Josh chats with Jaya Baloo from AISLE about their vulnerability scanner. If you follow open source vulnerabilities AISLE is a name you’ve seen popping up recently. They have a vulnerability scanner that is outperforming most of the existing scanners like Mythos. Jaya gives us some insight into how this all works and why they’re different. We also learn about some scary new attacks that can be conducted on LLM models. Jaya was a ton of fun and filled with insights.

This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.

Episode Transcript

Josh (00:00) Today, open source security is talking to Jaya Baloo who is a COO and CISO at Aisle. I am extremely excited to talk to Jaya. I’ve been trying to get Aisle on this show for a long time. They’ve been doing some amazing work at finding vulnerabilities. So Jaya, I mean, welcome to the show. You know, why don’t you tell us a little bit about

Jaya (00:15) Thank you.

Josh (00:16) yourself and and Aisle and we’ll get moving.

Jaya (00:19) Yeah, sure. So Jaya Baloo I used to be the CISO before we started Aisle at Rapid Seven. And before

Josh (00:27) Nice.

Jaya (00:27) that I was the CISO at Avast, an antivirus company that you you may know. and before that I was the CISO at a telco called KP and Telecom. So I’m just a security nerd who was kind of hellbent on trying to do something about the vulnerability problems that we had as a CISO. and that’s why we started ILE.

Josh (00:49) Nice. And what is Aisle doing?

Jaya (00:52) So we had very early on this premise that we could do vulnerability remediation at scale using AI. So really the kind of problems that we had with lag in terms of when you knew about a vulnerability existing to the time that your your tools had detection coverage, up until the point that you were triaging it, you know, discussing with the different folks in a company like whether the vulnerability is real, what you needed to do to fix it, that you wouldn’t break anything else.

We were convinced that we could make that entire process better, faster, smarter by using AI. That was our initial contention. And then my co-founder, who is amazing, Stanislav Fort, decided, like actually the thing that I kept complaining about, which was the scanner, that he should just build a new one. And I kept saying to him, dude, we don’t need another scanner. We’ve been doing scanners for a very long time. No more scanners, because CISOs are fed up with having

Yet more issues, you know, to add on to that vulnerability backlog that they can’t fix. No one needs to know this stuff. So, but he he was like saying, like, hey, you complain about the scanners all the time. So let me just see if I can make one that’s a little bit better. And he didn’t make one that was a little bit better. He made one that was pretty darn amazing. that didn’t just, you know, reduce the amount of false positives, but that also found a whole bunch of false negatives. So stuff that everybody else was missing.

Which terrified the bejesus out of me, to be very frank.

Josh (02:22) Yeah, yeah. And I mean that’s what spiked my interest here is so there’s a ton of people using LLMs to look for vulnerabilities right now. And it is and you know, it it ranges from it’s not going great for a lot of people to just flaming tire fires everywhere you look. And one

Jaya (02:36) Mm-hmm.

Josh (02:37) of my favorite people in the world is Daniel Stenberg. And I know he’s

Jaya (02:40) Yes.

Josh (02:41) brought you guys up more than once because it amuses me that he’ll point out like a lot of the other scanners aren’t finding things, but Aisle seems to keep

you know, digging things up around this. And and what you’ve got OpenSSL you found a bunch of vulnerabilities in. Like you are finding things in some of the most audited and scanned code bases on the planet, and you’re still finding them, which is like amazing, I think.

Jaya (03:02) Yeah, so if you if you, you know, follow our CEO and co-founder of Aisle Ondrej Vlcek who’s the former CEO at Avast on LinkedIn, you’ll see him post all these messages like Daniel came out I think only a week ago, if I’m not mistaken, and said, Hey, we’re ready for the next release of curl. so

Josh (03:22) Yes.

Jaya (03:23) far it’s totally clear sailing, we don’t have a lot of vulnerabilities. Mythos found zero, zero path didn’t find anything, we’re good to go.

