Mackenzie Jackson: Hello, everyone. Welcome to another episode of The Secure Disclosure podcast. Thrilled here to be today with Arun. Arun, thanks so much for coming to chat to me today.
Arun Singh: No worries. Thank you for having me.
Mackenzie Jackson: Yeah, in this hot weather. You thought you were escaping the heat of Australia and then you come here and it's…
Arun Singh: Well, I traded winter because it's like three or four degrees in Sydney where I'm from to like 30-odd degrees here.
Mackenzie Jackson: Yeah, yeah, it's wild. We're not prepared for this and used for it. That is why I'm wearing shorts. I was considering changing, but I've decided that no, I'm sticking to shorts.
Arun Singh: Smart idea.
Mackenzie Jackson: Look, one of the reasons why I really wanted to chat to you is because you've got experience. You're the CISO at the moment of Tyro Payments, a finance company. We'll get into that. But you've had many roles of leadership in security for a long time in heavily regulated areas. How's it been going?
Arun Singh: It has. While there's been a lot of product innovations and growth, at the same time there's never been a boring day in the world of cybersecurity.
Mackenzie Jackson: No.
Arun Singh: There's always a new fun exciting challenge that we never imagined. When I first got into cybersecurity it was always about here's the type of fishing attack vectors.
Mackenzie Jackson: Yeah.
Arun Singh: Don't plug in random USB sticks and so forth.
Mackenzie Jackson: Yeah. Yeah. Yeah. Yeah.
Arun Singh: And now you've got all of these supply chain attacks that are going from CI/CD pipelines and open source packages to developer endpoints. And so, but I've got all these tools and these tools should solve these problems. But there's a very small niche gap especially on developer workstations most EDR tools kind of don't actually solve for.
Mackenzie Jackson: What do you think is kind of the biggest threat we're facing right now, you would say? And how has that been different since, say, the last six months even? Or a year? Like how have things evolved over this last kind of period?
Arun Singh: There's actually been a few and we've been talking to the Tyro Payments board and a few other boards recently about supply chain attacks. It's, we've been looking at or over the last few years we've been advocating for developers and other security folk to keep their packages and dependencies up to date. Which typically means install the latest and greatest version, right? It is something that we have ingrained into them for years.
Mackenzie Jackson: Yeah. Yeah.
Arun Singh: And threat actors have used that teaching that behavior to start compromising these companies, right? Because you get in there, they compromise a brand new package. Security is telling the developer, "Hey, you need to upgrade. There's a vulnerability." They download it, you're breached. And capturing that or protecting those supply chain attacks is difficult. It's counterintuitive.
Mackenzie Jackson: Yeah.
Arun Singh: You want to patch vulnerabilities but not too fast.
Mackenzie Jackson: Yeah.
Arun Singh: So you now need to tell the devs patch. But you now have to go through and figure out what package is not malicious.
Mackenzie Jackson: Mhm.
Arun Singh: Which typically means implementing a cooldown period. We actually advocating for our developers to have like a seven-day cooldown period for any package at the moment. And there was a lot of interesting workshops we held with our engineering teams to make them understand the reasons behind it. And yeah, once they got on board, it was great.
Mackenzie Jackson: Yeah, I think it has been that counterintuitive and this kind of leads me to a question and I guess the credit to some attackers in some way is that we will be able to get further grasp on a lot of these supply chain problems. It's going to happen from the registry level, from the tooling level, from the, when a problem creates like this, creates that, is a big threat. You know, but the attackers will play it. They've always been able to find these next cracks and I guess that goes back to you saying you've never had a dull day.
Arun Singh: Absolutely. As I sort of tell my team and others that I mentor, we need to start thinking like these threat actors, right? Things that we take for granted, it's bread and butter for them.
Mackenzie Jackson: Yeah.
Arun Singh: They're like, "I can use this to counter ingrained human behavior." As I said, we advocate to everyone patch to latest version.
Mackenzie Jackson: Mhm.
Arun Singh: You assume that's going to be secure. We trust open source developers and everyone else, but the threat actors have used that nuance against us. They weaponized it, right? That's even without calling in AI. And how AI is now making much easier for threat actors to build vulnerabilities or find vulnerabilities that we haven't picked up.
