Podcast Episode 104

Episode 104 38 min

Why a16z’s CISO doesn’t trust the approve button

with Yash Kosaraju · a16z

0:00 / 38:00

Watch on YouTube Listen on Spotify, Apple Podcasts, Podbean, Player FM

Episode 104 of The Security Podcast of Silicon Valley. Host Jon McLachlan, co-founder of YSecurity and Cyberbase.ai, talks with Yashvier Kosaraju, who goes by Yash, Chief Information Security Officer of a16z and before that the first CISO of Sendbird. They cover when a startup makes its first security hire and why that isn't the head of security, why the accept-this-action prompt stops working as a defense against prompt injection after the third click, what a review of an AI tool should ask, why the a16z security team doesn't answer a request with a no, and what an AI task costs. Published September 22, 2026. About 38 minutes.

Episode notes

Yashvier Kosaraju, who goes by Yash, is the Chief Information Security Officer (CISO) of a16z, 4 months into the job when this was recorded, which by his own measure feels like about a year. The job covers the firm’s corporate environment, its cloud controls and its pitch decks, and the part that makes him useful to this audience is that a16z sits close enough to its portfolio companies that founders bring him their security problems directly.

So host Jon McLachlan starts there. When does a startup make its first security hire, and when does that become a head of security? Yash separates the two hard. The first hire is a staff or senior staff engineer who can work independently, someone in the code and the infrastructure rather than someone building a team, and the trigger is a risk decision about what data you hold and what happens if it walks. Headcount has nothing to do with it. Where that person sits matters as much as when you hire them, because an engineer without enough context and access can’t execute. The head of security comes much later, when the company is big enough to need a dedicated leader in the seat.

Then the sales version of the same question, which is the one founders feel first. A big client asks for a call with your security leader, or for a named contact they can reach in an emergency. Yash’s answer is that this is the wrong moment to go hire a head of security, and he lays out the 2 routes he’d take instead. Fractional CISOs come up, and he calls them a good resource for jumpstarting a program.

The middle of the episode is AI, and he does neither the optimistic version nor the doom version. The security market is saturated with vendors, he says, where every feature of what ought to be one suite is its own company, and for the first time in his career he can’t tell you how long consolidation will take. On offense, AI is good enough at working through known vulnerabilities, the published Common Vulnerabilities and Exposures (CVE) list, to overwhelm a defense, and the cost per exploit is falling for the attacker. His forecast is 12 to 18 months of painful catch-up, after which whole classes of vulnerability and whole categories of tooling stop being necessary. What he wants gone specifically is code security. Static application security testing (SAST) and software composition analysis (SCA) exist because humans write insecure code, and if agents are writing most of it, he’d like them writing it securely by default.

His real worry sits outside the valley. The rate of AI adoption here is nothing like the rate anywhere else, and attackers ramping up on AI don’t have to come to Silicon Valley to use it. The companies that haven’t adopted, or that can’t afford the tokens to build a defense, are the ones on the other end of that curve. He puts it plainly. The cost of not adopting AI is higher than the cost of not adopting anything that came before it.

Jon takes it to agents, and this is where the episode earns its title. Prompt injection is unsolved. The defense everybody points at is the accept-this-action prompt your coding agent throws up before it does something, and his read is that it stops functioning around the third click, when people click through without reading. So a16z adopts AI fast and scopes it deliberately instead. For an AI tool, the vendor review he cares about starts with what the tool can reach, and whether that connection writes back or only reads. The pen test and the questionnaire still get run, and on an AI tool they aren’t where the risk sits.

The other half of that is a rule about how his team answers requests. They don’t say no, because a no costs you twice. Whoever asked stops asking you, and uses the thing anyway.

Also in this one. Why the security teams of the next 2 years live much closer to the code, and what changes when a finding stops being a list of packages to upgrade and becomes a pull request one agent opens and another reviews. Where testing goes once the code layer is handled, and why business logic is the part AI is worst at. The return on investment conversation nobody has solved, including his own example of the same task costing wildly different amounts depending on how fast you asked for it. Why he doesn’t expect the frontier labs to be the ones who show you that price. What a16z’s actual AI mandate was, which had nothing to do with spending more. One cryptography course in India that turned into a master’s at Johns Hopkins and 15 years in the field. Why his proudest moments are other people’s promotions, and the correction he makes when Jon calls that giving back. The job he left in under 2 months. And why he’d decline the meeting with his younger self.

He’s hiring, and he says so on his way out.

Hosted by Jon McLachlan — co-founder of YSecurity.

The deep dive

The third click

Yash Kosaraju, CISO of a16z, with Jon on four months at a16z, the first security hire, the buyer who asks for a security leader, fractional CISOs, too many vendors, code security that goes away, months of catching up, the Silicon Valley bubble, prompt injection and the third click, what an AI tool can reach, a scoped yes, building people, a stint of less than two months, security teams closer to the code, what an AI task costs, and a mandate that never asked for token maxing.

By Jon McLachlan, host 32 min read

Episode 104 of The Security Podcast of Silicon Valley came out on September 22, 2026, with Jon McLachlan hosting. The guest was Yash Kosaraju, Chief Information Security Officer of a16z, the venture capital firm Andreessen Horowitz (Podbean, Apple Podcasts, Spotify, LinkedIn, a16z). The episode is called “Why a16z’s CISO doesn’t trust the approve button.” The video on our YouTube channel is called “104. Why the a16z CISO doesn’t trust the approve button.” Our companion post, The Human in the Loop Is Going Away, covers why approval prompts fail as a control for AI agents and what to limit instead. This page stays with the conversation.

Yash’s case is that the approval prompt in an AI tool is a weak defense, because people stop reading it. The a16z security team works on what each AI tool can reach: which data, how it gets there, and whether it can write back. And the team doesn’t answer a request with a no. It works out the use case and scopes the data to fit.

The line that sums up the conversation came when Jon asked how a CISO handles agents that take instructions from the internet.

“after the third click, you don’t really read what’s in there and you just start clicking through.”

Yash Kosaraju, at 16:54

The whole conversation, 38 minutes. The first security hire comes up at 4:07, the third click at 16:33 and what an AI task costs at 28:41. Watch on YouTube.

This page follows the conversation in order: a section for each part of it, twelve figures, ten clips from the tape, four LinkedIn posts, a post on X, a talk on another podcast, the full transcript, and five tools: a quiz, a scorecard for what your AI tools can reach before anyone clicks approve, a calculator for what the fast mode costs, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.

Four months at a16z

Jon introduced Yash as the CISO of a16z and listed what the job covers: the corporate environments, the sensitive information, “all of those juicy pitch decks,” and the corporate and cloud security controls. Then Jon asked how long Yash had been there. Technically, four months, Yash said.

“but it feels like about a year.”

Yash Kosaraju, at 2:15

Jon called it startup years. The energy at the firm, in Yash’s words, was high and electric, with everyone excited.

“I get to build on security with all the new technology that’s coming up.”

Yash Kosaraju, at 2:30

LinkedIn lists Yash as Chief Information Security Officer at Andreessen Horowitz since April 2026. Before that came Sendbird, as CISO from December 2021 to April 2026, Twilio from April 2018 to December 2021, from staff security engineer to director of product and infrastructure security, Box from March 2015 to March 2018, and iSEC Partners from January 2014 (LinkedIn). A 2025 profile by K logix calls Yash Sendbird’s first CISO, hired to build out its security program (K logix).

Wikipedia describes Andreessen Horowitz, also known as a16z, as a venture capital firm founded in 2009 by Marc Andreessen and Ben Horowitz. The 16 counts the letters between the first letter of Andreessen and the last letter of Horowitz (Wikipedia).

In October 2018, while at Twilio, Yash shared Twilio’s post on adding a safe harbor for good-faith researchers to its bug bounty program (X, Twilio). In April 2020, Yash wrote Twilio’s update on the program, which it runs with Bugcrowd (Twilio).

Yash on X, October 2018, sharing Twilio's safe harbor for bug bounty researchers. View on X.
Five cards. 2014 to 2015: iSEC Partners, security engineer. 2015 to 2018: Box, security engineer, then senior security engineer. 2018 to 2021: Twilio, staff security engineer to director of product and infrastructure security. 2021 to 2026: Sendbird, Chief Information Security Officer, the company's first. Filled, at the episode: a16z, Chief Information Security Officer since April 2026.
Yash's roles before the episode. Sources: LinkedIn and K logix.

Close partners to the portfolio

Jon asked whether the security companies in the a16z portfolio come asking for a test bed. Yash described a partnership.

“we are close partners for our portfolio company.”

Yash Kosaraju, at 2:51

The security team works closely with those companies and could be a customer, an advisor, or help with the right hires and with thinking about the problem the right way.

Founders’ questions range widely, Yash said. Founders who build security products want their product seen the way an enterprise security team would see it. Other portfolio companies ask about hiring a first CISO or a first security hire, or about getting ready for a big customer’s security audit or a compliance audit.

“It’s a long list.”

Yash Kosaraju, at 3:48

The first security hire

Jon asked for the signal that it’s time to hire a CISO, or to make the first security hire. Yash split the question in two.

“Those two are very different.”

Yash Kosaraju, at 4:07

The first security hire comes fairly early, and it’s an engineer.

“So when you look at the first security hire, it’s mostly a staff level, senior staff level engineer that can be independent, but isn’t your true head of security person who’s building the team.”

