Full Transcript for Democratizing Security for the Agentic Web with Cloudflare CTO Dane Knecht

AI has become the tool that's causing this kind of security apocalypse. It is also the tool that can help us solve it faster as well. It went from how to get everyone just using AI. Now all of a sudden everyone's racing to figure out what AI security means. I've heard serious technical people say things like air gap, everything important.

And we're like not going to be able to trust the internet for a while. And we just assume all the critical infrastructure and government services fall down at some point. Is that your expectation for what happens?

Dane, I'm so excited to do this with you. Yeah, thank you. Thanks for coming here, too. I'm sure I'm not the first person to make this joke, but your last name, Connect, that's pretty good for the Cloudflare value prop. Yeah, yeah. There's been some jokes about renaming the show next year. So with everything that Cloudflare is doing, what are your top few priorities as CTO right now? Well, I mean, this past year, it feels like 10 years compacted into one.

So those priorities are constantly shifting. But, you know, it all goes back to our mission of helping build a better internet. And that really hasn't changed over the last 15 years, where we want to make sure that the internet's secure. that everyone has access to be able to get their content online easily and scale it up. And just over the arc of the AI changes in the past year, it went from how to get everyone just using AI, how do you make it easy for them to deploy and their agents to deploy, to like most technical transitions, security is kind of an afterthought.

And now all of a sudden, everyone's racing to figure out what AI security means. And it means different sides view it kind of differently. One side, as a company, is how do you keep your data safe from AI leaking the data out? But it's also how do you keep people from getting in as well, too? And over the last, I would say, three to six months, just the number of vulnerabilities that are being reported in CDEs has just gone up exponentially.

Previously on the internet, we would see these log4j moments or these shell shock or type of incidents maybe once a year. It would be all hands on deck internally at Cloudflare to make sure how we protect not just

our enterprise customers, but also all of our free customers, because we view it as a public good and making sure that the internet stays safe. These things are now happening weekly. Not all of them are publicly reported on, but there are things that are as serious as the log4j type things, but just happening at a greater frequency. I expect that through the rest of this year and in the next year, by the next 18 months, the majority of Teams' time is going to be spent on security.

I think there's a stat that was put up earlier today during one of our keynotes, where it was showing that I think over 50% of engineering time is going to be spent on security. And I don't think that will last forever. I think that will be a short transition. At some point, the AI will have surveyed majority of the code and found most of the bugs or found most of the shortcuts.

There's one that's kind of coming out today and has been started to be blogged about and tweeted about. where one of the keys on the internet that protects all TLS and WebPKI, which just secures all your connections, was secured by the number four. Literally, they basically used... You know about cryptography. It's all about randomness, right? That's why Cloudflare has our lava lamps, is so that you can get good randomness.

And when a key out there is they use the seed, they use the initial thing to kind of create it with a single number four, it's going to be reverse engineered. And AI can just do all these things. It doesn't sleep. It's not like the one engineer you had that was red teaming things.

Last week, I think OpenAI found the seeds for the NIST curves back in 2000 that were released. These things are just moving so fast.

The bar is going up and the models are just getting so good at cybersecurity. Mid-South was just kind of the tip of the iceberg there. And since then, it's not just been the models getting better, it's the harnesses. It's how humans know how to use them and use those frontier models in order to find those exploits. Given your visibility, what do you know about the humans behind these attacks and harnessing these models and taking the volume of vulnerability discovery up so quickly? Are they nation state actors? Are they script kiddies? What can you say about how the attacker landscape has changed? Well, I actually think that some of these larger vulnerabilities that have

come out more recently, actually, haven't been nation states. They've been, you know, high school kids even that are... We're going to call them agent kitties now. Yeah, that are just... spending their time, you know, like they used to do, kind of capture the flag security contest. They're appointing their agents at an area and doing that.