Mackenzie Jackson: Yeah.
Arun Singh: Right? And I think one of the other really difficult things, at least in the Australian region, right? It's hard to say about the world, but a lot of companies are very secretive around sharing security intel with each other. Right? So you could be a competing bank. Now, if I tell you around about some of the security threats that we've seen or share any intel, my legal team will stop me and tell me that that's company information. You can't do that.
Mackenzie Jackson: Yeah.
Arun Singh: It's like, "Well, we've seen this. If I can help protect this other company…"
Mackenzie Jackson: Yeah.
Arun Singh: "…they will do the same for me in the future and protect me." Getting that community and others to understand the benefit of it, it's not easy.
Mackenzie Jackson: Yeah. Because attackers work together. And we actually seen this, I hate to talk about attacking groups because they thrive on it and you give them oxygen. You know, but if you look at kind of Team PCP, it's actually a collection of various threat actor groups. They teamed up with Lazarus. They're sharing intel. They're sharing information. They're even publishing secrets in public now for everyone to see.
Arun Singh: Absolutely.
Mackenzie Jackson: And then we're at this where we're kind of restricted by, yeah, these corporate structures that we've put in place for various reasons. But we need to break out of those and we need to kind of figure out that they're attacking the community. We need to work back together as a community.
Arun Singh: Absolutely. And as security professionals, while our engineers consume the work of open source tools that are built for free by a lot of engineers, we don't actually go and work with those open source devs to say, "Hey, you're a solo dev. You may or may not have the same skills or experience or tools to protect yourself from a security point of view."
Mackenzie Jackson: Mhm.
Arun Singh: "Here's how we'll help protect you." Because you are a trusted source for us. If you're compromised, it's easy for us to get compromised. Extend that boundary to them.
Mackenzie Jackson: Yeah, for sure. Let's switch it up a little bit now because one of the things that we've been really impressed in what you've been doing because you've also been sharing the results of what you're doing. There's a lot of like internal red teamings and areas like that. What have you been focusing on in terms of getting the development team secure in these red team exercises?
Arun Singh: It's to actually demonstrate to them how easy it is for these compromises to occur.
Mackenzie Jackson: Mhm.
Arun Singh: So I found in the past at least as a security professional, speaking to developers and not understanding their world comes off as inauthentic, right? So if I'm telling an engineer, "Hey, you've got all these vulnerabilities. You have all these threats. I have to now lock down your workstation. Make your life harder by adding all these friction points and when all you want to do is just get into the code and work." Right? It's frustrating for them. And over the years I've sort of understood that I need to understand their world. I need to understand their pain point and their motivations. And the best way to do that is to demonstrate that, "Hey, I'm quite technical myself. I understand what I'm doing. It's not theoretical. And here is how this attack chain works. Here's how we will compromise you and disrupt your work overall," right? One small security incident is going to pause a whole quarter of work, right? And then those engineers have to work multiple hours with the security team to essentially recover everything, right? And there's a whole post-incident reviews and sometimes you get the blame game and everything as well, what happened and how. So during that we sort of work with them, we demonstrate the attack chain. They see it in real, well, in real time essentially. They understand the reasons then why we're implementing certain controls. But what we typically do once we implement a control, we try to get feedback from them, right? It's too many times security teams will implement a control and say, "I've done my job." And the end users will raise complaints, "I can't do this. I'm blocked from doing this. I'm blocked from doing this." And most security teams won't actually end up getting feedback to make the right tweaks, get the right compromises. So I always made it a point to go back to developers or any end user, get the feedback, and try to tweak different things, try to understand how I can add the least amount of friction to the workflow. While at the same time demonstrating how I'm making their life easier.
Mackenzie Jackson: Yeah.
Arun Singh: You know what? If I make their life easier, they make my life easier.
Mackenzie Jackson: Yeah, and I think, I think what something you said that resonates with me is understand the blocking points or where friction is actually added because friction without explanation is just friction. No one likes that, right?
Arun Singh: Absolutely.
Mackenzie Jackson: So then understanding, understanding that and speaking to them on their level, I think that's quite important. I want to ask a spicy question now. What is something that you've done incorrectly in your career along these lines and something? What is something that you kind of looked back on and said, "That wasn't the right approach that I took there." If you're willing to share, you know.