Yash Kosaraju, at 4:11

“This person’s more in the weeds, in the code, in your infrastructure, hardening things, building things out.”

Yash Kosaraju, at 4:24

The timing is a risk decision: what data you have, how many customers you have, and what’s at risk. Where the engineer sits is a decision too. It could be the infrastructure team or another engineering team, wherever the engineer gets enough context and access to execute. The head of security comes much later, once the company needs a dedicated security presence and a leader for it.

Listen · Yash Kosaraju on episode 104, from 4:11
About 20 seconds: Yash on the first security hire. The clip stops on its own. Read the full transcript.

Our post In-House, On-Demand, or YOLO? compares the ways a startup can staff security.

Two cards. The first security hire comes fairly early: a staff or senior staff engineer who works independently, in the code and the infrastructure, hardening things and building things out. Filled, the head of security comes much later and builds the team, once the company needs a dedicated security presence and a leader for it. Below: when to make the first hire is a risk decision. What data do you have? How many customers do you have? Filled: what's at risk? Quote: "Those two are very different."
Two hires that people mix up, as Yash separated them. Source: the episode.

When a big buyer asks

Jon asked about tripwires: signals from the sales team or the market that say it’s time for a CISO. Sales gives you those signals, Yash said.

“Some of the bigger clients would definitely ask for one either a call with your security leader or a dedicated point of contact that they can reach out to for emergencies.”

Yash Kosaraju, at 5:39

“And just sort of showing that you have a mature security posture does require somebody with that title.”

Yash Kosaraju, at 5:52

That still isn’t the moment to hire a head of security, because that person builds the team. Yash ties the decision back to what’s at risk and what’s at stake: the data, how much of it you hold, and the access you have into your customers’ environments.

“Ideally, you have a team and maybe a head of security by the time you get to these multi-million, really large-scale deals”

Yash Kosaraju, at 6:20

Those are the deals where buyers start asking for a CISO. From there, the head of security can grow into the CISO role, or a field CISO can answer some of the buyer’s questions.

Where fractional CISOs fit

Jon asked whether a fractional CISO, someone brought in part time, is a common place to start.

“That’s a great resource. You could get either an advisor that you trust or a fractional CISO who can come in and jumpstart your program as well.”

Yash Kosaraju, at 6:52

Wikipedia describes a CISO as the senior executive who sets and maintains the vision, strategy and program that keep an organization’s information assets and technologies protected (Wikipedia). Our post What Is a vCISO? covers the fractional version.

Saturated with vendors

Jon asked about the most exciting security company in the portfolio. Yash didn’t pick one. The companies sit at different levels of maturity, and some take on new problems while others bring a new angle to old ones.

“And it’s always refreshing to see newer, better user-friendly solutions to age-old existing problems.”

Yash Kosaraju, at 7:36

Jon brought up AI, at the top of everyone’s mind, and Black Hat, and all the competition where security meets AI. Yash saw the other side of it.

“There are definitely great companies, but on the flip side, what I’m seeing is the security space is saturated with vendors.”

Yash Kosaraju, at 8:29

“Today, each feature of a bigger suite of features is one company.”

Yash Kosaraju, at 8:47

Yash wants consolidation down to a few vendors that each do more than one thing. Jon asked how long that would take. Before AI, Yash said, there was a number to give.

“But now with AI, everything’s accelerated. So it’s all up in the air.”

Yash Kosaraju, at 9:11

On July 28, 2026, Yash asked security vendors on LinkedIn whether “coffee at Black Hat?” outreach had paid off for all its volume, or whether everyone sends it because everyone else does (LinkedIn).

Yash asks security vendors whether "coffee at Black Hat?" outreach pays off.

Yash Kosaraju · July 28, 2026
Yash's question for security vendors. View on LinkedIn.
Today: a row of five compartments, each a feature sold by its own vendor. What Yash wants: one filled box, a few vendors each doing more than one thing. Quote: "Today, each feature of a bigger suite of features is one company."
One feature, one company, and the consolidation Yash wants. Source: the episode.

Code security that goes away

Jon asked which problems the security community will solve first with AI.

“We are taking a stab at multiple problems.”

Yash Kosaraju, at 9:35

The one Yash most wants to see go away completely is code security. Today that means a secure development pipeline with a row of scanning tools in it. With AI writing most of the code, Yash wants the coding agents to make some of those tools unnecessary.

“I’m looking forward to the day where all these coding agents write secure code by default.”

Yash Kosaraju, at 9:58

Assume breach

Jon had been at a small CISO dinner in San Francisco a few weeks earlier, and the mood in the room was bleak. Foundation models can read a code base and the third-party libraries everyone depends on, and start dropping in exploits and zero days. The table’s conclusion was to assume breach.

“Anything exposed to the internet basically is going to break.”

Jon McLachlan, at 11:11

Jon was glad Yash looked at the other side: how defenders use the same tools to fix things.

Catching up, faster

Yash agreed with the people at the dinner.

“They’re not wrong, by the way, right?”

Yash Kosaraju, at 11:39

Two things are true at once. AI is good at running through known vulnerabilities and exploits fast enough to overwhelm a defense. And it lowers what each exploit or breach costs an attacker.

“So the economic balance is going out of whack.”

Yash Kosaraju, at 12:07

“However, my hope is that we have this next 12, 18 months of pain where, again, we are playing catch up, but much more rapidly.”

Yash Kosaraju, at 12:10

After that stretch, some classes of vulnerability, and some classes of tools, stop being needed, and building defense in depth becomes second nature.

“And everybody gets there together, screaming and kicking.”

Yash Kosaraju, at 12:38

Wikipedia describes defense in depth as layers of security controls placed throughout a system, to give redundancy when a control fails or a vulnerability is exploited (Wikipedia). The CVEs in Yash’s answer are entries in the Common Vulnerabilities and Exposures system, a reference list of publicly known vulnerabilities (Wikipedia).

Listen · Yash Kosaraju on episode 104, from 12:12
About 30 seconds: Yash on the months of catching up. The clip stops on its own. Read the full transcript.
Three cards. Now: attackers use AI to run through known vulnerabilities and exploits fast, and each exploit costs them less. The next 12 to 18 months: pain, as defenders play catch-up, much faster than before. Filled, after: some classes of vulnerability and tools stop being needed, and defense in depth becomes second nature. Quote: "So the economic balance is going out of whack."
The months of catching up, as Yash described them. Sources: the episode and Wikipedia.

Silicon Valley is a bubble

Jon wasn’t sure how much running software foundation models have written so far. Yash agreed there’s a long road ahead for everyone, and named a worry.

“The thing that worries me, though, is we talk about all of these, but we are here in the Silicon Valley and that is a bubble.”

Yash Kosaraju, at 13:34

“The rate of adoption of AI is very different here than the rest of the US, than the rest of the world.”

Yash Kosaraju, at 13:42

Attackers who ramp up with AI don’t have to aim at the Valley, which will catch up on defense fast. Yash worries about everyone else: companies that haven’t taken up AI, or can’t afford the tokens to build their defenses.

Jon wondered whether new companies would help those late adopters. Yash answered with cost.

“The cost of not adopting AI today is much more than the cost of not adopting any other previous technologies.”

Yash Kosaraju, at 14:34

Listen · Yash Kosaraju on episode 104, from 13:34
About 40 seconds: Yash on the Silicon Valley bubble. The clip stops on its own. Read the full transcript.
Two cards. Silicon Valley adopts AI fast, and its defenses will catch up relatively quickly, so attackers don't have to aim there. Filled: everywhere else adopts AI more slowly, and some companies can't afford the tokens for their defenses, which is Yash's worry. Quote: "The cost of not adopting AI today is much more than the cost of not adopting any other previous technologies."
Where AI adoption runs fast, and where Yash's worry sits. Source: the episode.

A layer on top of the cake

Jon described a new layer on the security cake, with AI on top of everything else. A coding agent searches the web, reads about some API, and runs commands on the developer’s machine or in the cloud. It takes instructions from the internet into a prompt that has the developer’s access. Browsers settled this long ago.

“Anything that comes in from the internet, let’s just treat it as untrusted.”

Jon McLachlan, at 15:57

Agents, in Jon’s description, give what comes in mixed levels of trust, and the industry is debating where a human fits in the loop. Jon asked how a CISO at a firm that adopts AI fast handles it.

Wikipedia calls it indirect prompt injection when the attacking prompt sits in outside data, such as a website, an email or a document (Wikipedia).

The third click

Yash started with the state of the field.

“Prompt injection is an unsolved problem.”

Yash Kosaraju, at 16:34

The one defense people count on is the prompt an AI tool shows before it acts, asking you to accept a request or an action. It’s the prompt in the line at the top of this page.

“And that’s the sort of defense we think it’s there, but not really.”

Yash Kosaraju, at 16:59

OWASP’s entry on prompt injection lists both halves of the problem. One mitigation is to “Restrict the model’s access privileges to the minimum necessary for its intended operations.” Another is human approval for high-risk actions (OWASP). Yash’s point is that the approval half wears out.

Listen · Yash Kosaraju on episode 104, from 16:34
About 30 seconds: Yash on prompt injection and the third click. The clip stops on its own. Read the full transcript.
Six approval prompts in a row, each with an Accept button. Clicks 1 to 3 are drawn solid and marked read. Clicks 4 to 6 are dashed and marked clicked through. Below: before the third click, people read what the prompt asks. After it, people stop reading and click through. Quote: "And that's the sort of defense we think it's there, but not really."
The approval prompt, click by click. Source: the episode.