You know, there's also, you know, and there's just financial reward for them. There's bug bounties that they get paid out, you know, sizable amounts. But it's given the tools that, honestly, the nation states have had in some forms for much longer, either through agents or just through, you know, sure number of people that were working on the problems, given it to the masses.

This is the first time in 15 years I've heard serious technical people say things like, well, we should just like air gap everything important. And we're like, you know, not going to be able to trust the Internet for a while. And we just assume all the critical infrastructure and government services fall down at some point. Is that your expectation for what happens? Humans, we are pretty adaptable and we can move fast when we need to.

And, you know, I've seen the industry kind of partner together. And when things like this happen, people that you usually think of competitors are no longer competitors. We're just literally protecting critical infrastructure, as you said. And I think when those kind of critical moments happen, people will rise to that challenge. So I'm a little less doomsday.

I do think that a lot of the things that we've done over the past five to 10 years, moving away from a kind of a castle moat infrastructure for security to moving to more of a zero trust does put a lot of companies in a better position. Where, you know, you're not saying this office is completely air-gapped. You're saying, you know, these devices, these flows are secured in a different way.

And everything's going to be tightened. What is it going to take for organizations to do what you're describing? Like 50% of engineers do not work on security right now. I had Greg Brockman from OpenAI on the No Priors podcast last week, and he said that he thought in 2027, people are going to spend as much money on tokens for security as engineering.

Like you're saying, very related idea. What is going to drive that shift? There's some urgency, right? So you're going to move forward all your security spend over the next 18 months, both from the red team side, which is more the offensive, trying to actively try to exploit things, as well as the defensive side, how you prepare things. But I don't think that's going to last forever.

You know, I see a world in like 18 months where, you know, new software productivity goes way up because all those resources are back focused on that. But there's definitely this period where security is on everybody's mind.

What are some of the key elements of getting to a better place in terms of overall software and internet security? I think people discover, of course, that there are libraries and services everyone uses that had vulnerabilities that took effort to discover and now do not. And I think we'll hit some of those. What else is important there? Because part of the...

concern that i have is the rate of software production is also going up a great deal right so to some degree we got to go like patch everything that we have already made and then keep up and get ahead of the pace of delivery yeah um also i mean for one we're right now we're patching 70 years of of us a software uh out there so so some of it is just catch up And then on a go-forward basis, I think the software development lifecycle, the agent development lifecycle is going to need to change.

And luckily, the same way that we can use security right now for Red King and things like that, it'll just be built into the process every step of the way. And I think software will just get more secure over time. What have you learned about building secure production software internally already that you think people can learn from? Like, what does that mean? Like shift left and like, can we, and there are many theories of how to do this, including, you know, broader use of formal verification, using agents for security in the development process.

Like what do you think is going to create better software from first delivery? I can go back to first principles of there is you want to reduce your attack surface area. The easiest thing you can do is to give less places for there to be vulnerabilities. So, you know, looking at all your software and saying, how can I simplify this? How can I reduce the footprint, the code? And then, you know, beyond that, I mean, things like formal verification, like, and I think things that, you know, safer programming languages and things that are kind of built into the runtimes that make everything safer will come.

But, you know, I think it just starts with, and, you know, AI, at least, you know, the early AI is very verbose. It likes to create complexity. So, you know, AI in a sense of what we've been dealing with is actually uh uh not been kind of uh helping build a a more secure stuff right now but i i think it will get there and i think uh uh the you know that's where humans still come in and human judgment comes in and uh making sure that we design the software in a way that uh can stand on you know some securely That was actually going to be my reaction when you say we want to reduce the surface area.

I'm like, oh, yes, of course, in principle. And that's not the natural inclination of today's models. Right. And like, you know, I asked me to do something and I'm like, well, like with one tenth the complexity, please try again. Is that the role of engineering and security engineering today? Is that something that's going to be solved at the model level? The way that humans did before agents, it needs to be solved at all levels.