Arun Singh: There's quite a few things, but earlier on in my career, right, growing up and getting into security, you're taught security above all else.
Mackenzie Jackson: Mhm.
Arun Singh: That's what my previous leaders and mentors always taught me. And I always saw myself as, "Cool, what I say goes." Right? "I know what I'm talking about. This person, they don't understand what they're doing."
Mackenzie Jackson: Yeah.
Arun Singh: Even though they're really highly technical. So we, I would go out, see a risk, implement a control. Right? We had one where we decided to remove local administrator rights across everyone's workstations.
Mackenzie Jackson: Mhm.
Arun Singh: Now, for 90% of the business, no problems. The end users didn't really need to install or do much. And we had a really good process for them to get applications. The small cohort of software engineers though that don't just install software, they actually need to make system level tweaks that require local admin access, completely destroyed the productivity.
Mackenzie Jackson: Right. Yeah, yeah.
Arun Singh: And ended up going from a great victory that we've making the company more secure and we've got these really good processes in place. So you need an application, something installed, here's how you do it. And within an hour it's all automated. But because I didn't think about the software engineers and the need for local admin beyond installing applications, the whole team essentially revolted.
Mackenzie Jackson: Right.
Arun Singh: They're like, "No, we hate this." So it took us three days, we found the right compromise for them, but that essentially destroyed the trust they had in me.
Mackenzie Jackson: Right.
Arun Singh: So anytime I'd go and talk to them about a new control or something else that I needed help on, it was a hard-fought battle.
Mackenzie Jackson: Mhm.
Arun Singh: Because they had always assumed that if I'm going to implement a control, it's going to cause them…
Mackenzie Jackson: Yeah. Friction.
Arun Singh: Havoc. It's going to destroy their productivity. So it took me a year at least to win back that trust and build that reputation that now they know I am considering all angles and if I'm not sure, I'll come and speak to you.
Mackenzie Jackson: That's such a good story to share because I think that's the one, like a mistake that a lot of people would make and have made it without realizing it's a mistake.
Arun Singh: Absolutely. I always make it sure like if we're implementing any new control, I will get a pilot group of different users, roll it out to them and get raw feedback. And sometimes we do pick up issues that we never thought about.
Mackenzie Jackson: Yeah.
Arun Singh: And it's like, "Great. Pause. Let's go back to the drawing board. What do we need to do to compromise here and get the right level of control and productivity?" It was quite a learning experience for me, but it's helped at least and this was about ten-odd years ago now, but over the years that has become a strength now.
Mackenzie Jackson: Yeah, I can tell you see that. What's your kind of opinion? You've worked in a lot of very heavily regulated areas. So, right now, finance areas like that.
Arun Singh: Regulated bank.
Mackenzie Jackson: Regulated banks. Lots of fun stuff here. What's your opinion on kind of having to deal with a lot of these regulations which require all of these different compliant areas? I think like the question that I want to ask which I think it has an easy answer to it is like does this make us more secure? Yes, it probably does, but you know, is it all that necessary? Are there better ways to do it? I wanted to try and get you into as much trouble as possible on this podcast. When you, and do these regulations really help us or do we need to rethink this process?
Arun Singh: Ultimately, it does help us, right? And at least all the regulators I've ever worked with, right? At least in Australia, New Zealand, and the US, the regulators are not coming in to make things difficult. They are coming in for a conversation. They're wanting to learn about our world and how they can have a standard approach that any company, small or large, can implement and be mostly secure, right? But they never have prescriptive controls. They will never say, "You have to implement this control in this specific manner." They'll say something very generic like, "You have to have, you need to manage privilege access."
Mackenzie Jackson: Mhm.
Arun Singh: Right? Now, managing privilege access, you can do that a hundred different ways. It's up to the company to then tailor the implementation of the control and the advice from the regulators that suits their workforce and their productivity goals. Right? And again, a lot of people don't see it that way.
Mackenzie Jackson: Yeah.
Arun Singh: They see regulation as the government or another entity has told me I need to do this. I have interpreted it as this specific thing. I'm going to implement it.