And then

Josh (03:31) Yeah, yeah.

Jaya (03:32) he he did a post like Hold My Beer, you know, from Ted Lasso. And

Josh (03:35) I know, right?

Jaya (03:37) and then we basically tried to scan it and we found stuff and we reported it and we’re now I think just eight CVEs and a bunch of stuff still left to analyze. So that’s not bad, you know, and I think that that’s like I love to say that that’s what we do is that we we try to kind of underpromise, overdeliver continuously with everything that we do.

You know, just be a little bit humble and just do what you can and you do it for the right reasons. And yeah, and so far that’s worked pretty well.

Josh (04:09) And and I must just say, like, when Daniel did that, it’s like, what did you think was going to happen? Like you basically challenged the whole world to find vulnerabilities in curl ‘Cause he went from I think eight to like forty six in a week. Like

Jaya (04:22) Yeah.

Yeah, no, I think he had three and then I think we found I think

Josh (04:26) Okay, okay.

Jaya (04:27) just we have eight. I don’t know if there’s more now, but yeah, that’s certainly kind of the gist of what happened.

Josh (04:32) Yeah, yeah.

Jaya (04:33) I don’t know where we’re at actually at the current number. but yeah.

Josh (04:35) I love it. I love it.

Jaya (04:37) Yeah.

Josh (04:38) Okay, so I want to ask you, and you can answer as much or as little of this as you want, but

Jaya (04:42) Sure.

Josh (04:42) like, why is Aisle different? Because I feel like the th you’re obviously doing something no one else is. And the other thing I will say is when I read your blogs and I look at your webpage, you you aren’t using these, you know, like the the frontier models, you know, air c scare quotes there around that is is you talk a lot about using, you know, on prem

and smaller models to accomplish this, which just i is is

Jaya (05:06) Yes.

Josh (05:06) everything we’re being told, that’s the opposite of it, right?

Jaya (05:11) Well, to be fair, we can use both. So we can use both a frontier model as well as a small model. But if you remember when Mythos came

Josh (05:19) Okay, yeah.

Jaya (05:20) out, you know, their flagship vulnerability was a FreeBSD vulnerability,

Josh (05:24) Yes.

Jaya (05:25) and that was like amazing. That’s what they wrote about, and then they said they found like several thousand vulnerabilities afterwards. Well, we focused on finding that flagship vulnerability, but we did it with GPT Nano, and then we open sourced it.

So we basically did it with the smallest model you could find. And Stan said, okay, well, since this is a small model, then what we’re gonna do is we’re gonna be use a little bit of AI engineering. So if you’re working with a tiny model that is and open source and available for everybody to kind of use, what we need to then do is we obviously can’t feed it a ginormous, you know, context of the entire code base. So we’ll chunk the code base and say, bump, bump, bump, go find it here, go find it here, go find it here, go find it here. And that’s what we did. And

Again, it’s open source, so anyone can d download it. But then we found the same Free BSD vulnerability, but w obviously without access to Mythos And I think that the difference with Aisle is we basically have this wonderful little group of very strong AI research and engineering and cybersecurity. And we just basically put it together. You have a lot of companies,

But I would say that if you look at the amount of engineers we have versus the amount of overhead, it’s very rare to see like a 50 people company where like 95% is engineering, you know, and there’s a really tiny overhead for everything else. So the reason that you may never heard of have heard of Aisle because we don’t have a marketing team. You know, we’ve got this one human who does everything.

And we i it’s it’s just we’re lightweight on the other stuff, like the the stuff that you would normally see which would be way bigger at other folks. We’re just very, very heavy on the engineering part.