You need to train the engineers that are writing the code, the product engineers. The security teams still need to be involved in making sure that they're getting checks and balances, second set of eyes on things. You need to build in processes. We've gone to...

defining things a lot more internally on how we build at Cloudflare, writing down our principles. We have a document called the Codex, which is kind of like

a buildup of a lot of RFCs that the teams have built for it. Here's how you build secure software at Cloudflare. Here's how you build available software at Cloudflare. Here's our best practices. And then it kind of gets boiled up into some 10 commandments that the agents know how to follow and use in every part of the review process. that can help enforce those things.

So, you know, you have agents out there that are, you know, just riding a lot of the slop and then you have deeper down the factory, you have people that are, you know, doing the performance runs and the security runs and just like how the company operated before, you need those adversarial

reviews. When you zoom out a little bit and just look at overall traffic on the Internet and how much of it has become agent driven over the last year, I think it's outpaced most people's expectations. What has updated in your worldview of like what the web a year from now looks like, either from an economic model perspective or a security or requisite infrastructure perspective? Yeah, I mean, I kind of think of it as we're in the messy middle right now where humans and agents are riding the same rails on the internet, where agents are trying to parse a human web when it's just inefficient and was designed for humans that could do things at different speeds, going to a

website and be able to read and see the ads and participate in the more full economic model versus an agent that now can go to a thousand web pages in the same period of time, which is great. It's just you need to find a new economic model to support that. Do we get parallel webs? Is there like a human web and a machine web? Like everybody's trying to do, what's it called, AEO now? Yeah, I mean, yes, I think we do.

I think we find ways to deliver the content and meet agents and humans where they are, as opposed to trying to meet them in the same place. And

right now there's like translation layers. You know, there's a lot of companies that like, you know, help you, you know, an agent view a web page. These are just all extra, you know, burning of tokens for things that probably don't need to happen. The website usually knows what data, and we've had things like this, we've had APIs, ways that computers talk to each other for years.

It's just APIs only covered a small fraction of the information on the internet. And agents have a thirst to understand everything. And so they're going out and trying to explore the human internet. And we need to make it easier for them. We need to make it less costly for the site owners. And we need to find a way for them to get compensated.

I think it's in a world where you can get very simple. It's a good content website, like a Substack. They know what their CPM is for how much money they should be making on ads.

for that site. And so if an agent's reading that site, I think there is a world where you get to the point where an agent can decide whether or not they want to read the content and then they can decide if they want to pay the CPM rate, right? And that's where you need to then get new payment rails for the internet that can do millions of transactions a second.

uh for uh these all these little micro payments uh all these things we've been talking about for years uh you know uh micro payments you know always are two years two years away and uh um uh uh you know uh i i think agents will actually push that forward and actually and we will see a world where we're actually there is a new economic model for company creators Who do you think the players are? What are the variations of that infrastructure? I think, obviously, Cloudflare has an important role to play here, but the rise of personal agents like Instinct and Muse have also made this an immediate question from a transactional perspective.

I don't think everyone knows on the other side what the business outcome is going to look like. Everyone's been through these transformations where the internet, they thought it was going to kill Main Street. It didn't kill Main Street. Small businesses are still thriving.

But there were people that were displaced. And so there's always some skepticism there. And so there's some natural inclination to just block them out. You saw Amazon just say, no personal shopping there from an agent. I mean, I think these are all people that are that messy metal, but they're trying to figure out what that path forward is and trying to keep some of the negotiation leveraged there.

I think we will get to a place where Muse and Dots and all those personal agents will be able to accomplish tasks seamlessly as you as a human could do, even easier. But I don't know if the technology is quite caught up to that yet and the business models either. Is there anything you're personally excited about on the roadmap or just from a technical exploration perspective on the Cloudflare front that you feel like is going to enable this ecosystem in the future?

Absolutely. On the content side, we've released a conference monetization gateway where we make it easy for people to put their sites behind us and

take microtransactions for their content. uh we uh um including uh providing a wallets for agencies um uh uh and uh and a stable coin that's gonna be able to help kind of uh facilitate that transaction as well um you know we're also doing things uh with open ai uh uh practical signals where we're making it easier for agents to actually discover content instead of having to crawl the entire internet and continually go back to pages.

