Oct 26, 2023 · 36m · no-priors
No Priors Ep. 38 | With Material Security Co-Founder Ryan Noon
0:00 / 0:00
▶ Watch on YouTube →
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
Material Security co-founder Ryan Noon explores the transformative impact of generative AI on cybersecurity, detailing how large language models empower defensive engineering while simultaneously enabling asymmetric, automated social engineering threats.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. The hosts hold 17.9% of the talking time here. How this is scored →
The hosts as informed peer 5.6 Guest teaching 5.0 Guest disagreement 2.5 The hosts pushing back 1.0
speaking balance: gold is the hosts, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 8:20 Ryan dismisses the cybersecurity talent shortage trope
Ryan aggressively swats down a major industry talking point about the cyber skills shortage, calling it an overblown cliche when LLMs provide cheap intellectual labor.
Hardest push from the hosts ▶ 4:01 Elad reframes Material's security model around breach resilienceElad steps in to clarify the practical mechanics of Material's approach, prompting Ryan to refine the distinction between breach prevention and blast-radius containment.
Biggest teaching moment ▶ 20:20 Ryan breaks down the silver bullet cybersecurity economyRyan delivers a deep structural explanation of security market incentives, citing Ian Grigg's paper to explain why incumbents buy startups rather than innovating organically.
The host holds their own ▶ 19:23 Elad articulates the AI capability discontinuityElad provides an insightful structural analysis on why general observers mistakenly view LLMs as linear progressions from CNNs rather than fundamental paradigm shifts.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | The hosts as informed peer | Guest teaching | Guest disagreement | The hosts pushing back | Why |
|---|---|---|---|---|---|---|
| Defense-in-Depth Architecture and Email Data Protection | 5 | 5 | 2 | 1 | Elad synthesizes Material's core value proposition by referencing the 2016 election hacks, which Ryan expands upon using his seatbelts for email analogy and the fragility of tech duopolies. | |
| Early LLM Adoption and Model Headroom in Cybersecurity | 6 | 5 | 3 | 1 | Elad asks an informed technical question about data corpus augmentation, prompting Ryan to argue that current off-the-shelf models already provide abundant headroom without over-engineered fine-tuning. | |
| Generative AI Applications and Alleviating the Skills Shortage | 5 | 5 | 3 | 1 | Elad prompts on gen AI application domains, and Ryan colorfully rejects the traditional 'cybersecurity skills shortage' framing by pointing out LLMs offer 90% of a human analyst for pennies. | |
| Emerging Attack Vectors: Scaled Social Engineering and Voice Cloning | 6 | 4 | 2 | 1 | Elad identifies specific voice-cloning APIs like LMNT and ElevenLabs, while Ryan highlights how basic LLM grammar correction scales social engineering and CEO text scams. | |
| Cybersecurity as Innovation Waste Heat and National Security Vulnerabilities | 6 | 6 | 2 | 1 | Ryan frames cybersecurity as the inevitable 'waste heat of innovation,' prompting Elad to connect this to OpenAI's founding thesis on counterbalancing concentrated AI power. | |
| State Cyber Doctrines and the Underappreciated Power of Machine Reasoning | 6 | 5 | 2 | 1 | Elad probes DoD strategy and points out the broader misconception of treating LLMs as continuous increments rather than discontinuities, which Ryan validates. | |
| Cybersecurity Economics: Incumbents, Silver Bullets, and Startups | 6 | 6 | 3 | 1 | Elad asks about startup viability against incumbent distribution power, leading Ryan to deliver an extended breakdown of 'The Market for Silver Bullets' and VC dynamics in security. | |
| Enterprise Vendor AI Strategies and Strategic Cloud Partnerships | 6 | 4 | 2 | 1 | Elad cites Material's partnership with Snowflake as an example of hybrid incumbent collaboration, which Ryan agrees is essential to prevent messy point-solution bloat. | |
| Seven Years of Security Evolution: Mobile Lockdowns and Cloud Centralization | 5 | 6 | 3 | 1 | Ryan details the counterintuitive realities of mobile lockdown and cloud centralization, sharing a personal investing miss regarding AWS bundling and Snowflake diligence. | |
| Founder Playbook: Building High-Utility Products Over Gartner Taxonomies | 5 | 5 | 3 | 1 | Ryan vents about founders obsessing over Gartner taxonomies instead of building high-utility software that solves obvious workflow pains, referencing Elad's market sizing essays. | |
| Startup Strategy: Team Alignment, Market Sizing, and Avoiding Shovelware | 6 | 4 | 3 | 1 | Elad and Ryan align on startup advice, with Elad urging founders to target early-stage low-hanging fruit while Ryan critiques repetitive dev-tools shovel-selling. |
Statements from this episode (21)
Noon: Duopolies bring market stability but extreme security fragility
“Duopolies are stable in the market, but very fragile when it comes to security.”
