Trust at Machine Speed: AI, DevSecOps, and Zero Trust in National Security Software

April 30, 2026

 

In this episode of Exploited: The Cyber Truth, Paul Ducklin speaks with Nicolas Chaillan, host of In the Nic of Time and Former DAF CSO, about how AI is reshaping mission-critical systems.

The discussion focuses on a core challenge: trust. As AI systems evolve, adapt, and operate at machine speed, traditional approaches to security, validation, and governance start to break down.

One major shift is architectural. Rather than relying on a single model, organizations are moving toward multi-model strategies—using different AI systems for different tasks and avoiding dependency on any one provider.

At the same time, AI is transforming DevSecOps. It’s no longer just assisting developers—it’s writing code, building pipelines, generating tests, and identifying vulnerabilities, often faster than traditional tools. The result is a dramatic increase in speed, but also a need for tighter control and better oversight.

The conversation also highlights the growing gap between technology and policy. As AI capabilities advance, governance frameworks and acquisition processes are struggling to keep up—creating friction, risk, and, in some cases, unintended consequences.

The episode explores:

  • How AI is accelerating software development and security workflows
  • Why multi-model architectures are becoming the default approach
  • Where zero trust needs to evolve in AI-driven environments
  • The risks of policy decisions that limit access to key capabilities
  • How organizations can adopt AI without losing visibility or control

Speakers: 

Paul Ducklin: Paul Ducklin is a computer scientist who has been in cybersecurity since the early days of computer viruses, always at the pointy end, variously working as a specialist programmer, malware reverse-engineer, threat researcher, public speaker, and community educator.

His special skill is explaining even the most complex technical matters in plain English, blasting through the smoke-and-mirror hype that often surrounds cybersecurity topics, and  helping all of us to raise the bar collectively against cyberattackers.

LinkedIn

 

Guest Speaker – Nicolas (Nic) M. Chaillan – Host of In the Nic of Time and Former DAF CSO

Nicolas M. Chaillan is a serial entrepreneur, cybersecurity expert, and former senior U.S. government technology leader. He served as the first Air Force and Space Force Chief Software Officer under Dr. William Roper, bringing DevSecOps, continuous Authority to Operate (c-ATO), and modern software practices across the entire Department of Defense.

In 2022, he founded Ask Sage, Inc., the first generative AI platform to achieve FedRAMP High Authorization for government teams. Ask Sage was acquired by Big Bear.ai in 2025 for $250M, and Nicolas served briefly as Big Bear.ai’s CTO before departing in February 2026.

LinkedIn

 

Watch the Full Episode

Episode Transcript

Exploited: The Cyber Truth,  a podcast by RunSafe Security. 

[Paul Ducklin] (00:01.594)

Welcome back, everybody, to Exploited: The Cyber Truth. I am Paul Ducklin. As regular listeners will know, I’m usually joined by Joe Saunders, CEO and founder of RunSafe Security. Joe is not able to join us today, but I am joined by Nicolas Chaillan, host of In the Nick of Time and a former Chief Software Officer in both the Air Force and the Space Force.

[Nicolas Chaillan] (00:33.09)

Thanks for having me.

[Paul Ducklin] (00:35.15)

Nic, our title today is Trust at Machine Speed, AI, DevSecOps and Zero Trust in National Security Software. Now that sounds like an entire university course rather than a 30-minute podcast, but let’s start with your recent history. And even though Joe isn’t online with us today, he has recorded an introduction. So let me play that now.

[Joe Saunders]  (01:01.588)

Nicolas is a great entrepreneur and a great technologist, but what sets him apart is his unwavering focus on innovation and delivery for the war fighter and to help the United States and the Department of War and Department of Defense achieve its mission at a faster and faster rate and beat China in technology competition. I’ve witnessed Nicolas up close roll out DevSec apps across the DoD, as well as saw him build Ask Sage from a concept to the most widely adopted Gen.ai platform across the department. And what stood out to me is Nicolas prioritized innovation, making technology accessible, and certainly ensuring security is built in from the ground up. So Nicolas is a rare technologist who is an exceptional entrepreneur and exceptional driver of innovation for the department. Please enjoy the conversation with Nicolas.