We're making it easier for them to know what's new content and actually kind of more proactively do that. So, you know, it's a win for the AI labs as well as a win for the site owners not having to get constantly crawled and pay for that infrastructure. There's a whole set of new laws in the Internet that I think I'm really excited to see all those grow, to see the

X402 from when Stripe came out with it. I loved it because it went back to the 402 HTTP code, which

Tim Berners-Lee created 20 plus years ago, 30 plus years ago for payments. You always knew that you needed a better payments rail on the Internet. but we haven't been able to kind of figure it out. And I think agents will lead us to that as well. When you think about these initial products that you've released, what would success for a content creator or somebody who ostensibly had a website on the internet that they were monetizing with ads before? What's the killer success case you guys need to see or show the world where it just becomes like a default to do this? Well, I mean, I think we're, instead of them paying us, we're paying them, right? You know, where it's

covering their infrastructure costs, it's providing money that

supports their livelihood. You know, we can actually increase the number of content creators out there, which, you know, the last generation of the internet has done very well, like with YouTube and TikTok and

actually making it even exponentially larger. And when you look at the Workspace OS release and ecosystem work that you guys have been doing, what are

you hoping are the biggest use cases of it coming up? This is transitioning a little to a release called Cloudflare OS. Cloudflare OS is our internal platform for how our employees use AI every day. It actually goes back to security roots where we were very worried about customer data, internal data leaking out, and we wanted to make sure that our employees could use all the new AI tools and models, but have a way to safely deploy them internally to understand how that data is being used and flowing.

and have good governance over that. In addition, the reason my company is called Cloudflare OS is we started to realize that as we have more and more agents, we need to be able to teach them what we call for special, how we build a Cloudflare. You know, and for humans, we did that through, like, Cloudflare University and the onboarding process and, you know, meeting your colleagues and working with them.

But we needed to kind of more clearly define that and document that for agents. And so Cloudflare OS is both the platform where our employees can build anything that they want in a secure way without having to, you know, security, it's not something they have to think about. You know, the VR that's trying to create a call list, they don't have to worry about security.

It's just built in there. for them, but they also know that it's being done in a way that is consistent with the themes and values of how Cloudflare works. And why release? I think of this as like somewhat different from the other products that Cloudflare offers today in that it is not infrastructure. It's like an end user facing

product for managing AI use within the organization. Like why release it? Or do you think of it as a departure? Yeah, I mean,

For one, it's kind of a reference architecture, really. Over the past 10 years, we've built our developer platform where we started with just a simple serverless compute primitive and now over 100 different developer platform tools from storage to databases to durable objects.

We wanted to show how you can build it completely on Cloudflare and how we build things internally and kind of...

give people the option to, you know, fork it and build their own version of their own company OS on top of it. And what is a way in which it is helping your people and your organization that you think is like clear success?

It's actually used more by our go-to-market teams and our G&A teams than it is even used by our engineering teams. You know, it's given them a very fast... Early on, I thought we saw training was the biggest gap for people using AI. And when you just kind of point them at a chat interface or a...

Another by-putting tool, it's too much of a blank slate for them. This is a platform that you design everything for how your business works, and they immediately can go there and get access to all the data that they need. They can get guided and taken through where they quickly realize, this is not trying to replace me, this is trying to make me better at my job.

And that's been really exciting to see just all the different ways people at the company have done that. A lot of how this conference got put together, the marketing team built hundreds of internal tools where previously they would have to go out and work with different agencies, but the speed that they can move with a smaller team now is just amazing.

Assuming this is a continuation of starting in May, you guys did this restructuring to be an AI-first organization. What else, reflecting on the last number of months, has worked or not work that you would recommend to others? Yeah, I mean, so, you know, the restructuring was hard. You know, saying goodbye to some of our colleagues was the first time Cloudflare ever did it.

