Jan 2, 2019 · 33m · a16z
a16z Podcast | Security's Painful Prominence and Why There is No Turning Back
0:00 / 0:00
▶ Watch on YouTube →
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
In this episode of the a16z Podcast, Marc Andreessen and host Michael Copeland discuss the escalation of global cybersecurity threats, examining how early software design flaws, shifting corporate liabilities, cryptographic trust models like Bitcoin, and enterprise cloud migrations shape an increasingly interconnected virtual world.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. How this is scored →
The host as informed peer 2.1 Guest teaching 4.9 Guest disagreement 2.0 The host pushing back 1.5
speaking balance: gold is the host, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 2:05 Premise Rejection on Security Choices
Marc Andreessen explicitly rejects Michael Copeland's prompt framing that society faces a choice between stopping software expansion and accepting security risks, asserting that such choices are simply not true.
Hardest push from the host ▶ 25:09 Challenging User Friction on Bitcoin AdoptionMichael Copeland pushes back against Marc Andreessen's optimistic Bitcoin premise by pointing out that if everyday users struggle with two-factor authentication, adopting complex digital currency protocols will face major usability hurdles.
Biggest teaching moment ▶ 10:00 Enterprise Cloud Security InversionMarc Andreessen educates the host on the shift in enterprise IT, explaining how traditional CIOs mistakenly held on-premise infrastructure under the false belief it was safer than cloud providers.
The host holds their own ▶ 28:58 Citing Benedict Evans ThesisMichael Copeland demonstrates industry expertise by referencing Benedict Evans' framework ('tech has outgrown tech') to question how Silicon Valley's economy relates to broader global macroeconomic conditions.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | The host as informed peer | Guest teaching | Guest disagreement | The host pushing back | Why |
|---|---|---|---|---|---|---|
| Software Eats the World and the Escalating Reality of Cyber Threats | 1 | 4 | 2 | 1 | Michael Copeland frames the introductory question around balancing software adoption against security risks. Marc Andreessen gently refutes the assumption that stopping or slowing software adoption is a viable choice, arguing society is moving into a virtual world regardless. | |
| Historical Software Oversights and the C-Suite Priority Shift | 1 | 5 | 1 | 0 | Copeland asks Andreessen to expand on why early software lacked security consideration. Andreessen offers historical anecdotes from Mosaic, Netscape, and early databases, then details how corporate governance and board dynamics are shifting after the Target breach. | |
| The Virtual World Imperative and Enterprise Cloud Migration | 2 | 5 | 1 | 1 | Copeland prompts Andreessen on practical operational steps and mindset changes for corporate leaders. Andreessen details the cloud security inversion, explaining how specialized enterprise cloud providers offer far superior security compared to internal corporate IT infrastructure. | |
| Financial Liability, Payment Systems, and User Accountability | 3 | 4 | 3 | 2 | Copeland brings up liability and payment processing using Apple Pay as an example. Andreessen outlines credit card fraud structures and asserts a controversial stance that consumers using weak passwords and skipping two-factor auth should face personal financial liability. | |
| Breach Disclosure Dilemmas and Silicon Valley's Trust Gap with Government | 3 | 6 | 4 | 2 | Copeland raises government relationship issues following the White House summit at Stanford. Andreessen launches into a detailed critique of Washington's strained relations with Silicon Valley post-Snowden, mocking government proposals and predicting widespread future leaks. | |
| Bitcoin, Blockchain, and Cryptographic Trust Models | 2 | 5 | 2 | 3 | Copeland introduces Bitcoin and challenges Andreessen on friction points like user adoption. Andreessen explains cryptographic trust, bearer instruments, and why digital cash solves incentives and liability issues in online commerce. | |
| The Internet of Things and Autonomous Physical Infrastructure | 2 | 5 | 1 | 1 | Copeland asks for a definition of the Internet of Things and its security implications. Andreessen paints a vivid picture of trillions of connected objects, emphasizing the high security stakes involved in physical autonomous systems like self-driving cars. | |
| Silicon Valley's Global Technological Expansion and Macro Economic Outlook | 3 | 5 | 2 | 2 | Copeland introduces a macro question citing Benedict Evans' thesis that tech has outgrown tech. Andreessen counters media pessimism, highlighting how cheap smartphones and global software tools drive bottom-up economic empowerment in emerging markets. |
Statements from this episode (16)
Andreessen: Virtually all value and cyber attacks will move online
“And so the reality is we're gonna live in a virtual world. We're gonna live in an online world. We're gonna live in a software world. Because we're gonna live in that world, that is where, you know, virtually all of the value is going to be, which means that, …”
Andreessen: Cross-site scripting was unknown when Netscape invented JavaScript in 1995
“When we invented JavaScript at Netscape in 1995, the concept of cross-site scripting was a complete unknown.”