[Paul Ducklin] (02:00.012)

That is quite the CV. And as Joe said, when you founded the company Ask Sage, your focus was innovation for warfighters and you built an AI platform to help people use AI in a constructive, reliable and non-product specific way. So do you want to say how you went about that and what you thought was important about doing it that way?

[Nicolas Chaillan] (02:26.252)

Yeah, I think it’s very important, you know, when it comes to the US government not to get locked into one cloud provider or one LLM. We built a stack that brings not only the security, but also the abstraction so that you can have a single API, single source of truth, single data training, single enforcement layer so that it works with all the models without losing the benefits of each of the different capabilities out there and be able to consolidate it, bring it into a central place and have a unified user experience, both on the UI side and the API side so that teams can build agents and be able to tap every model and see what sticks. For complex agents, it’s actually very good to have access to all the models so you can see which one performs the best. It’s been really the way to go, particularly when you see teams getting locked into OpenAI or Anthropic or Google.

New models come in every month and it’s almost impossible to keep up, but also not wise to get locked into one.

[Paul Ducklin] (03:29.486)

So in a way, this is partly like what some cloud API providers are doing. So that if one cloud provider, say, puts their price up, you’re not stuck with that. Or if you don’t like the way negotiations are going, you can move. But with AI, things are a little bit different, as you just suggested, aren’t they? That you might want to use two, three, four, even more providers, or even connect in some open source models of your own particularly when you’re doing things like intelligence gathering, you actually want to be able to compare and contrast before you come out with your own research, don’t you?

[Nicolas Chaillan] (04:08.226)

For complex tasks, what you’re going to find is agents have different step-by-step processes they need to achieve. And it’s pretty clear that different models perform better than others for specific tasks. You may use, know, Gemini for video analysis, Plod for coding, and also complex agentic analysis as well. You may use something like 4mini because it’s inexpensive and easy for some type of summarization or content analysis. So each model, each version have different costs. And so a centralized single pane of glass for your billing and your tracking of consumption is also essential when you build something at an enterprise scale like this.

[Paul Ducklin] (04:53.334)

And if you can homogenize the right word, the API, that means that you can build one way of talking to all the models instead of having to have five different software stacks, one for each, and then try and unify the things later by yourself.

[Nicolas Chaillan] (05:10.292)

Exactly. I think it’s essential to have this abstraction layer with one line of code. You can swap model A to B, see how it performs, see how it sticks and be able not to get locked in to a single SDK or API. And that’s why we made it an open architecture. So it’s easy to move on. I don’t believe in getting people locked in to your product. I think if you bring value, you should be there. If you don’t, you shouldn’t. Having an open architecture and open framework with all the models and you can bring your own models, can bring commercial models and we release models same day as they’re released. So it’s a great way for all the teams to move fast.

[Paul Ducklin] (05:50.85)

So I assume you could even have two different models from the same AI organization if you wanted to compare and contrast them when a new model comes. So it’s not just about needing to jump from one provider to the other because they’ve got too expensive.

[Nicolas Chaillan] (06:07.342)

That’s right. And you can’t even make them fight each other. This guy’s the limit. And then when you build complex agents, I think it’s actually essential. I don’t have a single agent myself that’s not using all the model stacks. So you need access to all of it.

[Paul Ducklin] (06:22.05)

A simple analogy in software engineering might be that even if you love and are dedicated to C or C++, or even if you’ve made the jump to Rust because you think it’s great, it’s very likely that an entire project will have code in all sorts of different languages. Plus it’ll have documentation and HTML and CSS and JavaScript, et cetera. There’s rarely a one size that fits all in any sort of software engineering practice, is there?

[Nicolas Chaillan] (06:50.734)

I mean, it’s kind of common sense now, you people keep making the same mistakes and being short-sighted, trying to move fast, but creating a lot of technical debt. I think it’s actually not that complex when you have a platform like SAGE to be able to still move fast and probably even faster than most teams combined and yet not get locked into a provider.

[Paul Ducklin] (06:58.135)

Yes.

[Paul Ducklin] (07:09.288)

building upwards instead of digging a giant hole that you’re going deeper and deeper into. So Nick, let’s get to what you might call the elephant in the room in this discussion. My understanding is that the Defense Department in the US has decided that it no longer wants to use anthropics models for missile control systems because they don’t think it gives the openness that they want.

