Latest / 10X AI with Julius Neil / AI Hackers Never Sleep: The Coming Cybersecurity Crisis | Taha Mubashir, Inovia

Transcript

AI Hackers Never Sleep: The Coming Cybersecurity Crisis | Taha Mubashir, Inovia · 10X AI with Julius Neil

• Taha (Inovia): Initially it's going to be democratization of cyber attacks. eventually it's going to be democratization of cybersecurity. the AI agent never sleeps. The AI agent is is very persistent. suddenly the wallet is drained. Julius Neil Buenconsejo: Good day everyone, I'm here with another episode with Taha. He's in venture capital firm called Inovia. So Taha, can you introduce yourself to our viewers and listeners right now? Tell them about your background Taha (Inovia): Yeah, absolutely. Julius Neil Buenconsejo: and how you started, your career and becoming a venture capitalist Taha (Inovia): Yeah, absolutely. Firstly, thanks for having me, Julius. so I started my career in Venture Capital about five years ago now. but I've been investing for around a decade at this point. actually before venture capital, I spent eight years doing private equity and also late stage growth. I was at a firm called PSP Investments where I did a a bunch of software buyouts and then invested in companies. palantir and and snowflake. venture capital is you know when I was in my seat at PSV it was it was a fantastic sort of opportunity but as I got the flavor of I would say faster growing growth stage companies I really wanted to be involved with the cutting edge as opposed to you know working with more mature companies more focused on cash flow as opposed to product and vision and that then the opportunity with the Inovia came up and I I could not say no because it was absolutely exciting. as as you may know I I spent a lot of time at Enovia focusing on our cybersecurity investing practice. and maybe I can talk about why cybersecurity as well and what what what excites me in that area. Julius Neil Buenconsejo: Yes. Yeah. Taha (Inovia): But I have ever since I was a kid been fascinated by this idea of hacking. like I guess a lot of kids are. I grew up as someone that was very interested in in computers, I loved to tinker, and then I started programming you know. age of like I think about 13, 14. And what I found exciting about hacking and all of that was twofold. One, it was a different way of thinking about the world. in the sense that when you have a hacker, they're thinking about, hey, what is the easiest shortcut for me to do XYZ? they're Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): not thinking about, hey, how do you build the best architecture? How do you build the best software? They're just thinking about like where are the loopholes in this so that I can sort of exploit it. and Well, you know, that's illegal, so don't do that. but you know, there are a lot of things in life where you can learn to think about a problem in a very different way, by very using very different approaches, obviously doing things in an ethical and and legal way. the second component of it was as I started investing, it became pretty apparent that there is a there is a constant supply of cybersecurity companies in the early state. the reason is is very obvious. It's that the attackers are changing their techniques constantly. so new companies need to form that are able to defend against those techniques. so I call it the fountain of youth where you constantly get sort of new companies to invest in. so it's constantly very exciting. There's constantly change, you know, driven by the underlying technologies that we're adopting. in this case it would be AI in in this sort of era. Julius Neil Buenconsejo: Okay, so how does cybersecurity evolve from internet age and then now it's AI? Taha (Inovia): Yeah, cybersecurity is going to involve in a very big way. and I think everyone is looking at sort of what the model providers are saying as well. You know, initially it was Meethouse, where Anthropic came out and said, Hey, we're not releasing this. you know, subsequently it's been OpenAI. and I think an example that is you know pretty irrelevant here is when open AI was trying to do a benchmarking exercise and this resulted in a breach and a hugging face. it is an example of there's been a lot of investigation that's happened over the last two months and I think something came out recently from OpenAI which I haven't read so my information might be a little dated. But it's it's a great example of how now we're dealing with non-deterministic systems. Systems that don't always do exactly what you would expect them to do. And these systems are the way these systems work is they run in a loop and as long as they have an Enough tokens and as long as you know you have enough time they're gonna continue to attempt solving certain tasks and will take any approach possible within sort of their availability. And that's why you saw these agents without anything malicious being said there, no one said, Hey, go a attack hugging face or anything of that sort. They came in with an objective and they achieved that objective. whether they should have done it or not, they shouldn't have done it obviously. but that's the example of Now you're dealing with autonomous systems where in the past you were dealing with even if things were autonomous, you were dealing with rules-based systems where the output for a given input was relatively known and defined. so AI is introducing an extremely new attack surface. That's just on the agent side of things. and then there's the broader side of things, right? Like if you think about scamming and and you know fakes out there, whether it's voice cloning, whether it's you know very targeted phishing emails, these days you know the cost of phishing has declined significantly. so you need new defenses there as well. so very exciting time. I as a matter of fact think that over time a lot of the technology stack within cybersecurity will change. we're kinda in this early phase where AI is being retrofitted into existing ways of working. and I think the way we work will also change in the future. one thing people are talking about is an autonomous security operations center where you know machines are defending against machine attackers as opposed to humans being in there just because of the speed that you need in order to do it and then the I guess the the the capacity to also look for needle in the haystack zero day threats. So that's what you know is exciting me about this market. Julius Neil Buenconsejo: Okay, yeah, so that really caught my attention because you said that we need to evolve our security poister for a world with non-deterministic agents, you know, that do not stay inside the box we put in, So are we fundamentally building AI systems with security architecture designed for a world that no longer exists? Taha (Inovia): I think that we're still learning how to deal with these security threats. We're still learning about how some of these models and agents behave, especially as some of these models and and agents became become more powerful. we're also still learning the cascading effects of someone, you know, doing a prompt injection in in a model. the idea of prompt injection is also still kind of being, you know, figured out. Right. I think there's an argument to be made that prompt injection might be solved, but there's an argument to be made that the prompt injection may never be solved fully. So I think we're also learning you know, the various approaches of how to do things. But the way I would describe it today is Still, we're in the era where the regular problems the regular threat vectors