Josh (07:10) Well, I mean, look, I think your marketing is the vulnerabilities of open source, right? I mean, that’s how I learned of Aisle that’s what really piqued my interest is is why do I keep seeing this name in all of these vulnerability reports that are coming out from well known projects, right? It’s not like there’s a there’s a term Steve Christie used to use. He’s one of the founders of the CVE project. He called it PHP golf Where if people wanted to get vulnerab like CVEs on their name, just like pick any random PHP project, it’d be NPM today, you know, and like

Jaya (07:38) Yes.

Josh (07:39) It’s filled with vulnerabilities. And I mean, I see this all the time, right? Where like you can point an LLM at literally any P or any NPHP, a PHP or NPM project, almost any project. It’s gonna just be a train wreck of findings, right? But now curl

Jaya (07:49) Yeah. Yes.

Josh (07:52) or open SSL, those are different beasts.

Jaya (07:53) Right.

A hundred percent. And this is where we staked our reputation on. We initially started with finding vulnerabilities in OpenSSL and then curl. But maybe we should rewind just a little bit and explain why we started looking for vulnerabilities in

Josh (08:07) Yes.

Jaya (08:07) open source. Because it absolutely was not for PR or marketing. It was because okay, well, I I can just tell you, like these are obviously places to test your stuff where you have a code base and there’s a a a a sort of litmus test.

by having a maintainer actually provably agree with you that, you know, y you you basically have an unbiased observer who’s telling you if it’s legit or not, you know, who definitely has skin in the game. So those are good things. But the thing is, I should tell you that from a very personal perspective, when I was CISO at KPN, I was convinced that the world would end because of a Tomcat vulnerability, you know, that nobody had

Josh (08:46) Ha ha ha.

Jaya (08:47) bothered to

try to resolve and that this is really kind of the problem of our times. We it’s that KXCD comic. It’s genuinely that we don’t have a cybersecurity problem, we have that software engineering problem. And that for if if we are a company that is selling to enterprises and there’s only a certain degree of things they can fix because everything else in their code is open source and it’s just you know cannot, will not fix

We’ve got a problem. So we thought we need to like level everyone up. this is another reason that we have a commitment to open source. We have again, like maintainers can apply to Aisle and then we can try to figure out if they’re truly open source, we will like try to help them. And that’s how we see it. We see this as giving back to the community that that brought us here in the first place. And that if we help fix this, we’re actually

also helping fix these giant enterprises who are integrating everything from open source, but then you know, still have a lot of first party code riding on top of that. And that’s what we would like to be paid to scan. Yeah. Yeah. Yeah.

Josh (09:53) Yeah, right, right. Yes. You gotta eat. I mean, I get that. So let me

ask about I didn’t realize projects could like sign up with you. What does that process look like?

Jaya (10:01) Yes.

So we have a sign up area on our website and I can give you the URL, Josh, after Yeah,

Josh (10:07) Yeah, link in the show notes.

Jaya (10:08) yeah. And so f you know, you can also request a demo, I’m just saying. But you like the idea is that w we basically then have this commitment to folks who can then sign up and then we will scan a code base and look for vulnerabilities and report them back. And we just recently I don’t know if you saw that,

We are a CNA researcher underneath the CVE program. So if there are smaller projects and they’re not a CNA for their own code, we can absolutely help with that. we do this underneath the ENISA route. We’re very proud of this, obviously, because it’s a signaling of our ability to be mature, you know, sensible researchers on this area. And we think that’s very cool.

Josh (10:57) Yeah, yeah. Right. Okay. So I also wanted to ask you about the disclosure process, because this is something that is very hard to do. And a lot of people, especially a lot of the AI scanners, I I they’re just screwing it up because they kind of suck at it. So I’m I’m curious your like thoughts and experiences and lessons of going to a project, especially like OpenSSL or curl, that has pretty high standards and and like having to report a vulnerability. I assume

you’re not showing up with an AI slop report because they they

Jaya (11:28) No.

Josh (11:29) they like you. you know, first of

Jaya (11:31) Yeah.

Josh (11:31) all.