Instead of just saying, well, let’s use the other models then if they’re really so much better, they sort of said, well, that’s that no more anthropic, no more Claude anywhere in the US federal government. I guess they can make any decision they want, but that seems a little bit like cutting your nose off to spite your face, if that’s the right analogy.

[Nicolas Chaillan] (07:59.104)

Let me just start by saying that I’m no longer with Ask Sage and Big Bear who just bought Ask Sage. So those are my opinions. Yes. And I’m able to talk maybe a little bit more freely than people could in a publicly traded company. Sure. I’m a big supporter of President Trump. I got to tell you, the president appointed someone called Emil Michael as the Undersecretary for Research and Engineering, what we call the CTO of the Pentagon. He’s not very technical, not a very good fit for the role and not very liked. And he’s made a lot of short-sighted mistakes. The first one was to create what he called the gen.ai.mil where you wanted to bring a portal with each model provider and went to OpenAI, Entropic, Gemini, and XAI and wanted an icon per model on the browser so you can go to their respective UIs.

Before him, the team working with me understood what we talked about in terms of not getting locked in to one model and not having to train data four times. The former team understood the importance of not getting locked in. For some reason, whether it’s incompetence or ego or whatever, he decided to create this portal with four different icons. Three are turned off because they don’t have the accreditation to run it.

So they only have Gemini, which is even more short-sighted, right? Because you end up only at unclassed levels. They don’t have secret and top secret, even though companies like Ask Sage have all of the models and we have had them for two years now. Google is pretty happy because they are the only one there. Effectively, it created a non-existent problem because we had Anthropic for two years and everybody was using it. And it is by far the best model for agents and coding and many tasks very critical model and it’s also the most accessible and available across all classification levels, both in the intelligence community and in the Department of War. So it is a critical capability and for couriers, particularly, you know, with cloud code, there is no alternative really available to the department. So they don’t have a backup plan. Obviously people are upset about the decision, particularly when there was no need for it.

[Nicolas Chaillan] (10:22.924)

It’s almost like creating non-existent problems, mostly driven by incompetence and ego. And so now they got to remove it, losing what is today the best by far, capability. And then going out of their way to retaliate with this new supply chain labeling, which is unheard of, has never happened to a US company.

[Paul Ducklin] (10:45.848)

So that means that their product and their technology would be essentially prohibited in any aspect of federal government.

[Nicolas Chaillan] (10:54.622)

And their contractors. Right. Which is pretty insane.

[Paul Ducklin] (10:58.638)

So this wouldn’t just apply, say, to a missile system. No. It might apply to someone developing embedded devices for the power grid or water supply or wastewater disposal.

[Nicolas Chaillan] (11:12.3)

It’s not just the Department of War, it’s the entire US government and it’s all the contractors related to it. By the way, there’s no legal precedent. I don’t think they would win in court if it goes to court, which I’m sure it will. And Anthropic is upset about it and I would be upset too. I don’t think it’s a place of the government to retaliate against companies, particularly US companies. I don’t think that’s okay. That’s not something we should be doing no matter the party.

It’s not like the old days of Google with Project Maven five, six years ago, where a couple of Google employees protested with their engagement with the Department of Defense at the time on the use of simple AI recognition algorithm, not even tied to weapons at all. You had a few hundred Google employees, which many, by the way, were Chinese employees at Google, which nobody talks about. And then Google decided to walk away and shut it down, which was, you know, very short-sighted and very egregious, particularly when there was no use of the technology in autonomous weapons at all. Google was not labeled as a supply chain risk or anything like that back then, right? I know you have a company that’s just saying, hey, we have two lines. One is, we don’t want to spy on Americans, which I hope everybody agrees with that. And then the second one is, no autonomous weapon with Gen. AI, because the technology is not ready, but they’re willing to work on R&D and work with the government to see how to make it ready.

They are doing the right thing here, proposing to engage in a research mechanism. No one should be upset by this. By the way, no one with half a brain should want to use gen AI in autonomous weapons anyways, because it’s just not ready for it. So it’s not even an issue. Again, we’re creating non-existent problems, mostly driven by incompetence in ego, not rational thoughts by people that are out of their depth and selected by the president, unfortunately, with the wrong people here.

