we wanted to do is rethink a new way to do software control. Part of that was building a system and a taxonomy that can help customers better understand the software universe we live in now and helping them understand, really, and to answer a few fundamental questions, which the first is, what software is running in my environment? What’s installed on my systems? Second, what is it capable of doing? Is it agentic? Is it not?

Does it use AI? What AI backend does it use, if it is AI powered? What capabilities does it have? Can it remotely execute? Can it control and send files on its own? Can it run remotely? Can it run automatically? And then the third question we answer is, is it configured correctly? You know, one of the things you mentioned, agents.

A lot of folks don’t realize that when an AI agent spawns and spins up within a software session, by definition today, so like the world we live in, it inherits the identity and permissions and access of the human. And it’s in most ways not differentiated from the human user. So with traditional security, if Nick Warner’s on a system and I spin up an AI agent and it starts doing things for systems of record and for malware detection, for other security behavior monitoring tools, it just looks like Nick Warner’s activity. There’s no bifurcation of like, hey, this is an agent versus this is a human. And one of the things that we wanted to do was to help customers better understand, is software configured correctly? Is it over permissioned?

Could an agent act in and through that software in ways that it shouldn’t? And then the last question we want to answer for customers is, is it doing what it’s supposed to be doing at runtime? And that’s an ability to see, understand, and control what software and AI is doing and where it runs. And what we then also provide is a way to control all that, because where Neo sits is the compute control plane we establish is at the point of execution, on systems, on machines, on endpoints, where AI activity is originated and where much of it runs and acts, we can see, understand, and control AI and broader software powered by AI. We can help customers understand that. And that is a totally different approach that really wasn’t needed until two or three years ago.

But everything’s changed with what software is and means. The last thing I would say too is, I think a lot of people don’t understand how thorough the revolution is throughout the software universe.

John Richards II:
That’s for sure. I’ve got people still telling me, I think this is a bubble and we’re gonna see. It’s like, you have no idea how much has happened.

Nick Warner:
Yeah, and you know, you talk to some folks, if you say what’s AI software, they’ll say, well, Claude, ChatGPT, Gemini. What they don’t realize, and Gartner themselves cites, is 40% of enterprise apps are going to be agentic, fully agentic by the end of this year. And by 2030, 100% will be. So you think about the average company, the average Fortune 500 has thousands of different software apps, design tools, accounting tools, finance tools, HR tools, all of those are going to be little agentic platforms. And so this idea that, hey, we’ll just, you know, your example, John, about we’ll just secure and monitor Claude. It’s like Claude will only be one eightieth of your problem and opportunity. So what we think is really setting in for a lot of customers, really understanding that, okay, we need a totally different way of viewing software and better understand it’s not enough to say, well, that’s HR software we’ve used for the last eight years.

We know it, we trust it. Well, guess what? In February, that HR software could become fully agentic. It could act on its own. It could take your records. It could send those out to an unsecured storage server somewhere out in the internet. It could end up sending a bunch of personnel files out to a personal email address. You only find out about it later. And maybe you’re operating in a highly regulated industry and that’s a big problem.

You know, again, it’s software itself has undergone a rapid and permanent change, and there needs to be a new control plane for software.

John Richards II:
What does it look like for the teams trying to manage that then? Are they primarily setting up policies that are going to govern, you know, because you mentioned the visibility, but then are you governing that via a set of policies of what’s allowed, or is it anomalies getting identified and then there’s a human coming in? I’m sure there’s like a combination, but you know, what are the skills those teams need as they set something like this up and now need to manage this for, you know, tens of thousands of people across the company?

Nick Warner:
Well, look, the good news is, I’m not being all gloom and doom here, is that AI itself is an extremely powerful tool that can be used to help. And, you know, so much of what new software like Neo can provide is, we’re fully agentic ourselves. So gone are the days of you have to manually construct and painstakingly craft policies and exceptions and definitions. We have AI assistance built into our software that can auto-generate policies, auto-recommend policies based on the inventory of software that we find in your environment, the capabilities of that software that we agentically research and discover on our own, no human interaction required. And based on alerts and findings, we can auto-generate recommended policies and we can continually fine-tune, deploy those. We have agentic processes to remediate things that we find in an environment. So there is a lot of automation that modern technologies like Neo can bring to bear.

You know, so I think what’s really important for customers to understand is there is actually a way that you can identify, understand, and control this type of software and AI activity. I think we lived through the first year or two, it was a lot of, hey, I just want to find shadow AI, I want to just discover it, and now quickly moving into a realm of, like, okay, well, what can I do about it? How do I enforce policies? And do it in a way that is adoptable and isn’t gonna inundate me with alerts and false positives and issues. And again, if companies and security folks out there are looking to partner with companies, I highly encourage that you look at the crop of newer technologies out there where our software is fully agentic. It changes and evolves as fast as needed to adapt to this new rapidly changing landscape, and these technologies themselves, they need to be agentic, because that will take a huge load off of the idea of manually crafting and implementing. If you’re doing it in a handwritten static way, by the time you understand and deploy policies, they’ll be obsolete within 30 days, because the software itself has changed, the capabilities have changed, but it’s all very manageable if you’re doing it using an agentic platform yourself. And that’s part of the education that we’re on on the journey with our customers. And for us, it’s, there are so many things that we could never do as a company that we’re doing now as a, you know, we’re sub 100 employees still, we’re a Series A startup. And punching way above our weight from like a technology research and operational perspective. Much of that is powered by AI itself.

So there are an amazing amount of upsides to this agentic world that we’re living in. We’re just living through this painful sort of like vector reset of moving towards, from a security perspective, using these type of tools that we really need in this new AI battlefield that we’re living in.

John Richards II:
Well, with the rate of change you’ve talked about, it seems like the only way. As we come to wrap up here, for folks interested in that, especially you talk about the education part that comes as part of this understanding, but how Neo in and of itself can help them secure their things, what’s the best place for them to go to learn more about that, connect with someone?

Nick Warner:
We have a lot of content resources on our website. It’s neo.ai, N-E-O.ai. Anyone who wants to reach out to me individually, easy to get a hold of me. I’m Nick, N-I-C-K, at neo.ai. Happy to engage and talk to anybody out there.

John Richards II:
Awesome. Well, I’ll make sure we have the site link in the show notes. Nick, this has been incredibly informative. Thank you so much for coming on here. It has been a pleasure to hear about what you are doing and, you know, some hope amongst the doom and gloom of the danger that’s out there as well.

Nick Warner:
Thanks, John. I enjoyed it.

John Richards II:
This podcast is made possible by CyberProof, a leading co-managed security services provider, helping organizations manage cyber risk through advanced threat intelligence, exposure management, and cloud security. From proactive threat hunting to managed detection and response, CyberProof helps enterprises reduce risk, improve resilience, and stay ahead of emerging threats. Learn more at CyberProof.com. Thank you for tuning in to Cyber Sentries. I’m your host, John Richards. This has been a production of TruStory FM. Audio engineering by Andy Nelson. Music by Amit Sagie. You can find all the links in the show notes.

We appreciate you downloading and listening to this show. Take a moment and leave a like and review. It helps us to get the word out. We’ll be back next month right here on Cyber Sentries.