What the tool can reach

So the a16z team works on access.

“we are adopting AI at a massive pace, but also very deliberately”

Yash Kosaraju, at 17:11

The team looks at the systems each tool can read from and write to, and what it can do. Every company runs vendor due diligence, with its pen test reports and SOC 2 questionnaires. With an AI tool, Yash said, that isn’t the hard part.

“The bigger issue here is: what data do you have access to? How do you access it? And is it a two-way read-write or just a read?”

Yash Kosaraju, at 17:35

“Because, as you know, AI is only as good as the data it has access to.”

Yash Kosaraju, at 17:48

Jon agreed, and summed up the approach: scope what each agent is allowed to touch inside the organization. The principle of least privilege says each part of a system should reach only the information and resources its legitimate purpose needs (Wikipedia). Our post Are You Actually Going to Give the Agent Write Access? takes the write half of Yash’s question further.

Listen · Yash Kosaraju on episode 104, from 17:26
About 25 seconds: Yash on what an AI vendor review should ask. The clip stops on its own. Read the full transcript.
Two cards. The usual vendor review: do you have a pen test, do you have a SOC 2, the questionnaires everybody sends. Filled, the bigger questions for an AI tool: what data do you have access to, how do you access it, and is it two-way read-write or just a read? Quote: "Because, as you know, AI is only as good as the data it has access to."
The usual vendor review, and the questions Yash puts first. Source: the episode.

A scoped yes

Yash described a rule the cyber team keeps.

“One thing we are very deliberate about at a16z, especially within the cyber team, is not to say no when people request for something.”

Yash Kosaraju, at 18:28

“One, they’ll never come back to you. Two, they’ll find a way to use it anyway.”

Yash Kosaraju, at 18:38

So the team works with the person, learns what they’re trying to do, and defines access to the right data for that use.

“If it’s a POC, that can have a subset of test data.”

Yash Kosaraju, at 18:51

For anything else, the team works out what data the use needs, and keeps the firm safe. A 2025 profile by K logix had a shorter version: “Security should never be the hammer.” (K logix). Wikipedia calls systems that teams set up outside central IT, to get around its limits, shadow IT, and notes the security and compliance risks they bring (Wikipedia).

Listen · Yash Kosaraju on episode 104, from 18:28
About 40 seconds: Yash on not saying no. The clip stops on its own. Read the full transcript.
Two rows of boxes joined by arrows. A no: a request for a new AI tool, then, dashed, no, and they never come back, then, dashed, they use it anyway, they find a way. A scoped yes: a request for a new AI tool, then learn the use case, the goal behind it, then, filled, scope the data, where a proof of concept gets test data. Quote: "One, they'll never come back to you. Two, they'll find a way to use it anyway."
What a no leads to, and what a scoped yes looks like. Source: the episode.

In December 2025, as CISO of Sendbird, Yash talked about the same choice on the Cloud Security Podcast, in a chapter called “Security for Platform Engineers: Enabling vs. Blocking” (YouTube).

Yash on the Cloud Security Podcast, 55 minutes, posted December 9, 2025. The video starts at 29:20, the chapter on enabling and blocking. Watch on YouTube.

Two kinds of security people

Jon described two kinds of security people. One walks into a meeting and the room sinks, expecting a no to everything, pushed timelines, and strange requirements for certifications. The other walks into the same room, with the same people, maybe with the same effect on security, and the room is glad.

“Oh, I’m so happy that Yash is here.”

Jon McLachlan, at 19:45

“Culture means so much in the security space, especially if you want to be taken seriously.”

Jon McLachlan, at 20:06

Building people

Jon asked about Yash’s proudest moment.

“that is a deep question, and probably not something I was prepared to answer.”

Yash Kosaraju, at 21:46

The answer has changed over time, Yash said, with one theme running through it.

“I’m more proud of instances where somebody in my team achieves something versus I achieve something.”

Yash Kosaraju, at 21:57

That’s why Yash still likes building teams, building people and growing their careers.

“So when I see somebody who either used to work for me, who’s now a CISO”

Yash Kosaraju, at 22:08

Or someone in a director-level position, Yash went on.

“and they’re doing great things, that makes me proud.”

Yash Kosaraju, at 22:13

In the 2025 K logix profile, Yash’s hiring rule was “I like to hire smart people who want to do the right thing” (K logix).

Listen · Yash Kosaraju on episode 104, from 21:52
About 25 seconds: Yash on the proudest moment. The clip stops on its own. Read the full transcript.

Not to give back

Jon called that one of the most rewarding parts of giving back to the security community. Yash corrected the framing.

“I’ll be honest. I’m not doing it to give back.”

Yash Kosaraju, at 22:33

“I do it for a very purely personal reason. I am selfish in that sense.”

Yash Kosaraju, at 22:39

Yash had thought it through, asking whether the work was for somebody else, a way of giving back.

“And at some point, I realized, no, this is what helps me get meaning from my life, right? And that is helping others.”

Yash Kosaraju, at 23:14

So the work looks like giving back, and in Yash’s account it starts from a selfish reason. Jon’s answer was that it’s important to know who we are and what we want.

A stint under two months

Jon asked about one of the more challenging moments in Yash’s career. Yash picked a short stint after Box. Some things about the role hadn’t come up in depth during the interviews.

“So when I joined, I quickly realized that is not what I expected.”

Yash Kosaraju, at 24:37

It took a tough and honest conversation with the team there, and Yash left after less than two months. The hard part was the whole process: leaving a team Yash trusted at Box, joining, getting out, and working out what came next. Jon gave credit for not letting it drag on.

Closer to the code

Jon asked about the hardest problem the security community will face in the next five to ten years. Yash shortened the window.

“Five to ten years in the age of AI is probably a question that’s around 20 to 30 years on a normal day.”

Yash Kosaraju, at 25:39

So the question became the next year or so. AI’s skill at exploiting known vulnerabilities is getting security more attention, and that will change how engineering, security and the rest of a company work together.

“So the security teams will have to evolve from what they have been to much more proactive, much more in the weeds.”

Yash Kosaraju, at 26:09

A list of packages to upgrade won’t be enough anymore.

“We’d have to evolve to a much more close to code state where you find them, you figure out if it’s vulnerable, exploitable, reachable, all of those things.”

Yash Kosaraju, at 26:34

Then comes a pull request, a check that it breaks nothing, an agent doing the work, and an engineering agent that reviews and patches. Yash called it a step past DevSecOps. Testing moves too, from the code into the build and test stage, because agents will handle most of the patches.

“a lot of those business logic flaws, which AI isn’t as good as it is with your code”

Yash Kosaraju, at 27:29

That’s where the bigger focus will go, in Yash’s view.

Wikipedia describes DevOps as the integration and automation of software development and IT operations (Wikipedia).

Listen · Yash Kosaraju on episode 104, from 26:33
About 20 seconds: Yash on where security teams go next. The clip stops on its own. Read the full transcript.
Four boxes joined by arrows: find the vulnerability, check whether it's exploitable and reachable, open a pull request that breaks nothing, and, filled, an agent review that patches it. Below: today, a list of packages to upgrade. Next, security works close to the code, an agent does the work, and an engineering agent reviews and patches. Filled: testing moves into build and test, and business logic flaws get the bigger focus, since AI is weaker with them.
From a list of packages to a patch, as Yash described it. Source: the episode.

What an AI task costs

Jon turned to cost. A company weighing AI has to make the business case: the return, the expectations, and the token bills. Context decides how well AI works, Jon said, and it drives the cost too.

“My hope, like others, is that the token cost would come down.”

Yash Kosaraju, at 28:36

What Yash sees is that nobody estimates the work well.

“But on the flip side, what I’m seeing is we’re not good at estimating what each task we’re giving an AI agent would take.”

Yash Kosaraju, at 28:40

“one, they want the latest and greatest model. Two, they want the fast mode and not the slow mode.”

Yash Kosaraju, at 28:53

Yash’s example: the same task can finish in 10 minutes for $250, or take 15 minutes and cost $50. The fix, in Yash’s view, is to get better at estimating what a task takes and what it costs, so a person can decide whether it’s worth the money.

Jon wanted a little dollar sign that shows what a prompt will cost before you click, given your model, your context and everything in the chat.

“You’re buying something. You’re buying some compute.”

Jon McLachlan, at 29:56

Yash didn’t expect the makers of the frontier models to build it, since they have no incentive to. Our post Too Fancy: When Your Agent Costs You $50,000 an Hour to Operate runs the same math at a bigger scale.

Listen · Yash Kosaraju on episode 104, from 28:49
About 20 seconds: Yash on what an AI task costs. The clip stops on its own. Read the full transcript.
Two bars. Fast mode, 10 minutes: $250, filled. Slower mode, 15 minutes: $50. Below: $200 more for 5 minutes saved, which is $2,400 for each hour of waiting saved. Quote: "we're not good at estimating what each task we're giving an AI agent would take."
The same task, two ways, from Yash's example. Source: the episode.

A toggle for a cheaper model

Tools with AI built in get expensive too, Yash said, and the fix may come from the tools themselves.

“Maybe the one that came out two months ago is only 95% as accurate, but 50% cheaper.”

Yash Kosaraju, at 31:06

Yash expects tools to give that toggle to the person using them, across frontier models or open weight models the vendor hosts, and costs to come down that way.