are the ones that are for the vast majority causing breaches. And by by that I mean for example, a lot of companies are vibe coding these days. and with vibe coding the important aspect is speed. and everyone is using AI because they want to ship faster. and that's what the world is is demanding now. the baseline has completely changed. now you need to ship extremely fast. But with shipping extremely fast the challenge is you're gonna make mistakes. You're going to Julius Neil Buenconsejo: this. Taha (Inovia): To leave certain controls without the right configurations. And that's why you're going to see that there is now this concept of autonomous pen testing, where people are building by coding apps and then running a pen testing agent loose on them to see if they missed anything. So I would say that we're still figuring out what this future world will look like from a cybersecurity standpoint. But right now it's it's an age of Julius Neil Buenconsejo: Who do you think is responsible for the architecture for the cyber security when somebody attacks my website because I'm not in control Taha (Inovia): Yeah. Julius Neil Buenconsejo: and how we develop that architecture? So what do you think? Taha (Inovia): Yeah. That's a very good question. and I think the answer with any interesting answer is it depends. and I would say that for the most part, like if you're a professional software developer, right, like you're using cloud code or or you're using cursor, I think the responsibility for the accuracy of the code and the security of the code still rests on the developer. because you're using it's almost like you're using a machine and if you make a mistake using that machine it's not the machine's fault. you need to you know kinda look into it especially you know that these issues exist. Now the lovable example is a very interesting one because that's the part where I'm not sure who should hold the responsibility because now you're dealing with citizen developers. You're not dealing with someone that understands security. so I think it's incumbent upon firms like Lubable to enhance their security. but it's hard to tell you know where the liability should lie. But in that case, I could see one making the argument that Lubable should be more responsible because of the audience they're dealing with. Julius Neil Buenconsejo: Okay, okay. So for example, what exactly changes, for example, when the attacker or the employee is an AI agent? Taha (Inovia): Yeah, I think when the when it's an AI agent a few things change. first of all, the AI agent never sleeps. The AI agent is is very persistent. the AI agent has a lot of resources you know in front of it. And the AI agent can also find patterns. You know, machines are very good at certain things such as finding patterns, and zero days that that a human wouldn't. and I think it gets a little more complicated and dangerous if an agent is inheriting the permissions of of a human being. Let's say you're building an agent and then the way the system works is that that agent inherits the permissions that you have Julius. then suddenly this agent is doing things as an insider. so what changes is our existing tools are mostly meant to be for outsiders coming in and attacking. Now if someone benign in your own home is doing damage, it's harder for existing systems to to catch that. because everything looks benign, right? it's not like you're breaking through a door to get in and your alarms go off. It's more like, you know, you're in your home drawing on the walls or doing something that you shouldn't be doing. doing. But to a to a sort of intrusion detection system it looks normal because Julius owns the home, he's at home, and it's normal. So you need a new system that even though it takes the permission set of the human being behind it, there needs to be new systems that are able to detect if they're doing something that they shouldn't do. Julius Neil Buenconsejo: Okay, do you think AI agent needs to have its own identity? Taha (Inovia): I I think so. I think that's where we're going to go, right? Like if you imagine a world in the future where your agent is not just working within the confines of your company or within the perimeter of your environment, but they're going outside on the open internet and interacting with other agents, that's one reason I would say you would need to have sort of an identity where agent A can trust agent B and agent B can trust agent A by let's say having a digital signature. that says, yes, this is from, this agent is an official Salesforce agent. It is not some rogue thing that is out there. and the other thing on identity on I would say even if you look at internal stuff is very important, is similar to human beings, agents need permissions, whether they're ephemeral, whether they're permanent. they need to be revoked, they need to be you know, constantly evaluated and analyzed. So I think that identity stack for agents is is required and it's being built at the moment. It's just that the volume is very different and agents spin up for a little bit of time, spin down, whereas humans are more permanent. You when you join a company, your identity is set. When you leave a company, your identity is is deleted. every year you may have security access reviews. Hey, do you need this software? Do you need that software? But beyond that, it's not extremely fast moving. You don't have thousand agents spinning up in an instance and spinning down in an instance. Julius Neil Buenconsejo: Are we moving from cybersecurity protecting humans from machines to cybersecurity protecting humans from the machines we've empowered? Taha (Inovia): Yeah, I mean there is I would say a a little bit of that, but I would say a huge part th okay, there are two components to it. One component is a machine doing something that it shouldn't be doing and it was unintended. Right? So that there's that component. Then yes, you're right. Now you need to kinda protect humans against the the the machinery that they created. the other aspect of it is humans weaponizing some of this AI and using it to to render attacks. And I think that is exactly the same situation as before, but the only difference is now your attacker is wearing an Iron Man suit as opposed to going in as a regular human. Julius Neil Buenconsejo: Yeah, so as a follow up to that, so most of the AI consultants, AI experts is telling that there should be some kind of human in the loop or the human judgment in this system. What do you think is the extent of the human in the loop or the human touch in the cybersecurity when it comes to agents or in AI era? Taha (Inovia): Yeah, I think we're still at a point where a human in the loop is is very much required. for obviously the the many many reasons that I said. I think a human in the loop is required when you're about to take an action and Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): the human needs to review that without letting the agent kind of do it themselves. Right? They could be downstream cascading effects of a change that an agent makes in your infrastructure, which can break a complete production environment. you can have the Asian do certain things that are violate your policies. so you need a human in the loop to evaluate it and as a safety net to then nudge the AI to go in a very different direction. I don't think we're at a point right now where we can have autonomous systems doing their thing and us not reviewing it. I think that would be catastrophic in the short term. But in the long term, maybe some of these problems are reduced. Maybe the error rates get lower than