Jaya (11:32) Yeah. Well, we try to be good and we also try to be conservative. So we don’t report everything that we possibly can. We genuinely like we have an automated triage and in the very first times that we did this, we were very skeptical of our own results. So we,

Josh (11:49) Nice.

Jaya (11:49) you know, added human effort on top of it. Because I think that without that help these healthy skepticism, you’ve just drank your own Kool-Aid and you know, you’re

getting high on the product kind of thing. so I think that you really need to be very skeptical because like maintainer overload is a genuine real problem. and we saw that with a whole bunch of people who were overwhelmed with this AI slop. We also do our best to do a few things right, which is that we present both the vulnerability, the area of code where we found it, we also have a suggested fix, and when possible we present POC code as well.

So we, you know, try to give as much what’s the word, ammunition as you possibly can to a maintainer so that they can very easily determine true or false as well as severity rather quickly. And what we also have sometimes a dip more difficult time distinguishing between, which is is it a bug or is it something so serious that would actually necessitate a CVE

and so we we’ve had this debate internally as well. Like should we pre-screen? but I actually, you know, I think this is one of those things where you wanna be really honest. You know, sometimes these bugs can accumulate, they can cause untowards error in future versions of code. So we’ve actually instead of decreasing that aperture, we’ve actually widened it and thought, actually no, we should absolutely be giving back bugs because we’re not trying to claim bounty points with the CVEs, with that’s only

That’s a necessity when you need to inform more people about a particular issue, but there’s no i inherent merit on its own. So yeah.

Josh (13:35) mean I like that ‘cause you’re right, a lot of researchers and, you know, i i companies doing this sort of work, they’re obsessed with the criticals and they ignore everything else. But you’re right, I a bug is a bug, you know, and and it I get it, ‘cause it probably won’t be fixed anytime soon, but there’s definitely value in that, which yeah, that’s cool. I like that. Now now out

Jaya (13:53) Yeah. Yep. Yep.

Josh (13:56) of curiosity, how have maintainers responded to you showing up with what I assume is a a garbage truck full of bugs for their projects?

Jaya (14:02) And not everyone is equally as thrilled with us. and

Josh (14:05) Yeah.

Jaya (14:06) like we’ve never you know, I I think the the question is like why do we do it? I think the point is that we genuinely do it we try to do do it by being good. And I think like we, you know, make it very clear that we do our best to sanitize everything that we send so that we don’t have a high FP rate. In fact, the opposite. We have like

Either zero FPs or maybe like a 1% false positive ratio, and certainly like not the thing that we would ever want to send to a maintainer. To your point, Josh, this is the reason that they like us. I think in comparison, if we

Josh (14:41) Yeah.

Jaya (14:41) send it, it’s usually true. and I think the the question is, like when we had the most recent like what you said was a challenge from Daniel from curl, I think we were trying to push our own.

envelopes internally to try to find more rather than less, because literally we did that in the course of a couple of days. I think Daniel said that on a Monday, we then like reworked the scanner on a Tuesday. I think we then submitted on a Wednesday and had eight CVEs by Thursday. Something like this. This was the timeline roughly.

Josh (15:13) Wow.

Jaya (15:14) So that’s a crazy timeline. And I think when you try to do things quickly with that caliber of result, you might get more things wrong.

than when you have more time and d are more deliberate. but yeah.

Josh (15:31) Yeah. Okay, so I’m I’m curious, Jaya, if you can tell me like what is different with your technology, do you think, versus other scanners that people might run? Because, you know, you’re talking about low false positive rates and I like I’ve run many scanners and the false positive rates are often pretty bananas when, you know, in the initial pass. You can weed out through human and and maybe even some analysis, but I’m I’m curious

Jaya (15:49) Yeah, they are. Yeah. Yeah. Yes. Yeah.

Josh (15:54) what like why are you different?

Jaya (15:57) Well, we do a couple of things. First of all, we’re never overly reliant on any single LLM. We know that, you

Josh (16:02) Nice.