Two cards. The newest model: latest and greatest, the baseline for accuracy and price. Filled, the one from two months ago: only 95% as accurate, and 50% cheaper. Below, a toggle switch: the person using the tool picks, task by task.
The toggle Yash expects tools to offer. Source: the episode.

Measuring the return

Jon’s view is that problems get solved first by the people who feel the pain. If that’s finance, there’s friction with engineering. Jon asked how Yash keeps the organization under control.

“the whole company is very AI-forward in that sense.”

Yash Kosaraju, at 32:26

“And we have started talking about how do we start measuring ROI? How do we start educating people on what the right model, the right speed is for certain tasks?”

Yash Kosaraju, at 32:30

The goal is a middle ground, where an engineer knows what a task costs and decides whether it’s worth it.

Not token maxing

Jon said the companies that adopt AI most aggressively tend to ask the opposite: why aren’t you using AI more, and could you please spend more.

“But a16z was never that way. We gave people all the tools to experiment, but the mandate was not token maxing or go spend money.”

Yash Kosaraju, at 33:34

“The mandate was: Here’s a bunch of next-generation tools. Try them out, use them, see where they can add value.”

Yash Kosaraju, at 33:43

Yash called it pretty much the same thing, said in different ways.

“And just that change of words gives you a different perspective.”

Yash Kosaraju, at 33:56

On June 11, 2026, Yash posted a role for a staff security automation engineer, to build automation that makes the security team 10x with AI, and added that the job comes with “no token leaderboards” (LinkedIn).

Yash is hiring a staff security automation engineer. No token leaderboards.

Yash Kosaraju · June 11, 2026
Yash's post for a security automation role. View on LinkedIn.
Listen · Yash Kosaraju on episode 104, from 33:34
About 25 seconds: Yash on the mandate at a16z. The clip stops on its own. Read the full transcript.

No advice for a younger self

Jon asked whether Yash would meet a younger self, and what the advice would be.

“I guess today what I would say is maybe I wouldn’t meet my younger self.”

Yash Kosaraju, at 34:43

“And even if I did, I wouldn’t give any advice because every mistake I’ve made, every decision I’ve taken is what has led me here today.”

Yash Kosaraju, at 34:47

“And changing any of those, even for the better, you don’t know what implications that has.”

Yash Kosaraju, at 34:58

A good time to build

Jon asked for final words for the listeners, many of them founders.

“I am not an entrepreneur, so take this with a grain of salt, but it is a great time to be building.”

Yash Kosaraju, at 35:50

Yash’s advice was to keep at it and work hard, which carries you through the tough times. Then, after the thank-yous, one more thing.

“Oh, I’m also hiring by the way, so please do look at the jobs and apply.”

Yash Kosaraju, at 36:28

Jon pointed listeners to Yash’s team at a16z.

What happened after the tape

Our companion post came out the next day. The Human in the Loop Is Going Away covers the record on approval prompts, the ways attackers get around them, and what to limit instead, with a scorecard for what your agents can reach.

A new role on the security team. On September 29, 2026, Yash posted an Enterprise Security Engineer role on the a16z security team, owning data protection, SaaS security and data loss prevention, and “making the firm’s fast AI adoption safe” (LinkedIn).

Yash is hiring an Enterprise Security Engineer for the a16z security team.

Yash Kosaraju · September 29, 2026
Yash's post for the Enterprise Security Engineer role. View on LinkedIn.

Four open roles in November. On November 6, 2026, Yash wrote that most companies slow down hiring in November and December, and a16z doesn’t. The post listed four open roles across the security org: a lead engineer for incident response, a staff security engineer for AI and the security platform, a staff engineer for enterprise security, and a staff security technical program manager (LinkedIn).

Yash lists four open roles across the a16z security org.

Yash Kosaraju · November 6, 2026
Yash's post on four open security roles at a16z. View on LinkedIn.

The same themes on this show. On episode 106, Jesse Anglen of Ruh.ai described the one line of fine print that turns a coding agent against its own keys. On episode 105, Yair Grindlinger of Surf AI made the case for shrinking what a breach can reach. On episode 102, Chris Kirschke of Kyberis AI talked about trusting what feeds your agents, and the one time write access took production down. On episode 101, Johnny Hung and Munam Wasi of Mighty talked about prompt injection becoming a TikTok skill. On episode 100, Xia Hua of Traceforce showed a prompt injection in Playwright’s MCP server.

A timeline. September 22, 2026: episode 104, Yash on the show. September 23, 2026: our companion post on approval prompts, and what to limit instead. September 29, 2026, filled: a new role, an Enterprise Security Engineer for the a16z security team. October 20, 2026: episode 106, the prompt injection hiding in the fine print. November 6, 2026, filled: four open roles, which Yash lists across the a16z security org.
After the tape, from our companion post to Yash's November post. Sources: this site and LinkedIn.

Did you catch it? A seven-question quiz

Seven questions from the episode. Each answer links the moment in the transcript.

Quiz · seven questions

Did you catch it?

Pick an answer to see whether you caught it.

  1. Who should a startup's first security hire be, in Yash's view?

    b. "it's mostly a staff level, senior staff level engineer that can be independent" Transcript, 4:14.

  2. What did Yash say about the security vendor market?

    a. "the security space is saturated with vendors." Transcript, 8:34.

  3. Which part of security does Yash most want to see go away?

    c. Code security, once coding agents write secure code by default. See Code security that goes away.

  4. What happens after the third click on an approval prompt, as Yash put it?

    b. "after the third click, you don't really read what's in there and you just start clicking through." Transcript, 16:54.

  5. What does Yash call the bigger issue in a review of an AI tool?

    a. What data it has access to, how it gets it, and whether it's read-write or read only. See What the tool can reach.

  6. What data does a proof of concept get at a16z?

    c. "If it's a POC, that can have a subset of test data." Transcript, 18:51.

  7. In Yash's example, what can the same AI task cost?

    b. $250 in 10 minutes, or $50 in 15. See What an AI task costs.

Before the third click

Eight questions on what your AI tools can reach before anyone clicks approve. The scorecard follows the episode: access, the scoped yes, and cost.

Scorecard · eight questions

Before the third click

Pick the answer that fits today.

  1. Do you know which data each AI tool in your company can read?

    • No, there's no list
    • For some tools
    • Yes, written down for every tool

    "The bigger issue here is: what data do you have access to?" See What the tool can reach.

  2. Which AI tools can write back to your systems?

    • We don't know
    • We know, and write access is the default
    • Write access is granted per use case and reviewed

    Yash asks whether a tool's access is read-write or read only. See What the tool can reach.

  3. What does your vendor review ask of an AI tool?

    • The usual questionnaire and pen test report
    • A few questions on data access
    • What data it reaches, how, and whether it writes

    The pen test and the questionnaire still run. They aren't the hard part with an AI tool. See What the tool can reach.

  4. When someone asks for a new AI tool, what happens?

    • The answer is usually no
    • It waits in a queue
    • We work out the use case and scope the data to it

    "One, they'll never come back to you. Two, they'll find a way to use it anyway." See A scoped yes.

  5. What data does a proof of concept get?

    • Production data
    • Whatever the team asks for
    • A subset of test data

    "If it's a POC, that can have a subset of test data." See A scoped yes.

  6. How do you treat the approval prompts AI tools show?

    • As our main control
    • As one control among others
    • As a backstop behind access limits we set first

    After the third click, people stop reading the prompt. See The third click.

  7. Do people know what an AI task will cost before they run it?

    • No
    • Roughly
    • Yes, and they pick the model and speed to fit

    The same task can cost $250 in 10 minutes or $50 in 15. See What an AI task costs.

  8. Who owns the list of AI tools and their access?

    • Nobody
    • IT, informally
    • A named owner, with a review on a schedule

    The a16z team adopts AI fast and decides what each tool can reach. See What the tool can reach.

Clicking through

Start a list of every AI tool, the data it reads, and whether it can write back.

Some scope set

Make write access the exception, and give each proof of concept test data.

Scoped before the click

Review the list on a schedule, and add what each task costs to the review.

What does the fast mode cost?

The calculator runs Yash’s example from What an AI task costs: the same task can finish faster for more money, or a little slower for less.

Calculator

What does the fast mode cost?

Five numbers: tasks a week, and the cost and minutes of one task in the fast mode and in a slower mode.

$208,000more a year for the fast mode
87hours of waiting saved a year
$2,400for each hour of waiting saved

At 20 tasks a week, the fast mode costs $4,000 more a week, or $208,000 a year, and saves about 87 hours of waiting a year. That's $2,400 for each hour it saves.

The defaults are Yash's example from the episode, with 20 tasks a week as a placeholder, so put in your own numbers. The calculator counts 52 weeks a year and compares the two modes on price and time only.

From iSEC Partners to a16z

Yash’s path, a16z, the field around it, and this show. Filter by topic.

Timeline

From iSEC Partners to a16z

  1. The first Black Hat

    The conference opens in Las Vegas, right before DEF CON 5 (Wikipedia, on this page).

  2. Andreessen Horowitz

    Marc Andreessen and Ben Horowitz found the venture capital firm (Wikipedia).

  3. iSEC Partners

    Security engineer, until March 2015 (LinkedIn).

  4. Box

    Security engineer, then senior security engineer, until March 2018 (LinkedIn).

  5. Twilio

    Staff security engineer, then manager of product security from March 2019 (LinkedIn).