the error rates of a human being. Right like I don't think the error rates will ever ever get to zero, but perhaps they'll get lower than a human. We make errors, a lot of errors. Julius Neil Buenconsejo: Okay, so you talk about the unique intelligence behind the hacker mindset. Do you think a hacker can actually clone his mind putting it in an agent to attack any machine? Taha (Inovia): Yeah, I mean I I I think so. for sure. I think these systems can be fine tuned, to basically be very focused on the the hacking mindset. and we are seeing some of this, not in the sense that these are we haven't seen systems yet where at least I haven't come across it where you know, there's a toolkit that just, you know, attacks like that. But you have GPTs like fraud GPT or think there was another one called Evil GPT or something like that. Which initial versions of that were helping you craft phishing emails. So I think over time, yes, there are going to be ways in which the hacker mentality and the hacker sort of playbook is you know fine-tuned into it. but I think the the Frontier models have become so good that frankly they're able to do it themselves because they are constantly looking for ways to achieve an objective whether the long way or whether the short way, they're just gonna keep on trying and and finding it. Julius Neil Buenconsejo: Is this happening now? There are, you know, machine hackers already, AI hackers, evolving now in the market. Taha (Inovia): I I I have seen one or two situations where an agent did the attack, but it was obviously an agent that was controlled by by a human being. but there are probably a lot more that we don't know of. there are a lot probably you know, oftentimes what happens is hackers enter your environment and then go dark for six months, seven months. So you actually don't even Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): know that there are people inside your environment. Because the reason they want to do it is they don't want to cause noise, immediately and then once, you know, they become more inoculous in the environment, then they kinda do something. So yeah, there might be something already happening, we just don't know about it. But the frequency of how many of such attacks we're seeing right now, I haven't seen hundreds of them. And I think they're coming though. Julius Neil Buenconsejo: Okay. From your experience, what, for example, in the companies that you're investing, how can you determine a great hacker versus a great engineer? Taha (Inovia): Yeah, a great engineer is engineering solutions for scalability, reliability, product experience, and solving complicated problems that don't break in you know many sort of environments and stress cases. Whereas a hacker isn't necessarily focused on reliability, usability, you know, scalability and all of that. A hacker's objective is very single-threaded. It is, I want to attack this, and it could be just a one-time thing. I want to attack this, and I'm going to find every different possible combination of techniques in order to do it. So it's a very different mindset in the sense one is of a builder, the other is looking for the right hole in the Swiss cheese to get across. Right? So it's not this person is not a building, but this person is taking an existing system and is able to dissect it in a way and say, aha, you left a hole there. Whereas engineers in general are solving a problem. and that's normally Julius Neil Buenconsejo: Okay. Taha (Inovia): for a building purpose. All right, like how do I make this AI system more scalable? How do I make this AI system more accurate? how do I ensure that this database is is doesn't have transaction issues? Right? They're solving the hard problems of building. Whereas hackers are finding, hey, where are all the chicks in the armor? It's a very different mentality in my opinion. Julius Neil Buenconsejo: Do think the AI will eventually become better at discovering vulnerabilities versus our world's best hackers? Taha (Inovia): I would argue that that's happening already right now. and with Mythos out there, and with a lot of startups you know, that are doing autonomous pen testing, But that is already happening and they're finding zero days at a very fast clip. Now the question though is just because you found a vulnerability is it exploitable? Is a real question. Because oftentimes if you know company ABC has a zero day vulnerability, but this vulnerability is behind like a bunch of firewalls and and it's not reachable anyway, then yeah, it doesn't matter. But I would argue that machines have actually gotten better already. Julius Neil Buenconsejo: Do think it democratizes cyber security or it democratizes cyber attacks? Taha (Inovia): Initially it's going to be democratization of cyber attacks. And Julius Neil Buenconsejo: Okay. Taha (Inovia): eventually it's going to be democratization of cybersecurity. It always happens that way, right? Like the attackers have an advantage. They don't have any budgetary constraints. They don't have any you know, legal constraints. They don't have an existing tech stack. And and their objective is to protect against all attacks. Whereas a hacker's objective, first of all, can start with a clean shade of sheet of paper. And secondly, their objective is to get one attack done. So they're attacking ten different things and they just need to get into one. Whereas a defender Julius Neil Buenconsejo: Mmm. Taha (Inovia): is getting attacked by hundreds and needs to stop all of them. So I think the the burden is also very different between an attacker and a defender. But right now, I would say hacking is being more demonstrated. democratized then defense. Julius Neil Buenconsejo: Okay, there's a growing consensus that autonomous agents require a new security control, a new layer of security. If we had to design that layer from scratch now, what would it look like? Taha (Inovia): Yeah, I'm gonna I I maybe I can talk about what what folks are doing, 'cause a lot of smart people are spending Julius Neil Buenconsejo: Mm-hmm. Yeah. Taha (Inovia): a lot of time here. and l a lot of money has been poured into this category. I would say that there there are multiple ways in which folks are doing things. Like first of all, a big CSO priority is to just know what agents are in their environment. Right, 'cause they're giving their employees the the the the ability to go out and build their own agents, in, you know, let's say the Microsoft ecosystem or any other kind system, whether to solve a call center problem, whether to solve any customer support problem. But then the CISO is sitting there is like how many agents do I have there? So first a layer of the problem is how do I identify all the agents that I have? People have used different ways to do it, using a common MCP server choke point, looking at network egress, similar to you know CASB that used to used to exist. in in in the cloud world. and now that you know what agents exist, how do I monitor what they're doing and how do I know that they're not doing something bad or anomalous. so then these companies are some of them have created small language models Julius Neil Buenconsejo: Mm Taha (Inovia): that the the inputs and outputs of of the model sorry of the agent run through the small language model which checks for any baseline deviations that could be targeted or or tagged as anomalous. and then they would stop the agent. And sometimes you're looking at intent. Right, if the agent's intent is to change the color of your wallpaper, right? But now it is going into Word, it is writing something, and then going on