Mackenzie Jackson: Mhm.
Arun Singh: And the amount of times I've seen security folk go to their teams and say, "We have to implement this control in this manner because of compliance." It's too much to count.
Mackenzie Jackson: Yeah.
Arun Singh: And all that ever does, it shuts down that two-way conversation between the security team and the business. Because if I tell you I have to do this because of regulations, I've got no control over it.
Mackenzie Jackson: Yeah.
Arun Singh: You can't say anything, right? They're like, "Oh, okay, I understand. We're regulated." Whereas if I say, "Yes, we need to implement this control. We need to implement this security program. We have to have these type of controls, but I'd love your feedback on it." I can then nail down the exact control I want, make it secure, but now I've given you a voice, right? I've essentially made you a security champion…
Mackenzie Jackson: Mhm.
Arun Singh: …because you feel that you've got a vested interest. So instead of me having to come to you every single time and say, "I need to XYZ to make you secure." You're going to come seek me out and say, "Hey, I noticed this. I noticed this specific gap in our systems or something that didn't look right."
Mackenzie Jackson: Yeah.
Arun Singh: "Can we work together on how to fix it?" Right? What? Right, I didn't even know we had that gap.
Mackenzie Jackson: Yeah. Yeah. Yeah.
Arun Singh: Perfect. So ultimate regulation is actually a good thing, right? And at least for most regulators, they will come to most companies and have a conversation. They will learn from them. And it's our responsibility then to guide the regulators. They need as much information as possible to make well-balanced controls. And some security leads are quite good at it. Others are quite bad.
Mackenzie Jackson: Yeah. Yeah.
Arun Singh: Right? Because they just go, "No, no. I'm putting an iron fortress here without thinking about the business impact."
Mackenzie Jackson: Mhm.
Arun Singh: And as I tell my teams, "You could be the Albert Einstein of cybersecurity, but if you cannot influence the business and about how this control will help the business grow, right? Greater revenue and productivity, or you cannot take into consideration the business impacts, you're no good."
Mackenzie Jackson: Yeah.
Arun Singh: You need to have that business mindset. And most of the people I've been speaking to over the years now, they started to pick it up. At least the new generation of security professionals, they're a lot more savvy…
Mackenzie Jackson: Mhm.
Arun Singh: …in terms of business as well as technology.
Mackenzie Jackson: Yeah. I'm going to briefly interrupt this episode to thank our sponsor of the podcast, Aikido Security. Aikido Security is your complete code-to-cloud security solution. It secures everything from the first line of code that you write all the way through your supply chain, your dependencies. And of course, Aikido is also a leader in AI pen testing and AI code auditing. So make sure you check them out today. You can start for free at aikido.dev. All right, enough about that. Let's get back to the episode.
Mackenzie Jackson: Yeah, and I think that there has a bit of a changing guard, particularly in kind of your type roles and the CISO type roles, where this fundamentally was a non-technical role…
Arun Singh: Yes.
Mackenzie Jackson: …for a very long time. But you, and talking to you, and I that you have technical background, you have technical abilities, you know. What's your opinion on that changing guard there?
Arun Singh: It's important. The amount of times I've worked with or under a security leader that wasn't technical, and I've needed their support…
Mackenzie Jackson: Mhm.
Arun Singh: …and I'm speaking to them in technical language, and they've somewhat understood what I'm trying to say…
Mackenzie Jackson: Mhm.
Arun Singh: …but they could never fully grasp it, so I never got the full support.
Mackenzie Jackson: Yeah.
Arun Singh: Or, they couldn't appropriately challenge me, right? Play devil's advocate.
Mackenzie Jackson: Mhm.
Arun Singh: So, as I said, if I've thought about a control and I've got a perfect implementation plan, I need someone to challenge me to make sure have I thought about every single aspect of it and the potential impacts to the different user groups across the business. If I don't have that, I'm just going to go full steam ahead, implement it, and the end users are going to suffer. All right? So I try to be as technical as possible, or sort of be hands-on, understand all the tools, see what's happening out in the industry, and try to be that voice…
Mackenzie Jackson: Yeah.