  6. A safe harbor for researchers

    Twilio adds a safe harbor clause to its bug bounty terms, and Yash shares it on X (Twilio, X).

  7. The bug bounty, to date

    Yash writes Twilio's update on its bug bounty program (Twilio).

  8. Director at Twilio

    Director of product and infrastructure security, until December 2021 (LinkedIn).

  9. Security Metrics that Count

    Harini Rangarajan and Yash on automated security metrics at Twilio (Twilio).

  10. Sendbird

    Chief Information Security Officer, the company's first (LinkedIn, K logix).

  11. A K logix profile

    Yash on working with the business, and why security should never be the hammer (K logix, on this page).

  12. Cloud Security Podcast

    Yash on securing AI agents at Sendbird (YouTube, on this page).

  13. CISO of a16z

    Yash joins Andreessen Horowitz as Chief Information Security Officer (LinkedIn, on this page).

  14. No token leaderboards

    Yash posts a role for a staff security automation engineer (LinkedIn, on this page).

  15. Coffee at Black Hat?

    Yash asks security vendors whether the outreach pays off (LinkedIn, on this page).

  16. Episode 100

    Xia Hua of Traceforce shows a prompt injection in Playwright's MCP server (episode 100).

  17. Episode 102

    Chris Kirschke of Kyberis AI on the one time write access took production down (episode 102).

  18. This episode

    Yash on the show, and our companion post the next day (Podbean, companion post).

  19. Enterprise Security Engineer

    A new role to make the firm's fast AI adoption safe (LinkedIn, on this page).

  20. Episode 106

    Jesse Anglen of Ruh.ai on the prompt injection hiding in the fine print (episode 106).

  21. Four open roles

    Yash lists four open roles across the a16z security org (LinkedIn, on this page).

What to do this week

Five things, in the order of the episode.

  1. List what each AI tool can reach. For every AI tool in use, write down the data it reads, how it gets there, and whether it can write back, as in What the tool can reach. Our companion post has more on limiting what agents can reach.
  2. Turn the next no into a scoped yes. Start the next AI tool request as a proof of concept on a subset of test data, as in A scoped yes.
  3. Put a price on one task. Run one task in the fast mode and in a slower mode, and compare the time and the bill, as in What an AI task costs.
  4. Score your setup. Run the scorecard and the calculator.
  5. Get help with it. Our AI access control audits apply least privilege to the AI tools in your company, AI product red teaming attacks your AI product the way real adversaries will, and sales support helps when a big buyer asks for your security leader. If you want to talk it through, book 15 minutes with us.

Key takeaways

  1. The first security hire is an engineer.

    Yash Kosaraju's rule is that a startup's first security hire is a staff or senior staff engineer who can work independently in the code and the infrastructure. The timing is a risk decision about the data you hold, how many customers you have and what's at risk. The head of security who builds a team comes much later.

  2. A big buyer's request is a sales signal.

    When a big client asks for a call with your security leader, or a named contact for emergencies, showing a mature security posture takes somebody with that title. Yash still ties the hire to what's at stake: the data, how much of it you hold, and the access you have into customers' environments. A trusted advisor or a fractional CISO can jumpstart the program.

  3. People stop reading after the third click.

    Prompt injection is unsolved, and the defense people count on is the prompt an AI tool shows before it acts. After the third click, Yash says, people stop reading what's in it and click through.

  4. Ask what the tool can reach.

    The pen test and the security questionnaire still run. For an AI tool, the bigger questions are what data it can access, how it accesses it, and whether the connection is read-write or read only, because AI is only as good as the data it has access to.

  5. A scoped yes beats a no.

    A no leads to two things: people never come back, and they find a way to use the tool anyway. The a16z security team works out the use case and defines access to the right data for it, so a proof of concept gets a subset of test data.

  6. Catch-up comes first, then fewer tools.

    AI is good enough with known vulnerabilities and exploits to overwhelm defenses, and it lowers what each exploit costs an attacker. Yash hopes for 12 to 18 painful months of fast catch-up, after which some classes of vulnerability and some classes of tools stop being needed. The one Yash most wants gone is code security, with coding agents that write secure code by default.

  7. Silicon Valley is a bubble.

    AI adoption in the Valley runs faster than in the rest of the US and the world, and attackers don't need to aim at the Valley. Yash worries about the companies that haven't adopted AI or can't afford the tokens to build defenses, since the cost of not adopting AI is higher than for any earlier technology.

  8. Nobody estimates what an AI task costs.

    In Yash's example, the same task can finish in 10 minutes for $250 or in 15 minutes for $50, and people reach for the latest model and the fast mode. At a16z the mandate was to try the tools and find where they add value, never token maxing.

Chapters

Tap a chapter to play from there. The play icon beside it opens that moment on YouTube.

Pull quotes

“So when you look at the first security hire, it's mostly a staff level, senior staff level engineer that can be independent, but isn't your true head of security person who's building the team.”

Yash Kosaraju ·

“That's a great resource. You could get either an advisor that you trust or a fractional CISO who can come in and jumpstart your program as well.”

Yash Kosaraju ·

“There are definitely great companies, but on the flip side, what I'm seeing is the security space is saturated with vendors.”

Yash Kosaraju ·

“I'm looking forward to the day where all these coding agents write secure code by default.”

Yash Kosaraju ·

“However, my hope is that we have this next 12, 18 months of pain where, again, we are playing catch up, but much more rapidly.”

Yash Kosaraju ·

“The thing that worries me, though, is we talk about all of these, but we are here in the Silicon Valley and that is a bubble.”

Yash Kosaraju ·

“after the third click, you don't really read what's in there and you just start clicking through.”

Yash Kosaraju ·

“The bigger issue here is: what data do you have access to? How do you access it? And is it a two-way read-write or just a read?”

Yash Kosaraju ·

“One, they'll never come back to you. Two, they'll find a way to use it anyway.”

Yash Kosaraju ·

“one, they want the latest and greatest model. Two, they want the fast mode and not the slow mode.”

Yash Kosaraju ·

“But a16z was never that way. We gave people all the tools to experiment, but the mandate was not token maxing or go spend money.”

Yash Kosaraju ·

About the guest

Yashvier Kosaraju, Chief Information Security Officer, a16z

Yashvier Kosaraju, who goes by Yash, has been the Chief Information Security Officer of a16z (Andreessen Horowitz) since April 2026. Before a16z, Yash spent more than four years as the first CISO of Sendbird, led product and infrastructure security at Twilio, and worked in application security and penetration testing at Box, after starting in security consulting at iSEC Partners. Yash's team at a16z is hiring.

a16z ↗ LinkedIn ↗ Open roles at a16z ↗How to secure your AI Agents, on the Cloud Security Podcast ↗

About the host

Jon McLachlan is co-founder of YSecurity, the on-demand cybersecurity team for startups, and of Cyberbase.ai. The Security Podcast of Silicon Valley is hosted by Jon McLachlan and Sasha Sinkevich. Jon McLachlan on LinkedIn ↗

Context and sources

  • Yash Kosaraju's LinkedIn headline reads CISO@a16z, and the experience section lists Andreessen Horowitz since April 2026, Sendbird from December 2021 to April 2026, Twilio, Box and iSEC Partners. Jon introduces Yash as the CISO of a16z at the start of the episode. Source ↗
  • Yash's LinkedIn post of April 2026 marks the end of four and a half years at Sendbird. Source ↗
  • A K logix profile from March 31, 2025 calls Yash Sendbird's first CISO, after Twilio, where Yash moved from manager to interim director of product and infrastructure security, and more than three years at Box. Source ↗
  • Yash wrote Twilio's April 27, 2020 update on its bug bounty program. Source ↗
  • Yash's X account, @yashvi3r, shared Twilio's bug bounty safe harbor announcement in October 2018. Source ↗
  • In December 2025, as CISO of Sendbird, Yash talked about securing AI agents on the Cloud Security Podcast. Source ↗
  • Yash mentions at 36:28 that the team is hiring. On November 6, 2026, Yash listed four open security roles at a16z on LinkedIn. Source ↗
  • Prompt injection is entry LLM01 in OWASP's list for generative AI security, which names least privilege and human approval for high-risk actions among its mitigations. Source ↗
  • The CVEs mentioned at 11:39 are entries in the Common Vulnerabilities and Exposures system, a reference list of publicly known vulnerabilities. Source ↗
  • Black Hat, which Jon brings up at 7:47, is a computer security conference first held in Las Vegas in July 1997. Source ↗
  • The video of episode 104 on our YouTube channel, posted September 22, 2026. Source ↗

Transcript

Automatic transcription. Jon McLachlan hosts this episode with Yash Kosaraju, Chief Information Security Officer of a16z. There is no diarization on the tape, so speaker labels were assigned from the content and checked against reference recordings of each voice from this episode, and a few short lines may sit with the wrong speaker. The sponsor reads at the start and end are summarized in brackets. Names and terms were normalized where the recognizer misheard them (Jon McLachlan, Yash Kosaraju, a16z, YSecurity). Words in [brackets] are best guesses where the audio is unclear, and [...] marks words no decode made out. Speech is transcribed as spoken, though many repeated words and false starts are left out, and so are short backchannels such as "yeah" where they overlap the other speaker.

Read the full transcript 5,542 words

[Sponsor read: YSecurity, the sponsor of the show. For the moment a customer's legal team asks what happens if you get hacked: forty-plus security engineers who've done security at Apple, Uber, Microsoft, Robinhood and Brex, rented by the hour with a monthly cap, for SOC 2, ISO and HIPAA. Book a free strategy call, and the first eight hours are free at ysecurity.io/startups.]