They got to go, know, they got to go. They’re hurting the nation. China and Russia are laughing because they are not waiting for us. They’re using the technology. They have their own models as well, and they’re not fighting with their own internal companies. That’s not something which we should be even wasting time on. And by the way, there was no issue, right? I never had a single warfighter reach out to me and be like, hey, know, Anthropic is blocking my queries or slowing me down. And I was the largest deployment.

[Nicolas Chaillan] (13:36.606)

in the department. So if anyone had complaints, they would have come to me and I never had a single person complain about Anthropic..

[Paul Ducklin] (13:45.656)

Surely if they weren’t getting what they wanted out of one model, the whole idea is, as I understand it, in a free market economy, you go and use one of the others. Exactly. It’s not as though Anthropic had a monopoly on this. No.

[Nicolas Chaillan] (14:01.038)

You don’t have to go and ban from the entire US government just because you don’t agree on the 1% use case, which by the way, can’t even be done. So why are you thinking about it? The whole thing makes no sense.

[Paul Ducklin] (14:13.984)

It seems like a kind of argument that sets to blow off an awful lot of steam in the near future. It has got passions running quite hard. Certainly I can see that in you.

[Nicolas Chaillan] (14:26.614)

You know, the impact for startups and companies, right, that will not get involved with the department now, it should not be underestimated. Very few companies are willing to work with the Department of War at all. Anthropic was the first one to say, yes, let’s do it. And then we call them woke and whatever, which is absolutely not true. We don’t go after the 200 plus companies refusing to do any work with the Department of War.

And I’m not saying we should, but the fact is many companies now are not going to be eager to engage in any way with the department. And it’s already hard enough, right, to get through the clearance and contracting and cyber nightmare to get accredited and be working with the government. So now you’re adding this kind of additional pain to the game. The department has been complaining about the defense and digital base shrinking over the last 20, 30 years but they do everything to make it work.

[Paul Ducklin] (15:26.294)

When you then say, let’s turn this into what is effectively a ban on a company that maybe has some principles in one particular area, whether you agree with them or not, it doesn’t seem it’s useful to say, well, that means you’re not allowed to play at all.

[Nicolas Chaillan] (15:44.994)

Say the government decides, hey, we’re not going to use it, right? Doesn’t mean you label them as a supply chain risk. That is two very different things. And it’s completely egregious that the government would do something like this because now you’re impacting companies and private companies. It is completely unacceptable. That is what a dictatorship would do. That’s what China would do. That’s what a nation that we don’t want to look like would do. That’s completely unacceptable. Not to mention that OpenAI and Google have the same constraints and the same red lines and yet nobody talks about binding them.

[Paul Ducklin] (16:18.488)

Talking about supply chain risks, those exist because of the drive towards open-source software. Surely any sort of analytical or intelligence gathering technology, including AI, that you can use to help you validate this sea of software that you’re sucking in from goodness knows where is likely to work for the greater good of all. Declaring part of that possible cyber defense based on American AI technology to be a supply chain risk doesn’t actually stop the real supply chain risks. Which can even happen by mistake. In other words, nobody’s actually trying to attack you. You’re just making mistakes because you’re making poor choices. So the person might not want to do America down. This might be that you’ve decided to trust somebody who isn’t as good as you think at software engineering.

[Nicolas Chaillan] (16:58.551)

Right.

[Paul Ducklin] (17:17.602)

Which at the end of the day could be as big a risk as someone who’s deliberately implanted a vulnerability.

[Nicolas Chaillan] (17:24.109)

If you look at the last 500 vulnerabilities found in some of the most critical open source projects, those were found by Cloud46 Opus, the Anthropic model. So you’re now taking away the best capabilities to help defend and protect software.

[Paul Ducklin] (17:42.008)

So do you want to say something more generally about how you manage that balance of attack and defense when it comes to AI in software engineering, whether your software is going into a missile or into a router that could be exploited at someone’s house to perform some kind of attack against anybody or anything really?

[Nicolas Chaillan] (18:05.336)

You know, I think particularly in the last two months, AI is now at a state where you can actually replace humans for real. Too many people don’t understand it yet and they dismiss it, talk about hallucinations and different issues that you see with AI. But people that know how to use it now and people like me, we actually now, I’m at a stage where, know, Ask Sage was created with very few people.

And I can tell you I could now do an entire company just with me and nobody else. And so these many jobs, particularly in coding and testing and cyber related roles that are completely gone.