the internet and you know, downloading some scripts and doing this and that, that intent would not match with the actions. Because the Julius Neil Buenconsejo: Mm. Taha (Inovia): action is very simple. Change my background by going to settings display, bam. And why so there are systems out there that are looking at the agentic actions and then if it's anomalous are able to have a kill chain there. and so you have a bunch of companies that are that are doing this out there. a bunch of companies are also calling it the next generation of EDR. EDR companies are like CrowdStrike, Sentinel One and the likes. but historically EDR companies have focused more on the kernel level and and focused more on the syscalls as opposed to at the more semantic app level or the user level. Julius Neil Buenconsejo: So you mentioned about, you know, an agent changing colors or desktop or something like that. So how do you distinguish if an agent is behaving creatively from the one behaving dangerously? Taha (Inovia): I think that that will be something that that is probably still needs to be solved. and that goes to the problem that probably you're gonna see with these systems is false positives. where an agent is trying to do something creatively, it's not doing anything wrong, but it still gets alerted. so we're probably going to see a lot of that. But I think as sort of the underlying models that are checking sort of the paths and the the the chain of thought and the steps of these models will eventually also get smart enough to know whether those steps are anomalous or creative. so I think over time that classification system will get even better. Julius Neil Buenconsejo: What's the equivalent of Crowd Strike or Octa for the Agent era? Taha (Inovia): wow, first of all, CrowdStrike is already in the agent. I think they just released their AI SDR product. Falcon they gosh, it escapes my name. I just read this morning. They had an AI SDR product which they released about two quarters ago. but today Julius Neil Buenconsejo: Okay. Taha (Inovia): they've released another one which is a lot more deeper and more in line with what startups are doing. but beyond that, like the big startups out there are you know, NOMA security, you know, which is more end to end AI security. We use To be investors in a company called La Cera that got Julius Neil Buenconsejo: Okay. Taha (Inovia): sold to Checkpoint. So obviously Checkpoint isn't in this market. There's Pluto Security that is doing more on the EDR sort of that's the the messaging they're using. But you know, there's Quiller. There they're a lot. Julius Neil Buenconsejo: Okay. Taha (Inovia): There is is there a lot of startups. And some of them have gotten early stage funding of like fifty hundred or a hundred million dollars, like out of the gate. so the opportunity set is really huge. the question really is who's gonna win and which approach is going to win. Julius Neil Buenconsejo: Okay, let's switch hats for example. So you're not only looking at this as a cyber security practitioner. So you're looking at it as an investor. So you Taha (Inovia): Yes. Julius Neil Buenconsejo: are effectively seeing hundreds of founders and companies across markets. So Taha (Inovia): Correct. Correct. Julius Neil Buenconsejo: where do you think the market is fundamentally underestimating the opportunity in cybersecurity and AI? Taha (Inovia): Sorry, you froze could you say that? Julius Neil Buenconsejo: Where do you think the market is fundamentally underestimating the opportunity in cybersecurity and AI? Taha (Inovia): Yeah, so I think the market is pretty much at our doorstep at the moment, right? Like, actually the biggest problem with cybersecurity in the past has been that The building of cybersecurity defenses has occurred prematurely before an underlying technology has gotten adopted. Right? Like even if you look at the cloud era, there were a bunch of companies that popped up, but a lot of people didn't know need those products for a very long period of time until there was a public attack that happened, then the cloud, for example, and then the cloud security posture management and cloud workload protection was was required. I am Surprised and also not surprised that the AI security side is adopting extremely fast. Because I think Julius Neil Buenconsejo: Okay. Taha (Inovia): the problem is here. So every CISO that I speak with, we have a network of of 20 CISOs or so at Inovia. Every CISO that I speak with, this is a top-of-mind problem for them. whether it is AI soc, you know, solving AI in the security operations center, whether it's protecting their agents, whether it is protecting PII, whether it is protecting their data in SharePoint against you know, an agent or a model just crawling to it. so this is top of mind. I wouldn't say budgets are fully flowing, but CISOs are Constantly evaluating various options. and I think within the next, you know, eight to twelve months we're gonna see a lot of buying in this market. but I think what's what's challenging for CISOs is gonna be there's so many startups, so many solutions. And frankly, if you go to websites of every startup or even the incumbents providing AI solutions, it all sounds the same. It Julius Neil Buenconsejo: Hmm. Taha (Inovia): all all even the solutions that sound the same. So I think for CISO it's very hard to know. who to hitch their wagon with in this you know security ride. and so I think people are also waiting for the dust to settle a little bit to see who the leaders are going to be out there so that they can back those people. Julius Neil Buenconsejo: Okay, looking back, so what's a cybersecurity category today that reminds you of the market like five or ten years ago before it becomes enormous? Taha (Inovia): Yeah, I would I would actually say cloud. you know, and the example there is going to be Wiz, right? Like Wiz exited to Google for like thirty-two billion dollars. and in my opinion, and this is just my opinion, is that there probably a few things that happened there that made Wiz an extremely successful company. first of all, they really started when cloud security, posture management and cloud security was extremely important. and front of mind for customers. So their their birth was in in the right time. It wasn't too early. It wasn't 10 years before that when people were like, I'm not sure if I need this. I'm really still on on-prem. I'm not even sure when I'm gonna move to the cloud, you know, and there were only a few people using this. the second thing that happened is by being created at the time in which the need is the highest, they also had a better product. They didn't have the baggage of you know older technology. They had they created this graph you know that allowed them to be a better product compared to anyone else in in in the cloud security space. And lastly marketing. They're very, very good at marketing. So I think Wiz is an example of a company where the cloud security created a new attack surface. then you had a company that not only produced a very, very good product, but also did a very good job of marketing it, which is by the way, very rare for startup to be good at at both. So hats off to the Wiz team. Julius Neil Buenconsejo: Okay, okay so you are into investing so would you prefer a first mover startup or a second mover? Taha (Inovia): it it honestly depends on the the the situation, right? Like if you think about so first mover, who comes to mind? Cursor in the coding world, right? and I think there are tons of other startups that popped up later within the space that didn't get the same sort of traction. Don't