Jon McLachlan

Hello, everyone, and welcome to another episode of the Security Podcast of Silicon Valley. I'm your host, Jon McLachlan, and today we have an amazing guest joining us: Yash Kosaraju, the CISO of a16z. What a treat to have you on the show.

Yash Kosaraju

Thanks, [Jon]. Thanks for having me.

Jon McLachlan

So, at a16z, you're responsible for actually locking down and securing all of the corporate environments and all of the sensitive information and all of those juicy pitch decks and responsible for those corporate security controls and I'm sure all of the cloud security controls. And I bet that keeps you super busy, huh?

Yash Kosaraju

Yes.

Jon McLachlan

And I know a lot of our listeners here are very familiar with a16z, I'm sure. A lot of our listeners are founders themselves interested in the investment community, the security community in general. How long have you been with a16z?

Yash Kosaraju

Technically, it's been four months, but it feels like about a year.

Jon McLachlan

Startup years, right? Like something like that. Yeah. What's the energy like over there in a16z right now?

Yash Kosaraju

It's very high electric energy. Everyone's excited. I get to build on security with all the new technology that's coming up. So it's a great time to be here.

Jon McLachlan

Do you get a lot of inbound asks of, hey, are you a test bed for any of the a16z investments or the portfolio companies in the security space?

Yash Kosaraju

I wouldn't call it test [beds], but we are close partners for our portfolio company. So we do work very closely with them and we could be customers. But either way, be it as a customer or as an advisor, or just helping them make the right hires, think of the problem space in the right way, like we are there to help.

Jon McLachlan

What's one of the more common questions that maybe a founder might have for you?

Yash Kosaraju

It ranges. I've been, again, in the short time I've been here, I've had a wide variety of conversations with founders. If they're in the security space, it's helping view the product from an enterprise security team or security [CISO] lens and talk through that. Other portfolio companies could be from hiring their first CISO, hiring the first security hire, helping them prepare for a big customer security audit, your traditional compliance audits, anything. It's a long list.

Jon McLachlan

So there's a lot of B2B business deals being made, it sounds like.

Yash Kosaraju

That's the hope.

Jon McLachlan

And so, what's that signal? What does that look like for, you know, it's time to go hire your CISO? It's time to bring in that first security hire.

Yash Kosaraju

Those two are very different. So let's cut [those] down, right? So when you look at the first security hire, it's mostly a staff level, senior staff level engineer that can be independent, but isn't your true head of security person who's building the team. This person's more in the weeds, in the code, in your infrastructure, hardening things, building things out. That comes fairly early. Let's say it's a risk decision between what data do you have, how many customers do you have, and what's at risk. And that drives how early on you need to hire your first security engineer. And where this engineer sits is also something you need to decide. It could be within the infrastructure team, any other engineering team, right? So, again, put them in a place where they have enough context and access to just execute. Moving on to your first head of security, that comes much later, right? Like as your team grows where you decide you need a dedicated presence of security within the organization and you need a leader in that space. And that's when you start thinking about head of security roles.

Jon McLachlan

Are there certain signals that maybe come in from your sales team or that you can listen for in the market that will, that are sort of those tripwires of like, oh, this is the time. Where's that CISO?

Yash Kosaraju

That's a great question. So you will have your sales signals. Some of the bigger clients would definitely ask for one either a call with your security leader or a dedicated point of contact that they can reach out to for emergencies. And just sort of showing that you have a mature security posture does require somebody with that title. However, that's probably not when you're hiring for your head of security. That's somebody who would build that team for you. So it'd still tie that back to what are you [protecting]? What's at risk? What's at stake? What data? The volume of data, type of access you have into your customers' environment and sort of balance those two out. Ideally, you have a team and maybe a head of security by the time you get to these multi-million, really large-scale deals where they do start asking for a CISO. And then you can decide whether you want to build with your head of security into that CISO position or maybe get a field CISO to answer some of those questions.

Jon McLachlan

Do those fractional CISOs often come up as a possibility too? Is that a common place to start for a lot of entrepreneurs? Is maybe pull someone in part-time?

Yash Kosaraju

That's a great resource. You could get either an advisor that you trust or a fractional CISO who can come in and jumpstart your program as well.

Jon McLachlan

What's the most exciting portfolio company in that security space that you've got the honor and pleasure to have collaborated with a little bit. Is there any in particular that really

Yash Kosaraju

There are a lot of them that are in the security space and they're all in different levels of maturity. It's hard to pick one, but there's a lot of ones that are sort of taking on either existing problems or new ones, and putting a different spin and different lens on how they want to try and solve it. And it's always refreshing to see newer, better user-friendly solutions to age-old existing problems.

Jon McLachlan

Yeah. I get very excited about using new technologies in interesting new ways to help make the world a better and more secure place. You know, when you look at the landscape out there of new technologies, like AI comes like screaming top of mind, right at the top. And I don't know if you were at Black Hat. Did you go to Black Hat?

Yash Kosaraju

I was at the Black Hat [CISO] Summit.

Jon McLachlan

Amazing, amazing. There seems to be a lot of competition, but a lot of really great work out there in the intersection between security and AI. I'm curious.

Yash Kosaraju

There are definitely great companies, but on the flip side, what I'm seeing is the security space is saturated with vendors. We, at some point, need a consolidation to a very few ones that do more than just one feature. Today, each feature of a bigger suite of features is one company. I'd like to see a world where we don't need so many vendors to do all of those things.

Jon McLachlan

Yup. What do you think the timelines are for all of those consolidations to just like converge?

Yash Kosaraju

I mean, before AI, I could give you a number that I would trust myself to sort of back up. But now with AI, everything's accelerated. So it's all up in the air.

Jon McLachlan

So it's going to be faster than we've ever seen before. If it hasn't already begun, it will. In terms of the AI, you know, that intersection between AI and security, what do you think will be the first problems that we solve as a security community?

Yash Kosaraju

We are taking a stab at multiple problems. However, the one that I'm interested to see completely go away is your code security. You've had this whole secure SDLC pipeline with SCA and [SAST] and a bunch of other things in there. Now with AI writing most of your code, I'm looking forward to the day where all these coding agents write secure code by default, and like you don't need some of these features

Jon McLachlan

Okay. I love that. I love this direction. I was at a little CISO dinner here in San Francisco a few weeks back, and the tone of the entire dinner was just like assume breach, you know, because AI is just a tool, and you can use it as an evil person or a good person? And when you use it as an evil person, like, okay, the foundation models are extremely powerful, can have a look at the code base, can have a look at third-party libraries that everyone's code is dependent on in some form or another, and start like dropping in exploits and start dropping in zero days. And the tone in the room, you know, when I was at the dinner was like just very bleak. It's very like, oh, you have to assume that there's breaches that are going to happen and that the people are already inside your systems. And then, you know, forget your firewalls. They're going to breach the perimeters and the boundaries and all of that stuff. Anything exposed to the internet basically is going to break. If it hasn't already, it will. Because the capabilities are democratizing, essentially, like breaking into software, breaking the application layer. And so I'm super happy to hear that you're excited about the other side of that equation, which is like the defensive position. Like, how do we use the same tools to actually fix things?

Yash Kosaraju

They're not wrong, by the way, right? Like the whole thing where, well, there's two aspects to it. One, AI is really good at using all the different CVEs and exploits out there [in] a very fast pace [instead of] try and overwhelm the defenses to get in. So that's completely true. The other thing is the cost per exploit or cost per breach that as an attacker, you have to then sort of be aware of with AI would be going down. So the economic balance is going out of whack. However, my hope is that we have this next 12, 18 months of pain where, again, we are playing catch up, but much more rapidly. But once that evolves, you get to a place where some of these classes of vulnerabilities, or even some of these classes of tools that you have, would be redundant and not necessary. And it would become second nature to build a defense in depth, multi-layered approach. And everybody gets there together, screaming and kicking. But eventually, you get to a point where we are much better off today.

Jon McLachlan

Yeah. I imagine like a good chunk of that is just going to be using the latest and greatest foundation models and technologies to actually help us write code. A lot of it will be, right? Yes. Because the vulnerabilities there in the code. The application layer, you know, exploits, those are all like bugs essentially that have consequences [in frontier] models [and] security space. So, but I'm not sure what percentage of software that's running has been written by foundation models or AI in general.

Yash Kosaraju

So that's true. Yeah. There is a big journey everybody needs to go through. The thing that worries me, though, is we talk about all of these, but we are here in the Silicon Valley and that is a bubble. The rate of adoption of AI is very different here than the rest of the US, than the rest of the world. So, as the attackers ramp up their capability with AI, they don't necessarily have to target everybody in the Valley, right? Like, the Valley is going to catch up in its defenses relatively quickly. The rest of the world, the companies out there that haven't been embracing AI or maybe don't even have the financial resources to spend on tokens to build their defenses, like that's what I'm worried about next.

Jon McLachlan

Maybe there are companies out there that are specifically geared towards helping those legacy or those long tail adopters accelerate or defend their perimeters. But maybe not. Maybe that's where the challenge is. But that's where most of the technology lives.

Yash Kosaraju

The cost of not adopting AI today is much more than the cost of not adopting any other previous technologies. And from a cyber lens, it's much more intense of what you're missing out on and like how you need to protect yourself using AI.

