Aptori Is Building an Agentic AI Security Engineer  ## Metadata - Author: [[The New Stack Podcast]] - Full Title: Aptori Is Building an Agentic AI Security Engineer - Category: #podcasts - URL: https://share.snipd.com/episode/70b6fe26-1d6d-4485-9559-9bd19d95909a ## Document Notes ## Highlights - **Origin Story of Aptori** - Sumeet Singh explains how delays in secure software release cycles inspired Aptori’s creation. - Their goal is to enable enterprises to build secure, high-quality software quickly from the start. Transcript: Frédéric Lardinois Maybe talk a little bit also what Aptori does, obviously. So happy to be here talking to you again. So OpenStack was this most amazing cloud computing system. Sumeet Singh And our previous startup, we built all of this tooling to make OpenStack autonomous. You have an OpenStack cloud environment, you run our software on it, and it would just essentially run it for you without humans. But also without AI back. There was some amount of AI, but not the gen AI. There were lots of machine learning in there. Eventually acquired into Juniper, and once we were there, Juniper has this extremely large customer base the world over, of these large telecoms, large financial institutions, Who are in the regulated industry. And because of various requirements, they were all running their own cloud computing environment, so we got the opportunity to go in there and essentially sell them our software and Help them run their clouds. Customers in Japan, like Fujitsu, Torchetelecom in Europe, BT in the UK. So lots of fun, lots of learning. And really kind of like what happened in that journey was that as we worked more and more with these large companies in the regulated space and they were digitally transforming with The goal that, hey, we want to be like the Googles, and we want to be releasing software all the time. We don't want to be hardware anymore. We want to be virtualized. We want software and releasing. We want to be DevOps. Every single time, it'd be like, yeah, we're ready to release, but there's this long list of requirements that comes from security that, hey, they've got to do all these things before You're ready to release. It's kind of like heartbreaking, right? You've put all this effort in, you have this goal that, hey, I've got to release everything in six minutes, but you can't achieve that. So that's roughly where we started to think that, look, we've done this piece of automating the infrastructure, getting the infrastructure running. How do we then, for these large companies, make it so that they are actually able to release software that's secure, built with high quality, quickly? ([Time 0:00:53](https://share.snipd.com/snip/540a0f39-75af-4ae8-a4c3-b3aaf13d64f9)) - **Aptori as AI Security Engineer** - Aptori acts as an AI security engineer continuously scanning, testing, and triaging security issues in real time. - It also recommends code fixes and explains the reasoning, enhancing developer trust and workflow integration. Transcript: Sumeet Singh Really, the only way to do that is to make sure that as you're building your software, as you're building your applications, you build it with security in mind. That's what AppTory is. How do you do that? So AppTory, the way we say it is it's an AI security engineer. It's your AI security engineer. It has all these skills. There's all these agents. These agents scan your code for security weaknesses. They can actually test your applications and your APIs to see if there's any vulnerabilities in there. More specifically, vulnerabilities related to access control, like if all the users can see only the things they're supposed to see. Then it has skills to triage your issues. And when it's triaging, it's not just like a black box triage. It's surfacing to you the different steps the agent took, what the thought process was, so that when you see the result of the triage, you're also able to be like, yeah, that makes sense To me. And I trust this thing a little more now. And then most importantly, it even has the ability to give you code fixes. And it can do all of this in real time. And that's really what the big transformation has been with Gen.AI, especially with things like Flash, Gemini Flash. We can take all of this, have this running in your SDLC as part of your Git. And as the user is trying do that new merge, it responds immediately, tells you what all the issues are, it suggests fixes to you, gives the reasoning to you. And right there, you can actually talk to the agent as well. If you want more information, you just, on your comments, say, hey, give me more information. It gives you more information. And then when you have the confidence that, hey, this thing is telling me the right things, you say, accept the change and merge. ([Time 0:03:04](https://share.snipd.com/snip/1b669d13-3e27-462f-8bc2-0f1b65e99fde)) - **AI Agents Proxy for Security Teams** - Use AI agents as proxies for security teams to validate compliance controls across thousands of APIs. - Feed real-time violation feedback directly to developers within their development environment to improve security. Transcript: Sumeet Singh What we are finding is, look, if you go to these organizations, on average, they'll have anything between 15,000 and 20,000 APIs. It's an insane number of APIs. They'll have thousands of engineers, right? And that's on one