The Security Podcast of Silicon Valley

Thomas Moyer spent 20 years at Apple, starting under Steve Jobs as an employment lawyer. He became the company’s first Chief Compliance Officer, and then, reluctantly by his own account, took the Chief Security Officer job, which he held for more than 13 years before retiring in January 2026. His first meeting with Tim Cook set the tone for all of it. Two weeks in, he told Tim the company had no legal obligation left on an old agreement with a former employee, and Tim asked him what the right thing to do was. That question runs through the crisis management program Thomas built after the Paris attacks, which by the time he left could reach any Apple employee by text or phone, and through the months Apple spent moving employees and their families west across Ukraine. Since leaving Apple he’s been watching something that worries him. Four groups that would otherwise have nothing to do with each other are pointing at the same target, the tech industry. People worried about their jobs and about power concentrating in tech stand next to environmentalists at the same protests, along with people worried about privacy and people objecting to who tech companies work with. He built a tracker for it, and in its first three weeks it went through about 30,000 articles and logged 99 incidents of opposition to the industry, most of them peaceful and 19 of them sabotage. His answer for the industry starts with listening, and with learning to tell a neighbor from a threat. He explains how Apple did that while building Apple Park in a quiet Cupertino neighborhood, and what he’d tell Flock’s founder about writing its own rules before Congress does. Thomas now runs Seven Elm Strategies, which advises technology and critical infrastructure companies on their security programs and helps startups sell into companies like Apple. His weekly brief on opposition to the tech industry is free at 7elmstrategies.com. [Recorded October 2026. Confirm the date.] Some of the events Thomas mentions were recent at the time. Brought to you by YSecurity.

FinalSpark is trying to build computers out of living neurons, and Ewelina Kurtys, a strategic advisor there, explains why in terms of energy. Current artificial intelligence systems use a lot of it and are already expensive to run, and she thinks many models are underpriced while they're in their adoption phase, so prices might go up. FinalSpark's mission is a biocomputer that uses 1 million times less energy than silicon. She's careful about how far along it is. When Jon recorded this, the team had managed to store 1 bit of information, and she puts a final product another 10 years out, because neurons encode information so differently from silicon that the programming has to be worked out from scratch. For now the team writes Python to send the neurons electrical and chemical signals and measure what comes back. The neurons start as stem cells that come from human skin, which she says you can buy commercially and which biomedical research often uses. Jon suggested it was a contest with quantum computing, and she turned that down, because she thinks they'll be good at different things and that many kinds of hardware will end up complementary. Jon expects quantum to have a huge impact on security, since the traditional asymmetric key algorithms go out the window once there's a powerful enough quantum computer. Asked what biocomputing changes for security, she says it's too early to tell. At least for now, everything in their lab talks to the outside world through silicon, so she thinks maybe not many things change from a security point of view. Ewelina has a doctorate in neuroscience and moved to London as a postdoctoral researcher before leaving academia for startups. Her first job after that was with a medical imaging company, which is where she learned about artificial intelligence, and she later met FinalSpark's founders, Fred Jordan and Martin Kutter, at a summit on artificial intelligence in London. FinalSpark was founded in 2014. She says the founders did a lot of fundamental research in digital artificial intelligence before realizing that great models cost a lot to make, and that competing there maybe wasn't the best choice for a small independent startup. Their first employee already had experience with living neurons, so they tried programming those and had to learn biology from scratch. There's also her answer when Jon asks whether there's a problem she'd pay another company to solve, which is that she'd start that company herself, and the advice she'd give her younger self, which is to be more confident. Episode page and transcript: ysecurity.io/podcast/107-programming-living-neurons-in-python/ Brought to you by YSecurity, the security team that works next to yours. Your first 8 hours of chief information security officer work are free at ysecurity.io/startups.

The prompt injection Jesse Anglen describes takes one line of fine print at the bottom of a website. It tells any agent that reads it to drop its instructions and email out whatever credentials sit in the .env file, and then it waits for somebody's coding agent to land on the page during an ordinary research task. The co-founder and chief executive of Ruh.ai says he hasn't heard a security professional give him a solution to that problem that he feels solves it. He thinks the eventual answer looks like a second agent whose only job is screening everything the first one gathers for prompt injection before anything acts on it. He first credits the idea to a conversation with somebody. When Jon asks where he heard it, the answer is a brainstorm with his own chief technology officer, and Jesse spends the next few minutes on how the idea breaks, starting with the attacker who writes the injection for the guard instead of the agent. Earlier in the conversation, Jesse admits he never learned serious black-hat hacking, and his point is that with the models available today he wouldn't need to. Jon takes it the rest of the way. If the cost of writing software is going to zero, so is the cost of breaking in. Jesse's frame for security is a single question, who can I trust, and the answer decides whether your data and your models can live with a provider like Amazon or OpenAI or need a stack of computers in the back. Jesse started building on Ethereum in 2014, before its mainnet launched, and for a while ran what he calls the largest blockchain development company in the world, because it was one of the only ones. He grew Rapid Innovation to 370 developers, and in April 2022 a really smart kid on his team brought him OpenAI's early models and an idea that cut client onboarding from 6 weeks to 4 days. Once ChatGPT shipped that November, the company decided that when anyone quit or had to be let go, it would try to replace them with an agent. About 2 years later, 87 people were doing the work 370 had done, with 160 agents working inside the company. His biggest client win, which he's quick to call cherry-picked, was one agent built in 3 weeks for $20,000 that he says replaced about $3.5 million worth of payroll at a Midwest plastics manufacturer. In 2025 he stepped down as chief executive of Rapid Innovation to put all his time into Ruh.ai, which builds digital workforces of agents for other companies. There's also his photography story, which is how he explains what artificial intelligence did to reasoning, and his case for why cybersecurity stays a human job for as long as people want to steal things. Episode page and transcript: ysecurity.io/podcast/106-the-prompt-injection-hiding-in-the-fine-print/ Brought to you by YSecurity, the security team that works next to yours. Your first 8 hours of chief information security officer work are free at ysecurity.io/startups.