You know, we had always been very careful not to overhire. And this was for different reasons. This is because we saw the way AI was transforming some teams and how they work. And, you know, we kind of thought of it as like a factory floor where you needed to actually rebuild, rethink how things happen. You know, there were some processes or some, you know, the way a product manager would send an email before to customers, it involved three teams.

You know, it involved a team where, you know, You went to BI to go get a cohort of the people that you wanted to send an email to. You went to the marketing team to help you design the email and get the voice right. You went to the marketing operations team to get the email out.

You're never going to be able to actually redesign that process unless you kind of make some hard changes and force people to kind of rethink, well, what actually is the right way to do that? And it might not involve those three teams at all. It might just involve a new way of doing things. And so what came out of that was a tool where a product manager now goes in and describes the cohort.

They write an email, it rewrites it in Cloudflare's voice. It sends it to their manager,

and the manager can click approve if they like it, and it goes up. We didn't go from three teams getting faster at doing that. We went to one tool that can let a product manager know they have a superpower they didn't have before. When you think of all of the different workflows and tasks within an organization that's got about 5,000 people like Cloudflare, how do you decide who the owner is of rethinking that process? And was it bottoms up from one of those teams in this case? Is it an organizational leader? When you have so many of these things that could change to be faster and make more sense, as you described.

Yeah, I mean, Cloudflare has always had a thousand more things that we could ever do, whether it was products and features or things like this. And so we always look for people that are going to take initiative and ownership. And so it doesn't really matter if you're ordering it one to 100 and trying to prioritize it. Any one of those 100 things are probably safe if someone's passionate about it.

So we kind of gave people at the end of last year the tools and started seeing how they were experimenting and, you know, people quickly kind of broke out into different cohorts of people that were really leaning in and, you know, just naturally doing those things and taking ownership of them. So, you know, I think it was very bottoms up from how we're going to do those things.

It's been a major topic of conversation for organizations as to how they should think about token budgeting, right? Like, you know, what's a reasonable amount to spend? How do I think about this versus human capital? We should get tokens even within our organization. Like, what is your philosophy on this now? It's definitely changed. You know, and each model kind of makes you rethink it as the cost dynamics change.

But, you know, in general, you know, I think it's kind of silly that we're actually asking humans to decide which model to do each task. Um, like it should be intelligently routed. Yeah, exactly. Like humans just aren't, aren't going to ever be good at that. Right. Like, uh, um, you know, uh, um, but you know, early on you do it kind of, uh, brute force and you, you know, people, you get people to experiment and you say, Hey, Well, let's try for the planning part, let's use the top frontier models for that.

And then once the plan's written out and agreed upon and iterated on, then potentially some more of the open source models can go do that. And then you go back and you have one of the frontier models do the reviews and the red teaming and things like that. Now, all of that today is fairly manual.

But I think as we start to learn and experiment, I think we will become intelligent. And over time, there'll be more governance on that. Cloudflare has been in a place where

largely we've let people use the models and tools that they see fit for the job. We don't have a token leaderboard. We don't encourage it. We encourage people to focus on the output. The, you know, they're not graded on, you know, if they used it, they're graded on, you know, what they've shipped and what they've built. But then, you know, we do have some kind of, we found like, just kind of like giving people notices.

Like, you know, if you happen to use $300 a day, they'll just get an email, right? Like says, hey, did you know? And because most of the time people didn't realize they were doing it. And they're like, oh, huh. And then I think if it gets to 500, it goes to your manager. If it goes to 1,000, it goes to a VP in a day. But those things rarely happen.

And usually, people are actually happy to get those notices. Where do you think you are in your overall evolution of like take things just for the current level of capabilities of models, assume no new development of, you know, rethinking the way different things at Cloudflare are done from go-to-market to engineering to be... Oh, I think we're still so early.