Jaya (16:03) know, that is a fun fundamental problem. So we have a multi-agentic cyber reasoning system, which is also it sounds like jargon, it really isn’t. It just basically means we assign different roles to the different agents and they’re all kind of working together in a chain in order to get our final result and our reports and make sure that everything that we initially thought we found is actually true our successfully and correctly and you know.

skeptically analyzed and also then subsequently re-examined for making sure that it works, that we can validate it in a pipeline, and then only it would go to potential pull requests. So we do all of those steps in between and they’re all performed slightly differently. and that means that obviously like in order to get things done well, you’re performing different iterations, you’re

using this like these different roles. they like obviously have to cooperate to some extent, but they don’t always like start from the same starting point. and it’s a full system. And it’s a combination of both AI systems, so non-deterministic, and determinism as well. So it’s a it’s a full-fledged thing that we built. and this is what we make available for customers. I I have slides. I’m not I’m not trying to give you the product

pitch, but we have slides

Josh (17:22) Sure, sure.

Jaya (17:23) online, people can go read them, and that has all the right terminology of the things that we’ve called the stuff. But I I’m just trying to give you a sense of how it works. And what we then do is like really focus on our benchmarks and evals internally. I would argue that that’s probably like a prime piece of our IP. So we really look to how these different models perform on these different tasks from vulnerability detection across the vulnerability set that we have. So we have like quite a unique proprietary data set of the things that we found.

And then we see how they perform against that. And then like by collecting these different benchmarks and evaluations across the different model spaces, we can also then do like potentially post-training, fine-tuning. And of course we have a very good harness, but that is continuously getting improved. and

Josh (18:06) Sure, sure.

Jaya (18:07) yeah, and we do the same like thing, for example, like the coding tasks that we would do. So the like again, like I mentioned from the beginning, we’re like an AI lab plus cybersecurity skills. I think that’s

Josh (18:18) Yeah, yeah.

Jaya (18:19) very much the fabric of what we do, but I do think we have a few amazing how do you say it secret sauce special weapon whatever you want to call it and one of them is definitely our co-founder Stan who is just amazing. and you know we we’ve got some really pretty amazing people in this small company so very proud of that.

Josh (18:40) Yeah. Yeah. I mean I mean for sure. Like there’s a reason I know your name, right? And it’s not it’s not ‘cause you’re marketing, which you clearly don’t have. But I love it. So okay, so we’re we’re I’m I’m curious kind of your thoughts on on what’s next in this universe, because I think the last probably six months, I know like I started and in I mean Daniel Stenberg again is is I I

Jaya (19:04) Mm-hmm. Yeah.

Josh (19:05) use him as my example all the time just because he’s been very vocal and I think he’s very reasonable in this universe is what in twenty twenty five almost all the vulnerability reports were just sloping garbage and everyone was mad at everyone because they sucked. And now I feel like the tooling has come a really long way. Like the models and the harnesses and and all kinds of things. And I would say it’s pretty good at this, which is, you know, as as terrifying as it is exciting being a security person in this space. And now we’re seeing

you know, I think some organizations starting to figure out some of the magic. But I’m curious, what do you think is happening after this? Like what are the things you’re excited for, maybe you think are coming or you’re working on, or or what can we maybe look forward to or be scared that it’s on its way. I don’t know which one it is.

Jaya (19:52) Yeah, so I I like look I I I cannot help take off my security hat as a CISO. So i everyone who’s using models now in their enterprise, in the last year, we’ve done this conversion, right? And Daniel is amazing and he’s been doing such good work with curl, but like what I think you see is that, you know, Daniel changed his mind to some extent about what the uses of AI were,

Josh (20:14) Yeah. Yeah.