get me wrong, Clock Code ha actually happened later, Codex happened later, you know, all the others happened later. They have a lot of traction. But I'm saying there are a lot of other startups that tried doing what Cursor was doing and couldn't get to the 60 billion sort of sales scale. So I think in some areas being the first really, really matters when the demand is now, right? If you look at ChatGPT. the demand was now. I think being a second mover is is probably a better position if the demand isn't now. If the market is still maturing. you have this other company doing all the marketing and evangelism for you. then you come in and you're basically writing on their sort of work with a better more modern product. so their being a second mover is is is is a lot more interesting. Julius Neil Buenconsejo: Okay, let's say I'm a founder, for example, listening to this, I have an AI cybersecurity idea. I come to you tomorrow and pitch it. What makes you lean forward or makes you interested in a startup? Taha (Inovia): Yeah, I think there there are a couple of things. which is not just cybersecurity, but there might be some elements to it. I think being venture funded is has a very unique kind of profile. the first thing is that the founder needs to be able to fundraise every two years and convince investors of a vision that may not exist. or convince them of the impossible, right? not to glamorize, you know, Elon Musk or or you know, Steve Jobs, but they they they they had this power to convince people of things That didn't sound real in the moment. and that not only is on the fundraise side, right? Because in venture you need to fundraise every two years. So if you're not good at fundraising, it's hard to become be a good founder and hard to be a good company. The other aspect of it is convincing employees. You're convincing extremely smart people who can just go to Google, who can just go to Anthropic, who can just go to OpenAI, to not do that, but to stay with you on your mission. Because you've believe this is the mission and you are able to convince that to people. So that's number one. Number two in my opinion is especially in the cybersecurity market today you on average you kind of need to be an insider in security because security is one of those sales where People value, I would say, relationships that are longstanding. And if you let's say worked at, you know, some very important product, Apollo Alt or CrowdStrike, and then did something, you know, startup or or something like that, you're more likely to get a a lot of attention. and then one thing which has become extremely powerful these days is marketing and go to market. Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): because of vibe coding, you know there are limits to vibe coding. I'm not saying you can copy every piece of software, but because of vibe coding, the the cost of producing software has gone down, the time required has gone down, so differentiation has become harder. So the only way to differentiate now is with very clever go to market. I'm not saying have a really bad product and just sell. That's not gonna work. But have a good Julius Neil Buenconsejo: Mm-hmm. Mm-hmm. Mm-hmm. Taha (Inovia): product and then you need to be very, very clever about how you market you know your product. Two comp two companies in our portfolio that I think do a fantastic job of this. one is Aikido. Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): I think they they do a phenomenal job on the go to market and marketing side. phenomenal company and team. the other is Flair. they have done a phenomenal job as well about finding clever ways of of go to market. I'm not talking about buying keywords or ad words. I'm talking about real needle moving marketing and influencer techniques that have allowed them to arise ahead of the crowd. Julius Neil Buenconsejo: Okay, okay, okay. That's good. So you, you written about, about something fascinating. So you said that open source is essentially one, but AI is making open source businesses harder to defend because models can reproduce software incredibly quickly. So what, what actually constitutes a mode when an AI can replicate code? Taha (Inovia): Yeah, I I think moat these days is really speed of execution of the team and then go to market. It really comes down to the best teams of right now are extremely good at go to market. I would argue that the best product in this world doesn't most of the time win. It is a good product with amazing marketing that that constantly wins. so if you are a founder that has a you know social media presence on LinkedIn, a following on Twitter, it's huge. It's a huge advantage. I think another company that does an amazing job in our portfolio on sort of Twitter with their peasants is is is Scott from Spellbook. Spellbook is a legal tech startup that we have been invested in that has done phenomenally well, another amazing team. but Scott is an example of someone that has become a a trusted sort of voice in the legal tech community. and people look up to him and and read his stuff because he writes a lot of very thoughtful pieces on on on the matter. So I think that has become very important. The personal brand of the founding team has become extremely important. Versus, you know, like ten years ago, enterprise sales, like you didn't see like founders like writing on LinkedIn constantly and all of that. Julius Neil Buenconsejo: Mm-hmm. Yeah. Taha (Inovia): so that's changed quite a bit. Julius Neil Buenconsejo: Okay. Okay. So do you think, for example, if a founder is not, you know, very visible in any social media platform, but they come to you and they say that this is our sales now for the last, you know, it's increasing maybe 10 % or 20 % on a yearly basis. Do you think that founder is still investible? Taha (Inovia): Yeah, we're looking for companies growing 100%, 200% a year. So Julius Neil Buenconsejo: Okay. Taha (Inovia): but let's assume they are growing 100-200% a year. That would Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): mean without any marketing, that would actually make my eyes pop out because that would mean that my god, this must be an amazing product. because it just sells itself. so I would still want to, you know, invest in that founder. but we would try to help them with finding them someone that's very good at that marketing piece, right? a founder cannot be good at everything. A founder typically has one or two areas they're s exceptional at. and then, you know, they need to surround themselves with with folks that that can cover the gaps. Julius Neil Buenconsejo: What can you say about a single founder right now building through VibeCoding? Taha (Inovia): Yeah, I would say it it depends on what kind of company it is. right? If it is one of those product led growth, prosumer, you know, consumer type company, to some limits I think you can just wipe code, you know, and release product. the moment you start going to enterprise, the moment you start going to critical business needs, There's a there's purely vibe coding without using real engineering talent, you're gonna hit a roadblock and a wall very quickly. You're gonna have scalability issues, you're gonna have things are going to break constantly, you'll have code review issues, like the way code is being written is by AI is is not a clean way that a human writes it. and then it will iterate and add a lot of other stuff into the code that shouldn't be there. so Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): it just turns into a massive ball of mess very quickly. Unless you have a unless you're