Arun Singh: …and bring that back to my teams and have that, again, devil's advocate approach. So they are thinking about everything holistically. And ultimately that get to them the best outcome, right? And then they are seen as more than a security engineer or security architect. They're seen as an invaluable part of the business that is going to help the business grow ultimately.
Mackenzie Jackson: Yeah. Yeah. No, I really can see that and I really think it's kind of like the last four years that I've seen it, that that big shift start to happen. And I think like part of it may be because a lot of the challenges that we're facing now are more technical as well. We talked about at the start it was USB sticks, it was this…
Arun Singh: Yes.
Mackenzie Jackson: …and it's still, it's still phishing emails, it's still software all of that. But it's also now very difficult to have a CISO that doesn't understand the supply chain.
Arun Singh: Correct.
Mackenzie Jackson: You know, at a deep level to be able to help secure that. Not saying that the other schools are invalidated, just saying that that is now a tool that we kind of need in this box.
Arun Singh: Absolutely. And like having the ability to understand like APIs, the use of APIs, how to secure APIs, why a WAF is not a be-all end-all control.
Mackenzie Jackson: Yes. Yeah. Yeah.
Arun Singh: Having a WAF does not mean defense in depth.
Mackenzie Jackson: Yeah.
Arun Singh: Or having a defense in depth architecture doesn't mean that you'll never be compromised.
Mackenzie Jackson: Yeah.
Arun Singh: Right? Like these supply chain attacks, we never put controls in for them previously. We had all these other layers of defense.
Mackenzie Jackson: Mhm.
Arun Singh: Now this one small gap allowed it to get through.
Mackenzie Jackson: Yeah.
Arun Singh: Right? And we got compromised. It's like, "Why am I spending all this money on this architecture? We still got breached."
Mackenzie Jackson: Yeah. Yeah, for sure.
Arun Singh: And it just causes the senior leadership and board members to lose faith in the security professionals and the CISO that actually understood everything they need to understand, right?
Mackenzie Jackson: I, yeah, for sure. And vendors and all of that, we love to tell you, you know, like we love to tell you that we're going to solve all your problems. I mean, at Aikido we do solve all your problems, right?
Arun Singh: [laughter]
Mackenzie Jackson: But, you know, so and then when you see all this money going out for tooling and all of that and then you still have incidents and you're kind of thinking to yourself, "The box said it fixed it."
Arun Singh: Yes.
Mackenzie Jackson: "Why is…" and "I'm paid for the box." "Why does this problem exist?" So I think that's kind of, yeah, an important, an important point. What do you see as the biggest challenges we face in security over the next couple of years? Right now, at this point in time, it's very clearly supply chain attacks seem to be the biggest threat today, right?
Arun Singh: Yeah.
Mackenzie Jackson: And all the other threats still remain. Is this going to continue? Or do you think that we'll be facing new threats coming forward in the next couple of years? Just asking you to predict the future, nothing big.
Arun Singh: I think it will continue a while longer.
Mackenzie Jackson: Mhm.
Arun Singh: But I think ultimately the larger issue that we're going to end up facing is AI is going to accelerate productivity ten, a hundred-fold, right? However, and most of the software engineers and product engineers and a lot of the business folk are embracing AI quite heavily. They become power users essentially, right? But a lot of security teams have not been involved with the implementation of the security guardrails or the architecture around some of the AI tools that we're using. So they're not understanding the nuances that AI is going to introduce. So what's going to happen is AI is going to accelerate productivity, it's going to accelerate security threats, and the small team that you had before that was doing okay is not going to be able to keep up. Then they're going to play catch-up to move to an agentic workflow themselves…
Mackenzie Jackson: Mhm.
Arun Singh: …but they're playing catch-up. And by the time they've caught up to where we were six months ago, we're already two, three years into the future of AI and the new threats that we have to worry about.
Mackenzie Jackson: Yeah. Yeah.
Arun Singh: So making sure that at least security architects and leaders are involved in AI strategies and implementations and education is absolutely key and making sure that the security team is not just looking at AI security tools. They need to be using the same type of tools that our engineers are.
Mackenzie Jackson: Mhm.
Arun Singh: Right. Like my team's all got access to Claude Code as an example, because I want them to get in there and start trying to write code or ask it questions and see how far they can build it.