[Paul Ducklin] (18:47.65)

Do think they’ll be completely gone or do think we will just have a world where the humans can free themselves up for what you might call higher order tasks in the same way that once we got pocket calculators, we didn’t have to bother with the mess that was the slide rule anymore?

[Nicolas Chaillan] (19:05.41)

I think people are comparing the wrong things. I think it’s going to be way worse than the calculator or the automotive robotic shift or industrial revolution, whatever you want to call it. All these things were expensive, slow, and took years. Are there going to be new jobs around AI? Sure. Are they going to replace the old jobs? Absolutely not. But also when you have the cost of tokens and AI so low still.

I just created a product right before I left Big Bear. In three days, I built what would have taken probably 60 engineers full-time with one person, including marketing and a website and brochures, PDFs, visuals. So no, I don’t think it’s just augmenting people anymore. You’re not going to completely replace 100 % of the workforce. I’m not saying that, but I think you’re going to have a one to 10 ratio within five years. You could do more work and do more stuff.

But the company is also going to try to save money and you already see it happening. It’s unfortunate that, and I don’t like any of it, don’t get me wrong, but it’s going to happen whether I like it or not. I’m thinking at least between 18 to 35%, if not more, of jobs in a non-gluculob industry gone within five years. So it’s going to be a catastrophe. You know, that’s why you hear all these AI leaders.

They don’t really care about humans, by the way, just to be clear. Talk about universal base income. We all know it’s not going to work and we all know it’s going to be a disaster and people need a purpose and they need to have a reason to exist. So the whole thing is going to be a catastrophe. In fact, my AI agents puts the chance of a civil unrest within five years at 45%, which is insane.

[Paul Ducklin] (20:54.254)

So what are those 18 to 35 % of the people going to do?

[Nicolas Chaillan] (21:00.384)

Exactly. Nothing. We have a lot of need in the blue collar industry. So we need plumbers, electricians, all these jobs. We need a lot of it. lot of people would have a tough time reinventing themselves, from sitting on a couch with a laptop to working in the sun or in crawling spaces. A lot of people talk about AI becoming a force for good and lifting the society. I don’t think that’s true at all. We’re going to see a lot of innovation probably more than ever, and it’s going to create some jobs, I’m sure. But I think on the short term, before that happens, there’s going to be massive job impact. And I don’t think the government is ready for it. Not just the US, it’s worldwide. I think the US is going to go a little bit faster. And look, companies are greedy and they want to save cost and maybe they should, you that’s their job. So they’re going to cut jobs. I mean, you saw Microsoft, you know, cut just in the last six months cut about what is 15 % of their workforce.

[Paul Ducklin] (22:01.87)

That kind of thing has happened before, hasn’t it? Right. Depending on growth and shrinking cycle.

[Nicolas Chaillan] (22:07.394)

I don’t think it’s going to change. I think it’s only going to get worse. And, you know, these companies are pretty slow actually at actually using AI, right? So they still don’t grasp what can be done with it. And sure, I may be a little bit too early or too full leaning or whatever you want to call it, but I can tell you what I’ve done is scary. And for the first time in 41 years of me being alive, I’m actually scared of this technology. I don’t know what to tell my girls to learn.

They are five and seven and I was like, are going to do coding lessons or is there even a point? It’s just a very weird and scary time and I don’t think people really understand it yet.

[Paul Ducklin] (22:46.616)

So what would your advice be to somebody who is, for example, right now thinking of getting, say, into traditional software engineering to learn their way around using new technologies to do not just old things faster, but maybe new things in a more interesting way? We still have plenty of things that we could invent and have a lot of fun with.

[Nicolas Chaillan] (23:13.262)

There’s two main skills that humans need to have today. One is self-learning and the ability to learn without someone holding your hand to do it. I think that was my always my best skill. I was able to learn to fly a plane all the way to woodworking and coding and whatever else by myself.

[Paul Ducklin] (23:33.112)

That’s a bit like, I believe it’s an Albert Einstein saying that when you’ve been working for 20 years, make sure you have 20 years of experience, not one year of experience 20 times.