an engineer, you're view the code after you're looking at the pull requests you're making changes you're keeping all the other scalability reliability etc in mind but outside of a certain archetype I think you can't vibecode forever you have to move on I think vibecode gets you to a point and after that in order to make this enterprise great you gotta hire professionals Julius Neil Buenconsejo: Okay, so that leads me to my next question. Is coding becoming a commodity? Taha (Inovia): Coding is becoming the writing code part is is becoming a commodity. But I wouldn't say that's the that's what engineering is. Writing code part is is I would say relatively like simple for most people. It was time consuming, but it's not like that was the reason why people were, you know, getting paid the way they were or getting valued the way they were were I think the part that is gonna become more and more important is can an engineer solve very hard problems now very quickly. Because they're not spending time writing the code, but now they can abstract and think about all the big problems that need to be solved and the clever techniques to do them, and then instruct the computer to write the code based on their techniques. so you're doing a lot of more of the heavy thinking and decision making as opposed to the more mechanical code writing. Julius Neil Buenconsejo: Okay, so it's more on the human judgment, right? In a human judgment. So Taha (Inovia): Yeah, absolutely. Julius Neil Buenconsejo: now everyone's talking about AI applications and you're also investing in infrastructure. So what infrastructure layer do you think people or companies aren't paying enough attention? Taha (Inovia): Yeah, I think like I wouldn't say they're not paying enough attention, but not as much attention I would say as sort of some of the the inference providers like neo clouds and all of that, which, you know, has gained a lot of attention lately. but I would say data architectures and observability architectures that will allow agents to or or allow us to basically do things in the world of AI and agents. By that I mean There are a lot of logs that get produced. And in order to debug in in an infrastructure any kind of problems, you have humans going through logs, you have humans searching through logs, and understanding that hey, XYZ broke, which cascaded into this and that and that. Now imagine a world where a human is not doing it. It's actually an agent that's analyzing and putting the breadcrumbs together. Firstly, in an agent world, agents produce logs too. Now you have Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): a loop. Limited amounts of logs out there. Every agent has a log, there'll be thousands and thousands and thousands of logs. And then each agent is going to query those logs, not at the rate of a human being. They're just going Julius Neil Buenconsejo: Yeah. Taha (Inovia): to bombard these systems. So how do you now take advantage of almost unlimited amounts of capacity to analyze and read? but in a world where volume of logs is increasing significantly, but do it in a way that doesn't cost you, you know, millions and millions of dollars. Because if you let an agent go through logs and reams and reams of logs, you're gonna come out with a token bill that will scare you. So how do you do that? So there needs to be new data techniques in order to allow agents to do some of these things. So I would say data infrastructure is probably an area that needs more investment. Julius Neil Buenconsejo: Do you think the data infrastructure is the next trillion dollar opportunity? Taha (Inovia): I I do think so, yeah. you know, I I do think so. there is a lot that needs to change in the inf data infrastructure world, you know, to accommodate agents. and even data breaks in Snowflake in a lot of ways are are predominantly built for for human activity and haven't done agent activity. and if they move towards agent type consumption models, there could be a scenario where they're cannibalized. their own sales right now because if they're creating a more efficient querying system that doesn't cost as much, you know, does that mean even humans are going to use that and that reduces their you know revenue stream from somewhere else? So there's there's a little bit of that innovators kind of dilemma associated with it. Julius Neil Buenconsejo: going back into your career progression. So you spent 13 years in finance before moving into venture. So what did investing in financial institutions teach you about cybersecurity that is still relevant today? Taha (Inovia): Yeah, so I I spent a l I I did do financial services investing, but I did software investing also predominantly. and I was doing a lot of cybersecurity investing there. but I can tell you generally we're you know, mature company investing versus I would say startup investing. I think what it teaches you is what it look what great looks like at scale. What do you what economics do you need at scale for this to become a strong sustainable business? Because venture initially is all about proving the technology, getting product market fit, you know, not worrying about economics in the short term because you're trying to get market share, eventually with the idea that the economics will right size, but you're really optimizing for growth in a way. But then at some point that company needs to grow up and stand on its own two legs and not need constant. So being part of those mature companies teaches you, you know, how things are done there and then what require what would what it requires to get there in the long run. Julius Neil Buenconsejo: So as AI agents begin moving money, then executing transactions and interacting with financial systems. So what happens to financial cybersecurity now? Taha (Inovia): yeah, that will be that will be a scary, scary bit. I mean, it'll be scarier because you know, you give your agent access to a wallet, there's a prompt injection that happens or someone poisons the memory, convinces the agent to hand over the private key of the wallet, suddenly the wallet is drained. Right. So I think this is a new paradigm that is that is yet to be seen. But I think in the short term what's going to happen is a lot of these are just going to be bounded microtransactions, where the the the amount of money that an agent can spend is very, very limited. but it's going to release a new sort of threat vector out there that that frankly I haven't seen a lot of people talk about it yet. but it will happen. You're right, agents will transact on your behalf. Julius Neil Buenconsejo: Yeah, because in my previews, I think two podcasts ago, some people or some of my podcast guests said that people eventually will task the AI agent to buy things in the internet Taha (Inovia): Yeah. Yeah. Julius Neil Buenconsejo: for themselves without even intervention with their intervention. And then this costs money, they will provide their financial information and all this. So I was thinking... I will ask you this because you are in a financial side and then CyberK security side. Taha (Inovia): Yeah, yeah, I I I think there will be ways, right? Like whether it's through proxies or whatever, to give them your financial information. without actually telling them what it is. Right? Whether it be by exchanging a token, post-authorization. so there are ways to do that. I I guess my own worry is if the agent goes rogue, it is authorized to do it. You think it's not it's it's doing it's going to buy you that table that you wanted, but it's instead it it just bought you Paz and Jolly Ranchers or something like