Mackenzie Jackson: Yeah.
Arun Singh: Even if it means them vibe coding something. So I get them to sort of, we actually had an exercise where I got them to vibe code an application. And I went, "Great. Works. Now explain the code to me."
Mackenzie Jackson: [laughter]
Arun Singh: And they're like, "We can't." I said, "That's a problem. Go read through the lines of code and try to work it out. Or ask the AI to explain it to you so you have a better understanding of what each part means. So then when you're partnering with someone from software engineering and they're saying they've got a challenge, you actually can read the lines of code and understand what they're trying to get at and help them fix their security issues."
Mackenzie Jackson: Yeah.
Arun Singh: "Versus giving them the boilerplate of you have it that you're using package A, package A has ten CVEs, you have to fix it."
Mackenzie Jackson: Mhm.
Arun Singh: And your developer is saying, "But yeah, we have the package, but I'm not, my code never uses the package or doesn't use the vulnerable function."
Mackenzie Jackson: Mhm.
Arun Singh: So as a standard security person, it's like, "No, no, no, but my tool said you're vulnerable."
Mackenzie Jackson: Mhm.
Arun Singh: It's like, "Yeah, just because a package exists doesn't mean I, I'm exposed because my code's not using it." So having the ability to look at the source code, link it back to the CVE, and understand proper exposure is excellent. Now, tools like Aikido do actually help to do that, make life a lot easier, but being able to manually do that is a skill, and it's a key skill that most security people will need in probably the next five years.
Mackenzie Jackson: So, we've got to start wrapping things up a little bit, but there is one more question before we get into our final segment. And I just kind of wanted to, I had a question, and it's an impossible question. It's kind of a stupid question, but it's one I want to ask, too. Is if you, if you only had the budget for two tools, and I'm not talking about vendors, I'm talking about categories of tools. What are the two tools that you would implement in your dev team? And I'm not saying that like, you know, it's to keep you secure, but I just see this as what protects us from the biggest risks right now, do you think?
Arun Singh: That's a great question. So I think a product security application like an app sec something like Aikido and the like is absolutely key. All right, something that can help scan code within the IDE and help pick up insecure patterns of code or picks up secrets in code or vulnerabilities as the engineers in their zone…
Mackenzie Jackson: Yeah. Yeah.
Arun Singh: …working is absolutely key. All right, having a tool that just scans post commit you're already too late.
Mackenzie Jackson: Yeah.
Arun Singh: You need to be in the workflow of the developer right there. That is key. And also having a device protection or similar tool that we get better visibility into the developer workstation.
Mackenzie Jackson: Right.
Arun Singh: What packages are they installing? What dependencies are they using? The last one is quite hard…
Mackenzie Jackson: Mhm.
Arun Singh: …to solve for. We've actually looked at multiple tools in the past to do it. And it's always a duct tape contraption that's sort of giving you some limited visibility.
Mackenzie Jackson: Yeah. Yeah.
Arun Singh: But even if you've got the visibility, you can't do anything about it.
Mackenzie Jackson: Yeah. Yeah.
Arun Singh: What you have to do is got this big report. You walk up to the developers, "Hey, you need to uninstall XYZ."
Mackenzie Jackson: Yeah. Yeah.
Arun Singh: So, having something that can discover and put policies in place, but also make it frictionless where if a developer needs to install something, it's quite easy for them to do it.
Mackenzie Jackson: Yeah, that's a great scenario. I completely kind of agree with that. And that's interesting there the IDE code scanning part, because I think you touched on it before as if like if you vibe coded an app, do you understand what's happening? Right? I think that's important that we have something in there that does understand…
Arun Singh: Absolutely.
Mackenzie Jackson: …what security things are happening in there, yeah.
Arun Singh: Well, even with most developers, right? Where they, a lot of them are starting to use AI significantly to write code.
Mackenzie Jackson: Mhm.
Arun Singh: I guarantee you the good developers and the ones that are going to have really long lifespans in software development the next ten years will be the ones that will use AI to write the code, but they can understand the code.
Mackenzie Jackson: Yeah.
Arun Singh: Versus other developers that are just using AI to write the code and they're just claiming the credit. They don't care or don't necessarily understand what the AI is doing as long as it gets the work done. It gets the output. I'm done.