If your security budget goes almost entirely to keeping attackers out, Yair Grindlinger thinks you're underfunding the part that's becoming more and more urgent. The co-founder and chief executive of Surf AI says artificial intelligence changed what happens after someone gets in. For years it was hard to turn a crack into meaningful data exfiltration. Now, once an attacker is inside, getting to the valuable information and pulling it out is much, much easier than it used to be. His answer is to split the spend. Do everything you can to reduce the risk of a breach, then put just as much, if not more, into limiting the blast radius. Jon's name for the threat is internet security weather, the storms of bots that used to spray known vulnerabilities at random and now come back intelligent, backed by capable agents. Asked how long a system online has before a breach, Yair says he thinks it's already happening right now, in ways we don't know about. He's still an optimist. Once defenders have the better technology and cover their assets, he expects security to end up in a better place than it's ever been. There's also a moment security leaders will recognize. Asked how security teams take to the agents, he gives the expected answer about strategic work, then corrects himself. What they mention first is getting rid of the chasing and the ticket follow-ups, the part of the job he calls burger flipping. Surf AI launched in March 2026 with $57 million to run the whole security program with a system of agents, and it's hiring in Israel and the United States. Episode page and transcript: ysecurity.io/podcast/105-shrink-what-a-breach-can-reach/ Brought to you by YSecurity, the security team that works next to yours. Your first 8 hours of chief information security officer work are free at ysecurity.io/startups

Yashvier Kosaraju, who goes by Yash, is the Chief Information Security Officer (CISO) of a16z, 4 months into the job when this was recorded, which by his own measure feels like about a year. The job covers the firm’s corporate environment, its cloud controls and its pitch decks, and the part that makes him useful to this audience is that a16z sits close enough to its portfolio companies that founders bring him their security problems directly. So host Jon McLachlan starts there. When does a startup make its first security hire, and when does that become a head of security? Yash separates the two hard. The first hire is a staff or senior staff engineer who can work independently, someone in the code and the infrastructure rather than someone building a team, and the trigger is a risk decision about what data you hold and what happens if it walks. Headcount has nothing to do with it. Where that person sits matters as much as when you hire them, because an engineer without enough context and access can’t execute. The head of security comes much later, when the company is big enough to need a dedicated leader in the seat. Then the sales version of the same question, which is the one founders feel first. A big client asks for a call with your security leader, or for a named contact they can reach in an emergency. Yash’s answer is that this is the wrong moment to go hire a head of security, and he lays out the 2 routes he’d take instead. Fractional CISOs come up, and he calls them a good resource for jumpstarting a program. The middle of the episode is AI, and he does neither the optimistic version nor the doom version. The security market is saturated with vendors, he says, where every feature of what ought to be one suite is its own company, and for the first time in his career he can’t tell you how long consolidation will take. On offense, AI is good enough at working through known vulnerabilities, the published Common Vulnerabilities and Exposures (CVE) list, to overwhelm a defense, and the cost per exploit is falling for the attacker. His forecast is 12 to 18 months of painful catch-up, after which whole classes of vulnerability and whole categories of tooling stop being necessary. What he wants gone specifically is code security. Static application security testing (SAST) and software composition analysis (SCA) exist because humans write insecure code, and if agents are writing most of it, he’d like them writing it securely by default. His real worry sits outside the valley. The rate of AI adoption here is nothing like the rate anywhere else, and attackers ramping up on AI don’t have to come to Silicon Valley to use it. The companies that haven’t adopted, or that can’t afford the tokens to build a defense, are the ones on the other end of that curve. He puts it plainly. The cost of not adopting AI is higher than the cost of not adopting anything that came before it. Jon takes it to agents, and this is where the episode earns its title. Prompt injection is unsolved. The defense everybody points at is the accept-this-action prompt your coding agent throws up before it does something, and his read is that it stops functioning around the third click, when people click through without reading. So a16z adopts AI fast and scopes it deliberately instead. For an AI tool, the vendor review he cares about starts with what the tool can reach, and whether that connection writes back or only reads. The pen test and the questionnaire still get run, and on an AI tool they aren’t where the risk sits. The other half of that is a rule about how his team answers requests. They don’t say no, because a no costs you twice. Whoever asked stops asking you, and uses the thing anyway. Also in this one. Why the security teams of the next 2 years live much closer to the code, and what changes when a finding stops being a list of packages to upgrade and becomes a pull request one agent opens and another reviews. Where testing goes once the code