Jon McLachlan

And as this wave of adoption happens, it also feels like that there's now another layer to the security cake, if you want to call it that, where we have this now, there's an AI layer on the very top of it, right? So if my coding agent is searching the web, it's reading up on some API somewhere and executing essentially things on my local development environment, whether that be some remote thing in the cloud as an agent running on my behalf or my local dev machine, maybe the agent is essentially now taking instructions from the internet, throwing them into a prompt, into an engine that has access to whatever it is that I have access to as a developer and running it. And it just feels like a very familiar problem that browsers solved long, long time ago just by saying, you know what? Anything that comes in from the internet, let's just treat it as untrusted. But now agents are doing this, and agents are treating it as mixed-bagged levels of trust. And there's this human in the loop discussion that's going on. I'm super curious, how do you see and think about as a CISO who's responsible for the security of an organization, a16z, who is no doubt, I'm sure, like adopting AI very aggressively, right? And trying out all of the new things. Yeah, so, how as a CISO, do you approach that?

Yash Kosaraju

So, you're right. Prompt injection is an unsolved problem. The one perceived defense we have is sort of [Claude] or OpenAI giving you those prompt or user sort of interfaces that [say], do you accept this request or do you accept this action? The problem with that, though, after the third click, you don't really read what's in there and you just start clicking through. And that's the sort of defense we think it's there, but not really. The way we are approaching it is being very careful of how we adopt AI. So we are adopting AI at a massive pace, but also very deliberately, the systems that it has access to, the systems that it can write to or read from and what it can do and sort of have your own vendor due diligence that obviously everybody does. But also the bigger challenge with AI tools is not your vendor due diligence: of like, do you have a pen test or do you have a SOC 2? And like, all of those questionnaires. The bigger issue here is: what data do you have access to? How do you access it? And is it a two-way read-write or just a read? So, that's the bigger problem. And that's the bigger part of the review we do. Because, as you know, AI is only as good as the data it has access to.

Jon McLachlan

Context is everything. No, that's super interesting. And so it almost sounds like you're instead of trying to control what's coming in into the space, you know, into the AI and through inference calls and ending up inside agents, essentially doing things like scope what that thing is doing, scope that. So define and be deliberate around like what that agent is allowed to touch within your organization, within your security boundary.

Yash Kosaraju

Yes. One thing we are very deliberate about at a16z, especially within the cyber team, is not to say no when people request for something. That'll lead to two things, right? One, they'll never come back to you. Two, they'll find a way to use it anyway. Right. Rather than that, what we try to do is work with them, see what they're trying to do, and then define access to the right set of data for that use case. If it's a POC, that can have a subset of test data. If it's something else, then we work with them to see what kind of data is necessary to get to the point where they're going, but also keep the firm safe.

Jon McLachlan

No, that sounds like a great approach. There are two different types of security folks in the world. You can walk into exactly the same meeting, like one type can walk into a meeting, and everyone in that meeting room will go, oh no, so-and-so is here. And they're going to say no to everything, and they're going to push the timelines out. And they're going to tell us we have to do all of these strange requirements for these certifications that we have to uphold. And then the second person can walk into exactly that same meeting room with exactly those same people. It may even have exactly the same impact on security for the organization. But the people in that room will say, Oh, I'm so happy that Yash is here. He's going to help us understand what [are] our security commitments to our in-house goals and our customers and how we can move quickly together as partners instead of just saying no to everything and pushing time.

Yash Kosaraju

Exactly. That's the goal.

Jon McLachlan

Yup. Yup. Culture means so much in the security space, especially if you want to be taken seriously. I'm curious, though. It's been my experience that you have to be a little bit crazy to get into security. There's always a story there or something. What's your story? How did you get into security?

Yash Kosaraju

Mine's probably the most boring story you'll ever hear. You know, you'll hear all these crazy stories of like, I hacked into something or I did something, I got in. I went to college for security.

Jon McLachlan

That's not crazy. That's not crazy. So your interest in security was there before you started at college?

Yash Kosaraju

So I did my bachelor's in electronics and we had one course like cryptography, like you know, the art of hiding data in [plain text], so on. And that kind of got me hooked. And this was back in India. So from there, I came here to the U.S. I went to Johns Hopkins for a master's in cyber. From that's when I kind of got hooked into it. And that's been more than 15 years ago, and I'm still here.

Jon McLachlan

And the rest is history. Wow. I'm sure you've seen a lot of crazy things unfold in your long and interesting career, maybe even at [Johns Hopkins], graduate school.

Yash Kosaraju

Yeah, those 18, 24 months were probably the toughest sort of 18 months that I had to go through.

Jon McLachlan

I'm curious if you might be open to sharing what's been your proudest moment along your journey in the security space?

Yash Kosaraju

Oh, that is a deep question, and probably not something I was prepared to answer. Let's see. You know, that has changed over time, but there's a consistent theme to it. I'm more proud of instances where somebody in my team achieves something versus I achieve something. And that's why I still like building teams, building people, growing their career. So when I see somebody who either used to work for me, who's now a CISO, or somebody's in a director-level position and they're doing great things, that makes me proud.

Jon McLachlan

No, that's spectacular. That's one of the most rewarding pieces of being able to give back to the security community and being a leader like yourself. I'm also curious.

Yash Kosaraju

I'll be honest. I'm not doing it to give back. That's what gives me the satisfaction from my jobs. I do it for a very purely personal reason. I am selfish in that sense. But again, it is what it is.

Jon McLachlan

No, that's great. That's healthy. I think it's important that we know what we want in this world and that we go for it. Like, that's what ambition is, right? I feel like that there's maybe a reference there to some [Ayn Rand] philosophy.

Yash Kosaraju

No, not quite. Yeah, I went through this sort of whole thought process of like, am I doing this for somebody else? Is this my way of giving back? And at some point, I realized, no, this is what helps me get meaning from my life, right? And that is helping others. So, like, even though it does seem like I'm giving back, it starts from a purely selfish reason.

Jon McLachlan

Yeah, no, it's important to know who we are and to know what we want. And I respect that. That's very important. Because if you love what you do, you're never going to work a day in your life.

Yash Kosaraju

Yes.

Jon McLachlan

You absolutely can enjoy it. And you'll make everyone's life better around you. It will just happen naturally if you're enjoying what you're doing and you really sink your teeth into it and you dedicate yourself to something. So it doesn't need to be security, right? It could be anything. I appreciate that. I'm curious if you would be open to maybe venturing through your long and interesting career in security, and might be open to sharing what was maybe one of the more challenging moments.

Yash Kosaraju

I did take on a stint after my time at Box that I was there for a very short period of time. Again, these are things that I didn't go deep into in the interview process. So when I joined, I quickly realized that is not what I expected. It was very different. And it was a very tough and honest conversation to have with the team there. But I was there for about less than two months. And that was challenging because it was a big process to go through, leave a team that I trusted at Box and then go there and then have to get out of it and then figure out what's next.

Jon McLachlan

Oof. Yeah, those can be tricky situations. And but props to you for not letting it dangle like two months. That's very fast to go for the realization and the process and acceptance and moving on to the next thing. I'm very curious what you think the most challenging problem that the security community might face in the next five to ten years?

Yash Kosaraju

Five to ten years in the age of AI is probably a question that's around 20 to 30 years on a normal day. So let's cut that back, right? Next year or so.

Jon McLachlan

Next one to two years. Yeah. Yeah. Next year or so. Yeah.

Yash Kosaraju

The amount of visibility security is getting these days, just because of how AI is able to exploit all the CVEs, that's going to evolve how engineering, security, and the rest of the organizations work. So the security teams will have to evolve from what they have been to much more proactive, much more in the weeds. I don't think we can, as an industry, still come up with a list of here's all the as an example, here's all the packages you need to upgrade for because of the vulnerability. We'd have to evolve to a much more close to code state where you find them, you figure out if it's vulnerable, exploitable, reachable, all of those things. Create a pull request and then make sure it's also not breaking anything. And then probably your agent does this, and then the engineering agent reviews it and patches it. And like, that's the stage we need to get to where a lot of it's much more automated. We've talked about a lot of DevSecOps or SecDevOps, like pick your term for that. Like, again, but this goes much more deeper, much more autonomous in that sense. And a lot of testing today is more at the code level. I believe that'll now go into your build and test level, right? Because your agents will take care of most of these patches. But once the code's in dev or stage and you need to test this out, that's going to come back again where a lot of those testings, a lot of those business logic flaws, which AI isn't as good as it is with your code, that's where the bigger focus is going to be on.

Jon McLachlan

Yeah. Yeah, I couldn't agree more. And you know, to put that into context a little bit, one of the big things that I see when organizations are considering adopting AI is the cost and sort of articulating the business case for the ROI and the expectation, managing expectations and the token costs and all of that stuff. And like we mentioned before, context, context is king. Context is going to determine like how successful you can be, but it's also a direct impact on your cost too. I'm curious: How do you think that that's going to play out? Do you think the ROI and the expectations are going to have to be throttled back in short term? Or are you seeing adoption being more aggressive to take more risks with the ROI being factored in?

Yash Kosaraju

My hope, like others, is that the token cost would come down. But on the flip side, what I'm seeing is we're not good at estimating what each task we're giving an AI agent would take. The way I'm looking at people use AI is: one, they want the latest and greatest model. Two, they want the fast mode and not the slow mode. So there is one way of finishing the same task in 10 minutes that might cost you $250, or it could take you 15 minutes and cost you only $50. So we need to get better at estimating what it takes to get something done and what the associated dollar value will be, and making that decision of like, is it worth that amount that I'm spending instead of tweak and balance it out where the return on investment actually makes sense for the economic resource you're spending to get that thing done?