Jaya (20:16) but he’s not alone. Like

All these organizations that were originally AI skeptic are now, you know, somewhat like have ri ridden that wave from AI skeptic to token maxing to my god it costs so much money, let’s like f figure out how to decrease token spend

Josh (20:30) Yeah, yeah.

Jaya (20:31) and you know now how to be sensible about the use of AI. And I think that sensible thing is a good thing. I think we’re also realizing after Mythos was no longer available.

What that sudden dependence is on this new technology that we’ve created for ourselves, like that only a certain set of people were there. So, what does it mean to have sovereign AI? I think this is a real question and concern because it becomes an availability issue. You have a concentration risk with certain AI providers. So I think that those are real things to worry about. and the other thing to worry about is, of course, the geopolitical context. Right now, you have

Josh (21:06) Yes.

Jaya (21:06) LLMs from

China, which are amazing, which you see is like where Hugging Face is now reporting that their most used models are coming out of China. It’s not the frontier model providers. So I

Josh (21:16) Yep. Yep.

Jaya (21:18) think we should also be worried about this geopolitical, you know, binary split between these two places. And then there’s for me a bigger concern, which is even when you have somehow figured out how to spend the money, optimize your tokens, and know who you’re gonna trust, whether it’s China.

Or the United States for this stuff, then you still have the very real problem. How do you know you can trust any model? How do you know you’re not winding up in, you know, not the blue pill or the red pill, but some weirdo orange variation where you’re now like totally being screwed by your own model that’s inside your network doing all kinds of things. So the area of research that I find most exciting, we also put a blog out about this.

is how we manage to poison or trogenize the models. So we have this example and it’s actually really, really exciting. I would urge you to read that blog if you haven’t already.

Josh (22:17) Is this the one titled

Control is the New Frontier in Security AI?

Jaya (22:22) the title of the blog is called The Model That Fixes Your Code Might Hack the Linux kernel. And what we’re basically saying is we can trojanize an AI model to insert all kinds of malicious payloads into specific code bases. So you think you’re getting something, but you’re actually getting this very scary thing. And the and the models that we used

that we tried to do this on were like Qwen from Alibaba, GPT from OpenAI, North Mini from Cohere, and Granite from IBM. And we chose like very deliberately different models from different geographies and to try to show how simple it is to create a backdoored model. So it’s not just the inherent model misalignment, which we’ve also read really cool papers about, but also the potential for an attacker to do this to you.

when providing you these models. So this is the area of research that I think is most exciting because like we have so many different layers layers of trust, right? And we’ve always said in cybersecurity that there needs to be defense in depth. You need to be able to trust to different layers. So having this notion of, you know, what can I observe, how can I truly trust, when areas of how the LLM reasons, the types of actions it takes, the scale at which this takes those actions are very difficult.

For human beings to comprehend or much less observe. And we really knew need to fix that if we want to trust and verify that this is legitimate.

Josh (23:54) Yeah, yeah. Well and and I wanna come back to something you said a a few a moment ago was also, you know, talking about like the geopolitical aspect of all this. You are a European company. And so you don’t have the benefit of of, you know, the US saying you can only use these models in the US or or there’s obviously Chinese models. I know there’s some European organizations, but you have, I think, a very you have to have a more realistic view of all this stuff, right? Just because of what’s happening, like just

everywhere at the moment, which is I think that’s fascinating. And and the the poisoning piece of this is I have heard about this. I I suspect I read this blog a while back, but I it’s not in my brain at the moment. But this is it scares me because we we really don’t understand it, right? Like this is very, very new research.