Mackenzie Jackson: No, I think that makes sense. I'd like to play a little game with everyone on here. It's called would you rather? And it's a, it's a, it's a fun game where I ask you two really shitty questions and you have to pick one that you would do. So we'll start off with continuing down the vibe coding thing. Where you have two options from this. Option number one is that all your developers can code, they understand everything, but they cannot use any AI coding assistants at all, right? In this scenario, we'll say AI doesn't exist.
Arun Singh: Yep.
Mackenzie Jackson: Or the opposite is true and everything is now vibe coded at the prompt level. So no one really has, you've lost all of that understanding of what the code does. So there's no way to be able to go in and edit it. Which would you rather?
Arun Singh: So putting my security head on, option A.
Mackenzie Jackson: Because while AI is getting a lot better at writing code, right?
Arun Singh: You cannot replace years of experience…
Mackenzie Jackson: Yeah.
Arun Singh: …to actually help write secure, scalable, right?
Mackenzie Jackson: Yeah. Yeah.
Arun Singh: And writing a good prompt is a skill. Just asking it one-line questions, that's not a prompt. You need to actually, what are you expecting? What's the context of your question? How do you want it to be output? What's the data source I'm actually looking into? It's a whole skill that we're trying to develop across the business at Tyro Payments now as well.
Mackenzie Jackson: Yeah. Yeah. I think that's a, yeah, that makes, that makes sense. It's a tough question though.
Arun Singh: If I was a developer, AI makes my life easier.
Mackenzie Jackson: We've talked a lot about supply chain attacks here, so let me ask you another question here. All your dependencies are pinned to the current version right now, but you cannot update them. So any vulnerabilities, no matter what happens, they're there forever. Or, you auto pull the latest version on everything.
Arun Singh: Option A.
Mackenzie Jackson: Option A.
Arun Singh: Again. Because I can put in mitigating controls and that defense-in-depth layers.
Mackenzie Jackson: Whereas if everything is auto-updated, I'm fighting fires every single second, right?
Arun Singh: Yeah. So, yeah, option A, easy.
Mackenzie Jackson: For a lot of these questions, there's no right or wrong answer. For that one, I think there probably is a right answer.
Arun Singh: I think you chose that one, too.
Mackenzie Jackson: If you asked me a few years ago, I'd be like, yeah, option B.
Arun Singh: Yes. Absolutely.
Mackenzie Jackson: All right, let's get a little bit harder now. All of your development environment secrets…
Arun Singh: Mhm.
Mackenzie Jackson: …are, you know, or just your production secrets are in a .env file stored on your GitHub. It's private, though.
Arun Singh: Okay.
Mackenzie Jackson: It's on all the developers' machines because it's cloned, but it's private. Or, that's option one, you have to pick one. The other option is that you cannot have a web application firewall or any kind of firewall on your application. Everything's exposed. There's no way to block malicious traffic or malicious payloads.
Arun Singh: This is a hard one. Again, option A.
Mackenzie Jackson: There you go. Yep.
Arun Singh: Because again, I could encrypt that file and do a few other things to protect it. While still not great, but yeah, not being able to block any malicious traffic, oh, that's just nightmare fuel.
Mackenzie Jackson: I have one last question. It's not a, it's not a kind of would you rather, but it's just kind of a broad question. From a security point of view, if you could blow up AI, would you?
Arun Singh: No.
Mackenzie Jackson: No?
Arun Singh: No. It's the productivity benefits beyond just security and software development are significant, right? The amount of times I could, I, I've needed to search for a piece of information that I wrote months ago. I could go manually search for it, or I can go into my AI agent that's sort of semi-connected to everything. Then, "Hey, find me this information." "Here you go. Here was the context." So, I use it almost like a second brain, right? It reminds me of discussions I had a few months ago, or a decision that was made and it can help contextualize it.
Mackenzie Jackson: Yeah.
Arun Singh: Right? So, oh, yeah, I would never get rid of it.
Mackenzie Jackson: Well, I was going, well, I want to thank you so much for chatting with me today. It's been very insightful, and I hope to chat with you again in the future.
Arun Singh: Absolutely. Thank you.