Jon McLachlan

It's almost like pick your favorite AI tool, maybe like [Claude Cowork], for just as a crazy example, if there was a little dollar sign that told you how much that prompt was going to be before you clicked it, with if you chose like whatever your model, whatever your context engine, how much crap you had in your chat, a little dollar sign that made you like you're buying something. Cause honestly, like that's what you're doing. You're buying something. You're buying some compute, right?

Yash Kosaraju

I don't think the frontier models have the incentive to do that for us.

Jon McLachlan

Of course not. Of course not. They're going to hide it. They're going to let all of the engineers and all of the business leaders and the MBAs and the CISOs just use this amazing new tool that magically spits out these pretty good answers, you know, honestly. And then just invoice at the end of the month, like a nice 10-figure invoice. You're like, what? Excuse me? No, that's funny. But yeah, there will be. That's something that I've noticed. Like in the world of AI adoption, if you're building, if you're a founder and you're building an AI thing, you have to talk about ROI. It's part of the equation now for getting your thing adopted in security space or any space, really

Yash Kosaraju

A lot of the tools that have AI baked in, they get extremely expensive too. I do see a world in the nearby future where they would have multiple sort of models to choose from. Maybe the one that came out two months ago is only 95% as accurate, but 50% cheaper. So giving that toggle to the end user to sort of pick and choose between those parameters where the cost can come down drastically than what it is today. And that could be between your different sets of frontier models or maybe even open weight models that the vendor has hosted on their infrastructure. And that way the cost would come down.

Jon McLachlan

Yeah. Yeah, it's interesting. We'll see what happens. I've always thought of problems being solved, you know, or at least being motivated first by the people who feel the pain directly. And so, if the people who feel the pain directly are the financial people, like that, that's going to be internal friction between finance and engineering, as opposed to like maybe a more bottom-up model where engineering could feel the pain. It'll be really interesting to navigate to see what happens in that space. How do you keep your org under control? Because I'm sure, like you, you use a bunch of AI to help solve a lot of the problems and have an amazing team that I'm sure is accelerating themselves with all sorts of AI.

Yash Kosaraju

Yeah, we like not only just my organization, but the whole company is very AI-forward in that sense. And we have started talking about how do we start measuring ROI? How do we start educating people on what the right model, the right speed is for certain tasks? And that's something we have started talking within my teams as well: is how do you balance what you need versus how long does it take versus what does it cost? And get to a middle ground where you can say, well, if I know it's costing me x dollars to get y done, then I, as an engineer, can then make that decision whether it's worth that y dollars or not.

Jon McLachlan

Yeah. And in organizations that I would call like aggressive adopters, the conversations usually are like more along the lines of, hey, why aren't you using AI more. Could you please spend more? Which is backwards, I think, from what companies will usually ask. Right.

Yash Kosaraju

That's been the very interesting thing with AI. But a16z was never that way. We gave people all the tools to experiment, but the mandate was not token maxing or go spend money. The mandate was: Here's a bunch of next-generation tools. Try them out, use them, see where they can add value. And it's pretty much the same thing, but said in different ways. And just that change of words gives you a different perspective. The mandate is not to just use it for no reason, but try and see what actual value you can get out of it.

Jon McLachlan

Yep. Yep, exactly. Value-driven use and identifying that ROI, [cashing in]. I'm super curious if you would be open to venturing into the past and you could imagine having an opportunity to meet your younger self. I'm curious if you would meet your younger self and if you would take that opportunity, what advice you might have for your younger self?

Yash Kosaraju

This is not the first time I've been asked that. And I've had different answers every time that question came up. I guess today what I would say is maybe I wouldn't meet my younger self. And even if I did, I wouldn't give any advice because every mistake I've made, every decision I've taken is what has led me here today. And changing any of those, even for the better, you don't know what implications that has.

Jon McLachlan

Oh, that's a beautiful sentiment of self-acceptance and embracing like the amazing person that you are today.

Yash Kosaraju

I am fortunate to be in a very good place in life right now. I have a great job. I have a great family. I'm healthy. So, again, I wouldn't change anything.

Jon McLachlan

Well, very good. Very good. Thank you so much for your time today. This has been an absolutely wonderful discussion. Thank you for the honesty. Would you leave our listeners with any final words of wisdom? We do have a lot of entrepreneurs, and I'm sure you'll get a lot of listens from folks bubbling around with different ideas, interested in the security space.

Yash Kosaraju

I am not an entrepreneur, so take this with a grain of salt, but it is a great time to be building. And whatever you do, persevere, hard work. Those will get you through all the tough times. And good luck.

Jon McLachlan

Huge thank you, Yash, for joining. And a huge thank you to all of our listeners for tuning in to another episode of the Security Podcast of Silicon Valley. If you are so inclined, if you enjoyed this episode. Please comment, share, like if you feel so inclined and you feel it's worthwhile. And all gratitude in the world. Huge thank you.

Yash Kosaraju

Thanks, [Jon]. Oh, I'm also hiring by the way, so please do look at the jobs and apply.

Jon McLachlan

Yeah, please check out Yash's team over at a16z and send your resume to him. Connect on LinkedIn. We'll put all the good links in the show description for everyone's convenience. This has been a [YSecurity] production and stay tuned for the next episode. Thanks, everyone.

[Sponsor read: YSecurity. SOC 2 and ISO as keys to enterprise deals and regulated industries, done right the first time by 40-plus engineers from Apple, Uber, Microsoft, Robinhood and Brex, a referral program for founders who need it, and the first eight hours free at ysecurity.io/startups.]

FAQ

Questions this episode answers

When should a startup make its first security hire, and who should it be?
Yash Kosaraju, CISO of a16z, says the first hire is a staff or senior staff level engineer who can work independently, in the code and the infrastructure, hardening things and building things out. That person isn't the head of security who builds a team. The timing is a risk decision driven by what data you hold, how many customers you have and what's at risk, and the engineer should sit wherever there's enough context and access to execute.
What should a founder do when an enterprise buyer asks to speak to their security leader?
Yash treats the request as a sales signal. Showing a mature security posture takes somebody with that title, and the hire still ties back to what's at stake: the data you hold and the access you have into customers' environments. By the time deals reach multi-million dollar scale, Yash would ideally have a team and maybe a head of security, who can grow into the CISO role, or a field CISO for the buyer's questions. A trusted advisor or a fractional CISO can jumpstart the program.
Why does the accept-this-action prompt stop working as a defense against prompt injection?
Prompt injection is an unsolved problem, Yash says, and the one perceived defense is the prompt that asks whether you accept a request or an action before an AI tool goes ahead. After the third click, people stop reading what's in the prompt and click through, so the defense people count on doesn't hold.
What should a security review of an AI tool check?
Yash's bigger question for an AI tool is what data it has access to, how it accesses it, and whether the connection is two-way read-write or read only. The pen test and the questionnaire still run, and the a16z team puts access first, because AI is only as good as the data it has access to.
Why doesn't the a16z security team say no?
Yash Kosaraju's team is deliberate about not saying no to a request, because a no leads to two things. The person never comes back to you, and they find a way to use the tool anyway. The team works out the use case and defines access to the right data for it, so a proof of concept gets a subset of test data.
How is AI changing the economics of attack and defense?
Yash says AI is good at using known vulnerabilities, the CVEs, and exploits fast enough to overwhelm defenses, and the cost per exploit or breach is falling for attackers. Yash hopes for 12 to 18 months of pain in which defenders catch up much faster than before, after which some classes of vulnerability and some classes of tools stop being necessary, and defense in depth becomes second nature.
Why does Yash call Silicon Valley a bubble?
AI adoption in Silicon Valley runs at a different rate from the rest of the US and the world, Yash says, and attackers who ramp up with AI don't have to target the Valley, which will catch up on defense quickly. The worry is the companies that haven't embraced AI, or can't afford the tokens to build defenses, because the cost of not adopting AI is higher than for any earlier technology.
How much should one AI agent task cost, and why is it hard to estimate?
Yash's example is the same task finishing in 10 minutes for what might be $250, or in 15 minutes for $50. People want the latest model and the fast mode, and nobody is good at estimating what a task will take. When Jon asked for a dollar sign before you run a prompt, Yash said the frontier models have no incentive to build it. At a16z the mandate was to find value with the tools, never token maxing.
Read the companion article From the YSecurity blog The Human in the Loop Is Going Away Yash Kosaraju, the Chief Information Security Officer of a16z, told me nobody reads the third permission prompt. The numbers say he's being generous. The vendors are retiring the approve button, and your engineers clicked "don't ask again" months ago. Here's where the human goes next, and a scorecard for what your agents can reach. Read the article →
Keep reading on the YSecurity blog
Related episodes
If this episode hits close to home
AI Access Control Audits Least privilege, extended to the fastest-growing users in your company: AIs. AI Product Red Teaming Your AI product, attacked the way real adversaries will. Sales Support We make your customer's security team say yes.
New episodes every other Tuesday

Got a story like this one?

We're always looking for practitioners who've been in the room when it mattered.

Apply to be a guest
SpotifyApple PodcastsYouTubePodbeanPlayer FMRSS