You know, Comfort did something, you know, two years ago, we had about 200 entrants. And what we saw was those interns were, you know, really the first, you know, fully kind of AI native, you know, where you took AI away from them. I don't think they would be able to work. Is that good? Yeah.

Actually, I think it is. I think they know how to use the tools better than us. It's just like you took Google away from me over the last 10 years. How would I learn anything? That's where they reached to first. And we actually saw the managers that had interns from that summer actually adopt AI faster. So then this past summer, this past year, we decided we were going to hire 1,000 interns.

So that's, you know... For a 5,000-person company. Yes. Wow. Yeah, over the course of the year. Yeah, still. Yeah, and it's just been amazing because, you know, one, just the number of ideas that come from the interns, you know, that's something that, you know, with AI, it lets people experiment faster. And so having more ideas, getting more people in there, but also just seeing the way that they use AI, like, you know...

they need to fill out a form, they reach for AI. And I still find myself, you know, there's so many things where I'm like, oh, wait, I've just been doing this manually still. And then I'm like, yeah, wait, actually, I should be using AI. And I don't think that that's a natural for most of us yet. And I think that will take time. And so, yeah, I think we're still very early in our AI journey.

I love it, though. The mass intern strategy. Yeah. I run a very small partnership and we always have a, you know, an intern or two floating around a team of about a dozen for, you know, ideas and intern energy and all that. But we just converted one of our, you know, in college interns to full time and Jed and had him drop out and everything.

And I think that you're right where maybe like the dial should be turned up on the amount of DNA that is really, really native to these tools. Yeah, I think it's great for them as well, too. You see these schools like Waterloo and Northeastern with these co-op programs. And from what we've seen is

people that get that type of real work experience are some of our best employees many years in and go on to do great things. It is interesting or encouraging, though, that instead of it being like, hey, here's a master plan. We're going to map out every department and sub-department at Cloudflare and be like, here are the key workflows. We're going to try to re-engineer the workflows.

It is instead a strategy of like, assume people are rational about their tokens if given information about their usage. Hire a bunch of interns and assume high agency people we have here are going to go like... You know, shift those workflows to something more intelligent over time. And then brute force and just try things. You know, early on, we had an email alias called Agents at Cloudflare.

This was back in January of this year, where we just told people to, you know, curious, can I use AI for this? You know, email in your jobs to be done. And that email list would reply back to the skill file.

And for a while, people thought it was actually, you know, thought it was all AI and automated. It was actually a bunch of interns that were, you know, helping people write scale files. But that led us kind of get to see, you know, in a way that's not going out and like, you know, hiring a consulting firm to come out and like catalog every single thing to be done.

It's, you know, people that are recognizing, hey, this seems harder than it needs to be. I wonder if an agent can help me here. Is there anything else about the last year that's changed

beyond the intern level, like your hiring philosophy, once you look for people to bring on? Well, I mean, One of the biggest things we always look for is curiosity. And so, you know, if people aren't using AI at home in their personal life and all that, I mean, that's a pretty big red flag. Like, I mean, just how can you not be embracing AI if you have, you know, a level of curiosity out there? So, you know, I think just...

double down on some of those kind of key characteristics of drive and curiosity and empathy play even better for this next set of people. Well, I mean, I am a alpha user of all products and technology forever. But I think the answer is like fear and skepticism, right? And so I guess implicit in this claim about like curiosity, including an experimentation with frontier tools is like that needs to be a core principle for people who work at Flare.

Yeah, I mean, a lot of things we're doing, we're inventing new ways of doing things. I mean, the scale that we operate at for the number of sites behind us and the amount of free services we give away, it's just not possible with off-the-shelf technology. So you need people that can come in and literally invent new things. And that starts with curiosity.

I have a couple questions for you to close out, mainly about security and how to do that in a new way, both at Cloudflare and then how you think it's going to work in the broader ecosystem. What do you think is the process by which if half the engineering team is going to go work on security and just fix 70 years of vulnerability, how do you attack that problem? internally, assuming that not all software is perfect, even amazing production internet scale software, and then, you know, we'll talk about the ecosystem.