Jaya (24:45) Mm-hmm. Yes, it is. And like this I mean, like I think also there is a potential to have this agentic misalignment rather easily because im imagine like this is probably a very understandable thing that happened during the open AI hugging face incident, which is that a model was asked to perform a task. Yes, the guardrails may have been lowered. Yes, the

the actual environment where the model was sitting in might have been a bit too permissive for what it was actually supposed to do or there might have been more constraints deployed on the model or even more partitioning or a data diode. I mean you can think of all of these technical things that would have even further kind of isolated that model and limited its potential to do any form of lateral movement. However, I think that there’s still this fundamental discrepancy between the intent

Of the person who was administering the exam, if you will, f and you know, the the benchmark and the the model in its ability to understand like how was it expected to execute on that. And this divergence, this understanding, this misalignment between what is it you’re trying to convey for intent and what’s actually executed, I think is very real and very alarming, and we are absolutely

insufficient in our understanding of how we can better you know control that.

Josh (26:13) Yeah, yeah, for sure, for sure. Man. cripes I didn’t even

Jaya (26:18) Yeah. Yeah.

Josh (26:20) think we’d end up here, but this is way more scary than just finding vulnerabilities in our software. Like that’s a tractable problem. This one feels intractable.

Jaya (26:26) Yeah, I think and I I

and we’re naming it new things. So you must have heard of this area called JSpace, which is like this place where, you know, people are still trying to figure out how do we observe actually like how we arrive to some of these conclusions that are found in the J Space. I mean, you y I’m sure you read about the message board that was created on Artifactory by the different agents

Josh (26:48) Yep, yep.

Jaya (26:49) and how they communicate each other and swarm and how there’s like this

almost kamikaze attitude towards the swarm and members of the swarm kind of sacrificing their own needs in order to fulfill the interest of the collective. It’s it’s just fascinating. It makes me think of the Borg. You know, it makes me

Josh (27:06) I know, right?

Jaya (27:08) it really it it calls the imagination. and I think that’s always a an interesting place to be. but but a little scary.

Josh (27:16) Yeah, yeah, yeah. Right, right. my goodness. All right, all right, let’s land this plane, Jaya. What do you want us to know? What are some things people who are maybe interested in learning more can do? And and yeah, let’s just take it home.

Jaya (27:31) Yeah, I think the most interesting thing for me that I would love for people to know is first of all, what is Aisle? it’s funny, it’s whenever we’re in Europe, people don’t know how to pronounce Aisle because they keep

calling it yeah, so they’ll call it anything except Aisle and so we have to keep telling them, No, it’s like the aisle, like the seat, the aisle seat, instead of ASL or ISEL or, you know, all the other variations

Josh (27:53) Yeah, yeah.

Jaya (27:54) of A I S L E

and that we are really doing two things. We’re not just finding, we’re fixing. So all of these backlogs of vulnerabilities that you know we’ve accumulated, the tech debt that we’ve accumulated, we’re actually really, really good at minimizing that tech debt and making sure that we resolve the things that you already knew about. Plus, turns out that we’re pretty good at finding things you never knew about, but also being able to fix them.

I think that’s really important to me that like we built this to fix things, not to break things, not to find breaks,

Josh (28:31) Yeah.

Jaya (28:32) but to fix things. And I think like, you know, we would love to help people if they let us. I think that’s a really important like sentiment of the time that we’re currently in.

Josh (28:43) Right on. Yeah, I love that. I think that’s really cool. And and I do like the whole we built this to help people not not to break things. Cause I do think there is I mean, you’ve been in the security world for a long time and so have I.

Jaya (28:55) Yes.

Josh (28:55) Is there is a definite group of people that I would define are breakers, right? They are not fixers. And I’m not saying that’s a bad thing necessarily, but it’s also infinitely frustrating to deal with them when you are on the fixing side of that fence dealing with someone just throwing crap at you all the time. So

That’s cool. Fantastic.

Jaya (29:14) Yeah. Yeah.

Josh (29:15) All right. All right, Jayo. Thank you. Thank you so much. I mean, I’m excited. I can’t wait to have you back someday to to tell us about what new and crazy things you’re working on. So this is awesome. I I I’ve been so excited for this. I just thank you so much for the time. I truly appreciate it.

Jaya (29:28) thank you, Josh, it’s a pleasure, thank you.