[Nicolas Chaillan] (23:45.102)

Yes. You can learn to learn, right? And to motivate yourself to do it. That’s, I guess, the one skill. And then the other one is I see too many people dismissing AI and like, you know, I tried it for five minutes and it’s hallucinating and it’s doing junk.

[Paul Ducklin] (24:02.19)

Aren’t you a bit more worried though about people who do that experiment and they do get poor results but they either don’t care or don’t realise and they just plough on anyway? That gets us all into a much more serious problem because they’re digging a hole that they themselves won’t know how to get out of.

[Nicolas Chaillan] (24:25.24)

Yes. And both sides are bad, right? Not using it and pretending it’s not happening, they are guaranteed to not have a job in two years.

[Paul Ducklin] (24:33.622)

If you run a company and you have things that can currently be assisted with AI, but you decide you’re not going to use them, would you agree that you’re probably deceiving yourself because someone in your company is going to be doing it for you? yeah. They’ll just go, well, if you won’t buy me the tokens, maybe I’ll just put them on the credit card and just see how it goes. Yes. If you don’t know what results to expect, then you’re not going to be able to tell what’s going on in the business. Would you agree with that?

[Nicolas Chaillan] (25:06.734)

You don’t see a lot of that anymore. That was true in 2023 and 2024. I think company leaders, at least companies that will still exist in five years, have awakened and start understanding it. I still see studies saying 80 % of companies have spent a bunch of money in AI, so no return on investment. I’m like, you guys are already clueless. I don’t know how that’s even possible. I don’t understand how you could spend a bunch of money in AI and not get results. Maybe they were using copilot or something.

We don’t have a choice. When you’re competing against every nation and one guy in his basement creating a new startup now with AI, big companies have a tough time innovating and keeping up. That’s why they buy companies, right? But now you’re competing against one or two people, which can be very lean and very effective. I can compete now with pretty much any company on the software side, at least without touching the hardware stuff very easily at a pace that no company can even come close to. Of course, you don’t have ton of people that have both the entrepreneurial background, the visionary background, and then the AI skills to make it all happen together. within two or three years, you’re to have a bunch of younger kids that will make that happen. What scares me is I still see at universities and stuff, see kids that dismiss AI completely, like coders just coming out of school. And of course, all schools are so bad at teaching anything related to IT. Most universities, including the most prestigious ones, when you take the kids coming out, five year degree or whatever, are completely useless. They learn the wrong languages. They learn the wrong stuff. It’s completely worthless, right? I can tell you they’re not learning Rust or AI. In fact, they ban AI most of the time. I mean, all of it is such a waste of their money to those universities.

So anyway, my point is you have to really embrace it. And people putting their head in the sand and pretending it’s going to go away, they’re going to pay the price dearly. I don’t think you can come back from it. Once you’re gone with the jobs getting cut, even if they cut 20%, right? The first 20 % will be the people that didn’t use it at all. That’s why you see companies have metrics now. I don’t know if you’ve seen that, but many Fortune 500 have metrics about how much you use AI.

[Paul Ducklin] (27:28.206)

So to finish up, what advice would you have for someone in software engineering, whether we’re talking about mission critical stuff, missile systems, defense stuff, or something to help water go more smoothly along a pipe so that when you open the tap, it comes out. For anyone who’s struggling to make sense of AI development, and it sounds as though what you’re saying is that most people are at least trying, but they may not be very successful because

They’re just pressing the buttons and hoping that not only do they not have to write the code, maybe they don’t even have to think about it either. What would you advise for people so that if they do decide I’m going to embrace AI, how do they make well-informed decisions so that it works for them rather than, as you say, instead of them or even worse, against them?

[Nicolas Chaillan] (28:21.46)

One, you have to have the right tools. So you look at OpenClaw, a huge agentic improvement. That’s all I use today. It’s amazing. You put it on a Mac mini or whatever, on a laptop, on a VM, on the cloud, and then it becomes your executive agent for everything.