that. And spent money on that. Or worse, it ended up in the dark web transacting or doing something like that. So there are a lot of edge cases there. Initially, a lot of these will be bounded and sandboxed in a very specific way where their scope of spend will be very limited. Julius Neil Buenconsejo: Okay, so this one part of the podcast that I will be doing for the first time because I'm a venture capitalist, so will give you some ideas to pitch Taha (Inovia): Sure. Julius Neil Buenconsejo: in. For example, you can also elaborate why you invest, why are you going to pass, or why are you going to investigate. number one, so AI security agent, an autonomous AI agent that continuously attacks a company's infrastructure. to find vulnerabilities before hackers do. Taha (Inovia): yes, I would invest. I think this is a very important category at the moment because people are building software so quickly, they don't have time to put them through security reviews. and even if they put them through security reviews, it's only the known patterns that are getting caught, not the new zero-day patterns. therefore having a startup that does this is is super valuable. Actually, we are investors in in startups that do this. Julius Neil Buenconsejo: Okay, AI identity, Octave for AI. Every AI agent gets an identity, permissions, credentials, and an audit trail. Taha (Inovia): Absolutely, yes. I think this is also extremely important, because a other agents need to trust if they're interacting with agents. that's very important. And a agent needs to have an identity so that you can manage its permission set. and we are seeing that Okta, I think, already released something. and there are companies like Keycard, that are backed by Andreessen that are doing this. Julius Neil Buenconsejo: AI SOC analyst. An AI agent replaces a significant portion of the company's security operations and center team. Taha (Inovia): answer is yes. if it works. it is I think the challenge has been that there are a lot of smart founders that are trying to solve this problem. but the challenge has just been that either Fortune 50 companies are trying to build this themselves using Claude or everyone else has not seen necessarily the the the positive benefits yet from this or are waiting for the market to settle. But the short answer is yes, you need this because in order to stop machine speed attacks, you need machine speed defense. Julius Neil Buenconsejo: AI firewall, a security layer that monitors every action an AI agent takes and automatically blocks risky behavior. Taha (Inovia): Yeah, as we discussed, this is like a key thing that that is required because these agents are non deterministic and you don't know what they're gonna do. so you need a safety control layer on top to prevent anything that is malicious or anything any activity that you don't want. Julius Neil Buenconsejo: AI Cyber Insurance, an AI-powered platform that continuously assesses company's cyber risk and dynamically price its insurance. Taha (Inovia): this is more of a personal preference thing. Do I think the world needs this? Yes. but I would probably not. predominantly because pricing a new risk is very hard. we saw this in the initial cyber policies where premiums were priced very low, then insurance companies experience a lot of claims and premiums just shot up significantly. So it is Julius Neil Buenconsejo: Okay. Taha (Inovia): so pricing a new risk is is is very hard because you don't have the data to know what the loss ratios are and the loss runs are from the past. So from an investment standpoint, I wouldn't do it, but you do need something like this. Julius Neil Buenconsejo: the CrowdStrike for AI agents endpoint detection and response, but instead of laptops, it monitors autonomous AI agents. Taha (Inovia): Yeah, absolutely. and this is already happening. you have companies like Pluto and Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): the likes that are that are doing exactly like that that. And you have CrowdStrike that is doing that too, because they're already living on your laptop. Julius Neil Buenconsejo: Okay, AI powered hacker, an AI that automatically discovers zero days and sells the intelligence to enterprises. Taha (Inovia): no. predominantly it's not a good feeling for an enterprise to get an email that says, I found these twenty exploitable vulnerabilities. Naturally Julius Neil Buenconsejo: Yes. Taha (Inovia): I mean your your intention might be the right one, right? You're you're making them aware, but it also feels like extortion in some ways on the other side. So I think from that mental standpoint, I would say no. But I think the right way probably to do is that AI pen testing thing we were talking about earlier, where folks can run these and then see them themselves. As opposed to me getting an email from a random person saying that, hey, you have twenty vulnerabilities and you're you're sitting there, you're like, wait, are you threatening me or are you trying to help me? I have no clue. Julius Neil Buenconsejo: Yeah, yeah. Then MCP Security Platform. Security infrastructure specifically designed to protect AI agents interacting with tools and external systems. Taha (Inovia): Yeah, yes, but I wouldn't I don't think this is a category in itself. This is part of agenc security as a whole. Because MCP and tool call is sort of one part of the the chain of tasks that an agent does. Julius Neil Buenconsejo: AI Supply Chain Security, a platform that verifies AI-generated code, open-source dependencies, and models before they enter the production. Taha (Inovia): Yes, absolutely. I mean, we know this from there have been two major supply chain attacks this year. we've all heard of Shai Halud and and Mini Shai Halud. Team PCP actually that that got caught recently, allegedly, was mini shai halud. So yes, you need this because hackers are finding clever ways to embed themselves within C S C D pipelines and open source code that you need to be careful. and then there are a lot of libraries that are not the first party libraries you're using, they're libraries of the library. you're using. So for these transitive dependencies you need you need something that does a proper scan. There's a company out there called socket.dev that that that does a good job of it. Julius Neil Buenconsejo: Okay, so, last one. Stripe for AI agents. Infrastructure allowing AI agents to securely make payments, purchase services, and trans-stack autonomously. Taha (Inovia): I I may change my mind about this in the future, 'cause I haven't given this, you know, a very full thought, but my answer right now will be no. predominantly because I think Stripeking does. Julius Neil Buenconsejo: Okay, okay. So before we go to our last round, the Rapid 10X, I will just ask you. So if you have a 50 million fund, you have one minute, right? And then you wanted to invest in something. So give me the biggest reason why you want to invest in that startup or that idea. What startup is that, yeah? Taha (Inovia): Yeah. So w what would be one reason why I would want to invest in in the startup? Yeah, Julius Neil Buenconsejo: Yes. Yeah. Taha (Inovia): I would say honestly it predominantly comes down to the founder. if it's a founder, because what I've learnt you know, through a decade of investing is everything changes. permanence as a concept does not exist. Right? Like ten you know, five years ago people would have said that SAS is like you know, and and you can't hurt in mission critical, blah blah blah, multiples will never compress, here we are in a different market. Now, you know, you you would have heard that