Yeah, I mean, I think largely, you know, we're, you know, Today, we have one red team. I think by the end of the year, next year, we will probably have four or five red teams. So break people out into groups that are actually being more adversarial and actually going out and actively trying to find vulnerabilities. Why is that the approach when instead of like, oh, we're finally going to get our patching systems right, our processes right? I mean, processes and those things can always be better.

We have a volume process. We have a patching process. Really perfect now. But, you know, the best way I found for those sorts of things to get better is to, out of crisis kind of comes,

that's how you get those things fixed. When the volumes get too big for the engineering team to just do them using their normal processes, engineers are inherently lazy in a good way. And so they will automate away those things as they need to, as they realize that there's no other way to do that. So I think the focus needs to be on the discovery side.

And... people will do the right thing and figure out how to patch it in a scalable way over time. Do you express a philosophy on just prioritization of this versus like shipping new features? Because I guess my understanding of it's not as if we didn't have a backlog of like vulnerabilities and every large piece of software to go fix. It was just like whether or not that was a priority for engineering teams previously as one common state.

I think you need to figure out how to do both. It might come at the expense of cost optimization or other things, but companies, if you're not shipping, you're dying. That's how we think about it. So it's not going to be freeze in order to do this. No, absolutely not. You need to be able to continue building and shipping new things, but you need to be able to make sure that you're doing it securely and patching and fixing bugs.

And I think if we do it right, we'll actually be able to do them both faster with AI. While AI has become the...

the tool that's causing this kind of security apocalypse, lone apocalypse to happen. It is also the tool that can help us solve it faster as well. So it's on both sides of it. Where do you fall in this debate of the role, like good and bad, of open and closed models on the cyber front, right? Because the argument, the broad argument is, well, having defensive and offensive cyber capabilities, you know, they're parallel in the same model, despite...

uh, safety and guardrails being, being built into them. And so you can't have open defensive models without them also being offensive. And then the argument, um, sort of, uh, that were the concern around only having security capabilities in, um, a, a set of frontier closed models as well. How are you going to release them? And you can't possibly get them out to the distributed set of actors that need to defend.

Like, what, what do you think? Or did I characterize that? Yeah, I mean, I think over time it all has to be open because everyone's going to get access to it anyways.

That's how open source tends to work, yes. The bad guys are going to find a way to get it. So all URs and the top companies will have a way of getting it as well. So you're just excluding a mass population that just doesn't have the access that probably needs it. And and then so so final question, just because, you know, Cloudflare very mission oriented does carry the weight of some, you know, Internet resilience on on its back.

What about all of the people who can't afford to have four red teams or like never had a red team to begin with that run important systems? How do they how do they protect themselves? Also, I would say, put your sites behind Cloudflare. Put your infrastructure behind Cloudflare. Build on Cloudflare.

When these major vulnerabilities come out, like the React one last year, we don't just give it to our paid customers who have the advanced firewall and WAF capabilities. We give it to everyone. We view those kind of things as part of the utility that we offer. And, you know...

We want to provide that, just like we want to provide performance for everyone. Before Cloudflare started, there were probably 3,000 sites in the world that had a large-scale CDN to cache their stuff at the edge. Now there's hundreds of millions of sites that do. So Cloudflare's always viewed our goal as democratizing the security and performance for everyone.

Awesome. Thanks so much for doing this, Dane. And you guys heard it first. We have the agent kitties and the von apocalypse. Am I pronouncing that right? Yeah. Yeah, but it's resolvable. All right. Thanks so much, guys. Thanks.

Find us on Twitter at NoPriorsPod. Subscribe to our YouTube channel if you want to see our faces. Follow the show on Apple Podcasts, Spotify, or wherever you listen. That way you get a new episode every week. And sign up for emails or find transcripts for every episode at no-priors.com.