But you have to know what to ask. I think that the main issue that people struggle with is AI does not replace your brain in terms of the vision, where you’re headed, what you want it to do. If you don’t tell it to have security baked in and DevSecOps and follow a DevSecOps pipeline, do CBA scanning and static code analysis and reflect on the code. In fact, I have a gate now on my pipeline that my agent built that use AI itself to assess the code and it finds more stuff than all of the scanning tools we put on the pipeline for static dynamic analysis, CV scanning, software buildup material, and all these scanners. I can tell you the AI stage of the pipeline is able to find more issues both in security, but also in testing than the unit testing and integration testing. You know, I built this product in three days. It built its own DevSecOps pipeline. It built its own AI assessment. It built 1200 tests, 100,000 lines of code in three days with the product, the website of the product, the entire marketing and visuals for LinkedIn posts. You could build an entire business in three days. But one, you need to know what to ask. You have to the right vision. You need to be precise. You need to say, know, software security is not an afterthought. It needs to be baked in. You have to give it the context, the guidance, just like you would to an employee.

And in fact, I think of it as a bunch of employees that work 24 seven and don’t complain, I guess. But that’s kind of the way I give it the right insight and focus and background. So he knows what are we building? Hey, we’re working for the department of war. We can mess up. Security is key. Let’s build the architecture, the scope of work, the foundation for the DevSecOps pipeline, all the tooling, all the scanning tools. And by the way, he was able to deploy it on GitHub with GitHub actions, build the entire pipeline in four minutes with all the stages. That would have taken a human like a month.

[Paul Ducklin] (30:45.08)

So to really finish up, where would someone start learning the right things to ask? Is that really a question of diving in and learning by trying and learning by example?

[Nicolas Chaillan] (30:59.064)

You’re never going to replace experience. This was my 188th product. So I know what it takes to build a company. It’s my 14th company, right? So I know what it takes to get there. I know the right mistakes to avoid all these different step-by-step things. You could ask it and you could have it self reflect on, what should I do? What’s the next step? If you were a very successful entrepreneur, what would you do if you were me?

What do you think of my idea? The issue also is you bring your bias. I’m going to build this product. great. People are going to love it. You just created a bias in the agent and now it’s going to be like, your stuff is great, you know, even though it’s not great. It’s all about prompting. It’s all about how you bring things up. You could ask the same question in a different way and create bias. Is this the right idea? Or you could say, give me the first, the top five course of action for me to take.

[Paul Ducklin] (31:42.126)

Yes.

[Nicolas Chaillan] (31:56.972)

Instead of telling it the one you want to take or the one you think is best, just say, hey, you give me the five best options and then you reflect and then you decide. And then you can even have it reflect across the models for complex tasks or decisions. I just did a big investment decision, which by the way, I went with the agent and didn’t listen to Morgan Stanley or JP Morgan for a big investment. I listened to my agent. We’ll know if I was right or not, but I had Cloud, OpenAI, and Gemini fight each other to come to the conclusion. And they adjusted based on bouncing ideas between the models. I think it’s a very interesting world. It’s a very scary world. I don’t know what’s going to happen for younger, particularly entry-level jobs because people don’t know what to do. And they might not have the opportunity to learn by making a bunch of mistakes anymore like we used to.

You got to be on top of it. You’re going to learn. You’re going to go watch videos. You’re going to, you’re going to invest in yourself instead of spending time on tick tock and whatever stupid stuff you do. And that’s going to be 50 % of the bottle right there.

[Paul Ducklin] (32:59.886)

Thanks, Nick. I guess some of your views could be considered controversial, but it’s quite clear that you’ve tried this and it seems that your primary advice is if you’re going to start using AI to help you finish tasks, don’t tell it the result you want to achieve in advance because that is a self-defeating prophecy. Right. You’ll get the thing that you thought of, an open mind, I guess goes an awful long way. Nick, thanks so much for your time and your passion. Thanks to everybody who tuned in and listened. If you find this podcast insightful, please don’t forget to subscribe so that you know when each new episode drops. Please like and share us on social media as well. We really love it when you do that. And once again, thanks to everybody who tuned in and listened. And remember everybody, stay ahead of the threat. See you next time.

[Nicolas Chaillan] (33:31.256)

That’s right.

[Nicolas Chaillan] (33:58.264)

Thanks for having me.

AI vs. Vulnerabilities: Who Really Wins?

AI vs. Vulnerabilities: Who Really Wins?

    Artificial intelligence is rapidly changing cybersecurity, but not necessarily in the way headlines suggest. In this episode of Exploited: The Cyber Truth, Paul Ducklin sits down with RunSafe Security CEO Joseph M. Saunders and Dataminr’s Joe Slowik to explore how...

read more