Noon: LLMs excel at filtering noise in raw cybersecurity operations
“There's a lot of just raw operational work that happens in security of just like, we need to, you know, rarefy this signal, filter out the noise, and then honestly feed it through a human being who has some experience as to what the bad guys are trying to do. …”
Noon: Off-the-shelf AI models eliminate fine-tuning moats for cybersecurity tasks
“I'm seeing a lot of like, you know, I need to pretend that I have a moat, so I need to, you know, fine tune all this stuff and whatever, whatever. But yeah, no, I mean, So many things that were very, very, very hard for computers, you know, 18 months ago are v…”
Noon: Generative AI solves the cybersecurity skills shortage for pennies
“Kind of classic cliches in the cybersecurity industry, like the cybersecurity skills shortage, like America needs, you know, to bring back the draft and make everyone get a security certificate or something. Okay. Like, you know, that you have like, 90% of a h…”
Ryan Noon: LLMs Excel at Static Code Analysis and Secret Detection
“The stuff that Socket's doing, just like analyzing NPM dependencies, like, you know, even just like stack analysis, like looking for like, you know, Hey, you drop sensitive information in the middle of your code base. Like that's like such a messy, hard proble…”
Noon: Using LLMs just for phishing spell checks materially increases attack success
“Like, if all they could do was, like, spell check the bad guys, and that's all you were using, like, whatever off the shelf, you know, open source LLM for, like, even that would make a difference materially on, you know, cybersecurity policy returns.”
Noon: AI allows a single hacker to execute mass social engineering attacks
“Like one human can now supervise a thousand humans. You know, you don't need a room full of like jerks trying to hack grandma or whatever when honestly like one jerk will now suffice, you know, with a for loop.”
Noon: Cybersecurity is just the waste heat of computing innovation
“My moral basis for cybersecurity existing is that is essentially like the waste heat of all other innovation in, in computing and information, which is like, you know, if a computer is doing something new for you that it wasn't doing last year, then like the u…”
Noon: Open Western societies are especially vulnerable to infosec threats
“The West, I think is especially vulnerable to this, like open societies, I think are extra vulnerable when it comes to infosec stuff, because like we put it all out there. We adopt these systems. We open them up. We let the private sector totally handle them. …”
Gil: AI capabilities represent a major discontinuity, not a linear progression
“I feel like they're in general, people are viewing AI as this continuum where it's like, it's a CNN, RNN, and now we have transformers and it's just a straight line. And instead, obviously it's a big discontinuity in terms of capabilities. And I think most peo…”
Noon: AI shovel-selling is overhyped, but long-term societal impact is underhyped
“Shovel selling is overhyped, but I think the thoughtful, you know, discourse on what our society will be like in 10 years is probably under hyped.”
Noon: Cybersecurity incumbents acquire startups because early-stage efficacy is unpredictable
“There's a, you know, like a truism that all cybersecurity products are just, you know, complex insurance policies or whatever, right? But the point is like that, that mushiness exists. And so what has resulted in, in, in the free market here is these incredibl…”
Noon: Top VCs avoid cybersecurity because typical outcomes cap at $200M
“A lot of the best VCs like never, you know, make bets in cybersecurity because, you know, at best you're going to get a two hundred million dollar takeout to Paladin networks or whatever, right? That's the typical outcome”
Noon: LLMs can replace traditional security log parsing and aggregation pipelines
“So much of security is is, is emitting Logs and alerts and then parsing those logs alerts again and aggregating them. You know, I spent a lot of time doing, you know, data infrastructure and analytics in my life, you know, before, after my cybersecurity grad d…”
Noon: Startups Embed LLMs Deeply While Fortune 500s Run Science Projects
“Kind of the growthy companies with the nerdy founders, like immediately started integrating this into the product. Right. And then the like youngish public companies that like totally still got it. You know, would do like a thinner feature a little bit later, …”
Noon: Apple blocks iOS security tools while ignoring underlying vulnerabilities
“Even Apple, who's like so good at locking it down to the extent that, you know, Zuck is super sad or whatever, like we'll, we'll lock down the device and prevent, you know, the most, you know, obvious forms of cybersecurity software being made. But like, but t…”
Noon: I advised passing on Snowflake's Series B because of Redshift
“I did diligence on snowflakes B and told whoever asked me to pass. Cause I'm like redshift exists. Like AWS is not asleep at the wheel.”
Noon: Early cybersecurity founders should ignore Gartner categories and build utility
“Take a step back and just, like, try and build an incredibly useful thing that everyone should buy. Stop thinking about the Gartner categories and, you know, whatever, CASB, UBA, SIM, whatever, DNR, something, something, something, like, stop, like, trying to,…”
Noon: Startup difficulty is the inverse of market size
“The difficulty level of the game that is starting a company is essentially just, like, the size of the market, like, the inverse of that. You know, like, the bigger the market, like, you can eat mistakes, you know, you can burn time, you know, like, it's just …”
Gil: Early-stage markets reward simple products over complex technical problems
“In the latter part of an industry, when things have matured and sort of saturated, that's when you do the hard stuff. But in the early days of a new market, you just want to do the easy stuff, because that's very tractable, it's faster, it's easier, you know, …”
Noon: Non-technical founders default to repetitive business templates like mattress companies
“Like you need like really talented technologists on founding teams. Like I really think it's like, we're in the technology industry. Like, you know, if you leave the MBAs alone, they're going to do like Casper mattresses, but for mattress pads this time, but t…”