side. On the other side, they have these controls that come into play because of compliance requirements that could be hundreds of line items, right? You can't train all your engineers on all those hundreds of controls, right? Yet the security team, they are expected that, hey, all those hundreds of controls will be met. And they're supposed to ensure that they're met for every release, right? That is where our customers are finding us most helpful, right? It's like we become like a proxy for the security engineering team where they're able to say, hey, here are all the controls. And then our agents can do the validation and be checking and ensuring that all those controls are being met and feeding back to the developers in real time through Git that, hey, these Are your violations. ([Time 0:06:27](https://share.snipd.com/snip/7523541f-bf8c-48d7-a292-07a560b978f4)) - **From Alerts to Fixes with Gen AI** - Early tools overwhelmed developers with alerts but lacked fix suggestions; modern Gen AI now generates actionable code fixes. - These fixes come with explanations, educating developers and reducing repeated errors over time. Transcript: Sumeet Singh Yeah, absolutely. And actually, this is where all of this new AI changes the game, right? Just going back to the first version of the product. The first version of the product could not give the fix. And I used to tell my co-founder, Travis, all the time that, look, we're only giving these developers bad news. We're going to them and we're telling them, hey, you need to fix these six more things. Hey, you need to fix eight more things. And they're busy getting the feature out. But with AI generating these code fixes, complex code fixes, it's not like, hey, change this line here. It's the proper diff through different sections of your code to fix it. With this, we're giving them, you made this mistake, but look here, there's a potential resolution you can use, and it also, at that same time, tells them why it's doing it. ([Time 0:07:35](https://share.snipd.com/snip/e05158d1-7119-41cc-9f45-a346127dbebb)) - **Developer Attitudes Toward AI Tools** - Developers are curious and willing to explore AI tools despite initial skepticism. - Gen AI improvements have rapidly increased tool responsiveness and usefulness compared to early unusable versions. Transcript: Frédéric Lardinois Resistant to using these tools or worried about the code they're getting back from these AI tools? Because there seems to be two schools within the engineering community, right? The ones that are really into the AI LLM kind of coding and others who are extremely resistant to it. Sumeet Singh Everywhere we've been, we've found our users to be very curious. They all definitely want to try it and see how it works. Early on, it did used to be like, oh, I think I'm smarter than the AI. Yeah, exactly. But that wasn't the whole point of it. The point of it was this is the most assistive technology for you and treat it as such. And early pocs were very hard because you'd go into an organization and almost always the smartest engineer would raise their hand and the smartest engineer would be like, oh, let me See if this thing is smarter than me. But all this, Gen AI, it's improved tremendously over the last few years. I mean, every month the improvements are just mind-boggling. Our first iteration, to be honest, for this code fix was unusable. ([Time 0:09:30](https://share.snipd.com/snip/62ed2c88-ecf5-43a0-8374-f428a4ce8d32)) - **Expand AI Agents' Enterprise Roles** - Extend AI agents beyond security to address compliance queries and form evaluations within enterprises. - Leverage existing adaptive AI frameworks to diversify agent functionalities while maintaining enterprise control. Transcript: Sumeet Singh Can this also now start to respond to queries, like compliance questions? People submit forms all the time. Can it evaluate those forms for me? That's kind of like that next agent that we are making. ([Time 0:13:18](https://share.snipd.com/snip/59ed2a28-68a8-4939-b6e4-9a5c59a8f2a4)) - **Balancing AI and Determinism in Security** - AI security tools must combine generative AI with deterministic checks to ensure complete, reliable scanning. - Enterprise trust depends on transparent workflows and predictable validations beyond generative AI outputs. Transcript: Sumeet Singh Else could spin up another agent? This is the key thing here now. The way we think about this, and I'm sure other companies are doing as well, is it can't all be just Gen AI. We still have a bunch of technology in there that's proprietary that does the ML, but the AI works alongside it. There is a mix of things. There is a secret sauce, and that's how the systems will be. Specifically, in our case, I can give you an example. Now when I say, hey, we want to scan. We want to look at your code, look for security weaknesses. We want to scan your APIs, your applications, your cloud. When you're doing the scan, you do want some amount of determinism. You can't just leave it to Gen AI to take the greedy approach and say, hey, look, these are the 10 things I found or these are the 20 things I found. You want to make sure that whatever those controls are, whatever those checks are, that all of those checks were done. That's where the secret sauce kind of comes in. ([Time 0:15:30](https://share.snipd.com/snip/9904ce9a-ce1a-43f7-a8fe-2e689184d5dd))