Andreessen: Firing the Target CEO over security forced corporate executives to care
“The target hack has probably had the single biggest effect where the CEO got fired, and, you know, and this is one of those things, like, you know, this is fresh in mind, because I'm thinking about how to deal with kids, but, like, if you're dealing with CEOs,…”
Andreessen: Conflict with proxy advisor ISS gets corporate board directors removed fastest
“ISS, which is the firm that advises a lot of the pension funds and index funds on how to vote their shares, because it's the fastest way to get booted out as a director.”
Andreessen: Cloud vendors are more secure than most internal enterprise IT
“I think a lot of CI is becoming increasingly aware especially at companies that haven't mounted a first class effort in staffing and funding for security, that it's highly likely that the cloud vendor is more secure than they are.”
Andreessen: Apple deliberately designed Apple Pay tokenization to avoid fraud liability
“Apple's very deliberately crafted Apple Pay so that they're not holding the bag. Just to be clear. There's actually a very clever technique with tokenization where it's definitely all somebody else's fault.”
Andreessen: Consumers who use weak passwords should be held legally liable
“Consumers like who use bad passwords, like ought to be held liable for the consequence. Like consumers at some point, like at some point as an adult, you learn that when you leave your house at night, you lock the door, right? Consumers at some point are going…”
Andreessen: Two-factor authentication will become mandatory on all services
“The idea that two factor authentication is still optional and not required on all these services because everybody's worried that consumers aren't going to be able to, like, it's just going to be a part of life to have to do two factor authentication.”
Andreessen: Wave of shareholder lawsuits will follow undisclosed corporate security breaches
“I think this will be endless litigation. I think that, I think actually this is going to be a whole wave of shareholder litigation that's going to follow from this, because as far as I can tell, there may be formal, there may be legal requirements for disclosu…”
Andreessen: Silicon Valley relationship with US government is at absolute low point
“Relationships, the relationship between the government and Silicon Valley from, in terms of all these issues, is at an absolute low point. Like, It's one of those low points where you can't imagine it getting any lower, although it probably can.”
Andreessen: Tech companies are defensively driven to implement end-to-end encryption
“Valley companies now feel much more emboldened, not even so much out of a sense of, like, proactive, like, enthusiasm, but almost out of a sense of, like, defensive energy to get much more determined to do end-to-end encryption. Also much more determined to fi…”
Andreessen: No tech security policy progress will happen under Obama administration
“I think that I think nothing will happen under this, as far as I can tell, nothing will happen under this administration. I think whoever is the next president and whoever the next set of national security officials have a big opportunity on this.”
Andreessen: Every major government agency and corporation will inevitably face a Snowden
“And so, not only will there be a Snowden for the NSA, there will be a Snowden for the Chinese state security agency. There will be a Snowden for GCHQ. There will be a Snowden for Citibank, and on, and basically we'll all have Snowdens.”
Andreessen: Hedge funds will buy and own autonomous car fleets
“I think self-driving cars are actually gonna be, I think they're actually gonna be owned by hedge funds. So I guarantee they're not going to want to take responsibility. So I think what's going to happen is hedge funds are going to spend a billion dollars and …”
Andreessen: Android smartphones in developing nations are down to $25
“Smartphones, Android smartphones now are down to 25 dollars, right? And so India, Pakistan, you know, whole range of developing world countries, Indonesia, you know, you go to the local store and you literally get an Android smartphone for 25 dollars, right?”
Andreessen: A vibrant underground internet startup scene exists in Tehran
“He went and he spent two weeks on the ground in Tehran and he said there is an absolutely vibrant internet startup scene. Are underground in Tehran, and the kids who are working on these startups are just, like, as excited as can be.”