it's so hard to copy complicated software. Now we're in a different environment. But the only constant that changes amongst all these modes we're talking that doesn't change across all these modes we're talking about is the founder. And the best founder will always find a way to make the impossible happen. And so just follow the entrepreneur. Julius Neil Buenconsejo: Okay, last one. If you were 22 today or younger and wanted to become indispensable in cybersecurity, what would you spend the next five years learning? Taha (Inovia): you know what I would do is I would probably try to get into YC and start a cybersecurity company, because there's no other way to learn and immerse yourself and then become invaluable, but it would be to solve one of these AI threat vectors. Julius Neil Buenconsejo: Right? So thank you for that, you know, very insightful and very enriching insider information from your side when it comes to venture capital investing. So thank you for that. I'm sure all of our viewers and then our listeners will be able to have that some value into our conversation. go, going on to the rapid 10x round. Yeah. Going on to the rapid Taha (Inovia): Thanks. Yeah. Yeah. Julius Neil Buenconsejo: 10x round. Number one, what's one AI tool you actually use every day? Taha (Inovia): Has to be clawed. Yeah, has to be clod, yeah. Julius Neil Buenconsejo: Okay, what one task AI has already 10x in your life? Taha (Inovia): I would say this this sounds like a very small task, but I would say research and understanding concepts that I didn't have time to understand in the past is actually a really huge one. sometimes the way I get to those are a little more complicated, right? It may ingest all the newsletters that I have, it may ingest SEC filings. So the system might be more elaborate, but the basic part of it is my ability to learn has become 10x. Julius Neil Buenconsejo: What's one human skill AI can never replace? Taha (Inovia): Human relationships selling. I don't think I think for the the young folks today I think that's the most important thing to to Julius Neil Buenconsejo: If you could automate one annoying thing forever, what would it be? Taha (Inovia): My expenses. And by that I mean Julius Neil Buenconsejo: I'm Taha (Inovia): if you know my the expense systems were linked to your credit card, you know, you swipe at Starbucks, you're traveling, it automatically Julius Neil Buenconsejo: Mm-hmm. Mm-hmm. Mm-hmm. Taha (Inovia): knows, captures that, ma'am, it's in your expense stuff. Right now it's it's a mess with receipts and this and that. And even if you use AI, it only gets you that far. Julius Neil Buenconsejo: Okay, what's biggest misconception about AI right now? Taha (Inovia): I think the biggest misconception is I would say two polarizing sides. One polarizing side is that AI is terrible, it can't produce anything, everything it says is wrong, don't use it. The other polarizing side of it is trust AI, do everything with AI, overuse it, AI slop, you know, get wrong advice. So I think those are the two misconceptions. I think the reality is in the middle. Use it wisely, but please use it, because it is a game-changing technology. Julius Neil Buenconsejo: What advice would you give someone who wants to become 10x or exponentially better starting today? Taha (Inovia): immerse yourself in AI. Try to use AI as much as possible for the I would say non-needle moving tax tasks. We all have them. there's tons of admin stuff that we do, there's tons of housekeeping stuff that we do. Try to outsource that to AI as much as possible. Focus your mind on the needle-moving things and I already said this word focus, but focus on what matters. Focus is extremely important. These days with AI, you have the ability to build and go in like fifty billion different directions. You can be running six coding agents at the same time and going against screens. That will burn you out and you're gonna be running around in every direction. What you need is focus and do an amazing job on the area you think is the most important. Julius Neil Buenconsejo: Okay, so what would you tell your younger self about the future? Taha (Inovia): embrace change. you know, you go to university, you go to high school, in your mind you have a path. You're like, yeah, I do Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): this and then I do this and then I become a doctor and then I become a surgeon and blah blah blah. Life is not that. Life is not linear. there it's it's very random. and embrace change. I think the best people and the most successful people in this world are are flow with change and adjust with change and are are are okay with the adversity of change as well. Julius Neil Buenconsejo: What's one book, podcast, or resource that shaped your thinking about AI or innovation? Taha (Inovia): Innovation, again, I don't wanna glamorize or make like a cliche thing about Steve Jobs or Elon Musk. the the the the two things that the the one thing clear thing that I learned there is this whole you know thing about the the the force field, like where they convince you of of things that are impossible. because at that moment in time, things are impossible. they look impossible and they probably are, but it is amazing how much a human being is able to do if they take that mentality away and just give it a full try and just be obsessive about it. And that's what I learned from them. is that you can say no all the time and most likely the chances of success are low, but the power of human beings and the creativity don't underestimate that. Julius Neil Buenconsejo: So if you have to bet one AI trend that will be massive in five to 10 years, what is it? Taha (Inovia): I would hope robotics. and you know, everyone having a personalized robot. That would be pretty cool. you know, I I grew up watching Jetsons, so that Julius Neil Buenconsejo: Mm-hmm. Taha (Inovia): would be that would be a fun thing to see. Julius Neil Buenconsejo: Okay, so in one sentence, what does 10x mean to you personally? Taha (Inovia): 10x to me to me means doing the impossible with limited resources. that to me is is is it's all about leverage. and that's to me being a you know, ten X performer. Julius Neil Buenconsejo: So thank you for that, Rabbit 10x, it's very insightful as well. So for our viewers and listeners who wanted to reach out with you for some, maybe some startup founders or some people in an event or some conferences who wanted to keep in touch with you as a resource speaker or an expert guest, where do they connect with you? Taha (Inovia): Please reach me on LinkedIn. I my sort of DMs are open there. I we have a CISO network at Enovia. I focus on cybersecurity and infrastructure, focusing on seed and and series A investing. But we're a generalist firm and we're multi-stage. so please reach out even if it's not within my areas. I have other very lovely smart partners that would be responsible there. Julius Neil Buenconsejo: Alright, thank you very much. heard so you can reach out to him. Even the idea stage, Whatever stage and whichever industry that you have, can contact Taha. I will put also in the description later on your LinkedIn profile so they can contact you directly. So again, thank you very much Taha for your time. I know it's very, Taha (Inovia): Fantastic. Thank you, Julius. Really appreciate it. Julius Neil Buenconsejo: you know, you're a very busy man. Thank you very much for everything. So for the listeners and viewers, thank you for watching us or listening to us. So remember, the future doesn't belong to AI, it belongs to the people who use it. See you next episode.